Skills Leaderboard Pricing Docs

Sign In Get Started Free

Loading skill

Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Get Started Free →

◆DecimalAI

The agent dataset lifecycle platform. Build, test, and refine AI skills at scale.

Product

Skills Registry Leaderboard Pricing Documentation Changelog

Legal

Privacy Policy Terms of Service Security

© 2026 DecimalAI. All rights reserved.

Coverage · encod3d-sec | DecimalAI

securityby encod3d-sec

Coverage

encod3d-sec/coverage

Show per-asset vuln-class coverage gaps for the active engagement so nothing in scope is skipped. Use when asked "coverage", "what haven't we tested", "test gaps", "are we thorough", or before calling an engagement done.

SkillScore82Maintained

Automatic

◆Security & AppSec pack

Last verified 10/6/2026

Links this skill to your agents and keeps it current with the author's updates.

Install locally · CLI or SKILL.md

1 · One-time — install the CLI (docs ↗)

$pip install decimalai

2 · Get the skill — writes .claude/skills/encod3d-sec-coverage/SKILL.md

$decimalai skills pull encod3d-sec-coverage --out .claude/skills/

No CLI? Get the same file — curl · raw file

$

curl -fsSL --create-dirs -o .claude/skills/encod3d-sec-coverage/SKILL.md https://app.decimal.ai/s/encod3d-sec-coverage/SKILL.md

Raw file: /s/encod3d-sec-coverage/SKILL.md ↗ · machine-readable summary at /s/encod3d-sec-coverage.json ↗

Source encod3d-sec/torch ↗License MIT

Code scan CleanIntent PassedContent Clean

Benchmark snapshot

Same tasks, with and without this skill.

Model gemini-3.6-flashMeasured 10/6/2026v1

Pass-rate lift: +50 pp
Pass rate with skill: 82%
Tokens: -32%
Agent turns: 0%

18 of 22 cases passed with skill · 21 comparableTokens and turns describe resource use, not a dollar price.

Usage

All-time distinct users and times used, across every version.

Users: 0
Times used: 0

Read the skill

SKILL.md · instructions and conventions

Safety and source details

SkillSafety

✓ 3 of 3 passed

✓

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v5 — 9/14/2026

View 15 scanner checks

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

✓

IntentSafe

LLM judge · does the skill do what it claims

✓

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

encod3d-sec / torch

skills/workflow/coverage/SKILL.md

View on GitHub ↗

License MITImported 9/14/2026Version v1

Related skills

Other measured skills in the registry, with their headline benchmark lift.

encod3d-sec/ctf-categoryCTF challenge router - fingerprint a challenge (file type / prompt / artifacts) into its category (pwn, rev, crypto, forensics, stego, web, osint, hash) and route to the matching wiki page, tools, and first moves. Wiki-first.+13 pp pass-rate lift
encod3d-sec/evidenceEvidence hygiene before any FIND moves to Completed or enters a report. Cookie redaction, PII black-bar, HAR sanitization, screenshot metadata strip. Run after /triage passes and before final report assembly.+46 pp pass-rate lift
encod3d-sec/fuzzAdaptive, targeted web fuzzing - deterministic wordlist selection (wl-pick.sh) plus judgment. Picks the right SecLists list per surface (content/vhost/api/params/artifacts) smallest-first, calibrates filters against soft-404s, recurses, escalates T0 harness -> T1 seclists -> T2 cewl -> T3 app-specific on signal, pivots to hidden-param fuzzing, and detects/handles WAF/Cloudflare/throttle (backoff, origin-bypass, or hard STOP on the DoS tell). Engagement-type aware (ctf loud, pt calibrated, bb ste

+18 pp pass-rate lift

encod3d-sec/hunt-bizlogicBusiness-logic flaw hunting - workflow/state bypass, price/quantity tampering, negative/overflow values, coupon/refund abuse, mass assignment, and logic races. The top-paying bug class with no scanner coverage. Wiki-first, FIND schema output.+22 pp pass-rate lift

encod3d-sec/hunt-coreShared discipline for every hunt-* skill: scope and authorization gating, the two-account rule, the confirmation gate that separates a real finding from a false positive, enumeration limits, stop conditions, marker discipline, wiki-first query and self-heal, FIND output, Deadends, and wiki distillation. ALWAYS LOADED alongside any hunt skill. Also trigger directly on "is this in scope", "is this a real bug", "how do I confirm this", "should I keep going", "how many IDs should I test", "what seve+64 pp pass-rate lift

encod3d-sec/hunt-deserializationInsecure deserialization hunting across Java / .NET / PHP / Python / Ruby / Node. Gadget-chain RCE, OOB-gated blind detection, magic-byte fingerprinting. Wiki-first, FIND schema output.+17 pp pass-rate lift

encod3d-sec/hunt-federationOAuth and SAML attack hunting - redirect_uri bypass, state CSRF, SAML XSW (XSW1-XSW8), signature stripping, comment injection. Wiki-first, FIND schema output.+26 pp pass-rate lift

encod3d-sec/hunt-idorIDOR / BOLA hunting - two-account methodology, identifier discovery and UUID leak chaining, the trusted-identifier test, GraphQL node and nested-object IDOR, cross-tenant escalation, write and delete operations. Bounded ID sampling, never range sweeps. Wiki-first, FIND schema output. Trigger on IDOR, BOLA, broken access control, object level authorization, cross-tenant, "read another user's data", "swap the id", or any API path or parameter carrying a numeric ID, UUID, or account identifier.+18 pp pass-rate lift