feat: ethical-hacker skill package v0.1.0
This commit is contained in:
skillfactor-pipeline
31
PROVENANCE.md
Normal file
31
PROVENANCE.md
Normal file
@@ -0,0 +1,31 @@
|
|||||||
|
# Data provenance — ethical-hacker
|
||||||
|
|
||||||
|
Where the content of this skill package comes from, counted by
|
||||||
|
content items (tasks, competences, tools, evidence entries, curated
|
||||||
|
knowledge). Rendered live by Gitea:
|
||||||
|
|
||||||
|
```mermaid
|
||||||
|
%%{init: {'theme':'base','themeVariables':{'pie1':'#f9a825','pie2':'#1e88e5','pie3':'#ff355e','pie4':'#d97757','pie5':'#8e24aa','pieOuterStrokeWidth':'0px','pieSectionTextColor':'#fff'}}}%%
|
||||||
|
pie showData
|
||||||
|
title Content sources — ethical-hacker
|
||||||
|
"ESCO (occupation & competences)" : 75
|
||||||
|
"O*NET (tasks & tools)" : 108
|
||||||
|
"Job boards (market evidence)" : 72
|
||||||
|
"Anthropic official Claude skills" : 9
|
||||||
|
"External AI skill packs (mapped)" : 125
|
||||||
|
```
|
||||||
|
|
||||||
|
| Source | Items | Share | Files |
|
||||||
|
|---|---|---|---|
|
||||||
|
| ESCO (occupation & competences) | 75 | 19.3 % | references/profile.md, references/skills.md |
|
||||||
|
| O*NET (tasks & tools) | 108 | 27.8 % | references/tasks.md, references/tools.md |
|
||||||
|
| Job boards (market evidence) | 72 | 18.5 % | references/market.md (full report) + "Market evidence" headline sections |
|
||||||
|
| Wikipedia & AI expert curation | 0 | 0.0 % | glossary, literature, usecases, intake, quality, evals/ |
|
||||||
|
| Anthropic official Claude skills | 9 | 2.3 % | references/ai-skills.md, section "anthropics/skills" (official Claude Code skills) |
|
||||||
|
| External AI skill packs (mapped) | 125 | 32.1 % | references/ai-skills.md (per-source attribution inside) |
|
||||||
|
| Stack Exchange practitioner Q&A (CC-BY-SA) | 0 | 0.0 % | references/practitioner-qa.md (per-entry attribution inside) |
|
||||||
|
|
||||||
|
Licensing: O*NET (USDOL/ETA, CC BY 4.0) · ESCO (© European Union) ·
|
||||||
|
job-ad evidence via official APIs (JSearch/Adzuna) · Wikipedia content
|
||||||
|
paraphrased with source URLs — never copied · external AI skills are
|
||||||
|
linked, not copied (Apache-2.0/MIT/source-available, see ai-skills.md).
|
||||||
61
SKILL.md
Normal file
61
SKILL.md
Normal file
@@ -0,0 +1,61 @@
|
|||||||
|
---
|
||||||
|
name: ethical-hacker
|
||||||
|
description: "Occupational skill for the role 'ethical hacker' (also: network security tester, cybersecurity specialist, cybersecurity tester, ICT security tester, system security tester, red team expert). Use when the user asks for typical ethical hacker work such as: Assess the physical security of servers, systems, or network devices to identify vulnerability to temperature, vandalism, or natural disasters.; Collect stakeholder data to evaluate risk and to develop mitigation strategies.; Conduct network and security system audits, using established criteria."
|
||||||
|
---
|
||||||
|
|
||||||
|
# Ethical Hacker
|
||||||
|
|
||||||
|
Ethical hackers perform security vulnerability assessments and penetration tests in accordance with industry-accepted methods and protocols. They analyse systems for potential vulnerabilities that may result from improper system configuration, hardware or software flaws, or operational weaknesses.
|
||||||
|
|
||||||
|
## Core workflow
|
||||||
|
|
||||||
|
1. Assess the physical security of servers, systems, or network devices to identify vulnerability to temperature, vandalism, or natural disasters.
|
||||||
|
2. Collect stakeholder data to evaluate risk and to develop mitigation strategies.
|
||||||
|
3. Conduct network and security system audits, using established criteria.
|
||||||
|
4. Configure information systems to incorporate principles of least functionality and least access.
|
||||||
|
5. Design security solutions to address known device vulnerabilities.
|
||||||
|
6. Develop and execute tests that simulate the techniques of known cyber threat actors.
|
||||||
|
7. Develop infiltration tests that exploit device vulnerabilities.
|
||||||
|
8. Develop presentations on threat intelligence.
|
||||||
|
|
||||||
|
## How to use this skill
|
||||||
|
|
||||||
|
- Read [references/profile.md](references/profile.md) for the occupation profile and scope.
|
||||||
|
- Consult [references/tasks.md](references/tasks.md) for the full task and activity inventory.
|
||||||
|
- Check [references/skills.md](references/skills.md) for essential vs. optional competences.
|
||||||
|
- Check [references/tools.md](references/tools.md) for the software commonly used in this role.
|
||||||
|
- See [references/ai-skills.md](references/ai-skills.md) — matched external AI agent skills (per-source attribution).
|
||||||
|
|
||||||
|
## Key competences (essential)
|
||||||
|
|
||||||
|
- address problems critically
|
||||||
|
- analyse the context of an organisation
|
||||||
|
- attack vectors
|
||||||
|
- building systems monitoring technology
|
||||||
|
- communicate with stakeholders
|
||||||
|
- computer forensics
|
||||||
|
- computer programming
|
||||||
|
- conduct ICT code review
|
||||||
|
- cyber attack counter-measures
|
||||||
|
- cyber security
|
||||||
|
- develop code exploits
|
||||||
|
- engage with stakeholders
|
||||||
|
- ethical hacking principles
|
||||||
|
- ethics
|
||||||
|
- execute ICT audits
|
||||||
|
|
||||||
|
## Hot technologies
|
||||||
|
|
||||||
|
- Docker
|
||||||
|
- GitHub
|
||||||
|
- Kubernetes
|
||||||
|
- IBM Terraform
|
||||||
|
- Amazon Web Services AWS software
|
||||||
|
- Microsoft SQL Server
|
||||||
|
- ServiceNow
|
||||||
|
- Structured query language SQL
|
||||||
|
- C
|
||||||
|
- Go
|
||||||
|
|
||||||
|
---
|
||||||
|
*Sources: ESCO v1.2.1 (http://data.europa.eu/esco/occupation/76ef0a87-6afe-4560-b5d0-9a086abe45c5), O*NET 30.3 (15-1299.04). See manifest.json for licensing/attribution.*
|
||||||
178
manifest.json
Normal file
178
manifest.json
Normal file
@@ -0,0 +1,178 @@
|
|||||||
|
{
|
||||||
|
"name": "ethical-hacker",
|
||||||
|
"title": "ethical hacker",
|
||||||
|
"version": "0.1.0",
|
||||||
|
"layer": "core",
|
||||||
|
"language": "en",
|
||||||
|
"generated": "2026-07-07",
|
||||||
|
"ids": {
|
||||||
|
"esco_uri": "http://data.europa.eu/esco/occupation/76ef0a87-6afe-4560-b5d0-9a086abe45c5",
|
||||||
|
"esco_code": "2529.4",
|
||||||
|
"isco_group": "2529",
|
||||||
|
"onet_soc": "15-1299.04",
|
||||||
|
"crosswalk_match": "exactMatch"
|
||||||
|
},
|
||||||
|
"sources": [
|
||||||
|
{
|
||||||
|
"name": "ESCO",
|
||||||
|
"version": "1.2.1",
|
||||||
|
"url": "https://esco.ec.europa.eu/"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"name": "O*NET",
|
||||||
|
"version": "30.3",
|
||||||
|
"url": "https://www.onetcenter.org/",
|
||||||
|
"license": "CC BY 4.0"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"attribution": "This package includes information from the O*NET Database (v30.3) by the U.S. Department of Labor, Employment and Training Administration (USDOL/ETA), CC BY 4.0. skillfactor is not endorsed by USDOL/ETA. ESCO data (v1.2.1) (c) European Union, used per the ESCO download conditions: https://esco.ec.europa.eu/en/use-esco/download",
|
||||||
|
"counts": {
|
||||||
|
"tasks": 22,
|
||||||
|
"dwas": 18,
|
||||||
|
"skills_essential": 36,
|
||||||
|
"skills_optional": 38,
|
||||||
|
"software": 67
|
||||||
|
},
|
||||||
|
"enrichment_ai_skills": {
|
||||||
|
"generated": "2026-07-14",
|
||||||
|
"method": "deterministic mapping (ISCO prefix + title/competence keywords)",
|
||||||
|
"sources": {
|
||||||
|
"anthropics/skills": {
|
||||||
|
"repo": "https://github.com/anthropics/skills",
|
||||||
|
"commit": "f6656c1",
|
||||||
|
"license": "Apache-2.0; the document skills (docx/pdf/pptx/xlsx) are source-available \u2014 see the LICENSE.txt in the upstream skill folder",
|
||||||
|
"skills": 6
|
||||||
|
},
|
||||||
|
"obra/superpowers": {
|
||||||
|
"repo": "https://github.com/obra/superpowers",
|
||||||
|
"commit": "d884ae0",
|
||||||
|
"license": "MIT (c) Jesse Vincent",
|
||||||
|
"skills": 12
|
||||||
|
},
|
||||||
|
"wshobson/agents": {
|
||||||
|
"repo": "https://github.com/wshobson/agents",
|
||||||
|
"commit": "6fd3247",
|
||||||
|
"license": "MIT (c) Seth Hobson",
|
||||||
|
"skills": 12
|
||||||
|
},
|
||||||
|
"NVIDIA/skills": {
|
||||||
|
"repo": "https://github.com/NVIDIA/skills",
|
||||||
|
"commit": "153b14b",
|
||||||
|
"license": "CC-BY-4.0 (skills/docs), Apache-2.0 (code)",
|
||||||
|
"skills": 12
|
||||||
|
},
|
||||||
|
"veniceai/skills": {
|
||||||
|
"repo": "https://github.com/veniceai/skills",
|
||||||
|
"commit": "de089fa",
|
||||||
|
"license": "MIT",
|
||||||
|
"skills": 5
|
||||||
|
},
|
||||||
|
"czlonkowski/n8n-skills": {
|
||||||
|
"repo": "https://github.com/czlonkowski/n8n-skills",
|
||||||
|
"commit": "9ea3aa5",
|
||||||
|
"license": "MIT",
|
||||||
|
"skills": 12
|
||||||
|
},
|
||||||
|
"brycewang-stanford/Auto-Empirical-Research-Skills": {
|
||||||
|
"repo": "https://github.com/brycewang-stanford/Auto-Empirical-Research-Skills",
|
||||||
|
"commit": "85bf545",
|
||||||
|
"license": "CC-BY-4.0",
|
||||||
|
"skills": 1
|
||||||
|
},
|
||||||
|
"secondsky/claude-skills": {
|
||||||
|
"repo": "https://github.com/secondsky/claude-skills",
|
||||||
|
"commit": "c4889f6",
|
||||||
|
"license": "MIT",
|
||||||
|
"skills": 1
|
||||||
|
},
|
||||||
|
"rsmdt/the-startup": {
|
||||||
|
"repo": "https://github.com/rsmdt/the-startup",
|
||||||
|
"commit": "ff6a0be",
|
||||||
|
"license": "MIT",
|
||||||
|
"skills": 1
|
||||||
|
},
|
||||||
|
"davila7/claude-code-templates": {
|
||||||
|
"repo": "https://github.com/davila7/claude-code-templates",
|
||||||
|
"commit": "fa79251",
|
||||||
|
"license": "MIT",
|
||||||
|
"skills": 3
|
||||||
|
},
|
||||||
|
"mukul975/Anthropic-Cybersecurity-Skills": {
|
||||||
|
"repo": "https://github.com/mukul975/Anthropic-Cybersecurity-Skills",
|
||||||
|
"commit": "673da1f",
|
||||||
|
"license": "Apache-2.0",
|
||||||
|
"skills": 3
|
||||||
|
},
|
||||||
|
"a5c-ai/babysitter": {
|
||||||
|
"repo": "https://github.com/a5c-ai/babysitter",
|
||||||
|
"commit": "44a5d58b",
|
||||||
|
"license": "MIT",
|
||||||
|
"skills": 4
|
||||||
|
},
|
||||||
|
"mhattingpete/claude-skills-marketplace": {
|
||||||
|
"repo": "https://github.com/mhattingpete/claude-skills-marketplace",
|
||||||
|
"commit": "3fa16a9",
|
||||||
|
"license": "Apache-2.0",
|
||||||
|
"skills": 1
|
||||||
|
},
|
||||||
|
"alirezarezvani/claude-skills": {
|
||||||
|
"repo": "https://github.com/alirezarezvani/claude-skills",
|
||||||
|
"commit": "0241f43",
|
||||||
|
"license": "MIT",
|
||||||
|
"skills": 1
|
||||||
|
},
|
||||||
|
"trailofbits/skills": {
|
||||||
|
"repo": "https://github.com/trailofbits/skills",
|
||||||
|
"commit": "cfe5d7b",
|
||||||
|
"license": "custom (see upstream LICENSE)",
|
||||||
|
"skills": 2
|
||||||
|
},
|
||||||
|
"samber/cc-skills-golang": {
|
||||||
|
"repo": "https://github.com/samber/cc-skills-golang",
|
||||||
|
"commit": "4881c01",
|
||||||
|
"license": "MIT",
|
||||||
|
"skills": 1
|
||||||
|
},
|
||||||
|
"jeremylongshore/claude-code-plugins-plus-skills": {
|
||||||
|
"repo": "https://github.com/jeremylongshore/claude-code-plugins-plus-skills",
|
||||||
|
"commit": "e112938a",
|
||||||
|
"license": "MIT",
|
||||||
|
"skills": 2
|
||||||
|
},
|
||||||
|
"zebbern/claude-code-guide": {
|
||||||
|
"repo": "https://github.com/zebbern/claude-code-guide",
|
||||||
|
"commit": "d2c5280",
|
||||||
|
"license": "MIT",
|
||||||
|
"skills": 1
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"total_skills": 80,
|
||||||
|
"tiers": {
|
||||||
|
"core": 35,
|
||||||
|
"adjacent": 45
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"provenance": {
|
||||||
|
"items": {
|
||||||
|
"esco": 75,
|
||||||
|
"onet": 108,
|
||||||
|
"jobads": 72,
|
||||||
|
"wiki_ai": 0,
|
||||||
|
"anthropic": 9,
|
||||||
|
"ai_skills": 125,
|
||||||
|
"stackx": 0
|
||||||
|
},
|
||||||
|
"share_percent": {
|
||||||
|
"esco": 19.3,
|
||||||
|
"onet": 27.8,
|
||||||
|
"jobads": 18.5,
|
||||||
|
"wiki_ai": 0.0,
|
||||||
|
"anthropic": 2.3,
|
||||||
|
"ai_skills": 32.1,
|
||||||
|
"stackx": 0.0
|
||||||
|
},
|
||||||
|
"method": "content items per source category"
|
||||||
|
},
|
||||||
|
"collar": "white",
|
||||||
|
"computer_work": true
|
||||||
|
}
|
||||||
242
references/ai-skills.md
Normal file
242
references/ai-skills.md
Normal file
@@ -0,0 +1,242 @@
|
|||||||
|
# External AI agent skills — ethical-hacker
|
||||||
|
|
||||||
|
Proven, publicly available AI agent skills mapped to this occupation.
|
||||||
|
Nothing is copied from the sources: every entry is a name, a one-line
|
||||||
|
summary and a link to the upstream skill package. Each section names
|
||||||
|
its source repository, commit, license and retrieval date.
|
||||||
|
|
||||||
|
**Tiers:** `core` = the skill directly exercises a top market hard
|
||||||
|
skill, tool or method (from gated job-ad evidence) or an essential
|
||||||
|
ESCO competence of this occupation; `adjacent` =
|
||||||
|
plausibly useful, secondary. Entries are capped at 12 per source
|
||||||
|
and 80 in total per occupation (core first,
|
||||||
|
strongest matches survive); everything beyond the caps is excluded
|
||||||
|
and logged in the pipeline audit trail, not in this package.
|
||||||
|
|
||||||
|
_Matched deterministically (ISCO group + title/competence keywords,
|
||||||
|
tiered against market evidence + ESCO essentials) by
|
||||||
|
`pipeline/p5_enrich_ai_skills.py` on 2026-07-14._
|
||||||
|
|
||||||
|
## Source: anthropics/skills
|
||||||
|
|
||||||
|
- Repository: [https://github.com/anthropics/skills](https://github.com/anthropics/skills) (commit `f6656c1`, retrieved 2026-07-14)
|
||||||
|
- License: Apache-2.0; the document skills (docx/pdf/pptx/xlsx) are source-available — see the LICENSE.txt in the upstream skill folder
|
||||||
|
|
||||||
|
| Skill | Tier | What it adds | Upstream |
|
||||||
|
|---|---|---|---|
|
||||||
|
| `mcp-builder` | adjacent | Guide for creating high-quality MCP (Model Context Protocol) servers that enable LLMs to interact with external services through well-designed tools. Use when building MCP servers to integrate external APIs or services, whether in Python … | [source](https://github.com/anthropics/skills/tree/main/skills/mcp-builder) |
|
||||||
|
| `webapp-testing` | adjacent | Toolkit for interacting with and testing local web applications using Playwright. Supports verifying frontend functionality, debugging UI behavior, capturing browser screenshots, and viewing browser logs. | [source](https://github.com/anthropics/skills/tree/main/skills/webapp-testing) |
|
||||||
|
| `skill-creator` | adjacent | Create new skills, modify and improve existing skills, and measure skill performance. Use when users want to create a skill from scratch, edit, or optimize an existing skill, run evals to test a skill, benchmark skill performance with … | [source](https://github.com/anthropics/skills/tree/main/skills/skill-creator) |
|
||||||
|
| `claude-api` | adjacent | Reference for the Claude API / Anthropic SDK — model ids, pricing, params, streaming, tool use, MCP, agents, caching, token counting, model migration. TRIGGER — read BEFORE opening the target file; don't skip because it "looks like a … | [source](https://github.com/anthropics/skills/tree/main/skills/claude-api) |
|
||||||
|
| `docx` | adjacent | Use this skill whenever the user wants to create, read, edit, or manipulate Word documents (.docx files) or Word templates (.dotx files). Triggers include: any mention of 'Word doc', 'word document', '.docx', '.dotx', or requests to … | [source](https://github.com/anthropics/skills/tree/main/skills/docx) |
|
||||||
|
| `pdf` | adjacent | Use this skill whenever the user wants to do anything with PDF files. This includes reading or extracting text/tables from PDFs, combining or merging multiple PDFs into one, splitting PDFs apart, rotating pages, adding watermarks, creating … | [source](https://github.com/anthropics/skills/tree/main/skills/pdf) |
|
||||||
|
|
||||||
|
## Source: obra/superpowers
|
||||||
|
|
||||||
|
- Repository: [https://github.com/obra/superpowers](https://github.com/obra/superpowers) (commit `d884ae0`, retrieved 2026-07-14)
|
||||||
|
- License: MIT (c) Jesse Vincent
|
||||||
|
|
||||||
|
| Skill | Tier | What it adds | Upstream |
|
||||||
|
|---|---|---|---|
|
||||||
|
| `requesting-code-review` | core | Use when completing tasks, implementing major features, or before merging to verify work meets requirements | [source](https://github.com/obra/superpowers/tree/main/skills/requesting-code-review) |
|
||||||
|
| `receiving-code-review` | core | Use when receiving code review feedback, before implementing suggestions, especially if feedback seems unclear or technically questionable - requires technical rigor and verification, not performative agreement or blind implementation | [source](https://github.com/obra/superpowers/tree/main/skills/receiving-code-review) |
|
||||||
|
| `executing-plans` | adjacent | Use when you have a written implementation plan to execute in a separate session with review checkpoints | [source](https://github.com/obra/superpowers/tree/main/skills/executing-plans) |
|
||||||
|
| `test-driven-development` | adjacent | Use when implementing any feature or bugfix, before writing implementation code | [source](https://github.com/obra/superpowers/tree/main/skills/test-driven-development) |
|
||||||
|
| `writing-plans` | adjacent | Use when you have a spec or requirements for a multi-step task, before touching code | [source](https://github.com/obra/superpowers/tree/main/skills/writing-plans) |
|
||||||
|
| `finishing-a-development-branch` | adjacent | Use when implementation is complete, all tests pass, and you need to decide how to integrate the work - guides completion of development work by presenting structured options for merge, PR, or cleanup | [source](https://github.com/obra/superpowers/tree/main/skills/finishing-a-development-branch) |
|
||||||
|
| `using-git-worktrees` | adjacent | Use when starting feature work that needs isolation from current workspace or before executing implementation plans - ensures an isolated workspace exists via native tools or git worktree fallback | [source](https://github.com/obra/superpowers/tree/main/skills/using-git-worktrees) |
|
||||||
|
| `brainstorming` | adjacent | You MUST use this before any creative work - creating features, building components, adding functionality, or modifying behavior. Explores user intent, requirements and design before implementation. | [source](https://github.com/obra/superpowers/tree/main/skills/brainstorming) |
|
||||||
|
| `subagent-driven-development` | adjacent | Use when executing implementation plans with independent tasks in the current session | [source](https://github.com/obra/superpowers/tree/main/skills/subagent-driven-development) |
|
||||||
|
| `systematic-debugging` | adjacent | Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes | [source](https://github.com/obra/superpowers/tree/main/skills/systematic-debugging) |
|
||||||
|
| `dispatching-parallel-agents` | adjacent | Use when facing 2+ independent tasks that can be worked on without shared state or sequential dependencies | [source](https://github.com/obra/superpowers/tree/main/skills/dispatching-parallel-agents) |
|
||||||
|
| `verification-before-completion` | adjacent | Use when about to claim work is complete, fixed, or passing, before committing or creating PRs - requires running verification commands and confirming output before making any success claims; evidence before assertions always | [source](https://github.com/obra/superpowers/tree/main/skills/verification-before-completion) |
|
||||||
|
|
||||||
|
## Source: wshobson/agents
|
||||||
|
|
||||||
|
- Repository: [https://github.com/wshobson/agents](https://github.com/wshobson/agents) (commit `6fd3247`, retrieved 2026-07-14)
|
||||||
|
- License: MIT (c) Seth Hobson
|
||||||
|
|
||||||
|
| Skill | Tier | What it adds | Upstream |
|
||||||
|
|---|---|---|---|
|
||||||
|
| `sast-configuration` | core | Configure Static Application Security Testing (SAST) tools for automated vulnerability detection in application code. Use when setting up security scanning, implementing DevSecOps practices, or automating code vulnerability detection. | [source](https://github.com/wshobson/agents/tree/main/plugins/security-scanning/skills/sast-configuration) |
|
||||||
|
| `code-documentation-code-reviewer (agent)` | core | Elite code review expert specializing in modern AI-powered code analysis, security vulnerabilities, performance optimization, and production reliability. Masters static analysis tools, security scanning, and configuration review with … | [source](https://github.com/wshobson/agents/tree/main/plugins/code-documentation/agents/code-reviewer.md) |
|
||||||
|
| `code-refactoring-code-reviewer (agent)` | core | Elite code review expert specializing in modern AI-powered code analysis, security vulnerabilities, performance optimization, and production reliability. Masters static analysis tools, security scanning, and configuration review with … | [source](https://github.com/wshobson/agents/tree/main/plugins/code-refactoring/agents/code-reviewer.md) |
|
||||||
|
| `codebase-cleanup-code-reviewer (agent)` | core | Elite code review expert specializing in modern AI-powered code analysis, security vulnerabilities, performance optimization, and production reliability. Masters static analysis tools, security scanning, and configuration review with … | [source](https://github.com/wshobson/agents/tree/main/plugins/codebase-cleanup/agents/code-reviewer.md) |
|
||||||
|
| `comprehensive-review-code-reviewer (agent)` | core | Elite code review expert specializing in modern AI-powered code analysis, security vulnerabilities, performance optimization, and production reliability. Masters static analysis tools, security scanning, and configuration review with … | [source](https://github.com/wshobson/agents/tree/main/plugins/comprehensive-review/agents/code-reviewer.md) |
|
||||||
|
| `git-pr-workflows-code-reviewer (agent)` | core | Elite code review expert specializing in modern AI-powered code analysis, security vulnerabilities, performance optimization, and production reliability. Masters static analysis tools, security scanning, and configuration review with … | [source](https://github.com/wshobson/agents/tree/main/plugins/git-pr-workflows/agents/code-reviewer.md) |
|
||||||
|
| `stride-analysis-patterns` | core | Apply STRIDE methodology to systematically identify threats. Use when analyzing system security, conducting threat modeling sessions, or creating security documentation. | [source](https://github.com/wshobson/agents/tree/main/plugins/security-scanning/skills/stride-analysis-patterns) |
|
||||||
|
| `tdd-workflows-code-reviewer (agent)` | core | Elite code review expert specializing in modern AI-powered code analysis, security vulnerabilities, performance optimization, and production reliability. Masters static analysis tools, security scanning, and configuration review with … | [source](https://github.com/wshobson/agents/tree/main/plugins/tdd-workflows/agents/code-reviewer.md) |
|
||||||
|
| `comprehensive-review-security-auditor (agent)` | core | Expert security auditor specializing in DevSecOps, comprehensive cybersecurity, and compliance frameworks. Masters vulnerability assessment, threat modeling, secure authentication (OAuth2/OIDC), OWASP standards, cloud security, and … | [source](https://github.com/wshobson/agents/tree/main/plugins/comprehensive-review/agents/security-auditor.md) |
|
||||||
|
| `attack-tree-construction` | core | Build comprehensive attack trees to visualize threat paths. Use when mapping attack scenarios, identifying defense gaps, or communicating security risks to stakeholders. | [source](https://github.com/wshobson/agents/tree/main/plugins/security-scanning/skills/attack-tree-construction) |
|
||||||
|
| `security-compliance-security-auditor (agent)` | core | Expert security auditor specializing in DevSecOps, comprehensive cybersecurity, and compliance frameworks. Masters vulnerability assessment, threat modeling, secure authentication (OAuth2/OIDC), OWASP standards, cloud security, and … | [source](https://github.com/wshobson/agents/tree/main/plugins/security-compliance/agents/security-auditor.md) |
|
||||||
|
| `security-requirement-extraction` | core | Derive security requirements from threat models and business context. Use when translating threats into actionable requirements, creating security user stories, or building security test cases. | [source](https://github.com/wshobson/agents/tree/main/plugins/security-scanning/skills/security-requirement-extraction) |
|
||||||
|
|
||||||
|
## Source: a5c-ai/babysitter
|
||||||
|
|
||||||
|
- Repository: [https://github.com/a5c-ai/babysitter](https://github.com/a5c-ai/babysitter) (commit `44a5d58b`, retrieved 2026-07-14)
|
||||||
|
- License: MIT
|
||||||
|
|
||||||
|
| Skill | Tier | What it adds | Upstream |
|
||||||
|
|---|---|---|---|
|
||||||
|
| `sast-analyzer` | core | Static Application Security Testing orchestration and analysis. Execute Semgrep, Bandit, ESLint security plugins, CodeQL, and other SAST tools. Parse, prioritize, and deduplicate findings across multiple tools with remediation guidance. | [source](https://github.com/a5c-ai/babysitter/tree/44a5d58b/library/specializations/security-compliance/skills/sast-analyzer) |
|
||||||
|
| `cloud-security-testing` | core | Multi-cloud security assessment and penetration testing capabilities. Execute Prowler/ScoutSuite assessments, analyze IAM policies, identify cloud misconfigurations, test permissions, and enumerate cloud resources across AWS/GCP/Azure. | [source](https://github.com/a5c-ai/babysitter/tree/44a5d58b/library/specializations/security-research/skills/cloud-security-testing) |
|
||||||
|
| `security-sandbox` | core | Isolated analysis environment management for malware and exploit testing. Create and manage isolated VMs, configure Cuckoo Sandbox, set up REMnux/FlareVM environments, manage Docker-based analysis containers, and capture filesystem and … | [source](https://github.com/a5c-ai/babysitter/tree/44a5d58b/library/specializations/security-research/skills/security-sandbox) |
|
||||||
|
| `dast-scanner` | core | Dynamic Application Security Testing execution and management. Configure and execute OWASP ZAP and Nuclei scans, run authenticated scanning, manage scan policies and scope, correlate findings with SAST results, and generate comprehensive … | [source](https://github.com/a5c-ai/babysitter/tree/44a5d58b/library/specializations/security-compliance/skills/dast-scanner) |
|
||||||
|
|
||||||
|
## Source: alirezarezvani/claude-skills
|
||||||
|
|
||||||
|
- Repository: [https://github.com/alirezarezvani/claude-skills](https://github.com/alirezarezvani/claude-skills) (commit `0241f43`, retrieved 2026-07-14)
|
||||||
|
- License: MIT
|
||||||
|
|
||||||
|
| Skill | Tier | What it adds | Upstream |
|
||||||
|
|---|---|---|---|
|
||||||
|
| `security-pen-testing` | core | Use when the user asks to perform security audits, penetration testing, vulnerability scanning, OWASP Top 10 checks, or offensive security assessments. Covers static analysis, dependency scanning, secret detection, API security testing, … | [source](https://github.com/alirezarezvani/claude-skills/tree/0241f43/engineering-team/skills/security-pen-testing) |
|
||||||
|
|
||||||
|
## Source: brycewang-stanford/Auto-Empirical-Research-Skills
|
||||||
|
|
||||||
|
- Repository: [https://github.com/brycewang-stanford/Auto-Empirical-Research-Skills](https://github.com/brycewang-stanford/Auto-Empirical-Research-Skills) (commit `85bf545`, retrieved 2026-07-14)
|
||||||
|
- License: CC-BY-4.0
|
||||||
|
|
||||||
|
| Skill | Tier | What it adds | Upstream |
|
||||||
|
|---|---|---|---|
|
||||||
|
| `cs-skills` | core | 10 computer science skills. Trigger: algorithms, systems research, software engineering, security papers. Design: theory, complexity analysis, code-centric research, and security methods. | [source](https://github.com/brycewang-stanford/Auto-Empirical-Research-Skills/tree/85bf545/skills/43-wentorai-research-plugins/skills/domains/cs) |
|
||||||
|
|
||||||
|
## Source: davila7/claude-code-templates
|
||||||
|
|
||||||
|
- Repository: [https://github.com/davila7/claude-code-templates](https://github.com/davila7/claude-code-templates) (commit `fa79251`, retrieved 2026-07-14)
|
||||||
|
- License: MIT
|
||||||
|
|
||||||
|
| Skill | Tier | What it adds | Upstream |
|
||||||
|
|---|---|---|---|
|
||||||
|
| `senior-security` | core | Comprehensive security engineering skill for application security, penetration testing, security architecture, and compliance auditing. Includes security assessment tools, threat modeling, crypto implementation, and security automation. … | [source](https://github.com/davila7/claude-code-templates/tree/fa79251/cli-tool/components/skills/development/senior-security) |
|
||||||
|
| `code-review` | core | Perform code reviews following Sentry engineering practices. Use when reviewing pull requests, examining code changes, or providing feedback on code quality. Covers security, performance, testing, and design review. | [source](https://github.com/davila7/claude-code-templates/tree/fa79251/cli-tool/components/skills/sentry/code-review) |
|
||||||
|
| `loki-mode` | core | Multi-agent autonomous startup system for Claude Code. Triggers on "Loki Mode". Orchestrates 100+ specialized agents across engineering, QA, DevOps, security, data/ML, business operations, marketing, HR, and customer success. Takes PRD to … | [source](https://github.com/davila7/claude-code-templates/tree/fa79251/cli-tool/components/skills/ai-research/loki-mode) |
|
||||||
|
|
||||||
|
## Source: jeremylongshore/claude-code-plugins-plus-skills
|
||||||
|
|
||||||
|
- Repository: [https://github.com/jeremylongshore/claude-code-plugins-plus-skills](https://github.com/jeremylongshore/claude-code-plugins-plus-skills) (commit `e112938a`, retrieved 2026-07-14)
|
||||||
|
- License: MIT
|
||||||
|
|
||||||
|
| Skill | Tier | What it adds | Upstream |
|
||||||
|
|---|---|---|---|
|
||||||
|
| `performing-security-audits` | core | Analyze code, infrastructure, and configurations by conducting comprehensive security audits. It leverages tools within the security-pro-pack plugin, including vulnerability scanning, compliance checking, and cryptography review. Use when … | [source](https://github.com/jeremylongshore/claude-code-plugins-plus-skills/tree/e112938a/plugins/packages/security-pro-pack/skills/performing-security-audits) |
|
||||||
|
| `finding-security-misconfigurations` | core | Configure identify security misconfigurations in infrastructure-as-code, application settings, and system configurations. Use when you need to audit Terraform/CloudFormation templates, check application config files, validate system … | [source](https://github.com/jeremylongshore/claude-code-plugins-plus-skills/tree/e112938a/plugins/security/security-misconfiguration-finder/skills/finding-security-misconfigurations) |
|
||||||
|
|
||||||
|
## Source: mhattingpete/claude-skills-marketplace
|
||||||
|
|
||||||
|
- Repository: [https://github.com/mhattingpete/claude-skills-marketplace](https://github.com/mhattingpete/claude-skills-marketplace) (commit `3fa16a9`, retrieved 2026-07-14)
|
||||||
|
- License: Apache-2.0
|
||||||
|
|
||||||
|
| Skill | Tier | What it adds | Upstream |
|
||||||
|
|---|---|---|---|
|
||||||
|
| `code-auditor` | core | Performs comprehensive codebase analysis covering architecture, code quality, security, performance, testing, and maintainability. Use when user wants to audit code quality, identify technical debt, find security issues, assess test … | [source](https://github.com/mhattingpete/claude-skills-marketplace/tree/3fa16a9/productivity-skills-plugin/skills/code-auditor) |
|
||||||
|
|
||||||
|
## Source: mukul975/Anthropic-Cybersecurity-Skills
|
||||||
|
|
||||||
|
- Repository: [https://github.com/mukul975/Anthropic-Cybersecurity-Skills](https://github.com/mukul975/Anthropic-Cybersecurity-Skills) (commit `673da1f`, retrieved 2026-07-14)
|
||||||
|
- License: Apache-2.0
|
||||||
|
|
||||||
|
| Skill | Tier | What it adds | Upstream |
|
||||||
|
|---|---|---|---|
|
||||||
|
| `performing-binary-exploitation-analysis` | core | Analyze binary exploitation techniques including buffer overflows and ROP chains using pwntools Python library. Covers checksec analysis, gadget discovery with ROPgadget, and exploit development for CTF and authorized security assessments. | [source](https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/673da1f/skills/performing-binary-exploitation-analysis) |
|
||||||
|
| `performing-kubernetes-penetration-testing` | core | Kubernetes penetration testing systematically evaluates cluster security by simulating attacker techniques against the API server, kubelet, etcd, pods, RBAC, network policies, and secrets. Using tools | [source](https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/673da1f/skills/performing-kubernetes-penetration-testing) |
|
||||||
|
| `integrating-sast-into-github-actions-pipeline` | core | This skill covers integrating Static Application Security Testing (SAST) tools—CodeQL and Semgrep—into GitHub Actions CI/CD pipelines. It addresses configuring automated code scanning on pull requests and pushes, tuning rules to reduce … | [source](https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/673da1f/skills/integrating-sast-into-github-actions-pipeline) |
|
||||||
|
|
||||||
|
## Source: rsmdt/the-startup
|
||||||
|
|
||||||
|
- Repository: [https://github.com/rsmdt/the-startup](https://github.com/rsmdt/the-startup) (commit `ff6a0be`, retrieved 2026-07-14)
|
||||||
|
- License: MIT
|
||||||
|
|
||||||
|
| Skill | Tier | What it adds | Upstream |
|
||||||
|
|---|---|---|---|
|
||||||
|
| `security-assessment` | core | Vulnerability review, threat modeling, OWASP patterns, and secure coding assessment. Use when reviewing code security, designing secure systems, performing threat analysis, or validating security implementations. | [source](https://github.com/rsmdt/the-startup/tree/ff6a0be/plugins/team/skills/quality/security-assessment) |
|
||||||
|
|
||||||
|
## Source: samber/cc-skills-golang
|
||||||
|
|
||||||
|
- Repository: [https://github.com/samber/cc-skills-golang](https://github.com/samber/cc-skills-golang) (commit `4881c01`, retrieved 2026-07-14)
|
||||||
|
- License: MIT
|
||||||
|
|
||||||
|
| Skill | Tier | What it adds | Upstream |
|
||||||
|
|---|---|---|---|
|
||||||
|
| `golang-continuous-integration` | core | CI/CD pipeline configuration using GitHub Actions for Golang projects — testing, linting, SAST, security scanning, code coverage, Dependabot, Renovate, GoReleaser, code review automation, and release pipelines. Use when setting up or … | [source](https://github.com/samber/cc-skills-golang/tree/4881c01/skills/golang-continuous-integration) |
|
||||||
|
|
||||||
|
## Source: secondsky/claude-skills
|
||||||
|
|
||||||
|
- Repository: [https://github.com/secondsky/claude-skills](https://github.com/secondsky/claude-skills) (commit `c4889f6`, retrieved 2026-07-14)
|
||||||
|
- License: MIT
|
||||||
|
|
||||||
|
| Skill | Tier | What it adds | Upstream |
|
||||||
|
|---|---|---|---|
|
||||||
|
| `cybersecurity` | core | OSS-only security for OWASP Top 10, pentest, vuln testing (XSS, SSRF, CSRF, business-logic, Host header), threat modeling (STRIDE, ATT&CK), Sigma rules, SAST, code audit, AI/LLM red-team, or replacing paid tools (Burp, Nessus, Splunk) with … | [source](https://github.com/secondsky/claude-skills/tree/c4889f6/plugins/cybersecurity/skills/cybersecurity) |
|
||||||
|
|
||||||
|
## Source: trailofbits/skills
|
||||||
|
|
||||||
|
- Repository: [https://github.com/trailofbits/skills](https://github.com/trailofbits/skills) (commit `cfe5d7b`, retrieved 2026-07-14)
|
||||||
|
- License: custom (see upstream LICENSE)
|
||||||
|
|
||||||
|
| Skill | Tier | What it adds | Upstream |
|
||||||
|
|---|---|---|---|
|
||||||
|
| `audit-prep-assistant` | core | Prepares codebases for security review using Trail of Bits' checklist. Helps set review goals, runs static analysis tools, increases test coverage, removes dead code, ensures accessibility, and generates documentation (flowcharts, user … | [source](https://github.com/trailofbits/skills/tree/cfe5d7b/plugins/building-secure-contracts/skills/audit-prep-assistant) |
|
||||||
|
| `testing-handbook-generator` | core | Meta-skill that analyzes the Trail of Bits Testing Handbook (appsec.guide) and generates Claude Code skills for security testing tools and techniques. Use when creating new skills based on handbook content. | [source](https://github.com/trailofbits/skills/tree/cfe5d7b/plugins/testing-handbook-skills/skills/testing-handbook-generator) |
|
||||||
|
|
||||||
|
## Source: zebbern/claude-code-guide
|
||||||
|
|
||||||
|
- Repository: [https://github.com/zebbern/claude-code-guide](https://github.com/zebbern/claude-code-guide) (commit `d2c5280`, retrieved 2026-07-14)
|
||||||
|
- License: MIT
|
||||||
|
|
||||||
|
| Skill | Tier | What it adds | Upstream |
|
||||||
|
|---|---|---|---|
|
||||||
|
| `audit-flow` | core | Interactive system flow tracing across CODE, API, AUTH, DATA, NETWORK layers with SQLite persistence and Mermaid export. Use for security audits, compliance documentation, flow tracing, feature ideation, brainstorming, debugging, … | [source](https://github.com/zebbern/claude-code-guide/tree/d2c5280/skills/audit-flow) |
|
||||||
|
|
||||||
|
## Source: czlonkowski/n8n-skills
|
||||||
|
|
||||||
|
- Repository: [https://github.com/czlonkowski/n8n-skills](https://github.com/czlonkowski/n8n-skills) (commit `9ea3aa5`, retrieved 2026-07-14)
|
||||||
|
- License: MIT
|
||||||
|
|
||||||
|
| Skill | Tier | What it adds | Upstream |
|
||||||
|
|---|---|---|---|
|
||||||
|
| `n8n-mcp-tools-expert` | adjacent | Expert guide for using n8n-mcp MCP tools effectively. Use when searching for nodes, validating configurations, accessing templates, managing workflows, managing credentials, auditing instance security, or using any n8n-mcp tool. Provides … | [source](https://github.com/czlonkowski/n8n-skills/tree/9ea3aa5/skills/n8n-mcp-tools-expert) |
|
||||||
|
| `using-n8n-mcp-skills` | adjacent | Use when building, editing, validating, testing, or debugging an n8n workflow through the n8n-mcp MCP server — designing a flow, configuring a node, writing an expression or Code node, wiring credentials, or fixing one that misbehaves. The … | [source](https://github.com/czlonkowski/n8n-skills/tree/9ea3aa5/skills/using-n8n-mcp-skills) |
|
||||||
|
| `n8n-agents` | adjacent | Design n8n AI agents the right way. Use when building or editing any @n8n/n8n-nodes-langchain.* AI node — an AI Agent, LLM chain, Text Classifier, or Information Extractor — and whenever the user mentions AI agents, LLM with tools, tool … | [source](https://github.com/czlonkowski/n8n-skills/tree/9ea3aa5/skills/n8n-agents) |
|
||||||
|
| `n8n-code-tool` | adjacent | Write JavaScript or Python for the n8n Custom Code Tool (@n8n/n8n-nodes-langchain.toolCode) — the AI-agent-callable tool, NOT the workflow Code node. Use when building a Code Tool attached to an AI Agent, writing code that an LLM will … | [source](https://github.com/czlonkowski/n8n-skills/tree/9ea3aa5/skills/n8n-code-tool) |
|
||||||
|
| `n8n-code-python` | adjacent | Write Python code in n8n Code nodes. Use when writing Python in n8n, using _input/_json/_node syntax, working with standard library, or need to understand Python limitations in n8n Code nodes. Use this skill when the user specifically … | [source](https://github.com/czlonkowski/n8n-skills/tree/9ea3aa5/skills/n8n-code-python) |
|
||||||
|
| `n8n-subworkflows` | adjacent | Build reusable, composable n8n sub-workflows. Use when extracting shared logic, building anything multi-step or reused across workflows, or any workflow over ~10 nodes — and whenever the user mentions sub-workflows, Execute Workflow, … | [source](https://github.com/czlonkowski/n8n-skills/tree/9ea3aa5/skills/n8n-subworkflows) |
|
||||||
|
| `n8n-code-javascript` | adjacent | Write JavaScript code in n8n Code nodes. Use when writing JavaScript in n8n, using $input/$json/$node syntax, making HTTP requests with this.helpers / the $helpers global, working with dates using DateTime, troubleshooting Code node … | [source](https://github.com/czlonkowski/n8n-skills/tree/9ea3aa5/skills/n8n-code-javascript) |
|
||||||
|
| `n8n-workflow-patterns` | adjacent | Proven workflow architectural patterns from real n8n workflows. Use when building new workflows, designing workflow structure, choosing workflow patterns, planning workflow architecture, or asking about webhook processing, HTTP API … | [source](https://github.com/czlonkowski/n8n-skills/tree/9ea3aa5/skills/n8n-workflow-patterns) |
|
||||||
|
| `n8n-binary-and-data` | adjacent | Handle files and binary data in n8n correctly. Use when working with files, images, PDFs, attachments, uploads or downloads, base64, vision/multimodal input, or when an AI agent needs a file as tool input or output — and whenever the user … | [source](https://github.com/czlonkowski/n8n-skills/tree/9ea3aa5/skills/n8n-binary-and-data) |
|
||||||
|
| `n8n-error-handling` | adjacent | Wire n8n error handling so failures are loud, structured, and recoverable. Use when building any webhook/API workflow, a scheduled or unattended workflow, or any path where a silent failure would drop user-visible work — and whenever the … | [source](https://github.com/czlonkowski/n8n-skills/tree/9ea3aa5/skills/n8n-error-handling) |
|
||||||
|
| `n8n-multi-instance` | adjacent | Use when an n8n-mcp account targets more than one n8n instance — i.e. the `n8n_instances` tool is available, the user mentions multiple n8n instances or environments (prod vs staging, several teams or clients), a workflow / datatable / … | [source](https://github.com/czlonkowski/n8n-skills/tree/9ea3aa5/skills/n8n-multi-instance) |
|
||||||
|
| `n8n-self-hosting` | adjacent | Deploy a production self-hosted n8n end-to-end to a fresh Linux VM over SSH, using Docker Compose behind a Caddy reverse proxy with automatic HTTPS. Use whenever the user wants to self-host, install, set up, provision, or deploy n8n on … | [source](https://github.com/czlonkowski/n8n-skills/tree/9ea3aa5/skills/n8n-self-hosting) |
|
||||||
|
|
||||||
|
## Source: NVIDIA/skills
|
||||||
|
|
||||||
|
- Repository: [https://github.com/NVIDIA/skills](https://github.com/NVIDIA/skills) (commit `153b14b`, retrieved 2026-07-14)
|
||||||
|
- License: CC-BY-4.0 (skills/docs), Apache-2.0 (code)
|
||||||
|
|
||||||
|
| Skill | Tier | What it adds | Upstream |
|
||||||
|
|---|---|---|---|
|
||||||
|
| `hsb-app` | adjacent | Discover and run Holoscan Sensor Bridge example applications on a connected devkit. Filters available apps by the user's platform, HSB software version, board type, and sensors. Supports timed execution, failure analysis, code-edit … | [source](https://github.com/NVIDIA/skills/tree/153b14b/skills/hsb-app) |
|
||||||
|
| `mcore-linting-and-formatting` | adjacent | Linting and formatting for Megatron-LM. Covers running autoformat.sh, tools (ruff, black, isort, pylint, mypy), and code style rules. | [source](https://github.com/NVIDIA/skills/tree/153b14b/skills/mcore-linting-and-formatting) |
|
||||||
|
| `nemo-rl-session-memory` | adjacent | Manage durable working-session memory for coding agents. Use when a user asks to preserve or recover agent context across disconnects, VS Code restarts, long-running work, handoffs, or any session where important state should be written … | [source](https://github.com/NVIDIA/skills/tree/153b14b/skills/nemo-rl-session-memory) |
|
||||||
|
| `tilegym-converting-cutile-to-julia` | adjacent | Converts cuTile Python GPU kernels (@ct.kernel) to cuTile.jl Julia equivalents. Handles kernel syntax translation, 0-indexed to 1-indexed conversion, broadcasting differences, memory layout (row-major to column-major), type system mapping, … | [source](https://github.com/NVIDIA/skills/tree/153b14b/skills/tilegym-converting-cutile-to-julia) |
|
||||||
|
| `cuopt-developer` | adjacent | Modify, build, test, debug, and contribute to NVIDIA cuOpt (C++/CUDA, Python, server, CI). Use for solver internals, PRs, DCO, and code conventions. | [source](https://github.com/NVIDIA/skills/tree/153b14b/skills/cuopt-developer) |
|
||||||
|
| `nemo-mbridge-perf-hierarchical-context-parallel` | adjacent | Operational guide for enabling hierarchical context parallelism in Megatron-Bridge, including config knobs, code anchors, pitfalls, and verification. | [source](https://github.com/NVIDIA/skills/tree/153b14b/skills/nemo-mbridge-perf-hierarchical-context-parallel) |
|
||||||
|
| `tilegym-cutile-autotuning` | adjacent | Use when adding, modifying, optimizing, or debugging CuTile autotuning code. Trigger signals: `exhaustive_search` / `replace_hints` / `hints_fn` / `cuda.tile.tune` in code, `autotune` in filenames, or correctness/performance issues in … | [source](https://github.com/NVIDIA/skills/tree/153b14b/skills/tilegym-cutile-autotuning) |
|
||||||
|
| `cupynumeric-migration-readiness` | adjacent | Pre-migration readiness assessor for porting NumPy to cuPyNumeric. Use BEFORE substantial porting work begins when the user asks whether code will scale on GPU, whether they should migrate to cuPyNumeric, which NumPy patterns transfer … | [source](https://github.com/NVIDIA/skills/tree/153b14b/skills/cupynumeric-migration-readiness) |
|
||||||
|
| `dali-dynamic-mode` | adjacent | DALI imperative dynamic mode (`nvidia.dali.experimental.dynamic`, ndd): use when working on ndd code or migrating pipelines; skip pipeline-only tasks. | [source](https://github.com/NVIDIA/skills/tree/153b14b/plugins/nvidia-skills/skills/dali-dynamic-mode) |
|
||||||
|
| `deepstream-dev` | adjacent | NVIDIA DeepStream SDK 9.0 development with Python pyservicemaker API. Use when building video analytics pipelines, GStreamer-based video processing, TensorRT inference integration, object detection/tracking, or Kafka/message broker … | [source](https://github.com/NVIDIA/skills/tree/153b14b/skills/deepstream-dev) |
|
||||||
|
| `earth2studio-discover` | adjacent | Find Earth2Studio models, data sources, and examples for a weather/climate use case. Do NOT use for writing inference code, downloading data, or installation. | [source](https://github.com/NVIDIA/skills/tree/153b14b/skills/earth2studio-discover) |
|
||||||
|
| `earth2studio-install` | adjacent | Guide installing Earth2Studio via uv or pip, selecting model extras, and configuring the environment. Do NOT use for writing inference code, choosing models, or PhysicsNeMo questions. | [source](https://github.com/NVIDIA/skills/tree/153b14b/skills/earth2studio-install) |
|
||||||
|
|
||||||
|
## Source: veniceai/skills
|
||||||
|
|
||||||
|
- Repository: [https://github.com/veniceai/skills](https://github.com/veniceai/skills) (commit `de089fa`, retrieved 2026-07-14)
|
||||||
|
- License: MIT
|
||||||
|
|
||||||
|
| Skill | Tier | What it adds | Upstream |
|
||||||
|
|---|---|---|---|
|
||||||
|
| `venice-errors` | adjacent | Handle Venice API errors correctly. Covers the StandardError / DetailedError / ContentViolationError / X402InferencePaymentRequired body shapes, every meaningful status code (400, 401, 402, 403, 415, 422, 429, 500, 503, 504), the 402 … | [source](https://github.com/veniceai/skills/tree/de089fa/skills/venice-errors) |
|
||||||
|
| `venice-api-overview` | adjacent | High-level map of the Venice.ai API - base URL, authentication modes, endpoint categories, response headers, pricing model, error shape, and versioning. Load this first when starting any Venice integration. | [source](https://github.com/veniceai/skills/tree/de089fa/skills/venice-api-overview) |
|
||||||
|
| `venice-api-keys` | adjacent | Manage Venice API keys. Covers GET/POST/PATCH/DELETE /api_keys, GET /api_keys/{id}, GET /api_keys/rate_limits, GET /api_keys/rate_limits/log, the two-step /api_keys/generate_web3_key wallet flow, INFERENCE vs ADMIN key types, and per-key … | [source](https://github.com/veniceai/skills/tree/de089fa/skills/venice-api-keys) |
|
||||||
|
| `venice-responses` | adjacent | Use Venice's Alpha POST /responses endpoint - an OpenAI-compatible Responses API with typed output blocks (reasoning, message, function_call, web_search_call). Covers request shape, streaming, differences from /chat/completions, supported … | [source](https://github.com/veniceai/skills/tree/de089fa/skills/venice-responses) |
|
||||||
|
| `venice-auth` | adjacent | Authenticate to the Venice API with a Bearer API key or with an x402 / SIWE wallet. Covers header formats, the SIWE message fields, TTL and nonce rules, the venice-x402-client SDK, and how to choose between the two modes. | [source](https://github.com/veniceai/skills/tree/de089fa/skills/venice-auth) |
|
||||||
86
references/berufsbild-de.md
Normal file
86
references/berufsbild-de.md
Normal file
@@ -0,0 +1,86 @@
|
|||||||
|
# Berufsbild (Deutschland) — Ethical Hacker
|
||||||
|
|
||||||
|
> **Quelle:** BERUFENET, Bundesagentur für Arbeit — Beruf-ID 133432,
|
||||||
|
> KldB 2010: B 43384 · via öffentliche BERUFENET-API,
|
||||||
|
> abgerufen 2026-07-12. Automatisches Label-Matching
|
||||||
|
> (Score 1.00); Inhalte paraphrasiert/gekürzt, Volltext beim
|
||||||
|
> Original: https://web.arbeitsagentur.de/berufenet/beruf/133432
|
||||||
|
|
||||||
|
## Aufgaben und Tätigkeiten kompakt
|
||||||
|
|
||||||
|
Ethical Hacker werden in der Regel von Unternehmen beauftragt, die Sicherheit ihrer IT-Systeme zu testen. Dazu führen sie z.B. auch: Pentest
|
||||||
|
Informationstechnik (IT): Prüfung der Sicherheit möglichst aller Systembestandteile und Anwendungen eines Netzwerks oder Softwaresystems; dazu werden Mittel und Methoden verwendet, die auch Angreifende oder Hacker bzw. Hackerinnnen verwenden würden, um unautorisiert in das System einzudringen (sog. Penetration)
|
||||||
|
" name="Penetrationstest">Penetrationstests oder Quellcode-Analysen durch. Sie setzen spezielle Tools ein, um Soft- oder Hardware so lange anzugreifen, bis es ihnen gelingt, eine Sicherheitslücke auszunutzen und ins System einzudringen. Wenn sie die netzwerk- und arbeitsplatzspezifischen Risiken sowie Schwachstellen identifiziert haben, analysieren sie deren Ursachen und dokumentieren ihre Ergebnisse. Zudem schlagen sie neue IT-Sicherheitslösungen oder -maßnahmen vor, um Bedrohungen vorzubeugen. Ethical Hacker achten stets darauf, im Sinne des Unternehmens zu handeln sowie geltende Gesetze und Vorschriften zur Daten- und Informationssicherheit einzuhalten.
|
||||||
|
|
||||||
|
## Tätigkeitsbezeichnungen
|
||||||
|
|
||||||
|
Ethical Hacker
|
||||||
|
|
||||||
|
Auch übliche Berufsbezeichnungen/SynonymeConsultant Penetration Tester/in
|
||||||
|
|
||||||
|
IT-Schwachstellenanalyst/in
|
||||||
|
|
||||||
|
Pen-Tester/in
|
||||||
|
|
||||||
|
Penetrationstester/in
|
||||||
|
|
||||||
|
Security Analyst
|
||||||
|
|
||||||
|
Berufsbezeichnungen in englischer SpracheEthical Hacker (m/f)
|
||||||
|
|
||||||
|
Penetration Tester (m/f)
|
||||||
|
|
||||||
|
Vulnerability researcher (m/f)
|
||||||
|
|
||||||
|
## Die Tätigkeit im Überblick
|
||||||
|
|
||||||
|
Ethical Hacker greifen unternehmenseigene IT-Systeme im Auftrag des Unternehmen an, um Sicherheitslücken aufzudecken und zu schließen und so die Daten vor echten Eindringlingen zu schützen.
|
||||||
|
|
||||||
|
## Trends
|
||||||
|
|
||||||
|
Wachstumsmarkt IT-SicherheitDie zunehmende Vernetzung durch das Internet der Dinge (IoT), Mit "Big Data" bezeichnet man große Mengen strukturierter oder unstrukturierter Daten, deren Umfang zudem schnell wächst beziehungsweise die sehr rasch ausgetauscht werden. Die Daten können in unterschiedlichsten Formaten, etwa als Text-, Bild- oder Videodateien vorliegen. Es können zum Beispiel Produktions- und Transportdaten von Unternehmen sein, Daten aus Finanztransaktionen oder zum Online-Suchverhalten. Mit manuellen und herkömmlichen Methoden der Datenverarbeitung kann diese Datenflut nicht mehr ausgewertet werden. Es bedarf einer speziellen Big-Data-Analyse, basierend auf Algorithmen und intelligenten Mustererkennungstechnologien. s. auch "Data Mining".
|
||||||
|
" name="Big Data">Big Data, Bereitstellung von Computerressourcen über das Internet. Infrastruktur wie Server oder Datenspeicher, aber auch Software, Plattformen und Funktionen müssen nicht auf lokalen Computern vorgehalten werden, sondern stehen als Dienstleistung bereit. IT-Dienstleistungen können so dynamisch an den Bedarf angepasst angeboten, genutzt und abgerechnet werden.
|
||||||
|
" name="Cloud-Computing">Cloud-Computing, Onlinehandel etc. bergen für Privatpersonen und Unternehmen viele Sicherheitsrisiken. Datendiebstahl durch Phishing-Attacken, gefälschte elektronische Karten, Hackereinbrüche sowie Cyberterrorismus erfordern eine ständige Anpassung der Sicherheitsmaßnahmen in Unternehmen und Behörden sowie entsprechende Schulungen der Beschäftigten. Eine dieser Maßnahmen ist die sogenannte Cyber Resilience, die eine große Rolle im Schutz der (personenbezogenen) Daten spielt. Der Einsatz von Künstlicher Intelligenz (KI), um Cyberangriffe zu erkennen und zu bekämpfen, spielt zudem eine immer größere Rolle in der IT-Sicherheit. Die Nachfrage nach IT-Sicherheitsexperten, die sowohl traditionelle als auch innovative Ansätze beherrschen, steigt daher stetig.
|
||||||
|
|
||||||
|
## Aufgaben und Tätigkeiten im Einzelnen
|
||||||
|
|
||||||
|
Kunden/Kundinnen oder Unternehmensleitung bezüglich IT-Sicherheit beraten und unterstützen
|
||||||
|
aktuelle Bestandsaufnahme der Sicherheitsvorkehrungen eines Unternehmens machen
|
||||||
|
|
||||||
|
gemeinsam mit der Kundschaft bzw. der Unternehmensleitung Rahmenbedingungen für auch: Pentest
|
||||||
|
Informationstechnik (IT): Prüfung der Sicherheit möglichst aller Systembestandteile und Anwendungen eines Netzwerks oder Softwaresystems; dazu werden Mittel und Methoden verwendet, die auch Angreifende oder Hacker bzw. Hackerinnnen verwenden würden, um unautorisiert in das System einzudringen (sog. Penetration)
|
||||||
|
" name="Penetrationstest">Penetrationstests festlegen
|
||||||
|
|
||||||
|
Projekte planen und vorbereiten
|
||||||
|
|
||||||
|
Angebote erstellen
|
||||||
|
|
||||||
|
|
||||||
|
Sicherheit der IT-Systeme, insbesondere Webanwendungen und Software, z.B. durch Penetration oder Quellcode-Analysen testen
|
||||||
|
Analysen der IT-Sicherheit vor Ort oder extern durchführen
|
||||||
|
|
||||||
|
netzwerk- und arbeitsplatzspezifische Risiken und Schwachstellen identifizieren
|
||||||
|
|
||||||
|
Cyber-Angriffe gegen das IT-System dokumentieren
|
||||||
|
|
||||||
|
Testergebnisse und Vorgehen in Berichten festhalten
|
||||||
|
|
||||||
|
|
||||||
|
Sicherheitslösungen entsprechend den geltenden technischen Standards sowie Gesetzen und Vorschriften der Daten- und Informationssicherheit konzipieren
|
||||||
|
mit Fachkräften der verschiedenen Bereiche und Ebenen auf Grundlage der Testergebnisse Lösungen erarbeiten
|
||||||
|
|
||||||
|
nach Ursachenanalysen kundenspezifische Maßnahmen zur Behebung gefundener Sicherheitslücken definieren
|
||||||
|
|
||||||
|
Maßnahmenpläne erstellen und sie hinsichtlich Notwendigkeit, Anpassungsbedarf und Durchsetzungsmöglichkeiten überprüfen und detaillieren
|
||||||
|
|
||||||
|
interne IT-Sicherheitsmaßnahmen durch Entwicklung und Einführung innovativer Sicherheitsverfahren realisieren
|
||||||
|
|
||||||
|
## Arbeitsbereiche/Branchen
|
||||||
|
|
||||||
|
Ethical Hacker finden Beschäftigung
|
||||||
|
in System- und Softwarehäusern
|
||||||
|
|
||||||
|
bei IT-Dienstleistungsunternehmen
|
||||||
|
|
||||||
|
Sie finden auch Beschäftigung
|
||||||
|
in IT-Abteilungen von Unternehmen aller Wirtschaftsbereiche
|
||||||
83
references/market.md
Normal file
83
references/market.md
Normal file
@@ -0,0 +1,83 @@
|
|||||||
|
# Market evidence report — ethical-hacker
|
||||||
|
|
||||||
|
Source: **13 real job ads** (JSearch API, countries: us 13), extracted into the MSSQL evidence store; as of 2026-07-11.
|
||||||
|
This report contains extracted, aggregated facts only — no ad text is
|
||||||
|
reproduced (copyright / platform terms).
|
||||||
|
|
||||||
|
## Seniority distribution
|
||||||
|
|
||||||
|
| Seniority | Ads | Share |
|
||||||
|
|---|---|---|
|
||||||
|
| mid | 9 | 69 % |
|
||||||
|
| senior | 4 | 31 % |
|
||||||
|
|
||||||
|
## Tools — full market ranking
|
||||||
|
|
||||||
|
| # | Item | Ads | Share |
|
||||||
|
|---|---|---|---|
|
||||||
|
| 1 | Cobalt Strike | 4 | 31 % |
|
||||||
|
| 2 | Metasploit | 4 | 31 % |
|
||||||
|
| 3 | frida | 3 | 23 % |
|
||||||
|
| 4 | Mythic | 3 | 23 % |
|
||||||
|
| 5 | PoshC2 | 3 | 23 % |
|
||||||
|
|
||||||
|
## Hard skills — full market ranking
|
||||||
|
|
||||||
|
| # | Item | Ads | Share |
|
||||||
|
|---|---|---|---|
|
||||||
|
| 1 | penetration testing | 9 | 69 % |
|
||||||
|
| 2 | ethical hacking | 5 | 38 % |
|
||||||
|
| 3 | network security | 5 | 38 % |
|
||||||
|
| 4 | vulnerability identification | 5 | 38 % |
|
||||||
|
| 5 | threat analysis | 4 | 31 % |
|
||||||
|
| 6 | vulnerability assessment | 4 | 31 % |
|
||||||
|
| 7 | code review | 3 | 23 % |
|
||||||
|
| 8 | exploit development | 3 | 23 % |
|
||||||
|
|
||||||
|
## Methods — full market ranking
|
||||||
|
|
||||||
|
| # | Item | Ads | Share |
|
||||||
|
|---|---|---|---|
|
||||||
|
|
||||||
|
## Responsibilities — full market ranking
|
||||||
|
|
||||||
|
| # | Item | Ads | Share |
|
||||||
|
|---|---|---|---|
|
||||||
|
| 1 | vulnerability identification | 4 | 31 % |
|
||||||
|
| 2 | penetration testing | 3 | 23 % |
|
||||||
|
| 3 | technical documentation | 3 | 23 % |
|
||||||
|
|
||||||
|
## Regional breakdown
|
||||||
|
|
||||||
|
> **Corpus note:** 13 relevant ads in total — below the 100-ad target for a fully reliable ranking. Percentages above should be read as indicative.
|
||||||
|
|
||||||
|
### US (us)
|
||||||
|
|
||||||
|
**Insufficient evidence** — 13 ads (minimum for a regional ranking: 30). No ranking is reported for this region.
|
||||||
|
|
||||||
|
### UK (gb)
|
||||||
|
|
||||||
|
**Insufficient evidence** — 0 ads (minimum for a regional ranking: 30). No ranking is reported for this region.
|
||||||
|
|
||||||
|
### EU/DACH (de, at, ch, nl)
|
||||||
|
|
||||||
|
**Insufficient evidence** — 0 ads (minimum for a regional ranking: 30). No ranking is reported for this region.
|
||||||
|
|
||||||
|
|
||||||
|
## Job title variants in the market
|
||||||
|
|
||||||
|
| Title | Ads |
|
||||||
|
|---|---|
|
||||||
|
| Ethical Hacker (remote) | 2 |
|
||||||
|
| Ethical Hacker/IT-Security (m/w/d) | 2 |
|
||||||
|
| Ethical Hacker Needed at Web Agency. Work Remotely USA only 8 | 1 |
|
||||||
|
| Ethical Hacker/Cyber Specialist; Senior | 1 |
|
||||||
|
| Ethical Hacker/Cyber Hunt Expert | 1 |
|
||||||
|
| Ethical Hacker/Cyber Hunt Specialist (Senior) | 1 |
|
||||||
|
| Manual Ethical Hacker | 1 |
|
||||||
|
| Manual Ethical Hacker - Full-time | 1 |
|
||||||
|
| Penetration Tester | 1 |
|
||||||
|
| Penetration Tester / Ethical Hacker | 1 |
|
||||||
|
| Senior Manual Ethical Hacker | 1 |
|
||||||
|
|
||||||
|
Methodology: entities extracted per ad ({hard_skills, tools, methods, responsibilities, seniority}), normalized, counted as DISTINCT ads per entity; report threshold ≥ 3 ads. Headline sections in skills.md/tools.md use the stricter ≥ 20 % threshold.
|
||||||
27
references/profile.md
Normal file
27
references/profile.md
Normal file
@@ -0,0 +1,27 @@
|
|||||||
|
# Occupation profile — ethical hacker
|
||||||
|
|
||||||
|
- **ESCO URI:** http://data.europa.eu/esco/occupation/76ef0a87-6afe-4560-b5d0-9a086abe45c5
|
||||||
|
- **ESCO code:** 2529.4
|
||||||
|
- **ISCO-08 group:** 2529 — Database and network professionals not elsewhere classified
|
||||||
|
- **O*NET-SOC:** 15-1299.04 — Penetration Testers (match: exactMatch)
|
||||||
|
|
||||||
|
## Description (ESCO)
|
||||||
|
|
||||||
|
Ethical hackers perform security vulnerability assessments and penetration tests in accordance with industry-accepted methods and protocols. They analyse systems for potential vulnerabilities that may result from improper system configuration, hardware or software flaws, or operational weaknesses.
|
||||||
|
|
||||||
|
## Definition
|
||||||
|
|
||||||
|
nan
|
||||||
|
|
||||||
|
## Alternative labels
|
||||||
|
|
||||||
|
- network security tester
|
||||||
|
- cybersecurity specialist
|
||||||
|
- cybersecurity tester
|
||||||
|
- ICT security tester
|
||||||
|
- system security tester
|
||||||
|
- red team expert
|
||||||
|
- penetration tester
|
||||||
|
- pentester
|
||||||
|
- offensive cybersecurity expert
|
||||||
|
- vulnerability analyst
|
||||||
128
references/skills.md
Normal file
128
references/skills.md
Normal file
@@ -0,0 +1,128 @@
|
|||||||
|
# Competences — ethical hacker
|
||||||
|
|
||||||
|
Source: ESCO v1.2.1 occupation-skill relations (http://data.europa.eu/esco/occupation/76ef0a87-6afe-4560-b5d0-9a086abe45c5).
|
||||||
|
|
||||||
|
## Essential
|
||||||
|
|
||||||
|
- **address problems critically** (skill/competence)
|
||||||
|
- **analyse the context of an organisation** (skill/competence)
|
||||||
|
- **attack vectors** (knowledge)
|
||||||
|
- **building systems monitoring technology** (knowledge)
|
||||||
|
- **communicate with stakeholders** (skill/competence)
|
||||||
|
- **computer forensics** (knowledge)
|
||||||
|
- **computer programming** (knowledge)
|
||||||
|
- **conduct ICT code review** (skill/competence)
|
||||||
|
- **cyber attack counter-measures** (knowledge)
|
||||||
|
- **cyber security** (knowledge)
|
||||||
|
- **develop code exploits** (skill/competence)
|
||||||
|
- **engage with stakeholders** (skill/competence)
|
||||||
|
- **ethical hacking principles** (knowledge)
|
||||||
|
- **ethics** (knowledge)
|
||||||
|
- **execute ICT audits** (skill/competence)
|
||||||
|
- **execute social engineering tests** (skill/competence)
|
||||||
|
- **execute software tests** (skill/competence)
|
||||||
|
- **ICT infrastructure** (knowledge)
|
||||||
|
- **ICT network security risks** (knowledge)
|
||||||
|
- **ICT security standards** (knowledge)
|
||||||
|
- **ICT system integration** (knowledge)
|
||||||
|
- **identify ICT security risks** (skill/competence)
|
||||||
|
- **identify ICT system weaknesses** (skill/competence)
|
||||||
|
- **implement ICT risk management** (skill/competence)
|
||||||
|
- **information security strategy** (knowledge)
|
||||||
|
- **legal requirements of ICT products** (knowledge)
|
||||||
|
- **manage system security** (skill/competence)
|
||||||
|
- **monitor system performance** (skill/competence)
|
||||||
|
- **operating systems** (knowledge)
|
||||||
|
- **penetration testing tool** (knowledge)
|
||||||
|
- **perform ICT security testing** (skill/competence)
|
||||||
|
- **security engineering** (knowledge)
|
||||||
|
- **software anomalies** (knowledge)
|
||||||
|
- **tools for ICT test automation** (knowledge)
|
||||||
|
- **use scripting programming** (skill/competence)
|
||||||
|
- **web application security threats** (knowledge)
|
||||||
|
|
||||||
|
## Optional
|
||||||
|
|
||||||
|
- Aircrack (penetration testing tool) (knowledge)
|
||||||
|
- Backbox (penetration testing tool) (knowledge)
|
||||||
|
- BlackArch (knowledge)
|
||||||
|
- Cain and Abel (penetration testing tool) (knowledge)
|
||||||
|
- define security policies (skill/competence)
|
||||||
|
- hybrid model (knowledge)
|
||||||
|
- ICT encryption (knowledge)
|
||||||
|
- ICT safety (nan)
|
||||||
|
- ICT security legislation (knowledge)
|
||||||
|
- implement a firewall (skill/competence)
|
||||||
|
- implement ICT security policies (skill/competence)
|
||||||
|
- information confidentiality (knowledge)
|
||||||
|
- internet governance (knowledge)
|
||||||
|
- Internet of Things (knowledge)
|
||||||
|
- John The Ripper (penetration testing tool) (knowledge)
|
||||||
|
- Kali Linux (knowledge)
|
||||||
|
- levels of software testing (knowledge)
|
||||||
|
- maintain ICT server (skill/competence)
|
||||||
|
- Maltego (knowledge)
|
||||||
|
- manage cloud data and storage (skill/competence)
|
||||||
|
- manage IT security compliances (skill/competence)
|
||||||
|
- Metasploit (knowledge)
|
||||||
|
- Nessus (knowledge)
|
||||||
|
- Nexpose (knowledge)
|
||||||
|
- Open source model (knowledge)
|
||||||
|
- organisational resilience (knowledge)
|
||||||
|
- Outsourcing model (knowledge)
|
||||||
|
- OWASP ZAP (knowledge)
|
||||||
|
- Parrot Security OS (knowledge)
|
||||||
|
- perform project management (skill/competence)
|
||||||
|
- proxy servers (knowledge)
|
||||||
|
- remove computer virus or malware from a computer (skill/competence)
|
||||||
|
- Samurai Web Testing Framework (knowledge)
|
||||||
|
- service-oriented modelling (knowledge)
|
||||||
|
- set up cybersecurity training programmes (skill/competence)
|
||||||
|
- solve ICT system problems (skill/competence)
|
||||||
|
- WhiteHat Sentinel (knowledge)
|
||||||
|
- Wireshark (knowledge)
|
||||||
|
|
||||||
|
<!-- market-evidence -->
|
||||||
|
|
||||||
|
## Market evidence (job-ad analysis, 13 ads, as of 2026-07-11)
|
||||||
|
|
||||||
|
Share of analyzed job ads mentioning the item (threshold ≥ 20 %). Source: JSearch/Adzuna APIs.
|
||||||
|
|
||||||
|
### Hard skills
|
||||||
|
|
||||||
|
- penetration testing — **69 %**
|
||||||
|
- network security — **38 %**
|
||||||
|
- ethical hacking — **38 %**
|
||||||
|
- vulnerability identification — **38 %**
|
||||||
|
- threat analysis — **31 %**
|
||||||
|
- vulnerability assessment — **31 %**
|
||||||
|
- exploit development — **23 %**
|
||||||
|
- code review — **23 %**
|
||||||
|
- cyber hunt — **15 %**
|
||||||
|
- adversary emulation — **15 %**
|
||||||
|
- network security analysis — **15 %**
|
||||||
|
- red team operations — **15 %**
|
||||||
|
- risk management — **15 %**
|
||||||
|
- security analysis — **15 %**
|
||||||
|
- security engineering — **15 %**
|
||||||
|
- system exploitation — **15 %**
|
||||||
|
|
||||||
|
### Methods
|
||||||
|
|
||||||
|
- tactics, techniques, and procedures (TTPs) — **15 %**
|
||||||
|
- vulnerability exploitation — **15 %**
|
||||||
|
- opfor actions — **15 %**
|
||||||
|
|
||||||
|
### Responsibilities
|
||||||
|
|
||||||
|
- vulnerability identification — **31 %**
|
||||||
|
- technical documentation — **23 %**
|
||||||
|
- penetration testing — **23 %**
|
||||||
|
- mentor junior assessors — **15 %**
|
||||||
|
- risk reporting — **15 %**
|
||||||
|
- scenario development — **15 %**
|
||||||
|
- vulnerability exploitation — **15 %**
|
||||||
|
- threat prediction — **15 %**
|
||||||
|
- tooling development — **15 %**
|
||||||
|
|
||||||
|
<!-- market-evidence -->
|
||||||
49
references/tasks.md
Normal file
49
references/tasks.md
Normal file
@@ -0,0 +1,49 @@
|
|||||||
|
# Tasks & work activities — ethical hacker
|
||||||
|
|
||||||
|
Source: O*NET 30.3, occupation 15-1299.04 (Penetration Testers).
|
||||||
|
|
||||||
|
## Task statements
|
||||||
|
|
||||||
|
- **[nan]** Assess the physical security of servers, systems, or network devices to identify vulnerability to temperature, vandalism, or natural disasters.
|
||||||
|
- **[nan]** Collect stakeholder data to evaluate risk and to develop mitigation strategies.
|
||||||
|
- **[nan]** Conduct network and security system audits, using established criteria.
|
||||||
|
- **[nan]** Configure information systems to incorporate principles of least functionality and least access.
|
||||||
|
- **[nan]** Design security solutions to address known device vulnerabilities.
|
||||||
|
- **[nan]** Develop and execute tests that simulate the techniques of known cyber threat actors.
|
||||||
|
- **[nan]** Develop infiltration tests that exploit device vulnerabilities.
|
||||||
|
- **[nan]** Develop presentations on threat intelligence.
|
||||||
|
- **[nan]** Develop security penetration testing processes, such as wireless, data networks, and telecommunication security tests.
|
||||||
|
- **[nan]** Discuss security solutions with information technology teams or management.
|
||||||
|
- **[nan]** Document penetration test findings.
|
||||||
|
- **[nan]** Evaluate vulnerability assessments of local computing environments, networks, infrastructures, or enclave boundaries.
|
||||||
|
- **[nan]** Gather cyber intelligence to identify vulnerabilities.
|
||||||
|
- **[nan]** Identify new threat tactics, techniques, or procedures used by cyber threat actors.
|
||||||
|
- **[nan]** Identify security system weaknesses, using penetration tests.
|
||||||
|
- **[nan]** Investigate security incidents, using computer forensics, network forensics, root cause analysis, or malware analysis.
|
||||||
|
- **[nan]** Keep up with new penetration testing tools and methods.
|
||||||
|
- **[nan]** Maintain up-to-date knowledge of hacking trends.
|
||||||
|
- **[nan]** Prepare and submit reports describing the results of security fixes.
|
||||||
|
- **[nan]** Test the security of systems by attempting to gain access to networks, Web-based applications, or computers.
|
||||||
|
- **[nan]** Update corporate policies to improve cyber security.
|
||||||
|
- **[nan]** Write audit reports to communicate technical and procedural findings and recommend solutions.
|
||||||
|
|
||||||
|
## Detailed work activities
|
||||||
|
|
||||||
|
- Analyze risks to minimize losses or damages.
|
||||||
|
- Analyze security of systems, network, or data.
|
||||||
|
- Develop computer or information security policies or procedures.
|
||||||
|
- Develop computer or information systems.
|
||||||
|
- Develop organizational policies or programs.
|
||||||
|
- Develop testing routines or procedures.
|
||||||
|
- Discuss design or technical features of products or services with technical personnel.
|
||||||
|
- Evaluate characteristics of equipment or systems.
|
||||||
|
- Examine records or other types of data to investigate criminal activities.
|
||||||
|
- Interpret design or operational test results.
|
||||||
|
- Investigate illegal or suspicious activities.
|
||||||
|
- Prepare analytical reports.
|
||||||
|
- Prepare scientific or technical reports or presentations.
|
||||||
|
- Prepare technical or operational reports.
|
||||||
|
- Search files, databases or reference materials to obtain needed information.
|
||||||
|
- Stay informed about current developments in field of specialization.
|
||||||
|
- Test computer system operations to ensure proper functioning.
|
||||||
|
- Test performance of electrical, electronic, mechanical, or integrated systems or equipment.
|
||||||
93
references/tools.md
Normal file
93
references/tools.md
Normal file
@@ -0,0 +1,93 @@
|
|||||||
|
# Tools & technology — ethical hacker
|
||||||
|
|
||||||
|
Source: O*NET 30.3 'Software Skills' for 15-1299.04.
|
||||||
|
|
||||||
|
| Software | Category | Hot technology |
|
||||||
|
|---|---|---|
|
||||||
|
| Docker | Application server software | yes |
|
||||||
|
| GitHub | Application server software | yes |
|
||||||
|
| Kubernetes | Application server software | yes |
|
||||||
|
| IBM Terraform | Configuration management software | yes |
|
||||||
|
| Amazon Web Services AWS software | Data base user interface and query software | yes |
|
||||||
|
| Microsoft SQL Server | Data base user interface and query software | yes |
|
||||||
|
| ServiceNow | Data base user interface and query software | yes |
|
||||||
|
| Structured query language SQL | Data base user interface and query software | yes |
|
||||||
|
| C | Development environment software | yes |
|
||||||
|
| Go | Development environment software | yes |
|
||||||
|
| Microsoft Azure software | Development environment software | yes |
|
||||||
|
| Microsoft PowerShell | Development environment software | yes |
|
||||||
|
| Oracle Java 2 Platform Enterprise Edition J2EE | Development environment software | yes |
|
||||||
|
| Ruby | Development environment software | yes |
|
||||||
|
| Splunk Enterprise | Enterprise system management software | yes |
|
||||||
|
| Ansible software | Expert system software | yes |
|
||||||
|
| Microsoft Active Directory | Internet directory services software | yes |
|
||||||
|
| C# | Object or component oriented development software | yes |
|
||||||
|
| C++ | Object or component oriented development software | yes |
|
||||||
|
| Oracle Java | Object or component oriented development software | yes |
|
||||||
|
| Perl | Object or component oriented development software | yes |
|
||||||
|
| Python | Object or component oriented development software | yes |
|
||||||
|
| Microsoft Office software | Office suite software | yes |
|
||||||
|
| Apple iOS | Operating system software | yes |
|
||||||
|
| Apple macOS | Operating system software | yes |
|
||||||
|
| Bash | Operating system software | yes |
|
||||||
|
| Google Android | Operating system software | yes |
|
||||||
|
| Linux | Operating system software | yes |
|
||||||
|
| Shell script | Operating system software | yes |
|
||||||
|
| UNIX | Operating system software | yes |
|
||||||
|
| Microsoft Excel | Spreadsheet software | yes |
|
||||||
|
| JavaScript | Web platform development software | yes |
|
||||||
|
| Microsoft Active Server Pages ASP | Web platform development software | yes |
|
||||||
|
| PHP | Web platform development software | yes |
|
||||||
|
| Google Cloud software | Cloud-based management software | |
|
||||||
|
| Qualys Cloud Platform | Cloud-based protection or security software | |
|
||||||
|
| Hex-Rays IDA Pro | Compiler and decompiler software | |
|
||||||
|
| Vector 35 Binary Ninja | Compiler and decompiler software | |
|
||||||
|
| Ghidra | Computer aided design CAD software | |
|
||||||
|
| Database management systems | Data base management system software | |
|
||||||
|
| Microsoft Azure DevOps Services | Development environment software | |
|
||||||
|
| Microsoft Visual Basic Scripting Edition VBScript | Development environment software | |
|
||||||
|
| Rust programming language | Development environment software | |
|
||||||
|
| Software development tools | Development environment software | |
|
||||||
|
| Software libraries | Development environment software | |
|
||||||
|
| Web application software | Development environment software | |
|
||||||
|
| Management information systems MIS | Enterprise resource planning ERP software | |
|
||||||
|
| IBM QRadar SIEM | Network monitoring software | |
|
||||||
|
| Wireshark | Network monitoring software | |
|
||||||
|
| Firewall software | Network security and virtual private network VPN equipment software | |
|
||||||
|
| Objective C | Object or component oriented development software | |
|
||||||
|
| Magellan Firmware | Operating system software | |
|
||||||
|
| Kali Linux | Program testing software | |
|
||||||
|
| MITRE ATT&CK software | Program testing software | |
|
||||||
|
| System testing software | Program testing software | |
|
||||||
|
| HP WebInspect | Transaction security and virus protection software | |
|
||||||
|
| Invicti Acunetix | Transaction security and virus protection software | |
|
||||||
|
| Metasploit | Transaction security and virus protection software | |
|
||||||
|
| Nmap | Transaction security and virus protection software | |
|
||||||
|
| Portswigger BurP Suite | Transaction security and virus protection software | |
|
||||||
|
| Rapid7 Nexpose | Transaction security and virus protection software | |
|
||||||
|
| Rapid7 software | Transaction security and virus protection software | |
|
||||||
|
| Tenable Nessus | Transaction security and virus protection software | |
|
||||||
|
| IBM Middleware | Transaction server software | |
|
||||||
|
| Web server software | Transaction server software | |
|
||||||
|
| RESTful API | Web platform development software | |
|
||||||
|
| Security assertion markup language SAML | Web platform development software | |
|
||||||
|
|
||||||
|
<!-- market-evidence -->
|
||||||
|
|
||||||
|
## Market evidence (job-ad analysis, 13 ads, as of 2026-07-11)
|
||||||
|
|
||||||
|
Share of analyzed job ads mentioning the item (threshold ≥ 20 %). Source: JSearch/Adzuna APIs.
|
||||||
|
|
||||||
|
### Tools
|
||||||
|
|
||||||
|
- Cobalt Strike — **31 %**
|
||||||
|
- Metasploit — **31 %**
|
||||||
|
- Mythic — **23 %**
|
||||||
|
- PoshC2 — **23 %**
|
||||||
|
- frida — **23 %**
|
||||||
|
- ibm appscan — **15 %**
|
||||||
|
- Burp Suite — **15 %**
|
||||||
|
- Nessus — **15 %**
|
||||||
|
- sql map — **15 %**
|
||||||
|
|
||||||
|
<!-- market-evidence -->
|
||||||
Reference in New Issue
Block a user