yaklang/hack-skills

HACK.SKILLS is a knowledge base of security skills meant to be loaded by AI agents, built for people doing authorized work like bug bounty hunting, penetration testing, and CTF competitions. Instead of one giant document, the knowledge is broken into 101 focused skill files spread across 14 security domains, covering things like web security, API security, login and authorization flaws, privilege escalation on Linux, Windows, and macOS, Active Directory attacks, mobile security, binary exploitation, reverse engineering, cryptography attacks, blockchain security, AI and LLM security, network pivoting, and digital forensics. The project organizes this material in three layers so an AI agent does not have to read everything at once. There is one master entry point that handles routing and figuring out what phase of an engagement you are in, six category entries that route toward a specific type of attack surface, and then deep topic skills that only get loaded on demand once a category is chosen. For example, a category entry like auth-sec routes you toward login, session, and token related skills, and a deep topic skill covers something specific like SQL injection in full detail. Rather than copying large existing wordlists or payload collections wholesale, the authors say they distill knowledge from established public references, such as PayloadsAllTheThings, hacktricks, and ctf-wiki, into more compact, organized, and auditable skill files. The content is explicitly framed as educational methodology, without customer-specific or vendor-identifiable details. You can browse the skills three ways: through a searchable web interface, by reading the plain Markdown files directly in this repository, or by downloading an encrypted zip file for offline or air-gapped use. The recommended way to install the skills into your own agent tooling is a single command, npx skills add yaklang/hack-skills, after which you are meant to start from the master entry and drill down into deeper topics only as needed. The full README is longer than what was shown.