Agent skills by Encod3d-Sec

Runs a bug-bounty engagement through a script that tracks the current pass, builds a board of rows from recon and prints the next required action each turn.

Encod3d-Sec/TORCH

Adaptive web fuzzing for pentests, bug bounty and CTF work: picks the smallest suitable SecLists wordlist per target surface and calibrates filters against soft-404 responses.

Encod3d-Sec/TORCH

IDOR / BOLA hunting - two-account methodology, identifier discovery and UUID leak chaining, the trusted-identifier test, GraphQL node and nested-object IDOR, cross-tenant escalation, write and…

Encod3d-Sec/TORCH

Checks that the bb, pt and ctf workflow driver is set up correctly on a machine: vault content, skill symlinks, hooks, imports and a live smoke test, with fixes for failures.

Encod3d-Sec/TORCH

Opens a visible Chromium window on a Kali VM so an operator can complete a manual login or CAPTCHA while the agent watches and acts through the chrome-devtools MCP.

Encod3d-Sec/TORCH

Runs a capture-the-flag box from first scan to root with a driver script that tracks progress and prints the next action each turn.

Encod3d-Sec/TORCH

Decides when a main pentesting agent should hand a fully-specified, mechanical exploit-compile or privilege-escalation step to a cheaper sub-agent, and how to specify that handoff safely.

Encod3d-Sec/TORCH

Shared discipline for every hunt- skill: scope and authorization gating, the two-account rule, the confirmation gate that separates a real finding from a false positive, enumeration limits, stop…

Encod3d-Sec/TORCH

Vulnerability-research loop toward a novel CVE. An agent skill from Encod3d-Sec/TORCH.

Encod3d-Sec/TORCH

Capture a Burp Suite Repeater request/response as a PoC image (targets/<eng/poc/) by driving the Burp MCP + the Kali GUI.

Encod3d-Sec/TORCH

External recon and OSINT pipeline - subdomain enum, live host discovery, URL crawl, JS analysis, nuclei scan.

Encod3d-Sec/TORCH

Drive responsible disclosure of a proven finding to a CVE. An agent skill from Encod3d-Sec/TORCH.

Encod3d-Sec/TORCH

Evidence hygiene before any FIND moves to Completed or enters a report.

Encod3d-Sec/TORCH

API attack hunting (REST / GraphQL / gRPC) - BOLA/IDOR, BFLA, mass assignment, excessive data exposure, auth/JWT, introspection + batching, rate-limit abuse.

Encod3d-Sec/TORCH

Auth bypass and ATO hunting - legacy protocol matrix (XMLRPC, SharePoint /vtibin/, EWS, Citrix, etc.), JWT manipulation, password reset poisoning, SAML auth bypass, session fixation.

Encod3d-Sec/TORCH

Business-logic flaw hunting - workflow/state bypass, price/quantity tampering, negative/overflow values, coupon/refund abuse, mass assignment, and logic races.

Encod3d-Sec/TORCH

Drive Burp Suite over its MCP server as an AI triage + attack layer - review proxy history for signals, replay via Repeater/send, OOB-gate blind bugs with Collaborator, fuzz via Intruder (RoE-safe)…

Encod3d-Sec/TORCH

Web cache poisoning + cache deception hunting - unkeyed input poisoning, cache-key analysis, path-confusion deception, header/parameter cloaking.

Encod3d-Sec/TORCH

Insecure deserialization hunting across Java / .NET / PHP / Python / Ruby / Node.

Encod3d-Sec/TORCH

OAuth and SAML attack hunting - redirecturi bypass, state CSRF, SAML XSW (XSW1-XSW8), signature stripping, comment injection.

Encod3d-Sec/TORCH

GraphQL IDOR/auth-bypass, XXE file-read/SSRF (SVG/DOCX/SAML), SSTI detection and RCE.

Encod3d-Sec/TORCH

LLM / AI application attack hunting - prompt injection (direct + indirect), excessive agency, insecure output handling, system-prompt + data leakage.

Encod3d-Sec/TORCH

Microsoft 365 / Entra ID attack - tenant discovery, user enumeration via OneDrive differential (2026 verified), AADSTS code reference, Smart Lockout math (hard cap 1-2 attempts/user), ROPC…

Encod3d-Sec/TORCH

macOS attack hunting - foothold to root/persistence on a macOS host.

Encod3d-Sec/TORCH

MCP server attack hunting - tool poisoning, indirect prompt injection via tool output, rug-pull updates, cross-tool shadowing, over-permissioned/excessive-agency tools, lethal trifecta.

Encod3d-Sec/TORCH

HTTP request smuggling / desync hunting - CL.TE, TE.CL, TE.TE, CL.0, and HTTP/2 downgrade.

Encod3d-Sec/TORCH

SQLi and NoSQLi hunting - error-based, boolean-blind, time-based, UNION, NoSQL operator injection.

Encod3d-Sec/TORCH

SSRF hunting - OOB-mandatory methodology. An agent skill from Encod3d-Sec/TORCH.

Encod3d-Sec/TORCH

File upload attack hunting - extension/content-type/magic-byte bypass to web-shell RCE, path traversal in filename, SVG/XML XSS, zip slip, and pixel-flood DoS.

Encod3d-Sec/TORCH

XSS hunting - reflected, stored, DOM-based. An agent skill from Encod3d-Sec/TORCH.

Encod3d-Sec/TORCH

Drive msfconsole across the workflow - DB-backed recon (dbnmap, auxiliary scanners), version-exploit search/check/run, multi/handler reverse shells (meterpreter-first, plain shellreversetcp backup…

Encod3d-Sec/TORCH

Finding validation gate - 7-Question triage adapted for FIND schema.

Encod3d-Sec/TORCH

Search, query, and maintain the qmd-indexed wiki - semantic search, keyword search, re-index after adding pages, check index status.

Encod3d-Sec/TORCH

Ingest a CVE writeup, blog post, advisory, or GitHub repo into the wiki - fetch, dedup via sources:, update the right technique/tool page(s), re-index.

Encod3d-Sec/TORCH

Ranked next offensive moves from engagement state. An agent skill from Encod3d-Sec/TORCH.

Encod3d-Sec/TORCH