Your agent can do more. Find the skill that makes it happen.
Find your next superpower If you are an agent, refer to our llms.txt for full access.Use when the user wants a full teaching book in Silvanus Thompson Calculus Made Easy style, especially "轻松学", "Made Easy 风格", "用这种风格教我 X", or "x-made-easy". Do not use for ordinary Q&A, one-off articles, generic PDF work, or non-teaching writing.
Reflected XSS occurs when user-supplied input is echoed in an HTTP response without sanitization, allowing script execution in the victim's browser. Detect via injecting <script>alert(1)</script>, event handlers like onfocus, HTML entity bypass, and encoding variants. Tools: Burp Suite, OWASP ZAP, PHP Charset Encoder (PCE), Hackvertor, XSS-Proxy, ratproxy.
Detect and exploit Cross-Site Scripting (XSS) vulnerabilities including Reflected, Stored, and DOM-based variants. Use this skill when testing web applications for JavaScript injection, HTML injection, input sanitization bypass, or Content Security Policy evasion. Covers WAF bypass payloads, mutation XSS, blind XSS with out-of-band callbacks, and exploitation chains for session hijacking and accou…
Stored XSS (persistent XSS) occurs when attacker-supplied input is saved server-side and later rendered unencoded to other users. Common injection points include profile fields, comments, forum posts, file upload filenames, and application logs. Detect via PHP $_GET/$_POST/$_REQUEST/$_FILES, ASP Request.Form, JSP request.getParameter, and BeEF hook injection. Tools: Burp Suite, OWASP ZAP, Be…
A CLI tool for making authenticated requests to the X (Twitter) API. Use this skill when you need to post tweets, reply, quote, search, read posts, manage followers, send DMs, upload media, or interact with any X API v2 endpoint.
XML External Entity (XXE) injection exploits XML parsers that process DTD external entity declarations, enabling local file disclosure (file:///etc/passwd), SSRF via http:// entities, and DoS via Billion Laughs. Vulnerable Java APIs include DocumentBuilder, SAXParser, dom4j, TransformerFactory, SAXReader, XMLInputFactory, Xerces. Detect by injecting <!DOCTYPE> DTD with SYSTEM e…
Exploit XML External Entity (XXE) vulnerabilities in web applications to read arbitrary files, perform SSRF, or execute denial of service attacks. Use this skill when the server parses XML input from the user (such as SAML, SOAP, DOCX, or direct XML payloads).
Identifies a World Y skill without describing its functionality.
Supports authoring and tuning malware detection rules for YARA and YARA-X.
Develop and deploy advanced YARA rules, the industry standard "pattern-matching swiss army knife" for malware researchers. Use this skill to identify, classify, and hunt for specific malicious binaries (APT implants, ransomware) across enterprise networks, memory dumps, and VirusTotal based on hexadecimal signatures, API imports, and behavioral strings.
Write custom YARA rules to identify and classify malware based on textual and binary patterns. This skill focuses on creating robust signatures using strings, regular expressions, and hexadecimal opcodes extracted during malware analysis for enterprise threat hunting.
Publish a validated PR revision while continuing review, or complete a validated registered Git task when a selected private task reaches terminal delivery or the operator explicitly says yeet. Default pull-request completion delivers a tested ready PR and retires owned local state; integrate only for the user-selected outcome. Do not use for ordinary commits, tests, deployments, read-only or no-d…
Skills give your agent reusable instructions for a specific job. Pick one, read what it does, and bring it into your workflow.
A name only tells half the story. Search the full description and instructions to find the right fit.
Read the skill, visit its source, and see exactly what you’re adding to your agent.
Copy the install command from a skill page and run it in your project.
npx skillycli add owner/repo --skill name