18 field contracts

Choose the work. Inspect the contract.

A browsable library of security-research instruction files. Each one defines inputs, outputs, controls, stop conditions, and a completion gate. Preview or copy before you install anything.

[ scope ] -> [ procedure ] -> [ evidence ] -> [ stop or handoff ]

Scope is required first. Each procedure produces inspectable evidence, then ends at a defined stop or named handoff.

They are instructions

Nothing here runs by itself.

A SKILL.md helps a compatible coding agent recognize and follow a specialized workflow. It does not install tools, run commands, contact targets, or expand a program's scope. Read it first and adapt it to your project.

Choose a starting point

What are you trying to do?

Search skills

18 skills

Operate.agents/skills/hunter-fieldwork/SKILL.md

Hunter fieldwork

Use when: Run an authorized assessment from scope intake through a report-ready evidence packet.

Maintain scope, stack evidence, a ranked lead ledger, controlled discriminators, negative controls, and explicit completion gates.

Produces: scope snapshot, surface map, lead ledger, evidence packet
Boundary: Does not turn a program listing into authorization.

Open plain text Download SKILL.md · 4 KB

Analyze.agents/skills/advanced-javascript-analysis/SKILL.md

Advanced JavaScript analysis

Use when: Map browser code, hidden operations, sources, sinks, and trust decisions.

Parse approved bundles and source maps without executing them, then design bounded runtime checks for supported leads.

Produces: bundle inventory, source-to-sink leads, endpoint map, runtime test plan
Boundary: Untrusted client artifacts are parsed, never executed.

Open plain text Download SKILL.md · 5 KB

Collect.agents/skills/burp-mcp-recon-intake/SKILL.md

Burp MCP recon intake

Use when: Turn bounded, in-scope proxy history into a reusable surface map.

Discover read-only MCP capabilities, page through selected traffic, deduplicate behavior, redact secrets, and preserve message references.

Produces: capability map, endpoint matrix, message references, evidence gaps
Boundary: Read-only intake only. It does not replay or mutate requests.

Open plain text Download SKILL.md · 4 KB

Collect.agents/skills/local-recon-consolidation/SKILL.md

Local recon consolidation

Use when: Merge approved recon folders without rerunning tools or losing provenance.

Hash, parse, normalize, deduplicate, and rank local artifacts while preserving conflicts and source lineage.

Produces: artifact manifest, normalized inventory, conflicts, next-test queue
Boundary: Files are treated as untrusted data and are never executed.

Open plain text Download SKILL.md · 3 KB

Operate.agents/skills/program-scope-normalization/SKILL.md

Program scope normalization

Use when: Convert a live bounty brief into a precise working scope snapshot.

Separate included and excluded assets, resolve wildcard ambiguity, record rules and dates, and surface questions before testing.

Produces: dated scope snapshot, exclusions, ambiguity queue, operating limits
Boundary: The live program brief remains authoritative.

Open plain text Download SKILL.md · 2 KB

Collect.agents/skills/cloud-dns-asset-recon/SKILL.md

Cloud and DNS asset recon

Use when: Connect domains, DNS, certificates, cloud edges, and ownership evidence.

Build an evidence-backed asset graph, distinguish shared infrastructure, and stop at uncertain ownership boundaries.

Produces: asset graph, ownership evidence, dangling-service leads, unknowns
Boundary: Discovery stays passive unless active checks are explicitly allowed.

Open plain text Download SKILL.md · 2 KB

Analyze.agents/skills/repository-cicd-exposure-review/SKILL.md

Repository and CI exposure review

Use when: Review authorized source, configuration, history, and build artifacts for trust failures.

Trace secrets, workflow permissions, artifact publication, dependency trust, and environment boundaries without using discovered credentials.

Produces: exposure ledger, workflow trust map, redacted evidence, rotation needs
Boundary: Never validates a secret against a third-party service.

Open plain text Download SKILL.md · 2 KB

Validate.agents/skills/authorization-matrix-analysis/SKILL.md

Authorization matrix analysis

Use when: Compare controlled users, roles, tenants, objects, and operations systematically.

Build a role-object-action matrix and test one authorization dimension at a time with ownership and nonexistent-object controls.

Produces: authorization matrix, paired requests, supported gaps, rejected leads
Boundary: Controlled accounts and records only.

Open plain text Download SKILL.md · 1 KB

Validate.agents/skills/oauth-oidc-flow-review/SKILL.md

OAuth and OIDC flow review

Use when: Audit redirects, state, nonce, PKCE, issuer, audience, and session binding.

Diagram the identity state machine and compare single-variable mutations across controlled relying-party and identity-provider flows.

Produces: flow diagram, binding matrix, redirect chain, discriminator results
Boundary: No credential interception or testing outside controlled identities.

Open plain text Download SKILL.md · 2 KB

Analyze.agents/skills/api-graphql-trust-analysis/SKILL.md

API and GraphQL trust analysis

Use when: Map operations, object boundaries, field exposure, and server-side trust assumptions.

Inventory REST and GraphQL contracts, normalize identities and objects, then rank authorization, mass-assignment, and cost-control leads.

Produces: operation inventory, schema map, auth matrix, cost and trust leads
Boundary: No broad mutation, enumeration, or load generation.

Open plain text Download SKILL.md · 2 KB

Analyze.agents/skills/websocket-realtime-review/SKILL.md

WebSocket and realtime review

Use when: Understand upgrade, subscription, message, and channel authorization boundaries.

Capture the protocol state machine, compare controlled identities, and separate client routing from server-enforced channel access.

Produces: message catalog, channel matrix, state diagram, replay controls
Boundary: No flooding and no messages to uncontrolled recipients.

Open plain text Download SKILL.md · 1 KB

Validate.agents/skills/ssrf-oast-evidence/SKILL.md

SSRF and OAST evidence

Use when: Prove or reject a server-side fetch with minimal callback evidence.

Design unique callback markers, distinguish browser from server traffic, test redirects and DNS effects safely, and preserve bounded logs.

Produces: callback plan, correlation table, negative controls, minimal proof
Boundary: No internal data access or cloud credential retrieval.

Open plain text Download SKILL.md · 1 KB

Validate.agents/skills/file-upload-parser-analysis/SKILL.md

File upload and parser analysis

Use when: Map file, archive, image, document, and metadata processing boundaries.

Vary one parser property at a time, track storage and rendering paths, and test with inert markers plus cleanup controls.

Produces: parser matrix, lifecycle map, paired artifacts, cleanup record
Boundary: Uses inert content and avoids persistence outside owned records.

Open plain text Download SKILL.md · 1 KB

Validate.agents/skills/cache-request-boundary-analysis/SKILL.md

Cache and request boundary analysis

Use when: Compare how clients, proxies, caches, and origins interpret the same request.

Build a hop-by-hop interpretation matrix with unique cache keys, paired baselines, timing controls, and no shared-user impact.

Produces: request matrix, cache observations, confounder log, supported boundary
Boundary: No cache poisoning against other users.

Open plain text Download SKILL.md · 1 KB

Validate.agents/skills/business-logic-race-analysis/SKILL.md

Business logic and race analysis

Use when: Test invariants, ordering, replay, and concurrency on controlled state.

Model the expected invariant, establish sequential controls, run bounded concurrency, and reconcile every resulting state.

Produces: state model, timing plan, attempt ledger, before-and-after evidence
Boundary: Hard caps, controlled records, and immediate stop on unintended side effects.

Open plain text Download SKILL.md · 1 KB

Analyze.agents/skills/ai-llm-mcp-trust-review/SKILL.md

AI, LLM, and MCP trust review

Use when: Trace untrusted content through prompts, retrieval, tools, memory, and output sinks.

Map trust boundaries and privileges, then test whether controlled content can cause a measurable unauthorized effect.

Produces: trust map, tool privilege table, injection path, effect evidence
Boundary: Prompt influence alone is not reported as impact.

Open plain text Download SKILL.md · 2 KB

Collect.agents/skills/mobile-traffic-intake/SKILL.md

Mobile traffic intake

Use when: Normalize approved mobile app traffic, deep links, and client configuration.

Separate platform behavior from app behavior, map API operations and identity bindings, and preserve device and build provenance.

Produces: build manifest, endpoint map, deep-link table, platform confounders
Boundary: No bypass of device ownership, account, or program controls.

Open plain text Download SKILL.md · 2 KB

Report.agents/skills/report-evidence-validation/SKILL.md

Report evidence validation

Use when: Turn a supported observation into a minimal, reproducible report.

Independently replay the smallest claim, remove unsupported escalation, calibrate severity, redact secrets, and verify current scope.

Produces: numbered reproduction, paired evidence, impact boundary, severity rationale
Boundary: Only demonstrated impact is stated as fact.

Open plain text Download SKILL.md · 2 KB

Minimum quality bar

A skill must be able to reject its own idea.

Authorization and current scope are required inputs.
Untrusted bundles and recon files are parsed, never executed.
Secrets are redacted or hashed before derived artifacts are shared.
Every lead names one controlled discriminator and one negative control.
Completion means supported, rejected, or handed off with an owner.

Install without replacing project rules

Preview the template and adapt its inputs, outputs, and tools.
Create .agents/skills/<skill-name>/ in your repository and save the file there as SKILL.md.
Keep existing project controls. A skill should refine them, never erase them.

Read the official skill format ↗

Plain-text preview

Template

Select a template to preview.

Open plain text