yaklang/hack-skills

What it solves

HackSkills provides a structured, distilled knowledge base of cybersecurity skills designed specifically for AI agents to use during authorized security research, penetration testing, and bug bounty hunting. It transforms vast, fragmented security resources into a composable and searchable format that agents can load on demand to execute complex attack playbooks.

How it works

The project organizes security knowledge into a three-layer hierarchy to optimize how an agent consumes information:

1. Master Entry: A global router and operating doctrine that guides the agent's overall strategy and phase assessment.
2. Category Entries: Routers that group stable topic families (e.g., API security, authentication, injection attacks).
3. Deep Topic Skills: Detailed attack playbooks containing execution details, payload matrices, and bypass techniques.

Knowledge is distilled from high-quality public sources (like HackTricks and PayloadsAllTheThings) into routable and auditable skills, avoiding direct copying of massive dictionaries in favor of stable samples and taxonomies.

Who it’s for

It is built for AI agents and security researchers performing authorized penetration testing, CTF competitions, and bug bounty programs.

Highlights

• Agent-Optimized Structure: Uses a SKILL.md format designed for easy installation and retrieval by loaders.
• Comprehensive Coverage: Includes 102 deep topic skills across 14 security domains, including web, API, OS privilege escalation, and LLM security.
• Distilled Intelligence: Converts raw payload lists into scenario-based indices and method matrices for better agent stability.
• Multi-Channel Access: Available via a static Web UI for quick lookup, GitHub source for contributions, and encrypted ZIPs for air-gapped environments.