Browse the skills directory — 51 skills across 8 attack domains. Each page shows the slash command, environment support, and description.
Navigate to the skill folder in the cbug skills repo. Click the green Code button → Download ZIP. Each skill lives in its own folder — download one skill or an entire domain.
Go to claude.ai/customize/skills, click Add skill, and upload the ZIP. The skill becomes available as a slash command workspace-wide — immediately, no restart needed.
Type / in any Claude conversation to see your skills, select one, and attach your target URL or file. Findings are streamed back in the conversation.
# Example — SQLi hunt
› /hunt-sqli https://target.com/search?q=test
Running SQLi patterns... time-based check...
✓ Blind SQLi found — /api/search?q= (8.3s delay)
CVSS: 9.1 · Ready for /triage
Start with Web Hunting — it covers the majority of H1 bug class patterns and is the most commonly used domain.
No. Claude Free works for Chat-mode skills. Pro and higher give more context, faster responses, and better throughput. Claude Code (terminal) requires Claude Pro or higher.
Yes. Each SKILL.md is a complete system prompt. You can pass it directly to the Anthropic API or OpenRouter. See the GitHub repo for API usage examples.
Both. Each skill folder can be downloaded and uploaded independently. Download the full domain ZIP to get all skills in one upload.
Absolutely. The skills are MIT licensed. Fork the repo, edit the SKILL.md files to match your target types, scope, or program rules, and upload your modified version.
When you upload via claude.ai/customize/skills, the skill is available to your workspace by default. Check Claude admin settings to control skill visibility.
A mandatory pre-submission checklist built into the triage-validation skill. Every finding must pass all 7 questions before a report gets written. One wrong answer kills the finding — this keeps your N/A ratio clean.