Hunt MFA / 2FA bypass — 7 distinct patterns. (1) MFA not enforced on sensitive endpoints (password change, email change accept without MFA challenge), (2) MFA-step skip via direct…
Hunting skill for misc vulnerabilities. Built from 225 public bug bounty reports. Use when hunting misc on any target.
Hunt Node.js specific vulnerabilities — Prototype Pollution → RCE chains (lodash/merge/assign), Express trust proxy misconfiguration, child_process/eval injection, template engine…
Hunt NoSQL Injection — MongoDB operator injection ($where, $regex, $gt, $ne), CouchDB, Redis command injection, auth bypass via NoSQLi, data dump.
Hunt NTLM/Negotiate information disclosure on internet-reachable IIS/SharePoint/Exchange. Anonymous NTLM Type-2 challenge capture leaks NetBIOS domain, internal DNS forest,…
Hunting skill for oauth vulnerabilities. Built from 19 public bug bounty reports. Use when hunting oauth on any target.
Hunt Open Redirect — all types including low-impact, chained to OAuth token theft → ATO, phishing chains.
Hunting skill for race condition vulnerabilities. Built from 12 public bug bounty reports including modern HTTP/2 single-packet attack cases (James Kettle DEF CON 2023 "Smashing…
Hunting skill for rce vulnerabilities. Built from 67 public bug bounty reports. Use when hunting rce on any target.
Hunt SAML / SSO attacks. Patterns: XML Signature Wrapping (XSW) — modify Assertion while keeping Signature valid by relocating signed element, comment injection in NameID…
Hunt scoped systems and telemetry for supplied security indicators or behaviors. Use for hashes, paths, domains, addresses, certificates, accounts, processes, commands,…
Hunt Session Management vulnerabilities — session fixation (no regeneration on login), insufficient invalidation on logout / password-change / email-change, predictable or…
Hunt Microsoft SharePoint Server (2013/2016/2019/Subscription Edition) on-prem farms — anonymous endpoint enumeration, version disclosure, legacy SOAP login bypass…
Hunt source code and build artifact leakage — JavaScript source maps (.js.map) reconstructing TypeScript/ES6 source, Swagger/OpenAPI JSON endpoint discovery, .env/.git exposure,…
Hunt Spring Boot specific vulnerabilities — Actuator endpoints (heapdump, env, loggers, mappings, shutdown), Spring Expression Language (SpEL) injection → RCE, H2 console RCE,…
Hunting skill for sqli vulnerabilities. Built from 12 public bug bounty reports including modern NoSQL injection (Rocket.Chat CVE-2021-22911 MongoDB $regex, Mongoose ORM…
Hunting skill for ssrf vulnerabilities. Built from 15 public bug bounty reports including AWS metadata SSRF (HackerOne $25k Analytics PDF, Shopify Exchange $25k, Capital One…
Hunting skill for subdomain takeover vulnerabilities. Includes modern provider fingerprints — Microsoft Azure DevOps `cloudapp.azure.com` regional-pool re-issue (1-click OAuth ATO…
Use when auditing code that takes user or network input — hunt the OWASP web vuln classes by tracing untrusted input to a dangerous sink, and substantiate every finding input →…
Hunting skill for xss vulnerabilities. Built from 174 public bug bounty reports. Use when hunting xss on any target.
Hunting skill for xxe vulnerabilities. Built from 10 public bug bounty reports including SVG-upload XXE, Office-doc (PPTX/DOCX) XXE, SOAP XXE, SAML AssertionConsumer XXE, blind…
Scan the ClawHunter agent bounty marketplace for opportunities that genuinely match this agent's real capabilities (code, security research, writing) and surface only real matches…
Proactively hunts for Advanced Persistent Threat (APT) activity within enterprise environments using hypothesis-driven
Baseline the EFI System Partition and hunt malicious EFI binaries (ESPecter, BlackLotus, Bootkitty, Glupteba) by mounting the ESP, hashing and verifying boot loaders, scanning…
Detects credential stuffing attacks by analyzing authentication logs for login velocity anomalies, ASN diversity,
Run Chainsaw against collected Windows EVTX files to hunt with the SigmaHQ rule corpus, built-in detection rules, and high-speed keyword/regex search, plus analyze shimcache,…
Detect DCSync attacks by analyzing Windows Event ID 4662 for unauthorized DS-Replication-Get-Changes requests
Detect NTLM relay attacks by analyzing Windows Event 4624 logon type 3 with NTLMSSP authentication, identifying
Hunt for spearphishing campaign indicators across email logs, endpoint telemetry, and network data to detect
Hunts for stolen-session and OAuth/PRT token replay (T1550.001) by correlating Microsoft Entra ID SigninLogs SessionId/UniqueTokenIdentifier fields and Okta System Log sso/session…
Supply-chain malware infection scanner. IoC-based local scan + safe eradication for npm/PyPI worm campaigns (Mini Shai-Hulud 1st/2nd, S1ngularity, lottie-player).
Hauptversammlung AG und SE: HV Red Team Generalprobe. Liefert Norm-Pinpoints, Prüfachsen, Red Flags, Varianten und konkrete Output-Bausteine zum Slug-Thema im Aktienrecht —…
Look up HVAC equipment specifications (capacity, efficiency, dimensions, electrical requirements) by brand and model number.
LLM Wiki pattern + Cognee tarzı hibrit hafıza — Vector (ChromaDB) + Graph (Neo4j/NetworkX) + Relational (SQLite) üçlüsü.
Hyperflow code review. Use when the user wants the current diff, a commit, branch, or PR reviewed — verbs like audit, review, "check for issues", "security check", "code review".
Hyperflow ship phase. Use when the user is ready to release — verbs like ship, push, release, deploy, "cut a release", "ready to push".
Trade crypto, stocks (AAPL, NVDA, TSLA), indexes, and commodities (GOLD, SILVER) 24/7 on Hyperliquid via HIP-3.
Trade on Hyperliquid's perp markets (native + HIP-3) with intelligent order routing and cross-market splitting.
Trade and monitor Hyperliquid perpetual futures. Check balances, view positions with P&L, place/cancel orders, execute market trades.
Use when building apps with HyperX Data API — Hyperliquid wallet analytics, market data, Twitter/news feeds.
Römisches Recht: Hypothek Vergleich. Geführter Fachmodul mit Quellenlogik, Prüfroutine, Red-Team-Fragen und verwertbarem Output.
Node.js backend patterns: layered architecture, TypeScript, validation, error handling, security, deployment.
Foundational repository intelligence. Maps IaC architecture, environments, exposure, and trust boundaries.
Enforces IaC security rules (IAC-1 through IAC-5). Loaded by the conductor for security audits and review operations on infrastructure-as-code files.
Infrastructure as Code (IaC) security scanning using Checkov with 750+ built-in policies for Terraform, CloudFormation, Kubernetes, Dockerfile, and ARM templates.
Deep IAM and identity-layer security analysis for Infrastructure-as-Code. Detects wildcard permissions, privilege escalation paths, dangerous trust relationships,…
Deep network-layer security analysis for Infrastructure-as-Code. Detects public exposure, unrestricted ingress/egress, internet-facing workloads, exposed management ports, flat…
Terraform / Pulumi / CloudFormation review — state management, module contract, plan output, drift detection, security scan (tfsec/checkov/OPA), cost diff (Infracost).
Scans Infrastructure as Code for security misconfigurations. Wraps tfsec for Terraform and Checkov for multi-cloud IaC.
Infrastructure as Code security scanning for Terraform, Kubernetes, CloudFormation, and Azure ARM. Detects misconfigurations, security risks, and compliance violations before…
Serverless security analysis for AWS IaC. Detects insecure Lambda/API Gateway/Function URL exposure, overprivileged execution roles, event injection, privilege escalation via…
Deep storage and data security analysis for AWS Infrastructure-as-Code. Detects unencrypted data stores, public S3 buckets, missing backup/DR posture, dangerous access patterns,…
Use when targeting IACR Conference on Cryptographic Hardware and Embedded Systems (CHES) or deciding whether a computer-science manuscript fits this venue.
Vendor-neutral, governed industrial/OT data tap + intelligent troubleshooting. Read (and, gated, write) PLCs, controllers, machine tools and IIoT brokers over OPC-UA, Modbus-TCP,…
Factory edition of iaiops — discrete-manufacturing lines: OPC-UA, Modbus-TCP/RTU, Siemens S7comm (S7-300/400/1200/1500), Mitsubishi MC/MELSEC, Omron FINS (CS/CJ/CP/NX),…
Warehouse / intralogistics edition of iaiops — distribution centers, fulfillment, material handling: conveyors, sorters, palletizers, AS/RS, and AGV/AMR fleets.
Manage users, roles, permissions, workflow statuses, and authentication. The core security layer used by every other module.
Structure cloud IAM with role-based access, short-lived credentials, and permission boundaries that hold at scale.
Iam Policy Reviewer - Auto-activating skill for Security Advanced. Triggers on: iam policy reviewer, iam policy reviewer Part of the Security Advanced skill category.
Fetches raw IAM recommendations and associated security insights from Google Cloud for a specified target scope (Organization, Folder, or Project).