Hacking Agent Skills for AI Agents
Hacking skills are task-oriented packages that help an AI agent work through security problems: reconnaissance, scanning, exploitation, password attacks, and post-exploitation. They are built for authorized testing, CTFs, lab environments, and research, not for breaking into systems you do not own. Each skill is a SKILL.md package the agent loads to gain a specific capability, so the right pick depends on the phase of work in front of you. Use the ranked list as a shortlist: scan the descriptions for the technique you need, check what the skill expects as input and produces as output, and confirm it fits your environment before loading it. If two skills cover the same ground, start with the higher-ranked one and keep the other as a fallback.
8 to start with25 top options
Start with these.
An Agent Skill fits here when it carries out this task end to end.
These are the closest matches for this work. Start with the first one and open it to install.
- Rank 01View Agent SkillDirect
hack
Entry router and operating doctrine for authorized pentesting, web/API security, code audit, source-leak mining, and SOC/IR, enforcing scope gates and impact-first testing.
3,999 · popularity - Rank 02View Agent SkillDirect
performing-web-application-penetration-test
Performs systematic web application security testing per OWASP WSTG, covering authentication, authorization, input validation, session management, and business logic with Burp Suite.
599 · popularity - Rank 03View Agent SkillDirect
web-pentest
Structured black-box/grey-box web application penetration testing covering auth bypass, IDOR, session handling, business logic, and parameter tampering with Burp/ZAP workflows.
435 · popularity - Rank 04View Agent SkillDirect
owasp-top-10-testing
Tests applications against the OWASP Top 10:2025 and API Top 10 with Strix agents that attempt real exploits and report proof-of-concept findings per category.
8,842 · popularity - Rank 05View Agent SkillDirect
managed-pentesting-with-strix
Runs managed pentests of web apps, APIs, repos, or workspaces on the Strix cloud platform via CLI or REST API, with triage, SARIF export, and scheduling.
11,603 · popularity - Rank 06View Agent SkillDirect
exploiting-sql-injection-vulnerabilities
Identifies and exploits SQL injection vulnerabilities using manual techniques and sqlmap across major database engines, demonstrating data extraction and auth bypass.
463 · popularity - Rank 07View Agent SkillDirect
recon
Performs structured reconnaissance and attack surface enumeration for authorized pentests, CTFs, and bug bounties, covering DNS, port scanning, and content discovery.
337 · popularity - Rank 08View Agent SkillDirect
security-reviewer
Identifies vulnerabilities, runs SAST/dependency/secrets scans, performs penetration testing and infrastructure audits, and produces severity-rated reports with remediation.
5,584 · popularity
Explore 17 more Agent Skills
- Rank 09View Agent SkillDirect
conducting-network-penetration-test
Conducts network penetration tests per PTES methodology, covering host discovery, port scanning, service enumeration, vulnerability identification, and controlled exploitation.
281 · popularity - Rank 10View Agent SkillDirect
conducting-mobile-app-penetration-test
Conducts iOS and Android penetration testing per OWASP MASTG, covering static analysis, dynamic runtime analysis, and API security testing.
277 · popularity - Rank 11View Agent SkillDirect
wordpress-penetration-testing
Assesses WordPress installations for common vulnerabilities and WordPress 7.0 attack surfaces using WPScan, Metasploit, and manual techniques with authorization gates.
1,063 · popularity - Rank 12View Agent SkillDirect
ffuf-web-fuzzing
Expert guidance for ffuf web fuzzing during penetration testing, covering authenticated fuzzing, auto-calibration, multi-wordlist modes, and result analysis.
381 · popularity - Rank 13View Agent SkillDirect
dast-scanning
Performs dynamic application security testing with OWASP ZAP, Burp Suite, and Nikto, including baseline/full/API scans and CI/CD integration.
322 · popularity - Rank 14View Agent SkillDirect
firebase-apk-scanner
Scans Android APKs for Firebase security misconfigurations—open databases, storage buckets, auth issues, exposed cloud functions—and tests endpoints for authorized research.
5,073 · popularity - Rank 15View Agent SkillDirect
penetration-testing-with-strix
Pentest a web app, API, codebase, repository, URL, domain, or IP with Strix — autonomous AI penetration testing that exploits and proves vulnerabilities (OWASP Top 10 and beyond — injection, XSS, SSRF, auth/access-control flaws, IDOR, business logic) instead of just flagging them. Runs self-hosted…
12,429 · popularity - Rank 16View Agent SkillDirect
web-app-penetration-testing
Pentest a web app or website end to end — black-box testing of a live URL, staging environment, or local dev server that finds and exploits real vulnerabilities (auth bypass, broken access control, IDOR, injection, XSS, SSRF, business logic) and proves each one with a working proof-of-concept…
8,817 · popularity - Rank 17View Agent SkillDirect
api-security-testing
Security-test a REST, GraphQL, or gRPC API with Strix — autonomous agents that enumerate endpoints from an OpenAPI/GraphQL schema (or by crawling), then actually exploit the API-specific vulnerability classes in the OWASP API Security Top 10 (2023) — broken object-level authorization (BOLA/IDOR),…
8,760 · popularity - Rank 18View Agent SkillDirect
application-security-testing
Application security testing (AppSec) across a whole product with Strix — decide which asset needs which test (source code, running web app, API, CI pipeline), run it, and turn the results into a ranked remediation plan. Autonomous agents exploit and prove each issue instead of emitting…
8,637 · popularity - Rank 19View Agent SkillDirect
penetration-testing
Ethical hacking and security testing methodologies using penetration testing tools, exploit frameworks, and manual security validation. Use when assessing application security posture and identifying exploitable vulnerabilities.
1,063 · popularity - Rank 20View Agent SkillDirect
security-pen-testing
Use when the user asks to perform security audits, penetration testing, vulnerability scanning, OWASP Top 10 checks, or offensive security assessments. Covers static analysis, dependency scanning, secret detection, API security testing, and pen test report generation.
Needs (stated): Python
798 · popularity - Rank 21View Agent SkillDirect
security-audit
Comprehensive security auditing workflow covering web application testing, API security, penetration testing, vulnerability scanning, and security hardening.
1,347 · popularity - Rank 22View Agent SkillPossible
sast-configuration
Configures SAST tools like Semgrep, SonarQube, and CodeQL for automated vulnerability detection, custom rules, and CI/CD integration.
10,304 · popularity - Rank 23View Agent SkillPossible
golang-security
Security best practices for Go: injection, crypto, SSRF, secrets, threat modeling, plus gosec SAST, race detection, and fuzzing.
38,753 · popularity - Rank 24View Agent SkillPossible
rev-dex-dumper
Dumps DEX files from a running Android app's memory via ADB using a bundled panda-dex-dumper tool to defeat class-loading packing.
1,717 · popularity - Rank 25View Agent SkillPossible
reverse-skill-router
Codex adapter that routes authorized reverse-engineering, security-analysis, CTF, and defensive-testing tasks to skills in the reverse-skill repository.
1,139 · popularity
Frequently asked questions
- What kinds of skills are listed under Hacking?
- They cover the standard phases of security work: reconnaissance, scanning, exploitation, password attacks, and post-exploitation. Each one is a SKILL.md package that gives an AI agent a specific capability for authorized testing, CTFs, labs, or research.
- How is the list ordered?
- It is ranked by observed search demand, with skills that match the topic directly placed first. The ranking also caps how many skills any single publisher can occupy, so one author cannot fill the page.
- How do I choose between two similar hacking skills?
- Compare what each skill takes as input and what it produces, then pick the one that matches your current phase of work. If they overlap, start with the higher-ranked skill and keep the other as a fallback.
- Do I need a lab or target environment before loading one?
- Yes. These skills are meant for authorized testing, CTFs, lab environments, and research, so point them at systems you own or have explicit permission to test.
How to install an Agent Skill
Start with the first skill on this page. Claude Code reads a SKILL.md once it is in the skills directory:
- Claude Code — copy the SKILL.md for hack into ~/.claude/skills/hack/ for yourself, or .claude/skills/hack/ to share it with a project.
- From the registry — run npx skills add yaklang/hack-skills@hack.
- Or download hack from its source and place that SKILL.md in the directory above.
How to choose Check the source and the skill’s own instructions before you install. Official and Notable describe where a skill comes from.