Havuz

Claude Code ve uyumlu agent harness'leri için web güvenliği ve red-team çalışmalarına yönelik beceriler, komutlar ve iş akışları sunan bir skill bundle'dır.

Neden yükseliyor · 145 günlük yaşına göre 4.671 yıldız ve son 28 günde 37 commit dikkat çekiyor; bu, güncel geliştirme ve görünürlük sinyali. Ancak 3 farklı yazarla katkı tabanı dar ve README'deki 'battle-tested' iddiası bağımsız kullanım verisiyle doğrulanmıyor.

Website specification — HTML, accessibility, security, SEO, agent-readiness. Platform-agnostic, sourced, MIT.

发现藏在前端代码里的 API，验证未授权访问风险 · 动态浏览器追踪 × JavaScript 静态分析

面向小白用户的 CTF / 逆向 Skills 整合包：自动分流、头脑风暴、教学模式、比赛模式、只提示模式

Local-first AI red team for web, API, and LLM application security. Attacker-style reasoning, evidence-backed findings, and skills for AI co

Your app is guilty until proven secure: an agent skill whose /hack-me breaks into your own running app, proves each bug with a real request,

Secure PHP Development — lab-driven study notes: modern PHP 8.2/8.3 through a full OWASP-mapped catalogue of PHP vulnerabilities with exploi

An AI red-team agent for authorized labs and web app pentesting workflows. Turns Claude Code / OpenCode / Codex into a structured recon → te

基于多智能体架构与自主决策机制，配合大语言模型的理解能力，输入自然语言指令，AI 自动完成从目标侦察到漏洞验证的完整渗透测试流程。

Evidence-driven production readiness checklist for shipping web applications with confidence

See why a web vulnerability works, not just how to trigger it — a single-file, zero-dependency security lab that renders a vulnerable app as

Behavioral-discipline skill turning an AI agent into a methodical, non-robotic bug-bounty & pentest hunter - 42 always-on rules: scope, cove

Advanced web security scanner with 49 modules, evasion engine, and CVE database.

Open-source benchmark of 5 intentionally vulnerable web apps with 100 baseline vulnerabilities for evaluating AI penetration testing agents.

AI-Powered Offensive Security Research Engine - desktop-native security testing platform with native MCP integration. 90 tools, MITM proxy,

An advanced Out-of-Band and In-Band SSRF fuzzing scanner with dynamic request tracking.

Unblock copy, cut, paste, right-click & text selection on any website. React/Vue/Shadow-DOM aware. 100% local, zero tracking. MV3.Unblock co

Find and fix web-app vulnerabilities in one command — SAST + DAST + AI, for devs who aren't security experts.

AI Agent + 抓包融合安全测试工具 | 自然语言驱动自主渗透测试 | ReAct 编排引擎 | Tauri + FastAPI

Black-box web penetration testing automation framework for AI Agents

Drive your real, logged-in Chrome from an AI agent (Claude Code / Codex) over MCP - 55 tools for browsing, DevTools-grade network capture, a

WebStrike — automated web-pentesting framework that orchestrates Kali tools (subfinder, httpx, katana, ffuf, nuclei, sqlmap, dalfox) into on

Passive blue-team security scanner — 582 read-only modules, plus 32 opt-in probes. Runs on your machine. No accounts. No telemetry.

Privacy-first Chrome extension for fast, user-initiated web reconnaissance and page inspection.

Defensive research and practical examples for DDoS detection, mitigation, and resilient web architecture.

A runnable Playwright MCP wrapper for a DOM-based remote browser sa2web.

SQLGuardJS is Express request verification for SQL injection, XSS, and NoSQL injection with heuristic detection, schema checks, structured l

Harness-driven terminal AI agent for authorized security assessment, with TUI, headless automation, persistent context, 150 built-in skill

Offensive web security scanner — OWASP Top 10 · MCP server · CLI · Go

Autonomous web-app pentest engine — a multi-agent pipeline wielding 30+ offensive-security tools as skills, PoC-validated findings. Built on

60+ detectors for web, plus mobile apps and smart contracts. Every finding is mapped to the OWASP Top 10, marked Confirmed when we have proo