skills.rest
Wyl-cmd
Wyl-cmdCOMMUNITY
Explore all skills by this author →
GitHub

hack

Routes web and API security testing tasks to appropriate vulnerability category skills.

6|Updated Jan 31, 2026
Search Tags:#penetration testing#web security#api security#bug bounty#recon#kali linux#vulnerability triage
One-click install
npx skills add https://github.com/Wyl-cmd/kxns-cli --skill hack-wyl-cmd
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hack
Source: https://github.com/Wyl-cmd/kxns-cli/tree/main/src/kxns_cli/skills/hack
Command: npx skills add https://github.com/Wyl-cmd/kxns-cli --skill hack-wyl-cmd

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? When starting a bug bounty or authorized penetration test, it is hard to know which vulnerability class to test first and which specialized methodology to apply. This Skill acts as a primary router that maps observed target behavior to the correct category skill (XSS, SQLi, SSRF, IDOR, JWT, and more) so testing follows a structured methodology instead of random payload guessing. ## Core Features & Use Cases - Phase-Based Routing: Guides the agent through recon, context confirmation, phenomenon-based routing, and prioritized test ordering for web and API targets. - Phenomenon-to-Skill Mapping: Provides a lookup table linking observed behaviors (input reflection, server-side URL fetching, object IDs in APIs, JWT usage) to the right specialized skill and Kali tool invocation. - Automated Recon Sequence: Defines an ordered toolchain using subfinder, nmap, httpx, wafw00f, ffuf, nuclei, and searchsploit when no obvious symptoms exist. - Use Case: Given a new REST API bug bounty target, the Skill directs the agent to prioritize BOLA/IDOR, JWT, and mass assignment checks, then fall back to automated recon if nothing surfaces. ## Quick Start Ask the agent to plan a bug bounty testing route for your authorized target using the hack skill, describing the target type and any observed behaviors.

Frequently Asked Questions about hack

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I decide which vulnerability to test first on a bug bounty target?▼

Start with recon and context confirmation: identify the target type, auth model, and input/output locations. Then match observed phenomena to vulnerability classes, for example input reflection suggests XSS and server-side URL fetching suggests SSRF.

What is the recommended recon order for web security testing?▼

Run subdomain enumeration with subfinder, port scanning with nmap, HTTP fingerprinting with httpx and whatweb, WAF detection with wafw00f, directory brute-forcing with ffuf, then vulnerability scanning with nuclei and nikto.

How do I route API security findings to the right test category?▼

APIs with many object IDs map to IDOR/BOLA testing, login and token flows map to auth bypass and JWT attacks, and multi-step transactions map to business logic and race condition testing. A/B account replay is key for authorization checks.

Does this skill work for unauthorized targets?▼

No. The skill explicitly restricts usage to authorized targets, legal research, defensive validation, and bug bounty scope rules. It is designed for legitimate security assessment only.

What platforms are required to run the automated recon tools?▼

The recon toolchain relies on Kali Linux utilities such as nmap, ffuf, and nuclei, so a Linux environment is required. Windows users need WSL 2 with Kali Linux for full functionality.

Related Skills

Explore More Software Engineering Skills→
claudcherejiclaudchereji

penetration-tester

Execute authorized penetration tests and vulnerability assessments on systems, networks, and applications.

Community
Advanced
jinyimeng01jinyimeng01
54

exploit-agent

Validate suspected web vulnerabilities and generate structured exploit reports.

Community
Advanced
dreadnodedreadnode
11

vuln-critic

Filter low-quality and false positive vulnerability findings from scanners and agent output.

Official
Intermediate
six2dezsix2dez
1.4k

burp-scan

Coordinate Burp Suite scans via MCP for vulnerability identification.

Community
Advanced