attack
Take the attacker stance — for each surface, ask where it would break (injection, authn/authz, business logic, file handling, CSRF, SSRF) and turn the best…
Skill by rakabimar
Install
Works with Claude Code, Claude apps, Codex, Cursor, Gemini CLI, GitHub Copilot, VS Code, OpenCode, Goose, Windsurf. Read the repository before you give any tool access to your data.
npx agentmarket install skill/rakabimar-attack-7e6934
Asks which of your tools to add it to (Claude Code, Codex, Cursor, VS Code, Windsurf, Gemini CLI, Claude Desktop) and shows the change first. See https://agentmart.dev/cli.
Get the weekly diff
The weekly diff: one email a week with new agent tools, notable updates and grade changes, plus security alerts for tools you follow. Double opt-in, one-click unsubscribe.
About
Use cases: testing
Reviews
Write a reviewNo reviews yet. Installed it? Reviews come from verified installers only. How reviews work
Permissions
What this skill can do and what it asks for, from its SKILL.md. Checked Oct 25, 2026.
- Tools
- No tools found
- Secrets
- None asked for
- Install scripts
- None found
Network hosts it talks to 1
codeload.github.com· found in install command
Files it touches
~/.claude/skills/attack
What's inside
- Skill name
attack- Description
- Take the attacker stance — for each surface, ask where it would break (injection, authn/authz, business logic, file handling, CSRF, SSRF) and turn the best candidate into a hypothesis. Use after observe and before any test.
- License
- unknown
- Instructions
- 38 lines in SKILL.md · view on GitHub
Files (1)
- SKILL.md
The license isn't open source, so the instructions aren't shown here. Read SKILL.md on GitHub
More from rakabimar/huntress
- 0.547score
cache-deception
rakabimar
Use when a private/dynamic authenticated response may be cached and served cross-user because cache and origin disagree about static-looking paths…
SkillBFreshness: B★ 1Claude Code +9 - 0.547score
cache-poisoning
rakabimar
Use when attacker-controlled unkeyed input may alter a shared cached response; route private-response path confusion to cache-deception.
SkillBFreshness: B★ 1Claude Code +9 - 0.547score
client-reverse
rakabimar
Use when browser, mobile, desktop, or WebAssembly client code reveals security-relevant API routes, request signing, feature flags, cryptographic wrappers…
SkillBFreshness: B★ 1Claude Code +9 - 0.544score
business-logic
rakabimar
Use for feature-specific security invariants and invalid state transitions across checkout, wallet, coupon, subscription, invite, approval, refund, quota…
SkillBFreshness: B★ 1Claude Code +9 - 0.544score
cicd-security
rakabimar
Use for source-only CI/CD review of GitHub Actions, GitLab CI, release pipelines, untrusted PR inputs, workflow permissions, token/artifact/cache trust, OIDC…
SkillBFreshness: B★ 1Claude Code +9 - 0.544score
access-control
rakabimar
Use for broad permission, role, administrative function, delegation, impersonation, route-guard, middleware, feature-flag, and organization boundary…
SkillBFreshness: B★ 1Claude Code +9 - 0.544score
api-authorization
rakabimar
Use for REST or GraphQL object, property, function, tenant, relationship, lifecycle, batch, export, job, and API-version authorization boundaries; do not…
SkillBFreshness: B★ 1Claude Code +9 - 0.544score
authentication
rakabimar
Use for identity establishment and binding across login, registration, verification, reset, magic link, MFA, recovery, account linking, federation, device…
SkillBFreshness: B★ 1Claude Code +9 - 0.544score
cloud-security
rakabimar
Use only when source/recon shows AWS, Azure, or GCP application boundaries involving identity, resource policy, storage, signed URLs, metadata, serverless…
SkillBFreshness: B★ 1Claude Code +9 - 0.542score
api-enumeration
rakabimar
Use when enumerating API surface (OpenAPI/Swagger, GraphQL introspection, versioned or undocumented endpoints) and probing API object graphs for BOLA/IDOR.
SkillBFreshness: B★ 1Claude Code +9 - 0.533score
authn-bypass
rakabimar
Compatibility alias for authentication.
SkillBFreshness: B★ 1Claude Code +9 - 0.291score
research-loop
rakabimar
No description from the publisher yet.
SkillBFreshness: B★ 1Claude Code +9
Signals
- Stars
- 1
- Forks
- 1
- Open issues
- 0
- Last commit (this folder)
- Aug 25, 2026 (2 months ago)
From GitHub (fetched Oct 24, 2026).
Details
- License
- License unknown
- Repository
- github.com/rakabimar/huntress
- First seen
- Oct 24, 2026
- Last checked
- Oct 24, 2026
- Source
- GitHubgithub-graphql
More from rakabimar
- 0.547score
cache-deception
rakabimar
Use when a private/dynamic authenticated response may be cached and served cross-user because cache and origin disagree about static-looking paths…
SkillBFreshness: B★ 1Claude Code +9 - 0.547score
cache-poisoning
rakabimar
Use when attacker-controlled unkeyed input may alter a shared cached response; route private-response path confusion to cache-deception.
SkillBFreshness: B★ 1Claude Code +9 - 0.547score
client-reverse
rakabimar
Use when browser, mobile, desktop, or WebAssembly client code reveals security-relevant API routes, request signing, feature flags, cryptographic wrappers…
SkillBFreshness: B★ 1Claude Code +9 - 0.544score
business-logic
rakabimar
Use for feature-specific security invariants and invalid state transitions across checkout, wallet, coupon, subscription, invite, approval, refund, quota…
SkillBFreshness: B★ 1Claude Code +9 - 0.544score
cicd-security
rakabimar
Use for source-only CI/CD review of GitHub Actions, GitLab CI, release pipelines, untrusted PR inputs, workflow permissions, token/artifact/cache trust, OIDC…
SkillBFreshness: B★ 1Claude Code +9 - 0.544score
access-control
rakabimar
Use for broad permission, role, administrative function, delegation, impersonation, route-guard, middleware, feature-flag, and organization boundary…
SkillBFreshness: B★ 1Claude Code +9
Cite this page
attack skill. Agent Mart. https://agentmart.dev/skills/rakabimar-attack-7e6934 (last updated 2026-10-24)