0
v…
… skills
… categories
authorized research only
Composable security playbooks for AI agents.
One master entry, six category routers, and 100+ deep topic skills — drilled down on demand by your agent. Static, auditable, install in a single command.
Install
Two ways to wire HackSkills into your agent. Bundle the whole kit, or pull a single playbook on demand.
One command pulls the whole kit (master + category + 100+ topic skills) and registers them with your skills loader.
npx skills add yaklang/hack-skills
Recommended for first-time setup. Works with any tool that consumes the skills CLI convention.
Pick a single playbook — useful when you only need one topic and want to keep the loader minimal.
npx skills add yaklang/hack-skills/hack
If your tooling supports per-skill registration (frontmatter name identifier), this scopes to one playbook only.
Plain HTTP. Pull the raw SKILL.md for any skill — drop it into a custom prompt, RAG store, or your own skills folder.
curl -fsSL https://raw.githubusercontent.com/yaklang/hack-skills/main/skills/hack/SKILL.md
No installer required. The Markdown file is self-contained and includes routing hints in its frontmatter.
Hand a single URL to your AI agent — Cursor, Claude Desktop, MCP-style loaders, or any tool that reads remote Markdown.
frontmatter name
hack
raw url
https://raw.githubusercontent.com/yaklang/hack-skills/main/skills/hack/SKILL.md
github source
github.com/…
Most agent loaders will respect the name: field in frontmatter as a stable identifier, even when the source URL moves.
Air-gapped friendly. AES-256 encrypted ZIP — keeps the playbooks intact when downloading via networks where antivirus / EDR / browser scanners flag offensive markdown.
password
hack-skills
Public constant — printed openly in workflow, README, CDN logs, and this page. Not access control.
Why is the ZIP password protected?
- HackSkills bundles offensive-security playbooks (XSS, SSTI, AD attacks, etc.). Plain markdown frequently triggers AV / EDR / browser content scanners on public CDNs and gets silently dropped or quarantined.
- Wrapping the archive with AES-256 + a public password (
hack-skills) bypasses content heuristics so the file actually arrives intact. - Anyone can download. Anyone can extract. The password is printed everywhere on purpose.
curl -fsSLO https://oss-qn.yaklang.com/hack-skills/latest/hack-skills.zip && 7z x -phack-skills hack-skills.zip
Works with 7z, unzip -P hack-skills, native macOS Archive Utility, and most cross-platform tools. SHA-256 manifest is published per version under the same OSS prefix.
Browse
Filter by category, tier, or free-text. / to focus search anywhere.
loading skills.json…