security▌

### offensive-initial-access - - **Skill Name**: initial-access - Practical, repeatable guidance for authorized security work. - Includes procedures, checks, and references for this skill.

### offensive-api-abuse - Advanced API exploitation methodology focused on business logic abuse and sophisticated attack patterns that bypass traditional security con - Practical, repeatable guidance for authorized security work. - Includes procedures, checks, and references for this skill.

### offensive-exploit-development - - **Skill Name**: exploit-development - Practical, repeatable guidance for authorized security work. - Includes procedures, checks, and references for this skill.

### offensive-shellcode - Shellcode development reference for offensive security engagements. Use when writing custom x86/x64 shellcode, implementing position-indepen - Practical, repeatable guidance for authorized security work. - Includes procedures, checks, and references for this skill.

### offensive-linux-privesc - Comprehensive Linux privilege escalation methodology for offensive security engagements. Covers the full attack surface from a low-privilege - Practical, repeatable guidance for authorized security work. - Includes procedures, checks, and references for this skill.

### offensive-api-security - Comprehensive API security testing methodology covering REST, gRPC, and WebSocket attack surfaces. Addresses the full OWASP API Security Top - Practical, repeatable guidance for authorized security work. - Includes procedures, checks, and references for this skill.

### offensive-oauth - - **Skill Name**: oauth-attacks - Practical, repeatable guidance for authorized security work. - Includes procedures, checks, and references for this skill.

### skill-scanner - Review agent skill folders, archives, repository references, or updates before installation for instruction abuse, executable behavior, perm - Practical, repeatable guidance for authorized security work. - Includes procedures, checks, and references for this skill.

### webhook-callback-security - Review inbound webhooks and callbacks that trigger agent actions — signature verification, replay protection, payload trust, and the authori - Practical, repeatable guidance for authorized security work. - Includes procedures, checks, and references for this skill.

### offensive-iot - IoT and embedded device security testing methodology. Covers hardware reconnaissance (UART, JTAG, SWD, SPI flash, I2C EEPROM, eMMC chip-off) - Practical, repeatable guidance for authorized security work. - Includes procedures, checks, and references for this skill.