Skip to content
Get packs

Capability Primitive Search

Chains low-severity findings into code execution by mapping and searching attack capabilities.

Source Download skill
Repository
AIPentest/CyberStrikeAI
Stars
8,323
Licence
Apache-2.0
Files
1 file

What it does

This skill is a penetration-testing playbook written in Chinese with English keywords. It tells an AI agent to stop hunting for a single critical bug and instead treat each finding as a building block (such as file read, file write, or SSRF). The agent then combines these building blocks, working forward from what it has and backward from a goal like command execution, to find a multi-step attack chain. It also suggests looking at legitimate admin features and cross-domain reuse of credentials or capabilities.

Great for

  • Security professionals running authorized penetration tests or red-team exercises
  • Students learning how low-severity weaknesses combine into serious compromises
  • Bug bounty hunters who need ideas when no obvious critical vulnerability exists

Skip it if

  • Testing systems you do not own or have written permission to test, since the skill is offensive and gives no authorization checks (illegal use risk)
  • Non-security users looking for general coding or writing help, since the content is narrowly about exploitation
  • Production environments where the agent might execute attack steps against live systems without a safe scope (unintended damage risk)

Try asking

  • “Given this low-severity info leak and an exposed admin panel, what chain could lead to command execution?”
  • “I have SSRF but no RCE yet. Work backward from command execution and tell me which primitives I still need.”
  • “List the admin-panel features in this app that could act as built-in execution or file-write primitives.”
Step-by-step guide: how to use Capability Primitive SearchInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 1 original files, the Apache-2.0 licence and an attribution note.

    capability-primitive-search.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip capability-primitive-search.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip capability-primitive-search.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Pair it with an agent that has actual testing tools and an authorized target scope, since the skill itself only supplies reasoning guidance.
  • Ask the agent to label each chain step as hypothesis until it is verified with evidence, as the skill itself recommends.
  • Provide concrete findings (versions, responses, configs) so the agent can map them to primitives accurately.

What's inside

  • SKILL.md

Redistributed unmodified from AIPentest/CyberStrikeAI under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.