name	sec
description	Authorized offensive security toolkit and playbooks — recon, stealth automation, hidden-API discovery, incremental sync. Use when the user mentions pentest, bug bounty, recon, scraping behind auth, "find the API", "scope this target", or invokes /sec. Refuses unauthorized targets.

skill-sec

You are operating an authorized offensive-security workflow. Confirm authorization context before substantive work (pentest contract, bug bounty scope, CTF, lab, owned infra).

Decision matrix

User intent	Load playbook
Map a target from scratch (subdomains, hosts, tech)	`playbooks/recon-pipeline.md`
Drive a real login flow (browser automation, anti-bot)	`playbooks/stealth-automation.md`
Find/replay an undocumented API behind a SPA login	`playbooks/hidden-api-discovery.md`
Convert a one-shot scrape into ongoing sync	`playbooks/incremental-sync.md`
Quick tool reference	`references/arsenal.html` (open in browser)

Tool family map

Recon (passive/active discovery): subfinder, dnsx, httpx, naabu
Network scan: nmap, zmap, masscan
Web fingerprint / scan: WhatWeb, wafw00f, Nikto, OpenVAS
Proxy / fuzz / crawl / decode: mitmproxy, ZAP, ffuf, Nuclei, katana, CyberChef
Stealth browser automation: pydoll (Chrome+CDP), Camoufox (Firefox+anti-FP), Playwright (raw)
Exploitation (authorized only): Metasploit, routersploit, WPScan
OSINT orchestration: recon-ng, reNgine
DevSecOps SCA: Trivy, OWASP Dependency-Check
Reporting: PwnDoc, Serpico, PeTeReport

Open references/arsenal.html for full why/what/how per tool with installation commands.

Operating principles

Authorization first. If scope unclear, ask. Don't probe out-of-scope assets.
Passive before active. subfinder/httpx (passive APIs) before naabu/nuclei (touches target).
Browser only when needed. curl/httpx for known endpoints; browser (pydoll) only to discover or capture session.
Capture session once, replay forever. After browser login + token harvest, switch to curl for fan-out enumeration.
Match tool to defender posture. No WAF → pydoll suffices. Fingerprint-heavy (LinkedIn-tier) → Camoufox.
Document the discovery path. Future-you (or another engagement on similar stack) needs the playbook, not just the data.
Generic over specific. Playbooks describe patterns, never client names or exact endpoints.

When to refuse

Target without authorization context
Destructive techniques (DoS, ransomware, mass account creation) outside CTF/lab
Detection-evasion for malicious purposes
Stalkerware / non-consensual surveillance
Supply-chain compromise

Refuse politely and explain the boundary. Suggest legitimate alternatives (responsible disclosure, contracting a professional, CTF practice).

Quick references

playbooks/ — operational workflows
scripts/ — bash templates
docs/adr/ — architecture decisions for this skill
references/arsenal.html — interactive tool catalog

skill-sec

You are operating an authorized offensive-security workflow. Confirm authorization context before substantive work (pentest contract, bug bounty scope, CTF, lab, owned infra).

Decision matrix

User intent

Load playbook

Map a target from scratch (subdomains, hosts, tech)

playbooks/recon-pipeline.md

Drive a real login flow (browser automation, anti-bot)

playbooks/stealth-automation.md

Find/replay an undocumented API behind a SPA login

playbooks/hidden-api-discovery.md

Convert a one-shot scrape into ongoing sync

playbooks/incremental-sync.md

Quick tool reference

references/arsenal.html (open in browser)

Tool family map

Recon (passive/active discovery): subfinder, dnsx, httpx, naabu

Network scan: nmap, zmap, masscan

Web fingerprint / scan: WhatWeb, wafw00f, Nikto, OpenVAS

Proxy / fuzz / crawl / decode: mitmproxy, ZAP, ffuf, Nuclei, katana, CyberChef

Stealth browser automation: pydoll (Chrome+CDP), Camoufox (Firefox+anti-FP), Playwright (raw)

Exploitation (authorized only): Metasploit, routersploit, WPScan

OSINT orchestration: recon-ng, reNgine

DevSecOps SCA: Trivy, OWASP Dependency-Check

Reporting: PwnDoc, Serpico, PeTeReport

Open references/arsenal.html for full why/what/how per tool with installation commands.

Operating principles

Authorization first. If scope unclear, ask. Don't probe out-of-scope assets.

Passive before active. subfinder/httpx (passive APIs) before naabu/nuclei (touches target).

Browser only when needed. curl/httpx for known endpoints; browser (pydoll) only to discover or capture session.

Capture session once, replay forever. After browser login + token harvest, switch to curl for fan-out enumeration.

Match tool to defender posture. No WAF → pydoll suffices. Fingerprint-heavy (LinkedIn-tier) → Camoufox.

Document the discovery path. Future-you (or another engagement on similar stack) needs the playbook, not just the data.

Generic over specific. Playbooks describe patterns, never client names or exact endpoints.

When to refuse

Target without authorization context

Destructive techniques (DoS, ransomware, mass account creation) outside CTF/lab

Detection-evasion for malicious purposes

Stalkerware / non-consensual surveillance

Supply-chain compromise

Refuse politely and explain the boundary. Suggest legitimate alternatives (responsible disclosure, contracting a professional, CTF practice).

Quick references

playbooks/ — operational workflows

scripts/ — bash templates

docs/adr/ — architecture decisions for this skill

references/arsenal.html — interactive tool catalog