yaklang/hack-skills

Helping AI Agent become an awesome practical hacker!

What it solves

HackSkills provides a structured, distilled knowledge base of cybersecurity attack patterns and methodologies specifically designed for AI agents. It transforms vast, fragmented security resources (like PayloadsAllTheThings and HackTricks) into a composable and searchable format that agents can load on demand to perform bug bounty hunting, penetration testing, and authorized security research.

How it works

The project organizes security knowledge into a three-layer hierarchy to optimize how an AI agent consumes information:

  1. Master Entry: A global router that provides operating doctrine and high-level test sequencing.
  2. Category Entries: Routers that group stable topic families (e.g., API security, Injection attacks).
  3. Deep Topic Skills: Detailed attack playbooks and execution details for specific vulnerabilities (e.g., XSS, SQLi, SSRF).

Knowledge is distilled from public security research, CVE advisories, and established pentesting encyclopedias into SKILL.md and SCENARIOS.md files, avoiding large raw dictionaries in favor of stable samples and taxonomies.

Who it’s for

It is built for developers of AI agents and security researchers who want to provide their agents with a professional-grade "hacker arsenal" of skills that are easy to audit, maintain, and install via a simple command.

Highlights

  • Comprehensive Coverage: 101 deep topic skills across 14 security domains, including web, API, OS privilege escalation, and blockchain security.
  • Agent-Optimized Structure: Designed for on-demand loading to prevent context window overflow while maintaining deep technical detail.
  • Multi-Channel Access: Available via a static Web UI for quick lookup, GitHub source for contributions, and an encrypted ZIP for air-gapped environments.
  • Distilled Intelligence: Converts raw payload lists into scenario-based indices and method matrices for improved agent stability.

Related

  • Project
    Rion-Wu-tech/wechat-intelligence-hub

    A tool that converts local WeChat chat histories into a searchable personal intelligence hub for tracking business opportunities, commitments, and daily summaries.

  • Project
    Open-Curiosity/gini-agent

    A personal AI agent that uses interactive inline controls and live browser handoffs to solve the problem of human-in-the-loop requirements for complex tasks.

  • Project
    mhss1/MyBrain

    An all-in-one productivity app and AI assistant that combines tasks, notes, calendar, and bookmarks into a private, local-first environment.

  • Project
    MinishLab/model2vec

    Model2Vec is an open‑source Python library that distills any sentence‑transformer into a tiny, static‑embedding model (8‑30 MB) that runs up to 500× faster on CPU. It offers zero‑data distillation, optional fine‑tuning for classification, and integrates with Hugging Face, Sentence‑Transformers, and LangChain. Install with `pip install model2vec`, load pre‑built models via `StaticModel.from_pretrained`, or distill your own in ~30 seconds on a CPU.