Skills - AwareXone Docs

Skills live under skills/<name>/ and load as agent knowledge (for example /skill-name in supported harnesses). Install with ./install.sh or --agent agents for shared Agent Skills.

Catalog

Skill	Focus
`bug-bounty`	Master workflow — recon through report, vuln classes, LLM testing, chains
`argus`	CORS, CRLF, NoSQL, JWT, OOB (interactsh), LLM red-team scanners
`bb-methodology`	Session start / next-step orchestrator — 5-phase hunting workflow
`cicd-security`	GitHub Actions, runners, dependency confusion, supply chain
`client-reverse`	Client request-signing and anti-bot token reversal
`credential-attack`	Password-spray methodology with legal guardrails (hard-stop before spray)
`graphql-audit`	GraphQL introspection, IDOR via aliasing, batching, auth bypass
`meme-coin-audit`	Token / rug-pull and LP / bonding-curve risks
`mobile-pentest`	Android/iOS bounty workflow — proxy first, then decompile/Frida as needed
`report-writing`	H1 / Bugcrowd / Intigriti / Immunefi templates and impact-first tone
`security-arsenal`	Payloads, bypass tables, gf patterns, always-rejected list
`triage-validation`	7-Question Gate, pre-submit gates, CVSS quick reference
`web2-recon`	Subdomain enum, live hosts, crawl, fuzz, JS analysis
`web2-vuln-classes`	Reference for 26 web2 bug classes
`web3-audit`	Smart contract audit — 10 DeFi classes + Foundry PoC template

How they relate to the CLI

Stage	Skills that matter most
Start / stuck	`bb-methodology`, `bug-bounty`
Recon	`web2-recon`
Class hunting	`web2-vuln-classes`, `argus`, `graphql-audit`, `cicd-security`
Mobile / signed clients	`mobile-pentest`, `client-reverse`
Creds (authorized only)	`credential-attack`
Web3	`web3-audit`, `meme-coin-audit`
Before submit	`triage-validation`, `report-writing`, `security-arsenal`