Note: This repository contains Pwnote's implementation of skills for pentest workflow automation. For information about the Agent Skills standard, see agentskills.io.

Pwnote Skills

Skills are folders of instructions, scripts, and resources that agents load dynamically to improve performance on specialized tasks. They teach AI agents how to complete specific pentest workflows in a repeatable way — generating engagement files, automating recon, formatting findings, and integrating with external tooling.

Pwnote Skills extend the Pwnote pentest platform, giving agents domain-specific knowledge for security assessments, bug bounty hunting, certification exams, and CVE research.

Gallery

Installation

# Install all skills
npx skills add https://github.com/Pwnote/skills

# Install a specific skill
npx skills add https://github.com/Pwnote/skills --skill pwnote-bug-bounty

Prerequisite: Pwnote account + AI agent.

Available Skills

All skills are prefixed with pwnote- to avoid name conflicts with similar skills from other repositories.

Skill Description
pwnote-bug-bounty Bug bounty workflow. Program intake, recon, vulnerability class playbooks, report writing (HackerOne / Bugcrowd / Intigriti / YesWeHack), triage disputes.
pwnote-cve-research CVE research and responsible disclosure. Disclosure timeline tracking, CNA/MITRE submission, advisory writing, CWE mapping.
pwnote-tryhackme TryHackMe room notes and writeups. Structured note-taking per task, public writeup format, flag tracking.
pwnote-hackthebox HackTheBox machine notes. Recon / foothold / privesc note structure, enumeration checklist, Linux and Windows privesc references.
pwnote-offsec-pen200 Offsec PEN-200 / OSCP workflow. Exam report structure, screenshot and evidence discipline, proof file conventions.
pwnote-offsec-web300 Offsec WEB-300 / OSWE workflow. Whitebox source review, exploit chain documentation, PoC scripting conventions.
pwnote-offsec-osai Offsec OSAI / AI Red Teaming workflow. Prompt injection taxonomy, agent trajectory documentation, two-axis severity model.
pwnote-engagement-file Engagement import/export JSON files. Bundles metadata, notebook documents, code/host/credential blocks, findings with CVSS/CWE/CVE, attack-path boards.

Adding a Skill

Drop a folder under skills/ with a SKILL.md file and any scripts or resources it needs. The frontmatter name field must match the folder name.

skills/
  pwnote-your-skill/
    SKILL.md
    scripts/
    resources/

Refer to the Agent Skills specification for the full schema and conventions.