Agent skills
Skills you can use with AI coding agents, indexed from public GitHub repositories.
-
file-upload-bypass
Guide file upload restriction bypass during authorized penetration testing.
blacklanternsecurity/red-run 126
-
2fa-bypass
Bypass two-factor authentication (2FA/MFA) during authorized penetration testing.
blacklanternsecurity/red-run 126
-
deserialization-dotnet
Exploit .NET deserialization vulnerabilities during authorized penetration testing.
blacklanternsecurity/red-run 126
-
xss-dom
Guide DOM-based XSS exploitation during authorized penetration testing.
blacklanternsecurity/red-run 126
-
red-run-ctf
Multi-phase penetration test orchestrator. Handles recon, assessment surface mapping, vulnerability chaining, and routes to technique skills for execution. Invoke via /red-run-ctf slash command only.
blacklanternsecurity/red-run 126
-
red-run-legacy
Legacy subagent-based orchestrator. Superseded by /red-run-ctf (agent teams). Use /red-run-legacy to invoke manually. Does not auto-trigger.
blacklanternsecurity/red-run 126
-
unknown-vector-analysis
Analyze custom applications, scripts, and binaries that standard technique skills could not exploit. Performs source code review, attack surface mapping, CVE research, and PoC adaptation. Route here when ANY technique agent returns saying standard patterns do not match, the target uses a custom/unknown application, or no existing technique skill covers the vector. Trigger phrases: "standard patterns don't match", "custom script", "unknown binary", "no matching technique", "unrecognized application". Do NOT use for known vulnerability classes that have dedicated technique skills — route to those instead.
blacklanternsecurity/red-run 126
-
<skill-name>
<What this skill does in 2-3 sentences. Focus on technique scope and when to use it. No trigger phrases, negative conditions, or OPSEC details here.>
blacklanternsecurity/red-run 126
-
retrospective
Post-engagement lessons-learned retrospective. Reads the engagement directory, analyzes skill routing decisions, identifies knowledge gaps and missing skills, and produces an actionable improvement report.
blacklanternsecurity/red-run 126
-
windows-token-impersonation
Exploit Windows token privileges for local privilege escalation to SYSTEM.
blacklanternsecurity/red-run 126
-
linux-discovery
Linux local privilege escalation enumeration and attack surface mapping.
blacklanternsecurity/red-run 126
-
linux-kernel-exploits
Exploit Linux kernel vulnerabilities and escape restricted shells for privilege escalation.
blacklanternsecurity/red-run 126
-
linux-cron-service-abuse
Exploit cron jobs, systemd timers/services, D-Bus services, and Unix sockets for privilege escalation.
blacklanternsecurity/red-run 126
-
windows-discovery
Windows local privilege escalation enumeration and attack surface mapping.
blacklanternsecurity/red-run 126
-
windows-credential-harvesting
Harvest stored credentials from a Windows system for privilege escalation or lateral movement.
blacklanternsecurity/red-run 126
-
windows-uac-bypass
Bypass Windows User Account Control to escalate from medium to high integrity.
blacklanternsecurity/red-run 126
-
windows-kernel-exploits
Exploit Windows kernel vulnerabilities, vulnerable drivers, and privileged file operations for local privilege escalation to SYSTEM.
blacklanternsecurity/red-run 126
-
linux-sudo-suid-capabilities
Exploit sudo misconfigurations, SUID/SGID binaries, and Linux capabilities for privilege escalation.
blacklanternsecurity/red-run 126
-
linux-file-path-abuse
Exploit writable critical files, NFS misconfigurations, shared library hijacking, and privileged group membership (docker, lxd, disk, adm, video, staff) for Linux privilege escalation. Use when a user belongs to a privileged group or has write access to sensitive files or paths.
blacklanternsecurity/red-run 126
-
windows-service-dll-abuse
Exploit Windows service misconfigurations and DLL hijacking for local privilege escalation.
blacklanternsecurity/red-run 126
-
gpo-abuse
Exploits Group Policy Objects for code execution, privilege escalation, and lateral movement in Active Directory. Covers GPO enumeration (GPOHound, BloodHound, PowerView), exploitation via immediate tasks, logon scripts, and registry modifications (SharpGPOAbuse, PowerGPOAbuse, pyGPOAbuse, GroupPolicyBackdoor), SYSVOL/NETLOGON logon script poisoning, and GPP password extraction.
blacklanternsecurity/red-run 126
-
ad-discovery
Enumerates Active Directory domains and maps attack surface for penetration testing.
blacklanternsecurity/red-run 126
-
kerberos-roasting
Extracts and cracks Kerberos service tickets (Kerberoasting) and AS-REP hashes (AS-REP Roasting) for offline password recovery.
blacklanternsecurity/red-run 126
-
adcs-access-and-relay
Exploits ADCS through ACL abuse on templates/CA objects and NTLM relay to enrollment endpoints. Covers ESC4 (template ACL → modify to ESC1), ESC5 (PKI object ACLs), ESC7 (ManageCA/ManageCertificates abuse), ESC8 (NTLM relay to HTTP enrollment), ESC11 (NTLM relay to ICPR RPC).
blacklanternsecurity/red-run 126