An optimized collection of AI agent skills, goals and workflows for security auditing
Paste in your chat:
Run the AI Security Registry installation wizard https://github.com/forefy/.context/blob/main/install.md
- Data maintained in this repo is also listed on https://forefy.com/aisecurity
- Search and download from there via easy installation button
Security auditing skills for AI agents, adhering to the Agent Skills Format.
.context is one of the oldest efforts by security researchers to share auditing knowledge directly to your AI agent, and is built gradually over time. at the most simple form, you type "audit this contract" and end up with a multi-agent triaged AI report.
Skills are grouped into category folders under skills/. Discovery is flat, so the folders are for organization only; each skill still lives at skills/<category>/<name>/SKILL.md.
skills/applicative-pentest/ - portable, tool-agnostic web-app testing methodologies (curl/python3, no scanner required), each with runnable snippets and the wordlists/regexes/thresholds inline or in references/.
ssrf-oob- active out-of-band SSRF probe; injects an OAST/collaborator callback into request-forwarding params and client-IP headers, then watches for the DNS/HTTP interaction that proves a blind server-side request.http-request-smuggling- active HTTP desync detection for CL.TE and TE.CL via raw socket requests, using timing probes plus differential-response confirmation with the exact payloads.jwt-attacks- forges and re-signs captured JWTs to test signature validation (alg:none, signature stripping, kid traversal, jwk/jku injection, RS256/HS256 confusion) plus offline HMAC secret cracking.broken-access-control- active authorization and IDOR testing by replaying captured requests with swapped identities and incremented object-ids, carrying the response-diff thresholds that decide a finding.webapp-probe- assesses what a web app exposes or leaks, passively from captured traffic (headers, cookies, secrets, error pages, tech fingerprints, RCE-prone params) and actively (exposed files, vulnerable software on open ports, Wayback endpoints, dependency confusion).cdn-peek- checks whether a CDN/WAF-fronted host is reachable outside its edge, using only dig, curl, openssl, whois, and nc; works against any reverse-proxy edge.
skills/blockchain/ - smart-contract auditing and on-chain investigation.
smart-contract-audit- full smart contract audit framework with multi-expert analysis for Solidity, Anchor, Vyper, TON (FunC/Tact), and Sui (Move), with language-specific checks and vulnerability pattern references.foundry-poc- context-window-optimized skill to generate a Foundry proof of concept for a discussed finding.blockchain-forensics- trace stolen funds and attribute attacker wallets using only public on-chain data; also useful for deployer history and privileged-role validation during audits.safe-hunt- sweeps DeFi protocol Safe multisig wallets for governance misconfigurations, scoring each against a finding pattern library and producing an audit-ready ranked report.
skills/cloud/ - cloud and infrastructure exposure.
cloud-bucket-brute- active enumeration of publicly readable cloud-storage buckets; permutes a company name into candidate bucket names and probes AWS S3, Google Cloud, DigitalOcean, Alibaba, Oracle, and Vultr.infrastructure-audit- infrastructure security audit framework for IaC, Docker, Kubernetes, and cloud configurations; audits generate numbered folders in.context/outputs/for tracking and reports.
skills/hunter-utils/ - general auditing methodology and workflow tooling picked up naturally as you travel through a codebase.
tiny-auditor- context-window-optimized audit skill; think caveman for audits.auditor-quiz- get engaged with the codebase from a security-auditor perspective and test how well you memorized it by quizzing yourself.audit-scope- generate a security audit scope document from GitHub repo URLs and/or API access descriptions, with a protocol narrative and a scope table (NSLOC, focus areas, days).sandboxed-audit-runner- wraps the agent session inside the Anthropic Sandbox Runtime before auditing untrusted code, protecting the host from prompt-injection embedded in the codebase.gdocs-audit-report- create, format, and maintain security audit reports in Google Docs via the Docs API, covering finding formatting, summary tables, severity colors, and index-drift safety.pre-bounty- pre-engagement recon and target prioritization for a bounty/VDP scope; maps assets, mines bug history, extracts scope gotchas, then scores and ranks every asset best-to-worst by opportunity and renders a ranked asset -> setup -> ROI Sankey.hackerone-report- drives a HackerOne submission end to end: dedup pre-flight, concise writeup, a video-ready PoC package, and browser form-fill, handing the irreversible login and Submit steps back to the user.external-enumeration- passive external attack-surface mapping for a company; multi-source subdomain discovery, NS/MX/TXT ownership attribution, per-subdomain header harvest, tech-stack and dual-CDN detection, stealth Cloudflare bypass, and a structured recon report.vm-lab- spins up disposable local VMs (macOS, Windows, Linux) and drives them over SSH for cross-OS repro and debugging; process/network/file/memory triage, live event capture, code-signing and injectability checks, dynamic instrumentation, and malware/RE repro on any free hypervisor (Parallels, VirtualBox, VMware) with no paid CLIs.
skills/generic-utils/ - workflow tooling that is useful on any engagement, security or not.
context-window-to-skill- converts a completed agent conversation into a reusable skill, extracting the pitfalls, tweaks, and lessons so the next run gets it right from the start.agent-onboarding- onboard concurrent agents to a shared TODO.md so parallel terminals sync work and keep coverage tracking.git-commit- before committing, pre-runs tests, reviews changed code, strips dead code and sensitive data, enforces clean commit messages, and validates the change won't break deployments.training-guide- build an interactive, click-through visual course as a self-contained HTML page that teaches a subject one idea per screen, each with a hand-built diagram, an intuition reveal, and trick-question quizzes.variant-table- render draft copy as a side-by-side comparison table, one row per logical unit with three genuinely distinct rewrite variations plus a top-pick column, for iterating on wording.
skills/defensive/ - blue-team and DFIR.
endpoint-threat-hunt- live endpoint threat hunting across process/file/network/persistence/registry categories using native OS tools (macOS/Linux/Windows), producing a structured findings report with explicit coverage gaps.
Skills, workflows and goals are following industry best practice and guidance (e.g. we read the docs):
And are CI-validated by in-repo, versioned json-schema files:
.context skills, goals and workflows are validated on the AI Security Registry.
forefy |
Your research knowledge is the only skill required to contribute, whether its a methodology, specific knowledge on a protocol or language or even corrections - everything's highly welcome! help secure and improve the community!
