Skills
bb-local-toolkit
by elementalsouls
A Claude Code skill bundle for bug hunting and external red-team work - 82 skills, 15 slash commands, 681 disclosed-report patterns curated across 24 core vulnerability classes, pl
Our verdict
We have not reviewed bb-local-toolkit yet
No one at Enterprise DNA has checked this listing against its sources. The description comes from public listings gathered automatically. Any fact below shows where it came from and when it was last checked.
From the listing
About bb-local-toolkit
A Claude Code skill bundle for bug hunting and external red-team work - 82 skills, 15 slash commands, 681 disclosed-report patterns curated across 24 core vulnerability classes, plus enterprise identity + infrastructure attack matrices.
Notes
5,306 stars on GitHub. Last updated 2026-10-26. Licensed MIT.
Indexed from github-skill-repos. Verified against the live GitHub repo.
Key facts
What we have checked
Not checked yet. Dated facts such as prices, releases and repository activity appear here once we have confirmed them from a source.
Health and security
Is bb-local-toolkit looked after, and what do its setup files show
Security check static checks
65 out of 100
- High Hides instructions for the model in an HTML comment (an HTML comment, hidden when the file is displayed, that tells the model to override its instructions): skills/bb-local-toolkit/SKILL.md, line 1100.
- Medium Tells the agent to override the user or its own instructions (quoted, in a code block or described as an attack, possibly an example): skills/bb-local-toolkit/SKILL.md, line 742.
- Note 1 of 1 packages are not pinned to one version, so only the malicious packages list was checked for them, not version advisories.
Alternatives
Alternatives to bb-local-toolkit
| Record | Type | How we know | Checked |
|---|---|---|---|
| offensive-active-directoryThis is an alternative to it | Skill | Matched from the listing text | |
| offensive-advanced-redteamThis is an alternative to it | Skill | Matched from the listing text | |
| offensive-api-abuseThis is an alternative to it | Skill | Matched from the listing text | |
| offensive-jwtThis is an alternative to it | Skill | Matched from the listing text | |
| offensive-sstiThis is an alternative to it | Skill | Matched from the listing text |
Compare
Compare bb-local-toolkit side by side
Sources
Where this comes from
No sources recorded yet. Each source we check is listed here with the date we checked it.
A source shows what was published when we checked it. It does not certify security, performance or a working installation. Read our method.
Changelog
What changed
Security finding
Open-source & AI alternatives
Swap-in tools that solve the same job. Weigh the trade-offs before you commit.
offensive-active-directory
SnailSploit
claude-red is a curated library of offensive security skills designed for the Claude skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level me
offensive-advanced-redteam
SnailSploit
claude-red is a curated library of offensive security skills designed for the Claude skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level me
offensive-api-abuse
SnailSploit
claude-red is a curated library of offensive security skills designed for the Claude skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level me
offensive-jwt
SnailSploit
claude-red is a curated library of offensive security skills designed for the Claude skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level me
offensive-ssti
SnailSploit
claude-red is a curated library of offensive security skills designed for the Claude skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level me
Get the free Developer’s Field Guide
A 27-page field guide to the AI coding workflow with Claude. Claude Code, MCP servers, the prompt patterns that work, and what to delegate. Free.
Enter your work email. We send it straight over, plus a few short notes worth knowing. Unsubscribe any time.