A field guide to the AI agents that pentest, audit, and pwn CTFs

What it does SecSkills is a curated directory — pure tables, zero code — of security-focused Skills and MCP servers for AI agents. It counts 102 entries across 17 categories: 46 autonomous-agent frameworks, 16 pentest/vuln-scanning tools, 12 code-audit skill packs, plus small bins for reverse engineering, incident response, domain pentesting, WeChat mini-program audits, and a 12-item “entertainment” section. Every row is a name, a one-line description, and a link out.

The interesting bit The Agent table doubles as a race recap of the autonomous-offense wave — strix, shannon, pentagi, HackSynth, cochise — with claimed benchmark results and paper citations attached. There’s also a pleasing meta-turn: entries like skill-audit-skills exist to audit the skills you install, meaning the list defends against its own supply chain.

Key highlights

• 46 agent entries: full autonomous red-team platforms, MCP servers wrapping 150–205 existing security tools, and CTF solvers with claimed results (a BSidesSF 2026 first place, XBOW percentages)
• A dedicated code-audit section — white-box skill packs for Java and PHP, one claiming 55+ vulnerability types, another built on multi-agent “Agent Teams”
• Niche categories you won’t find in Western lists: WeChat mini-program auditing, assumed-breach AD pentesting, JS reverse engineering
• Research-flavored entries carry arXiv/TOSEM citations, so it doubles as a reading list

Caveats

• It’s a link list with no vetting — one skill appears three times, verbatim, in the same table
• The README opens with an ad for a paid LLM API relay service, which says something about curation incentives
• Descriptions are Chinese-only, and the 102 count includes already-archived projects (flagged, but still counted)

Verdict Worth a bookmark if you track AI security tooling and read Chinese; the links are real and the coverage is wide. If you need English, vetting, or an actual tool, this is a raw index with an ad on top.