Skip to main content

Cyberstrike is now open source! AI-powered penetration testing for security professionals. Star on GitHub

On this page

Custom Skills

A skill is a Markdown file of reusable methodology the agent can pull in on demand. Skills are discovered by filename — every skill lives in a file named SKILL.md.

📸 SCREENSHOT: custom-skills.png

Custom skill layout

File & Location

The file must be named SKILL.md. Cyberstrike scans for **/SKILL.md under a skill/ or skills/ directory inside .cyberstrike/, and under skills/ (Claude Code layout):

.cyberstrike/
└── skills/
    └── sql-injection/
        └── SKILL.md

Frontmatter

Only name and description are required. The rest are optional metadata used for categorization and kill-chain linking:

SKILL.md
---
name: sql-injection
description: Methodology for testing SQL injection
version: "1.0.0"
author: you
tags: [injection, database]
category: injection
owasp_id: WSTG-INPV-05
tech_stack: [postgres, mysql]
cwe_ids: [CWE-89]
chains_with: [auth-bypass]
prerequisites: [request-capture]
---


Walk the tester through boolean-, error-, time-, and union-based SQLi:
1. Identify injectable parameters …
2. …

Caution

The body is plain Markdown — there is no templating (no {{target}}, {% if %}, {% for %}, or $ARGUMENTS). Frontmatter does not support args, model, agent, or permission fields, and the file must be literally named SKILL.md (arbitrary names like my-skill.md are not loaded).

The name in frontmatter must match the skill’s identity — a mismatch is reported as an error.

Using Skills

Loaded skills are available to the agent and can be browsed with the /skills command. The agent pulls a skill’s methodology into context when it’s relevant to the task.

Related Documentation