Skills Leaderboard Pricing Docs

Sign In Get Started Free

Loading skill

Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Get Started Free →

◆DecimalAI

The agent dataset lifecycle platform. Build, test, and refine AI skills at scale.

Product

Skills Registry Leaderboard Pricing Documentation Changelog

Legal

Privacy Policy Terms of Service Security

© 2026 DecimalAI. All rights reserved.

Arsenal · encod3d-sec | DecimalAI

securityby encod3d-sec

Arsenal

encod3d-sec/arsenal

Wiki-first "what do I use" lookup - pick the automated TOOL (wiki/tools/), then the PAYLOAD/technique (wiki/payloads/ + wiki/cheatsheets/), for a surface/service/vuln-class BEFORE hand-rolling or working from memory. Use for "tool for <service>", "automated tools for web/<service>", "what should I run on <surface>", "which tool for <X>", "payloads for <X>", "payload arsenal", "cheatsheet for <X>", "how do I exploit <tech/class>", "exploit/attack chain for <X>", "arsenal", any SSRF/XSS/SQLi/SSTI/

SkillScore86Maintained

Automatic

◆Security & AppSec pack

Last verified 10/10/2026

Links this skill to your agents and keeps it current with the author's updates.

Install locally · CLI or SKILL.md

1 · One-time — install the CLI (docs ↗)

$pip install decimalai

2 · Get the skill — writes .claude/skills/encod3d-sec-arsenal/SKILL.md

$decimalai skills pull encod3d-sec-arsenal --out .claude/skills/

No CLI? Get the same file — curl · raw file

$

curl -fsSL --create-dirs -o .claude/skills/encod3d-sec-arsenal/SKILL.md https://app.decimal.ai/s/encod3d-sec-arsenal/SKILL.md

Raw file: /s/encod3d-sec-arsenal/SKILL.md ↗ · machine-readable summary at /s/encod3d-sec-arsenal.json ↗

Source encod3d-sec/torch ↗License MIT

Code scan CleanIntent PassedContent Clean

Benchmark snapshot

Same tasks, with and without this skill.

Model gemini-3.6-flashMeasured 10/10/2026v1

Pass-rate lift: +23 pp
Pass rate with skill: 86%
Tokens: +17%
Agent turns: 0%

19 of 22 cases passed with skillTokens and turns describe resource use, not a dollar price.

Usage

All-time distinct users and times used, across every version.

Users: 0
Times used: 0

Read the skill

SKILL.md · instructions and conventions

Safety and source details

SkillSafety

✓ 3 of 3 passed

✓

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v5 — 9/14/2026

View 15 scanner checks

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

✓

IntentSafe

LLM judge · does the skill do what it claims

✓

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

encod3d-sec / torch

skills/workflow/arsenal/SKILL.md

View on GitHub ↗

License MITImported 9/14/2026Version v1

Related skills

Other measured skills in the registry, with their headline benchmark lift.

encod3d-sec/campaign-healthHealth check for the bb/pt/ctf workflow driver subsystem - verifies everything is in place so every machine runs the same. Checks vault-content consistency (scripts present, JSON valid, routing wired, all 69 tool pages carry phase:, the tool index resolves, the hook edits are in place) AND per-machine wiring (the three workflow skills symlinked, hooks registered, imports work), then runs a live init->board->next smoke test. Use when setting up the workflow on a new machine, after a vault sync, w+33 pp pass-rate lift
encod3d-sec/coverageShow per-asset vuln-class coverage gaps for the active engagement so nothing in scope is skipped. Use when asked "coverage", "what haven't we tested", "test gaps", "are we thorough", or before calling an engagement done.+50 pp pass-rate lift
encod3d-sec/ctf-categoryCTF challenge router - fingerprint a challenge (file type / prompt / artifacts) into its category (pwn, rev, crypto, forensics, stego, web, osint, hash) and route to the matching wiki page, tools, and first moves. Wiki-first.

+13 pp pass-rate lift

encod3d-sec/evidenceEvidence hygiene before any FIND moves to Completed or enters a report. Cookie redaction, PII black-bar, HAR sanitization, screenshot metadata strip. Run after /triage passes and before final report assembly.+46 pp pass-rate lift

encod3d-sec/fuzzAdaptive, targeted web fuzzing - deterministic wordlist selection (wl-pick.sh) plus judgment. Picks the right SecLists list per surface (content/vhost/api/params/artifacts) smallest-first, calibrates filters against soft-404s, recurses, escalates T0 harness -> T1 seclists -> T2 cewl -> T3 app-specific on signal, pivots to hidden-param fuzzing, and detects/handles WAF/Cloudflare/throttle (backoff, origin-bypass, or hard STOP on the DoS tell). Engagement-type aware (ctf loud, pt calibrated, bb ste+18 pp pass-rate lift

encod3d-sec/hunt-bizlogicBusiness-logic flaw hunting - workflow/state bypass, price/quantity tampering, negative/overflow values, coupon/refund abuse, mass assignment, and logic races. The top-paying bug class with no scanner coverage. Wiki-first, FIND schema output.+22 pp pass-rate lift

encod3d-sec/hunt-coreShared discipline for every hunt-* skill: scope and authorization gating, the two-account rule, the confirmation gate that separates a real finding from a false positive, enumeration limits, stop conditions, marker discipline, wiki-first query and self-heal, FIND output, Deadends, and wiki distillation. ALWAYS LOADED alongside any hunt skill. Also trigger directly on "is this in scope", "is this a real bug", "how do I confirm this", "should I keep going", "how many IDs should I test", "what seve+64 pp pass-rate lift

encod3d-sec/hunt-deserializationInsecure deserialization hunting across Java / .NET / PHP / Python / Ruby / Node. Gadget-chain RCE, OOB-gated blind detection, magic-byte fingerprinting. Wiki-first, FIND schema output.+17 pp pass-rate lift