vestjoe/trove-skill

A vendor's application-security skills for a coding agent: it scans source, dependencies and secrets, then confirms a finding against the running app through a proxy before it reaches the report.

Routes an agent handed an APK, a binary, obfuscated frontend JavaScript or a pentest target to the playbook that fits, then sets up the toolchain that playbook needs. Its playbooks also cover Windows identity attacks, beyond the reversing the name implies.

Pairs bug-bounty web and API hunting with smart-contract auditing across several chains, each audit backed by a reference of known vulnerability classes. It ends in a submission drafted for the bounty platform.

A broad penetration-testing skill set that also works through the OWASP LLM top ten as concrete tests. It ends in the report, with compliance formats and a risk prioritiser.

Tests an AI coding IDE or its agent, such as Cursor, Cline or Claude Code, for the ways a hostile workspace can steer it. You map the surface first, work one vulnerability class per skill, then chain what you confirmed.

Works an IoT device from three sides: its companion Android app, its hardware debug and serial interfaces, and the network it sits on. Each hardware skill ships a small Python helper instead of assuming the tool is installed.

Splits a code repository's vulnerability scan across several agents and merges what they find. A benchmark skill scores each scan against a known-vulnerable sample, so one setup can be compared with another.

Works on the report an engagement ends in, inside Ghostwriter: it turns a sample Word report into a Ghostwriter template, drafts an executive summary traced back to the findings, and grades whether a finding or report is ready for final delivery. It runs offline on exported report data, or reads a live Ghostwriter over its GraphQL API.

Aims at the judgement rather than the commands: trace a finding to demonstrated impact, capture memory before the box is reimaged, notice the honeypot. Offence, defence and a shared core install separately.

Walks an internal AD engagement technique by technique, each step naming the command to run and the telemetry it leaves behind. It ships no code of its own and drives tools you already have installed.