forefy/.context

Perfil de forefy

Última actividad de origen registrada: 15 de octubre de 2026 a las 09:47

Catálogo de SkillsMP actualizado: 26 de octubre de 2026 a las 11:37

skills recopiladas: 35

Estrellas en GitHub: 153
Forks en GitHub: 30

README del repositorio

Archivo de origen del README: README.md

Leer el README original

Mostrar README completo

<h1 align="center">.context</h1> <img src="static/logo.svg" alt="pocer" width="180"> An optimized collection of AI agent skills, goals and workflows for security auditing <a href="https://github.com/forefy/.context/issues/new/choose"><img alt="Issues" title="Issues" src="https://img.shields.io/github/issues-raw/forefy/.context"></a> <img alt=".context GitHub repo size" title=".context GitHub repo size" src="https://img.shields.io/github/languages/code-size/forefy/.context"> <img alt=".context GitHub commit activity" title=".context GitHub commit activity" src="https://img.shields.io/github/commit-activity/m/forefy/.context"> <img alt="GitHub last commit" title="GitHub last commit" src="https://img.shields.io/github/last-commit/forefy/.context"> <a href="https://twitter.com/forefy"><img alt="Forefy Twitter" title="Forefy Twitter" src="https://img.shields.io/twitter/follow/forefy.svg?logo=twitter"></a> <img src="https://claude.com/images/claude_app_icon.png" width="16" height="16" alt=""> Claude Code  ·  <img src="https://github.githubassets.com/images/modules/site/copilot/copilot.png" width="16" height="16" alt=""> Copilot  ·  <img src="https://avatars.githubusercontent.com/u/161781182?s=48&v=4" width="16" height="16" alt=""> Gemini  ·  <img src="https://avatars.githubusercontent.com/u/14957082?s=48&v=4" width="16" height="16" alt=""> Codex  ·  <img src="https://avatars.githubusercontent.com/u/134168893?s=48&v=4" width="16" height="16" alt=""> Hermes Agent  ·  <img src="https://avatars.githubusercontent.com/u/14957082?s=48&v=4" width="16" height="16" alt=""> OpenAI <a href="https://t.me/forefy_t" title="forefy Telegram">Telegram DM</a> # Installation ## Agents: Paste in your chat: ``` Run the AI Security Registry installation wizard https://github.com/forefy/.context/blob/main/install.md ``` ## Manual 1. Data maintained in this repo is also listed on https://forefy.com/aisecurity 2. Search and download from there via easy installation button # What is this? Security auditing skills for AI agents, adhering to the [Agent Skills Format](https://platform.claude.com/docs/en/agents-and-tools/agent-skills/overview). `.context` is one of the oldest efforts by security researchers to share auditing knowledge directly to your AI agent, and is built gradually over time. at the most simple form, you type "audit this contract" and end up with a multi-agent triaged AI report. # About the Skills Skills are grouped into category folders under `skills/`. Discovery is flat, so the folders are for organization only; each skill still lives at `skills/<category>/<name>/SKILL.md`. ## Applicative pentest `skills/applicative-pentest/` - portable, tool-agnostic web-app testing methodologies (curl/python3, no scanner required), each with runnable snippets and the wordlists/regexes/thresholds inline or in `references/`. - `ssrf-oob` - active out-of-band SSRF probe; injects an OAST/collaborator callback into request-forwarding params and client-IP headers, then watches for the DNS/HTTP interaction that proves a blind server-side request. - `http-request-smuggling` - active HTTP desync detection for CL.TE and TE.CL via raw socket requests, using timing probes plus differential-response confirmation with the exact payloads. - `jwt-attacks` - forges and re-signs captured JWTs to test signature validation (alg:none, signature stripping, kid traversal, jwk/jku injection, RS256/HS256 confusion) plus offline HMAC secret cracking. - `broken-access-control` - active authorization and IDOR testing by replaying captured requests with swapped identities and incremented object-ids, carrying the response-diff thresholds that decide a finding. - `webapp-probe` - assesses what a web app exposes or leaks, passively from captured traffic (headers, cookies, secrets, error pages, tech fingerprints, RCE-prone params) and actively (exposed files, vulnerable software on open ports, Wayback endpoints, dependency confusion). - `cdn-peek` - checks whether a CDN/WAF-fronted host is reachable outside its edge, using only dig, curl, openssl, whois, and nc; works against any reverse-proxy edge. ## Blockchain `skills/blockchain/` - smart-contract auditing and on-chain investigation. - `smart-contract-audit` - full smart contract audit framework with multi-expert analysis for Solidity, Anchor, Vyper, TON (FunC/Tact), and Sui (Move), with language-specific checks and vulnerability pattern references. - `foundry-poc` - context-window-optimized skill to generate a Foundry proof of concept for a discussed finding. - `blockchain-forensics` - trace stolen funds and attribute attacker wallets using only public on-chain data; also useful for deployer history and privileged-role validation during audits. - `safe-hunt` - sweeps DeFi protocol Safe multisig wallets for governance misconfigurations, scoring each against a finding pattern library and producing an audit-ready ranked report. ## Cloud `skills/cloud/` - cloud and infrastructure exposure. - `cloud-bucket-brute` - active enumeration of publicly readable cloud-storage buckets; permutes a company name into candidate bucket names and probes AWS S3, Google Cloud, DigitalOcean, Alibaba, Oracle, and Vultr. - `infrastructure-audit` - infrastructure security audit framework for IaC, Docker, Kubernetes, and cloud configurations; audits generate numbered folders in `.context/outputs/` for tracking and reports. ## LLMs `skills/llms/` - security testing for LLM applications, agents, and the protocol surface around them. - `prompt-injection-audit` - audits an LLM application for indirect prompt injection by composing objective x technique payloads, delivering them through the channels the agent actually reads (pages, tool responses, files, tickets, RAG), and proving impact with an out-of-band callback rather than a judge where one is not needed. - `mcp-server-pentest` - pentests an MCP server for authentication bypass, confused-deputy SSRF, and tool-argument injection; black-box from the server URL, deeper with repo or host access. - `llm-fuzz-tools` - runs several LLM red-team scanners against one target, normalizes their output to a common schema, dedupes across them, and reports honest coverage instead of a summed probe count. ## Hunter utils `skills/hunter-utils/` - general auditing methodology and workflow tooling picked up naturally as you travel through a codebase. - `tiny-auditor` - context-window-optimized audit skill; think caveman for audits. - `auditor-quiz` - get engaged with the codebase from a security-auditor perspective and test how well you memorized it by quizzing yourself. - `audit-scope` - generate a security audit scope document from GitHub repo URLs and/or API access descriptions, with a protocol narrative and a scope table (NSLOC, focus areas, days). - `sandboxed-audit-runner` - wraps the agent session inside the Anthropic Sandbox Runtime before auditing untrusted code, protecting the host from prompt-injection embedded in the codebase. - `gdocs-audit-report` - create, format, and maintain security audit reports in Google Docs via the Docs API, covering finding formatting, summary tables, severity colors, and index-drift safety. - `pre-bounty` - pre-engagement recon and target prioritization for a bounty/VDP scope; maps assets, mines bug history, extracts scope gotchas, then scores and ranks every asset best-to-worst by opportunity and renders a ranked asset -> setup -> ROI Sankey. - `hackerone-report` - drives a HackerOne submission end to end: dedup pre-flight, concise writeup, a video-ready PoC package, and browser form-fill, handing the irreversible login and Submit steps back to the user. - `evidence-video` - turn a user story or bug reproduction into a short walkthrough video where every scene is a real capture (browser, proxy, or terminal) hashed into a tamper-evident manifest, so a reviewer re-runs verify and the chain either holds or breaks; a Python generator refuses to emit a scene without a real frame, features the real request-and-response behind a step with secrets redacted, and always ends on insight, impact and risk with a blast-radius map of what the flow reaches, assembled with HyperFrames. - `external-enumeration` - passive external attack-surface mapping for a company; multi-source subdomain discovery, NS/MX/TXT ownership attribution, per-subdomain header harvest, tech-stack and dual-CDN detection, stealth Cloudflare bypass, and a structured recon report. - `nuclei-suggest` - browse the nuclei-templates library and recommend a scoped template set for a stack, target, or CVE, tiered by blast radius, then run it against an authorized target with a confirmed ceiling and report findings; browsing and selection stay passive, only execution sends traffic. - `vm-lab` - spins up disposable local VMs (macOS, Windows, Linux) and drives them over SSH for cross-OS repro and debugging; process/network/file/memory triage, live event capture, code-signing and injectability checks, dynamic instrumentation, and malware/RE repro on any free hypervisor (Parallels, VirtualBox, VMware) with no paid CLIs. ## Generic utils `skills/generic-utils/` - workflow tooling that is useful on any engagement, security or not. - `context-window-to-skill` - converts a completed agent conversation into a reusable skill, extracting the pitfalls, tweaks, and lessons so the next run gets it right from the start. - `agent-onboarding` - onboard concurrent agents to a shared TODO.md so parallel terminals sync work and keep coverage tracking. - `git-commit` - before committing, pre-runs tests, reviews changed code, strips dead code and sensitive data, enforces clean commit messages, and validates the change won't break deployments. - `training-guide` - build an interactive, click-through visual course as a self-contained HTML page that teaches a subject one idea per screen, each with a hand-built diagram, an intuition reveal, and trick-question quizzes. - `variant-table` - render draft copy as a side-by-side comparison table, one row per logical unit with three genuinely distinct rewrite variations plus a top-pick column, for iterating on wording. - `self-improve` - audit a finished conversation for corrections and dead ends, then commit the generalizable lessons back into the repo so the next run does not repeat them. ## Defensive `skills/defensive/` - blue-team, DFIR, and agent-side defense. - `endpoint-threat-hunt` - live endpoint threat hunting across process/file/network/persistence/registry categories using native OS tools (macOS/Linux/Windows), producing a structured findings report with explicit coverage gaps. - `dylib-hijack-scan` - scan macOS for applications susceptible to weak-dylib and rpath-order hijacks, scored by whether library validation actually blocks the attack. - `parse-security` - the last gate before untrusted instruction content is ingested; screens a fetched skill, goal or workflow for prompt injection on the assumption its author wrote it to defeat this exact review, covering instruction override, fabricated authorization, exfiltration, persistence, concealment and manipulation aimed at the reviewer's own verdict. # Quality Skills, workflows and goals are following industry best practice and guidance (e.g. we read the docs): - [Agent Skills open standard](https://github.com/agentskills/agentskills) - [Claude Code Dynamic Workflows](https://code.claude.com/docs/en/workflows) And are CI-validated by in-repo, versioned json-schema files: - [https://github.com/forefy/.context/schemas](https://github.com/forefy/.context/blob/main/schemas) .context skills, goals and workflows are validated on the AI Security Registry. # Contributions Your research knowledge is the only skill required to contribute, whether its a methodology, specific knowledge on a protocol or language or even corrections - everything's highly welcome! help secure and improve the community!

Cargando el README del repositorio…

Skills en este repositorio

Analistas de seguridad de la información Analistas de garantía de calidad de software y probadores Administradores de redes y sistemas informáticos Otras ocupaciones informáticas

7 categorías ocupacionales · 94% clasificado

skill

ocupación

descripción

actualizado

no-aispeak

sin clasificar

Generate textual content as the user will normally write without the disliked common AI way of writing