yaklang/hack-skills: A Skill Catalog for Security Agents, Not a Scanner

What hack-skills Is For, and Who It Is Actually Written For

The repository describes itself as an Agent Skills knowledge base, and the description line is blunt about the audience: helping an AI Agent become an awesome practical hacker. That framing matters more than it first appears. This is not a penetration testing toolkit, a scanner, or a payload generator. It is a set of markdown files that an agent loader reads before it reasons about a security task. The stated coverage is 101 deep topic skills across 14 security domains, spanning web, API, authentication and authorization, OS privilege escalation on Linux, Windows and macOS, Active Directory, mobile, binary exploitation, reverse engineering, cryptography, blockchain and smart contracts, AI/ML and LLM security, network protocols and pivoting, and digital forensics. The README names four intended contexts: bug bounty, penetration testing, CTF competitions, and authorized security research. If your agent is being pointed at a web target and you want it to reach for a structured methodology instead of improvising, that is the gap this fills. If you want something that runs a scan, this is the wrong shape of artifact entirely.

The Three-Layer Routing Scheme and Why the README Argues Against Flat Catalogs

The design decision worth studying is the refusal to expose everything at once. The README states the goal directly: not to expose every minor tip as an entry point, but to compress what the loader truly needs to see into one master entry, six category entries, and deep topic skills drilled down on demand. The loader priority table makes the ordering concrete. The master entry, hack, handles global routing, test sequencing, and cross-category switching, and is recommended for exposure first. Category entries such as recon-for-sec, api-sec, and auth-sec route by attack surface into stable topic families, also exposed first. Deep topics such as xss-cross-site-scripting and sqli-sql-injection carry the full playbooks and are meant to load on demand. That is a context-window argument as much as a knowledge argument: an agent that loads 101 playbooks upfront pays for all of them on every turn. Whether the routing actually holds up in practice is something you can only judge by reading the category entries, and the README does not publish routing accuracy or coverage statistics, so treat the layer split as a structural claim rather than a measured one.

Directory Layout and the SKILL.md Convention

The current branch has converged on one layout: every skill lives in its own directory, uniformly at skills/{semantic-identifier}/SKILL.md. The identifiers are semantic rather than numeric, which is what makes the routing table legible: skills/hack/SKILL.md, skills/recon-for-sec/SKILL.md, skills/api-sec/SKILL.md, skills/auth-sec/SKILL.md, skills/xss-cross-site-scripting/SKILL.md, skills/sqli-sql-injection/SKILL.md. The repository's primary language is listed as CSS, which is a side effect of the static site under site/ rather than the knowledge content, and is worth knowing before you judge the repo by its language breakdown. The README also notes that the site is a fully client-side static build with no tracking and no backend, deployed through .github/workflows/deploy-pages.yml. For a knowledge repository, a flat and predictable path convention is most of the battle, because it lets a loader resolve a skill by name without a registry.

Installing It: the npx Command and the Raw SKILL.md Path

The README gives two entry points. The preferred one is the npx command: npx skills add yaklang/hack-skills. If your tooling can pull a single SKILL.md directly, the README offers the frontmatter name hack and the raw URL https://raw.githubusercontent.com/yaklang/hack-skills/main/skills/hack/SKILL.md. After installing, the recommended order is stated plainly: start from the master entry, then move into category entries, and only then drill into deep topic skills. There is no configuration file, no environment variable, and no service to start. That is the entire setup surface described in the material, and it is a fair reflection of what this is: content that a loader consumes, not software that runs. If your agent framework expects a manifest, a version pin, or a lockfile for skills, the README does not describe one, so you would be resolving skills by path and name.

The Offline ZIP and the Search Index Behind the Web Catalog

Three distribution channels are kept in sync on every push to main. The web UI at skills.hackbenchmark.com offers fuzzy search, a category sidebar, a P0/P1/P2 tier filter, copy-paste install commands, and an encrypted ZIP download. The GitHub source is the plain SKILL.md set for diff review and offline reading. The third channel is an AES-256 ZIP of all *.md files with the public password hack-skills, distributed via CDN, intended for air-gapped use or when antivirus strips plain markdown. The search index is described as a weighted fuzzy index over name, id, category, and description, with field qualifiers such as category:auth, tier:deep, and lines:>200. Two things follow from that. First, the tier filter implies skills carry a P0/P1/P2 classification, which is a curation signal you should inspect rather than assume. Second, a public password on an archive means the encryption is there to survive transit and endpoint filtering, not to restrict access, and the README presents it that way.

What It Distills From, and the Boundary the README Draws

The source list is unusually explicit for a repository of this kind. It names swisskyrepo/PayloadsAllTheThings for payload families and bypass techniques, PentesterSpecialDict for OS-specific payload dictionaries and middleware path fuzzing lists, Dictionary-Of-Pentesting for bug bounty bypass techniques and cloud metadata endpoints, Hello-CTF for CTF web tutorials, ctf-wiki for Pwn, crypto, reverse engineering and forensics, and hacktricks for privilege escalation, Active Directory, containers, mobile and AI security, plus public research papers and CVE advisories for methodology and taxonomies. The processing principles are where the design intent shows: no direct copying of large dictionaries or full payload lists, distillation into routable and auditable skills, small stable samples and taxonomies rather than exhaustive lists, and no customer-specific or vendor-identifiable case details. Read that as a deliberate trade. You give up the completeness of a full payload dictionary in exchange for something an agent can route and a reviewer can audit. If your workflow depends on exhaustive payload coverage, this repository is not trying to be that, and the README says so.

Where It Falls Short: No Releases, No Homepage, and a Thin Maintenance Signal

Several honest caveats sit in the repository metadata rather than the prose. No releases were retrieved, so there is no versioned artifact to pin against; consumers track the main branch, and the README confirms the three channels are resynced on every push to main. There is no homepage field, so the web UI is discoverable only through the README. The last push timestamp is recent, which indicates activity but says nothing about review depth, and the README gives no contributor process beyond pull-request review. The deeper limitation is categorical: this is a knowledge base, so its failure mode is not a crash but a confidently wrong playbook. Nothing in the material describes a validation step, a test suite for skill content, or a way to flag a skill as stale after a technique stops working. An agent that loads a deep topic skill inherits whatever accuracy that file has, and the README offers no mechanism for verifying it. That is the risk you are accepting, and it is not one the repository claims to solve.

How This Differs From hacktricks and PayloadsAllTheThings

The obvious comparison is with the sources it draws from, and the difference is not coverage but consumption model. hacktricks is written for a human reader working through a target: long-form pages, dense cross-linking, and a browsing pattern that assumes you will read several pages in a session. PayloadsAllTheThings is organized around vulnerability categories and payload families, and its value is breadth of payloads. hack-skills inverts both. Its unit is a single SKILL.md addressed by a semantic identifier, its top level is a router rather than a table of contents, and its stated processing principle is to avoid copying large dictionaries or full payload lists. So the practical difference is this: if a human is doing the reading, hacktricks and PayloadsAllTheThings remain the deeper references. If a loader is doing the reading, hack-skills is shaped for that consumer, and its three-layer split exists precisely because a loader cannot afford the browsing pattern a human uses.

Licence and the Cost of Keeping It Current

The repository is MIT licensed, which permits reuse and modification with the usual attribution and warranty disclaimer, though the licence text itself is not reproduced in the material and you should read the LICENSE file before redistributing. One licence question the README does not answer: the skills are distilled from hacktricks, PayloadsAllTheThings, ctf-wiki, Hello-CTF, PentesterSpecialDict, and Dictionary-Of-Pentesting, and the material does not state the licence terms of those upstream projects or how the distillation interacts with them. That is a question for whoever owns the redistribution, not a settled matter here. Maintenance cost is the other side. Because there are no releases and the channels resync on every push to main, there is no version to freeze against, so any deployment that consumes this repository is tracking a moving branch. The README's stated processing principles (small stable samples, taxonomies, cross-references) suggest the maintainers are optimizing for stability over time, but that is an intent, not a guarantee you can verify from the material provided.

Editorial conclusion

Adopt hack-skills if you are wiring a skill-aware agent and want a routed security curriculum rather than a flat prompt dump; the three-layer split is the part worth copying even if you keep your own content. Skip it if you need executable tooling, exploit code, or payload dictionaries, because the README describes distillation and explicitly rules out copying large dictionaries or full payload lists. Before relying on it, verify three things in the repository itself: that skills/hack/SKILL.md is the frontmatter name your loader resolves, that the category entries you intend to expose first actually exist under skills/, and what the AES-256 ZIP contains, since the archive is distributed with the public password hack-skills.

Official sources

1. Issues
2. License: MIT
3. README
4. yaklang/hack-skills on GitHub