> ## Documentation Index
> Fetch the complete documentation index at: https://community.rifteo.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Skills Overview

> 34 battle-tested security skills for AI agents covering every phase of a security engagement.

## Stop improvising. Start executing.

Rifteo skills are the methodology layer your AI agent is missing. Each skill encodes the exact steps, bypass techniques, and output formats that expert practitioners use so your agent delivers complete, structured results from the first prompt.

<CardGroup cols={3}>
  <Card title="34 skills" icon="shield-halved">
    Web, API, infrastructure, compliance, attack mindset, and reporting every phase covered
  </Card>

  <Card title="★ Top 5 benchmarked" icon="star">
    Community-selected best performers proven by real benchmark data
  </Card>

  <Card title="One command install" icon="terminal">
    `rifteo-skills add <skill>` no config, no account
  </Card>
</CardGroup>

> ★ marks the top 5 skills by benchmark performance. See the [full benchmark results →](/skills/benchmarks)

***

## Top skills right now

Ranked by benchmark performance — real numbers, same model, skill on vs. skill off:

| Skill                                        | Headline Result                                      | Category        |
| -------------------------------------------- | ---------------------------------------------------- | --------------- |
| [IDOR Hunter ★](/skills/idor-hunter)         | **+120% more findings** on the same target           | API Security    |
| [XSS Hunter ★](/skills/xss-hunter)           | **-75% time** to complete a hunt, +29% more coverage | Web Application |
| [SSRF Hunter ★](/skills/ssrf-hunter)         | False positives → **confirmed exploits**             | Infrastructure  |
| [HexStrike Forge ★](/skills/hexstrike-forge) | **0 → 2 confirmed findings** per session             | Integrations    |

[See full benchmark report →](/skills/benchmarks)

***

## What is a skill?

A **skill** is a self-contained instruction file that teaches an AI agent a specific security or compliance methodology. Each skill:

* Defines precise **trigger conditions**: when the agent should activate it
* Provides a **step-by-step methodology** the agent follows
* Specifies the **exact output format** to produce
* Includes **rules and guardrails** to prevent incorrect behavior

Skills are not code modules they are structured prompts that encode expert knowledge. The agent reads the `SKILL.md`, understands when to apply it, and executes the methodology against whatever the user provides.

***

## Installing a skill

```bash theme={"system"}
# Install the CLI (one-time)
npm install -g @rifteo/skills

# Install a skill
rifteo-skills add <skill-name>

# Install globally (available in all projects)
rifteo-skills add <skill-name> --global

# List installed skills
rifteo-skills list

# List all available skills
rifteo-skills available
```

***

## Available skills

**Web Application**

| Skill                                              | What it does                                                                        |
| -------------------------------------------------- | ----------------------------------------------------------------------------------- |
| [XSS Hunter ★](/skills/xss-hunter)                 | Full XSS methodology: reflected, stored, DOM, filter bypass, CSP evasion, mXSS      |
| [IDOR Hunter ★](/skills/idor-hunter)               | Systematic IDOR and BOLA detection with multi-account testing and bypass techniques |
| [XXE Phantom](/skills/xxe-phantom)                 | XXE injection: file read, blind OOB, SSRF chaining, SVG and XLSX vectors            |
| [SSTI Hunter](/skills/ssti-hunter)                 | Server-side template injection with engine fingerprinting and RCE exploitation      |
| [JS Analyzer](/skills/js-analyzer)                 | JavaScript analysis for secrets, endpoints, sinks, and prototype pollution          |
| [HPP Hunter](/skills/hpp-hunter)                   | HTTP parameter pollution detection and exploitation                                 |
| [Clickjacking Hunter](/skills/clickjacking-hunter) | Clickjacking detection and PoC generation                                           |
| [Redirect Forge](/skills/redirect-forge)           | Open redirect discovery and OAuth code theft chaining                               |

**API Security**

| Skill                                | What it does                                                                  |
| ------------------------------------ | ----------------------------------------------------------------------------- |
| [IDOR Hunter ★](/skills/idor-hunter) | See Web Application — also covers API BOLA and object-level auth bypass       |
| [JWT Cracker](/skills/jwt-cracker)   | JWT attacks: alg:none, weak secret brute-force, RS256 to HS256, kid injection |

**Infrastructure**

| Skill                                                    | What it does                                                                  |
| -------------------------------------------------------- | ----------------------------------------------------------------------------- |
| [SSRF Hunter ★](/skills/ssrf-hunter)                     | SSRF detection and exploitation turns false positives into confirmed exploits |
| [Nuclei Template Writer](/skills/nuclei-template-writer) | Writes production-ready Nuclei templates from vulnerability descriptions      |
| [Check Exploit](/skills/check-exploit)                   | Checks if a CVE has a public exploit and assesses exploitability              |

**Reconnaissance**

| Skill                                    | What it does                                                       |
| ---------------------------------------- | ------------------------------------------------------------------ |
| [Scope Grill ](/skills/scope-grill)      | Validates and clarifies engagement scope before any testing begins |
| [Attack Surface](/skills/attack-surface) | Maps the full attack surface of a target before testing begins     |
| [Vuln Diagnose](/skills/vuln-diagnose)   | Diagnoses ambiguous or incomplete vulnerability reports            |

**Reporting**

| Skill                                              | What it does                                                                       |
| -------------------------------------------------- | ---------------------------------------------------------------------------------- |
| [Finding Writer](/skills/finding-writer)           | Converts raw notes into a structured, report-ready finding                         |
| [Pentest Report](/skills/pentest-report)           | Assembles a full pentest report from individual findings                           |
| [Bugbounty Reporter](/skills/bugbounty-reporter)   | Converts raw findings into triage-ready HackerOne/Bugcrowd reports                 |
| [CVSS Scorer ★](/skills/cvss-scorer)               | Computes exact CVSS v3.1 base score and vector from a vulnerability description    |
| [Risk Assessor](/skills/risk-assessor)             | Business risk assessment and executive-ready justification from technical findings |
| [Remediation Planner](/skills/remediation-planner) | Generates specific, prioritized remediation plans with code-level fixes            |

**Compliance**

| Skill                                                      | What it does                                                            |
| ---------------------------------------------------------- | ----------------------------------------------------------------------- |
| [Compliance Gap Analyzer](/skills/compliance-gap-analyzer) | Identifies compliance gaps against ISO 27001, SOC2, NIST, and PCI-DSS   |
| [Control Lookup](/skills/control-lookup)                   | Maps controls across frameworks with cross-references and testing hints |

**Workflow**

| Skill                                            | What it does                                                 |
| ------------------------------------------------ | ------------------------------------------------------------ |
| [Find Skills](/skills/find-skills)               | Discovers and installs the right skill for any security task |
| [Engagement Handoff](/skills/engagement-handoff) | Structures engagement handoff notes between team members     |
| [CTF Writeup](/skills/ctf-writeup)               | Formats CTF challenge writeups for publication               |
| [Caveman](/skills/caveman)                       | Ultra-compressed comms mode for fast-paced testing sessions  |
| [Skill Benchmark](/skills/skill-benchmark)       | Benchmarks skill performance with and without the agent      |

**Attack Mindset**

| Skill                                                    | What it does                                                                                                 |
| -------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------ |
| [Red Mind](/skills/redmind)                              | Offensive security mindset that shifts the agent to attacker thinking across any target type                 |
| [Economist Attack](/skills/economist-attack)             | Prioritizes high-impact attack paths using an effort-impact ratio — never waste budget on low-yield surfaces |
| [Dead Angle](/skills/deadangle)                          | Re-examines every conclusion from multiple vantage points before delivery — findings hold up under scrutiny  |
| [Less Noise Attack](/skills/less-noise-attack)           | Operates below SOC detection thresholds — passive recon first, minimal footprint, targeted action only       |
| [Less Aggressive Attack](/skills/less-aggressive-attack) | Offensive engagement without damage — proves vulnerabilities exist through observation, not destruction      |

**Integrations**

Skills that orchestrate external MCP tool servers into structured engagements.

| Skill                                        | MCP Server | What it does                                                                                                                |
| -------------------------------------------- | ---------- | --------------------------------------------------------------------------------------------------------------------------- |
| [HexStrike Forge ★](/skills/hexstrike-forge) | HexStrike  | Full pentest engagement: 5-phase workflow, parallel execution, triage gates, and report-ready findings from a single prompt |

***

## Skill anatomy

Every skill lives in its own directory:

```
skills/
└── my-skill/
  ├── SKILL.md     # Required agent instructions
  ├── references/    # Optional context files the skill reads at runtime
  │  └── guide.md
  └── scripts/     # Optional Python or bash scripts the skill runs
    └── my-tool.py
```

### `SKILL.md`

The core of every skill. It has two parts: a **frontmatter block** and a **body**.

**Frontmatter** declares the skill's identity and discovery metadata:

```yaml theme={"system"}
---
name: my-skill
description: One-sentence description shown in skill discovery and search results.
license: MIT
metadata:
 version: "1.0.0"
 author: YourName
 tags: ["security", "compliance", "pentest"]
---
```

**Body** defines the agent behavior in structured Markdown sections:

```markdown theme={"system"}
# Skill Title

## When to Use
Activate this skill when the user:
- asks to test X
- provides Y and wants it structured as Z

## Step 1: Title
What the agent does in this step.

## Output Format
Produce exactly this structure. Do not omit any section.

## Rules
- Rule 1: hard constraint
- Rule 2: behavior guardrail
```

***

## Skill lifecycle

<Steps>
  <Step title="Define">
    Identify the methodology to encode: what triggers it, what steps it follows, and what output it produces
  </Step>

  <Step title="Write SKILL.md">
    Author the `SKILL.md` following the [Style Guide](/docs/style-guide): frontmatter, trigger conditions, step-by-step instructions, output format, and rules
  </Step>

  <Step title="Add references and scripts">
    Bundle any reference documents or helper scripts the skill needs into `references/` and `scripts/`
  </Step>

  <Step title="Benchmark">
    Run `skill-benchmark` to score quality and check compatibility across agents if it doesn't outperform no-skill, it doesn't ship
  </Step>

  <Step title="Document">
    Write the `.mdx` documentation page following the [Style Guide](/docs/style-guide)
  </Step>

  <Step title="Publish">
    Open a pull request the skill appears in the community hub after review and merge
  </Step>
</Steps>

***

## Naming conventions

| Rule                                        | Good                                        | Avoid                                                 |
| ------------------------------------------- | ------------------------------------------- | ----------------------------------------------------- |
| Use kebab-case                              | `idor-hunter`, `risk-assessor`              | `IDORHunter`, `risk_assessor`                         |
| Name by what the skill does, not how        | `finding-writer`, `compliance-gap-analyzer` | `run-audit`, `do-check`                               |
| Keep names under 40 characters              | `control-lookup`                            | `multi-framework-compliance-control-reference-lookup` |
| Use descriptive tags from the approved list | `pentest`, `compliance`, `risk`, `audit`    | `misc`, `tool`, `helper`                              |

## Ready to contribute?

Follow the [Style Guide](/docs/style-guide) and the [contribution process](/docs/contributing) to add your methodology to the community library.