Browse Skills

Hunt ATO catalogs nine distinct account takeover paths, including password reset flaws, email change without re-auth, OAuth account-link CSRF, MFA bypass, session fixation, JWT manipulation, and SSO subdomain takeover. Use it when hunting ATO chains or testing password reset, email change, MFA, OAuth, session, and JWT primitives toward a critical finding.

Hunt Brute Force identifies missing or weak rate limiting on login, OTP/2FA, password-reset, and credential-stuffing endpoints to find brute force, enumeration, and ReDoS vulnerabilities. Use it when testing web apps for brute force, user enumeration, or rate-limit bypass via headers like X-Forwarded-For.

Hunt CI/CD finds and validates vulnerabilities in CI/CD pipelines, including Jenkins RCE, GitHub Actions injection, self-hosted runner poisoning, OIDC abuse, and Terraform state leakage. Use it when targeting public orgs, CI dashboards, or build artifacts.

Hunt Clickjacking tests for missing X-Frame-Options and CSP frame-ancestors headers, then proves a sensitive page can be framed and clicked cross-site to confirm a UI redressing vulnerability.

Hunt CORS Misconfigurations probes CORS headers and browser behavior to find credentialed cross-origin read flaws, including origin reflection with credentials, null-origin trust, and subdomain regex bypass. Use it when testing API endpoints, SPAs, or any app emitting Access-Control-* headers.

Hunt CSRF identifies cross-site request forgery vulnerabilities in authenticated web applications using patterns from 15 public bug bounty reports, including SameSite bypasses and account takeover chains. Use it when testing state-changing endpoints, token validation, and cookie SameSite attributes.

Hunt Deserialization detects and exploits insecure deserialization vulnerabilities in Java, PHP, Python, .NET, and Ruby applications to achieve RCE. Use when testing targets that process serialized objects, including Log4Shell/JNDI, ysoserial, PHP object injection, pickle, BinaryFormatter, and Marshal.load.

Hunt Dispatch is a skill-set loader for the /hunt orchestrator. It fingerprints the target, picks the right platform attack skills, and loads the Red Team or WAPT skill set when /hunt receives a mode answer.

Lean Context compresses LLM context by up to 99% using 79 MCP tools, 10 read modes, 95+ shell patterns, and tree-sitter AST for 27 languages. Use it when reading files, running shell commands, searching code, or exploring directories.

LeanCTX compresses LLM context by up to 99% using 79 MCP tools, 10 read modes, 95+ shell compression patterns, and tree-sitter AST parsing for 26 languages. Use it when reading files, running shell commands, searching code, or exploring directories.

APM Issue Autopilot drives any open microsoft/apm issue from raw intake to a mergeable PR with triage as the central gate. It batches issues, runs the triage panel per issue, presents one consolidated review, escalates by default, and only auto-implements clear, bounded accepts approved by the maintainer.

APM Review Panel runs a fan-out panel of specialist agents to review a labelled pull request in microsoft/apm. It aggregates findings from mandatory and conditional specialists plus a CEO synthesizer, then writes one advisory recommendation comment (no verdict labels, no merge gating). Use when a non-trivial PR needs cross-cutting recommendation on architecture, CLI logging, DevX UX, supply-chain