Hack
Load this first when you have an authorized web or API target and need structured routing across recon, validation, and exploit-chain skills instead of ad-hoc security guessing.
Overview
Hack is an agent skill for the Ship phase that routes authorized web and API security work through recon, validation, privilege escalation, and chain-building phases before loading specialized vulnerability skills.
Install
npx skills add https://github.com/yaklang/hack-skills --skill hackWhat is this skill?
- P0 entry router for HackSkills—picks phase then vulnerability category before deep topic skills
- Phases: Recon, Validation, Privilege Escalation, and chain building
- Routes to XSS, SQLi, SSRF, IDOR, JWT, and API tracks instead of baseline model memory
- Emphasizes boundary conditions and auditability for real engagements
- Trust model: authorized targets, legitimate research, and bug-bounty rules only
- Four primary testing phases: Recon, Validation, Privilege Escalation, chain building
Adoption & trust: 1.2k installs on skills.sh; 980 GitHub stars; 2/3 security scanners passed (skills.sh audits).
What problem does it solve?
You received a new in-scope target but do not know which security track to run first, so the agent improvises instead of following a reproducible assessment methodology.
Who is it for?
Builders running authorized bug bounty, internal pentests, or API hardening passes who already use the HackSkills ecosystem.
Skip if: Unauthorized scanning, criminal intrusion, or production changes without explicit written permission and program rules.
When should I use this skill?
Web application testing, API security assessment, recon, vulnerability triage, exploit path planning, or choosing the next HackSkills category skill on an authorized target.
What do I get? / Deliverables
After routing, the agent selects the correct HackSkills category and phase-aligned next skill so testing proceeds with structured methodology rather than scattered prompts.
- Selected testing phase and vulnerability category
- Routing decision for the next specialized HackSkills module
Recommended Skills
Journey fit
How it compares
Use as a security methodology router—not a single CVE exploit cheat sheet or a generic code linter.
Common Questions / FAQ
Who is hack for?
Solo security-minded builders and indie teams performing authorized web/API testing who want an agent to pick the right HackSkills track before diving into XSS, SQLi, SSRF, IDOR, or JWT modules.
When should I use hack?
Use it at the start of Ship security work when a new bounty target arrives, when findings need triage into the correct category skill, or when you want stable Web/API testing methodology instead of one-off prompts.
Is hack safe to install?
The skill encodes offensive-security methodology for authorized use only; review the Security Audits panel on this Prism page and your program rules before enabling it in an agent with network access.
SKILL.md
READMESKILL.md - Hack
# HACKING SKILLS / HackSkills ## Overview This is a top-level routing skill for **bug bounty, web security, API security, and authorized penetration testing**. Its core role is not to replace all specialized techniques, but to help the agent: 1. First determine the testing phase (Recon / Validation / Privilege Escalation / Chain building) 2. Then select the correct vulnerability category 3. Avoid relying only on baseline model memory; prefer structured methodology 4. Prioritize boundary conditions AI often misses but that matter in real engagements ## Trust Model - This knowledge base emphasizes content safety and auditability. - Use this only within **authorized targets**, **legitimate research**, **defensive validation**, and **bug-bounty-approved rules**. - Do not use these techniques for unauthorized attacks. ## When to Use This Skill Use this skill first in the following scenarios: - You just received a new bug bounty target and do not know where to start - You need to decide whether to load XSS / SQLi / SSRF / IDOR / JWT / API tracks first - You want the agent to perform Web/API security testing with a more stable methodology - You need to route scattered findings to the right attack surface - You want AI to miss fewer critical test points in security work ## Operating Model ### Step 1: Start with Recon and context validation Collect first: - Target type: classic web, REST API, mobile backend, admin panel, payment flow, file upload, GraphQL - Identity and permission model: anonymous, regular user, admin, multi-tenant - Input locations: URL, query parameters, JSON, headers, cookies, filenames, imported files, templates, reflection points - Output locations: HTML, attributes, JS, PDF, email, logs, background tasks, mobile endpoints ### Step 2: Route by observed behavior | Signal | Priority direction | |---|---| | Input reflects into HTML / JS | XSS / SSTI | | Server actively fetches URL / hostname | SSRF | | Accepts XML / Office / SVG | XXE | | Path, filename, or download endpoint is controllable | Path Traversal / LFI | | Many object IDs appear in APIs | IDOR / BOLA / BFLA | | Login, reset password, 2FA, sessions | Auth Bypass / JWT / OAuth | | Multi-step transactions, coupons, pricing, inventory | Business Logic | | MongoDB / JSON query syntax exposure | NoSQL Injection | | CLI tools, image processing, importers | Command Injection | | HTTP parsing anomalies / front-back framing mismatch | Request Smuggling | | Node.js JSON handling / controllable `__proto__` | Prototype Pollution | | PHP weak comparison / 0e hash / loose conditions | Type Juggling | | Repeated parameter names / WAF-app parsing mismatch | HTTP Parameter Pollution | | One-time operations (coupon/inventory/reset) | Race Condition | | XML/XSLT template processing | XSLT Injection | | Accessible .git/.svn/.env paths | Insecure SCM | | CSV/Excel export features | CSV Formula Injection | | WebSocket protocol upgrades | WebSocket Security | | Internal package names / supply-chain inventory | Dependency Confusion | ### Step 3: Use the most likely-hit testing order 1. Recon / Methodology 2. API Security / Auth / IDOR 3. XSS / SQLi / SSRF / SSTI / XXE 4. Business Logic / Race Condition 5. Chained exploits and privilege-escalation paths ## Core Skill Map If you have the full repository, prioritize using these topic documents together: - [Recon and Methodology](../recon-and-methodology/SKILL.md) - [XSS Cross Site Scripting](../xss-cross-site-scripting/SKILL.md) - [SQLi SQL Injection](../sqli-sql-injection/SKILL.md) - [SSRF Server Side Request Forgery](../ssrf-server-side-request-forgery/SKILL.md) - [XXE XML External Entity](../xxe-xml-external-entity/SKILL.md) - [SSTI