Hack Skills

What it is

hack-skills (yaklang/hack-skills) is an Agent Skills knowledge base of offensive security methodology. The layout is one master entry (hack), six category entries and 102 deep-topic skills. Each skill sits at skills/{semantic-identifier}/SKILL.md. The README says the content is distilled from public sources, not mirrored: it avoids large dictionaries and full payload lists and uses small samples, taxonomies and cross-references.

How it works

Loading is tiered. The README recommends starting at the master entry, moving to a category entry, and only then opening a deep topic skill. The aim is to keep the loader's visible surface small.

The repo is published in three synced forms, updated on every push to main:

• The GitHub repo.
• A static, client-side website at skills.hackbenchmark.com. It has no tracking or backend, and its search supports qualifiers such as category:auth, tier:deep and lines:>200.
• An offline ZIP.

What to do

Install the master entry:

npx skills add yaklang/hack-skills

Fetch a single skill file directly:

curl -fsSL https://raw.githubusercontent.com/yaklang/hack-skills/main/skills/hack/SKILL.md

Use it as a local knowledge base:

git clone https://github.com/yaklang/hack-skills.git

For air-gapped hosts, or where AV, EDR or browser scanners strip offensive markdown, use the ZIP:

curl -fsSLO https://oss-qn.yaklang.com/hack-skills/latest/hack-skills.zip
7z x -phack-skills hack-skills.zip
# or:  unzip -P hack-skills hack-skills.zip

Caveats

• The ZIP is AES-256 encrypted with the public password hack-skills. The README says this is not access control. It exists only to get past content heuristics. Build and integrity-check details are in .github/workflows/upload-hack-skills.yml. A security team may want to know the archive is deliberately packaged to avoid scanner detection.
• Destructive operations (DROP, TRUNCATE, mass DELETE, FLUSHALL, shutdown, DoS) are replaced with time-based or read-only proofs. Webshell writes (INTO OUTFILE / DUMPFILE), reverse shells and command execution are kept on purpose, so an agent loading these skills can be directed to gain access.
• Defensive snippets such as rename-command FLUSHALL "" are retained as hardening.
• For custom tooling such as proxy hot-patching, traffic decryption or fuzzing logic, the README points to a sister project, Yak Skills.
• The page gives no per-skill quality evidence, test results or update dates. Content is described as generic methodology with no customer-specific data.