mrhlaingbwardev/agentic-hacking-skills

What it is

This repository is the bonus material for the Agentic Hacking ebook. It collects 28 SKILL.md templates, a web-pentest agent, a custom wsl-security-tools MCP server, and an opencode.jsonc MCP configuration, so that an AI coding tool can run web-security workflows through OpenCode (2). The author intends these skills for authorized testing only (14).

The repository itself is the free companion to a paid book; the full six-module book and the same 28 templates are sold through the author's ebook site (4). The source is listed as proprietary rather than an OSI license (2).

Install

You need OpenCode installed and a configured model before adding these files.

On Linux, macOS, or WSL:

git clone https://github.com/mrhlaingbwardev/agentic-hacking-skills
cp -r agentic-hacking-skills/skills/* ~/.config/opencode/skills/
cp -r agentic-hacking-skills/agents/* ~/.config/opencode/agents/
cp -r agentic-hacking-skills/mcp-servers/* ~/.config/opencode/mcp-servers/

On Windows PowerShell, use the equivalent Copy-Item -Recurse commands from the README (11). Then merge opencode.jsonc into your existing OpenCode configuration and replace the placeholder API keys with your own (14). Restart OpenCode so it loads the new skills, agent, and MCP server.

An alternative, README-described flow is to give your AI the repository URL and ask it to install the skills, agents, and MCP config into OpenCode for you (9). The manual copy commands above are the concrete path.

Constraints

The workflow assumes OpenCode and its ~/.config/opencode/ directory layout. The README recommends a lightweight, low-reasoning model such as DeepSeek Flash, because deeper reasoning models may refuse security requests (2). That recommendation is a usage constraint, not a guarantee that any model will perform the tasks.

The provided opencode.jsonc contains placeholder API keys and must be edited before use (14). The skills and agent are scoped to authorized testing only (14). The repository is described as proprietary; check the terms before redistributing or reusing the material. The README does not document the individual skill contents or the MCP server's required tools, so inspect the files before running them against a target.

HotRepo's take

The project appeared on HotRepo's new JavaScript list on 2026-11-06, with 30 stars and 60 forks gained in a roughly one-hour window starting at 02:45 UTC. That is a short observation period and no all-language daily rank was recorded, so the data supports only that single-day burst, not a broader trend. The fork count matching the star gain in that window is unusual and worth watching, but it does not by itself establish adoption or quality.

The repository's README is mostly written in Burmese and centers on selling the ebook, while the actual template content is not shown in the provided material. Treat the repository as a companion file set whose contents and MCP server behavior should be inspected before use.