security-agent-skills
79 offensive-security skills with a router, across 9 domains and 8 agent platforms.
About
A large pack of 79 skills covering recon/OSINT, web and network pentesting, exploit development, reverse engineering, CTF, post-exploitation, cloud/AI security, and hardware/IoT. A security-orchestrator router skill reads intent and routes to the right methodology, payloads, and commands, with 214+ reference files and provider configs for 8 agent harnesses.
It ships offensive tooling knowledge (nmap, sqlmap, Ghidra playbooks), so it's genuinely dual-use — the repo itself says use it for authorized testing only. Very early days at 4 stars; expect rough edges.
What it can do
- security-orchestrator master router for cross-domain tasks
- 79 skills in 9 domains (recon, pentest, exploit dev, RE, CTF, post-exploitation, cloud, hardware)
- Shared rules library (payloads, WAF bypass ladder, hunting rules)
- Per-agent provider configs
- Trilingual docs (EN, simplified/traditional Chinese, Japanese)
Setup
- Clone: git clone https://github.com/Wang200935/security-agent-skills.git
- cd security-agent-skills
- Install for your agent: ./install.sh --agent claude-code
- Or install everywhere: ./install.sh --all
Prerequisites
A supported AI coding agent; bash; some skills reference external tools (nmap, sqlmap, Ghidra, Frida)
Use cases
Works with
Trust score — 7/10
Scored 7/10 (metrics tier, metrics-v1). Evidence: 4 stars, 19 commits, 1 release — early; 79 skills + orchestrator, 8 agent platforms, trilingual docs; dual-use: ships offensive pentest playbooks; repo restricts to authorized testing; real engagement claims are author-reported, not independently verified. License: MIT; acceptable-use doc restricts to authorized security testing.
★ 4 GitHub stars
How the trust score is built
Full methodology →- Adoption · stars/downloads, log-scaled vs peers
- 4.0/10
- Maintenance · recency, releases, issue load
- 7.0/10
- Openness · license + docs
- 8.0/10
- Manual review · sanity read + red-flag check
- 7.0/10
- · 4 stars, 19 commits, 1 release — early
- · 79 skills + orchestrator, 8 agent platforms, trilingual docs
- · dual-use: ships offensive pentest playbooks; repo restricts to authorized testing
- · real engagement claims are author-reported, not independently verified
Sources
Every fact above was checked against these sources. Where a claim comes from the provider and couldn't be independently verified, the text says so.