yhy0Community·27 Agent Skills Included

ghsa-skill-builder

Vulnerability audit and penetration testing patterns from real CVEs

Audits Python and Go code for injection, path traversal, auth bypass, SSRF, deserialization, and crypto flaws using patterns extracted from real GitHub Security Advisories. Runs web penetration tests for SQLi, XSS, IDOR, CSRF, and access control issues based on thousands of real HackerOne bug bounty reports. Eliminates manual CVE research by turning public vulnerability data into ready-to-use detection checklists and attack playbooks.

74|10

↗

npx skills add yhy0/ghsa-skill-builder --all -g -y

All Skills in This Repository (27)

Pure Emerald Level Indicators

📦 In Repo

yhy0

ghsa-skill-builder

Generate security vulnerability Skills from GHSA and HackerOne reports.

pentest-deserialization-xxe

Identify and exploit deserialization and XXE vulnerabilities in web applications.

pentest-xss

Guide penetration testers in discovering and exploiting XSS vulnerabilities in web applications.

pentest-path-traversal

Identify and exploit path traversal and file inclusion vulnerabilities in web applications.

go-vuln-injection

Analyze Go code for injection vulnerabilities and trace data flow from sources to sinks.

go-vuln-info-disclosure

Analyze Go data flow from sensitive sources to exposed sinks for information disclosure vulnerabilities.

pentest-idor

Automate discovery and exploitation of IDOR vulnerabilities in web APIs.

pentest-business-logic

Test web applications for business logic, race condition, and denial-of-service vulnerabilities.

go-vuln-dos

Audit Go source files for DoS and resource exhaustion vulnerabilities.

vuln-patterns-injection

Detect injection vulnerabilities in Python code by analyzing sources and sinks.

pentest-command-injection

Identifies and exploits command injection and remote code execution vulnerabilities in web applications.

go-vuln-ssrf-requestforgery

Audit Go code for SSRF, XSS, and CSRF vulnerabilities.

Community

Intermediate

Frequently Asked Questions

FAQPage Schema

How to install GHSA Skill Builder?▼

Run `npx skills add yhy0/ghsa-skill-builder --all -g -y` in your terminal to install all 26 security audit and pentest skills globally.

What vulnerabilities does GHSA Skill Builder cover?▼

It covers 26 categories including SQL injection, XSS, SSRF, path traversal, auth bypass, deserialization, IDOR, and command injection, split across Python audit, Go audit, and web pentest skills.

Where does the vulnerability knowledge come from?▼

All patterns are extracted from real GitHub Security Advisories (GHSA/CVE) and public HackerOne bug bounty reports, including root causes, vulnerable code, and why standard scanners miss them.

Can it generate new security skills automatically?▼

Yes. The included builder skill pulls the latest GHSA and HackerOne data, analyzes patch diffs, and generates or updates audit skills for Python, Go, and other ecosystems.

Do I need security experience to use it?▼

No. Each skill provides a detection strategy, checklist, and real-world cases, so your coding assistant can audit code or run pentest checks from plain-English requests.