ssrf

Use when testing a web application for SQL injection on an authorized engagement.

7 skills

Use when planning or running nmap scans during authorized engagements: host discovery options, TCP SYN, connect, UDP, NULL, FIN, Xmas, and ACK scan types, service and OS detection, timing templates T0 to T5, evasion techniques (fragmentation, decoys, idle scans, source port tricks, data length padding), NSE script selection by category, and output formats for evidence.

6 skills

Use when you hold a low-privilege Linux shell on an authorized engagement, lab, or CTF and need a reliable path to root.

6 skills

Use when testing a web application for cross-site scripting on an authorized engagement.

6 skills

Use when mapping an authorized Active Directory environment during an internal assessment or assumed breach exercise.

5 skills

Use when testing REST, GraphQL, or internal APIs on an authorized engagement.

5 skills

Collection of example skills demonstrating various capabilities including skill creation, MCP building, visual design, algorithmic art, internal communications, web testing, artifact building, Slack GIFs, and theme styling

19 skills

Security review for Claude-generated code. Pattern-based warnings on edits, LLM-powered diff review on Stop, and an agentic commit reviewer that catches injection, XSS, SSRF, hardcoded secrets, and 25+ other vulnerability classes.

hooks

Skill: add headroom-ai compress() to a Python or TypeScript app to cut LLM input tokens (tool outputs, logs, JSON, chat history). No API key.

1 skill

Generate natively editable PPTX from PDF / DOCX / URL / Markdown — real DrawingML shapes, text boxes, charts, and animations. Note: run `pip install -r requirements.txt` inside the installed plugin directory for the Python post-processing scripts to work.

1 skill

Package any website or local web build into a lightweight desktop app with Pake CLI.

1 skill

Automates browser interactions for web testing, form filling, screenshots, and data extraction

12 skills