CCM
/Skills
SkillsMCPMarketplacesDigestToolsAdvertise

This week in Claude

Every Monday: Claude Code, Agent SDK, MCP, and the Anthropic platform moves worth your time.

Skills by Category
Frontend DevelopmentBackend & APIsTesting & QASecurityDevOps & CI/CDGit & Pull RequestsDocumentationCode Review & QualityAI & Agent BuildingSkill Development
MCP Servers by Category
Sales & MarketingWeb & Browser AutomationDatabasesAI & LLM ToolsCloud & InfrastructureCommunication & MessagingDeveloper ToolsDesign & CreativeDocuments & KnowledgeSearch & Web Crawling
Marketplaces by Category
AI Agents & OrchestrationLLM IntegrationDevelopment ToolsFrontend & UIBackend & APIsDatabasesTesting & Code QualityDevOps & CloudSecurity & ComplianceGit & Version Control

Claude Code Marketplaces

Discover Claude Code plugins, extensions, and tools. Automatically updated directory of Anthropic Claude AI marketplaces with development tools, productivity plugins, and integrations.

Resources

  • Browse Skills
  • Browse MCP Servers
  • Browse Marketplaces
  • Skill index
  • MCP index
  • Marketplace index
  • Plugins Reference

Community

  • About
  • Tools
  • Feedback
  • Privacy Policy
  • Advertise

Built for the Claude Code community with Claude Code by mertbuilds.com

Independent project, not affiliated with Anthropic
yaklang avatar

Cmdi Command Injection

yaklang/hack-skills
2.6k installs1.6k stars
Summary

Loads comprehensive command injection attack patterns for when user input touches shell execution, whether it's ping utilities, file converters, or import pipelines. The playbook covers all major shell metacharacters, blind detection via timing and DNS exfiltration, filter bypasses using IFS and brace expansion, and vulnerable code patterns across PHP, Python, Node, and legacy ASP. You get context-specific payloads for quoted strings, command substitution, and OOB channels, plus a solid library of reverse shells for Linux and Windows. The real value is in the blind injection decision trees and the catalog of non-obvious entry points like email senders and archive processors where base models typically miss the execution chain.

Install to Claude Code

npx -y skills add yaklang/hack-skills --skill cmdi-command-injection --agent claude-code

Installs into .claude/skills of the current project.

CodeRabbit
CodeRabbit
AI writes the code. CodeRabbit catches the slop.
Try For Free →
belt - the only tool your agent needs
belt - the only tool your agent needs
belt cli automatically finds the best tools and skills for your agent. image, video, music, tts...
one prompt install →
inference shell
inference shell
create and run specialised agents in minutes
build now →
MCP-ready Email SendingMCP-ready Email Sending
MCP-ready Email Sending
Plug Mailtrap into your AI workflow and let it handle the email.
Connect Mailtrap MCP →
Make your agent a DeFi expert
Make your agent a DeFi expert
Agent, run crypto. Access onchain data & trade routes via 1inch.
Install now →
Capacitor - Shared memory for your team’s coding agents.
Capacitor - Shared memory for your team’s coding agents.
Make coding agent sessions - Searchable, Shareable, Vendor-neutral & Scored.
Try For Free →
CodeScene MCP ServerCodeScene MCP Server
CodeScene MCP Server
Your agent targets a perfect 10 Code Health score. Deterministic. Every commit.
Try For Free →
Give your AI the whole web as clean markdownGive your AI the whole web as clean markdown
Give your AI the whole web as clean markdown
Integrate web data into your AI product. One API to scrape website & brand data.
Get API Key Now →
CodeRabbit
CodeRabbit
AI writes the code. CodeRabbit catches the slop.
Try For Free →
belt - the only tool your agent needs
belt - the only tool your agent needs
belt cli automatically finds the best tools and skills for your agent. image, video, music, tts...
one prompt install →
inference shell
inference shell
create and run specialised agents in minutes
build now →
MCP-ready Email SendingMCP-ready Email Sending
MCP-ready Email Sending
Plug Mailtrap into your AI workflow and let it handle the email.
Connect Mailtrap MCP →
Make your agent a DeFi expert
Make your agent a DeFi expert
Agent, run crypto. Access onchain data & trade routes via 1inch.
Install now →
Capacitor - Shared memory for your team’s coding agents.
Capacitor - Shared memory for your team’s coding agents.
Make coding agent sessions - Searchable, Shareable, Vendor-neutral & Scored.
Try For Free →
CodeScene MCP ServerCodeScene MCP Server
CodeScene MCP Server
Your agent targets a perfect 10 Code Health score. Deterministic. Every commit.
Try For Free →
Give your AI the whole web as clean markdownGive your AI the whole web as clean markdown
Give your AI the whole web as clean markdown
Integrate web data into your AI product. One API to scrape website & brand data.
Get API Key Now →
Files
SKILL.md

Select a file.

Featured
CodeRabbit
CodeRabbit
AI writes the code. CodeRabbit catches the slop.
Try For Free →
belt - the only tool your agent needs
belt - the only tool your agent needs
belt cli automatically finds the best tools and skills for your agent. image, video, music, tts...
one prompt install →
inference shell
inference shell
create and run specialised agents in minutes
build now →
MCP-ready Email SendingMCP-ready Email Sending
MCP-ready Email Sending
Plug Mailtrap into your AI workflow and let it handle the email.
Connect Mailtrap MCP →
Make your agent a DeFi expert
Make your agent a DeFi expert
Agent, run crypto. Access onchain data & trade routes via 1inch.
Install now →
Capacitor - Shared memory for your team’s coding agents.
Capacitor - Shared memory for your team’s coding agents.
Make coding agent sessions - Searchable, Shareable, Vendor-neutral & Scored.
Try For Free →
CodeScene MCP ServerCodeScene MCP Server
CodeScene MCP Server
Your agent targets a perfect 10 Code Health score. Deterministic. Every commit.
Try For Free →
Give your AI the whole web as clean markdownGive your AI the whole web as clean markdown
Give your AI the whole web as clean markdown
Integrate web data into your AI product. One API to scrape website & brand data.
Get API Key Now →
Categories
CLI & Terminal
First SeenMay 16, 2026
View on GitHub

More from yaklang/hack-skills

All 102 skills →
  • Graphql And Hidden Parameters2.6k
  • File Access Vuln2.6k
  • Http Parameter Pollution2.6k
  • Ssti Server Side Template Injection2.6k
  • Kernel Exploitation2.5k
  • Deserialization Insecure2.5k
  • Request Smuggling2.5k
  • Browser Exploitation V82.5k
  • Open Redirect2.5k
  • Symbolic Execution Tools2.5k
  • Insecure Source Code Management2.5k
  • Race Condition2.5k
  • Crlf Injection2.5k
  • Web Cache Deception2.5k
  • Dependency Confusion2.5k
  • Csp Bypass Advanced2.5k
  • Mobile Ssl Pinning Bypass2.5k
  • Expression Language Injection2.5k
  • Http Host Header Attacks2.5k
  • Jndi Injection2.5k
  • Csv Formula Injection2.5k
  • Active Directory Acl Abuse2.5k
  • Clickjacking2.5k
  • Subdomain Takeover2.5k

Recommended

More CLI & Terminal →
longbridge avatar
longbridge-fundamentals

longbridge/skills

Financial statements, business segments, dividends, valuation multiples (PE/PB/PS), industry comparison, operating data, corporate actions, company and executive profiles, cross-stock comparison, and valuation ranking via Longbridge. Also: DCF models, value investing screens (low PE/PB, margin of safety), and behavioral finance analysis frameworks. Triggers: "财报", "三表", "利润表", "资产负债", "现金流", "估值", "PE", "PB", "分红", "公司信息", "高管", "行业估值", "并购", "DCF", "内在价值", "低估值", "安全边际", "行为金融", "小盘成长", "专精特新", "主营业务", "业务构成", "收入结构", "业务分析", "是做什么的", "是干嘛的", "公司画像", "行业排名", "行业龙头", "市场份额", "收入占比", "业务结构", "財報", "估值", "分紅", "內在價值", "安全邊際", "主營業務", "業務構成", "收入結構", "行業排名", "行業龍頭", "financial report", "income statement", "balance sheet", "valuation", "dividend", "company info", "industry valuation", "DCF", "value screen", "behavioral finance", "main business", "business composition", "revenue structure", "what does XX do", "industry ranking", "market share", "利潤表", "資產負債", "現金流", "行業估值", "併購", "行為金融", "小
2.5k
47
openai avatar
speech

openai/skills

Use when the user asks for text-to-speech narration or voiceover, accessibility reads, audio prompts, or batch speech generation via the OpenAI Audio API; run the bundled CLI (`scripts/text_to_speech.py`) with built-in voices and require `OPENAI_API_KEY` for live calls. Custom voice creation is out of scope.
2.5k
24.7k
openai avatar
netlify-deploy

openai/skills

Deploy web projects to Netlify using the Netlify CLI (`npx netlify`). Use when the user asks to deploy, host, publish, or link a site/repo on Netlify, including preview and production deploys.
2.5k
24.7k
yaklang avatar
linux-privilege-escalation

yaklang/hack-skills

Linux privilege escalation playbook. Use when you have low-privilege shell access and need to escalate to root via SUID/SGID binaries, capabilities, cron abuse, kernel exploits, misconfigurations, or credential harvesting on Linux systems.
2.5k
1.6k
dpearson2699 avatar
activitykit

dpearson2699/swift-ios-skills

Implement, review, or improve Live Activities and Dynamic Island experiences in iOS apps using ActivityKit. Use when building real-time updating widgets for the Lock Screen and Dynamic Island — delivery tracking, sports scores, ride-sharing status, workout timers, media playback, or any time-sensitive information that updates in real time. Also use when working with ActivityKit, ActivityAttributes, Activity lifecycle (request/update/end), Dynamic Island layouts (compact/minimal/expanded), push-to-update Live Activities, or Lock Screen live widgets.
2.5k
981
yaklang avatar
windows-privilege-escalation

yaklang/hack-skills

Windows local privilege escalation playbook. Use when you have low-privilege shell access on Windows and need to escalate via token abuse, Potato exploits, service misconfigurations, DLL hijacking, UAC bypass, or registry autoruns.
2.5k
1.6k