watermarks-remover

| | | || | | |/ |/| || |/ |/ |/ | |/| | | | | | |/ ||| | | | | | \ | | | | | \ | \ | \ | | | || / | | \ watermarks-remover Agent 技能 + 标准库 Python 服务，用于从文本和文件中剥离多厂商 AI 溯源标记 ——面向你拥有 的内容的隐私与卫生需求。该技能是一个轻量客户端：它通过 HTTP 驱动底层机制，因此 agent 主机无需 Python。 层级| 目标| 方式 ---|---|--- A| 不可见 Unicode、异体空格、双向文本、标签字符|...

x86-cpp-reversing-skill

x86-cpp-reversing 一个用于逆向工程 32 位小端 x86（IA-32）二进制文件以及由 C++ 编译生成的汇编代码的 Claude Code 技能。它可以从 ELF 或 PE 二进制文件中恢复类布局、虚函数表、虚函数分发以及 RTTI/继承层次结构，并涵盖在获得这些结构后会遇到的工作流程：恢复自定义文件格式、将数据文件的索引条目映射回使用它们的代码/实体，以及在此过程中识别混淆或反调试技巧。 为智能体使用而构建：SKILL.md 是智能体读取的入口点，其编写方式使得机械性、定义明确的工作（ABI 结构体布局、重定位解析、符号还原）通过 scripts/recon.py...

skill-scanner

Skill Scanner A best-effort security scanner for AI Agent Skills that detects prompt injection, data exfiltration, and malicious code patterns. It combines pattern-based detection YAML + YARA-X, AST and dataflow analysis , an optional LLM-as-a-judge , and a bounded CEL decision layer over typed...

bug-reaper

BugReaper 结构化 web2 漏洞赏金 AI 技能 — 18 类漏洞、4 个漏洞赏金平台、零 AI 垃圾内容。兼容 OpenClaw、Cursor、Claude Code、Antigravity 和 Windsurf。 BugReaper 是一款 Agent Skill，可将任何兼容的 AI 代理转变为训练有素的 web2 漏洞赏金猎人。它强制执行基于证据的验证，模拟 HackerOne、Bugcrowd、Intigriti 和 YesWeHack 的真实分类流程，并将低严重性漏洞串联为严重发现。每条发现都必须具备可运行的 PoC 才会被报告。 代理兼容性 代理| 支持情况|...

exploitBenchSkill

OpenSec ExploitBench V8 PoC Skill An installable Pi and Agent...

SecureAI-Scan v0.8.0

SecureAI-Scan The AI security scanner that proves its findings. SecureAI-Scan finds LLM, MCP, Agent Skill, and RAG vulnerabilities in TypeScript, JavaScript, and Python — and shows you the evidence: the exact source → flow → sink path for every dataflow finding, resolved through real imports, not...

SecureAI-Scan v0.5.0

SecureAI-Scan The AI security scanner that proves its findings. SecureAI-Scan finds LLM, MCP, Agent Skill, and RAG vulnerabilities in TypeScript, JavaScript, and Python — and shows you the evidence: the exact source → flow → sink path for every dataflow finding, resolved through real imports, not...

Fake AI Agent Skill Passed Security Scans and Reportedly Reached 26,000 Agents

Security firm AIR built a fake AI agent skill, pushed it through a popular skill marketplace and an Instagram ad, and says it reached roughly 26,000 agents, including some on corporate accounts. Every skill security scanner the firm tested it against marked it safe. The payload was harmless by...

CVE-2026-48116 AnythingLLM: RCE via ripgrep --pre argument injection in filesystem-search-files agent skill

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to 1.13.0, the filesystem-search-files agent skill passes its LLM-controlled pattern parameter to ripgrep as a positional argument without a -- end-of-options separato...