Mohd Kashif
Community@inventashif
Mohd Kashif (inventashif) maintains 93 offensive-security skills covering bug bounty hunting, red-team operations, web3 audits, and Trigger.dev/React development guidance.
Agent Skills by Mohd Kashif
Showing 72 vetted skills indexed across 1 GitHub repositories.
inventashiftrigger-tasks
Build durable background tasks, scheduled jobs, and AI agent workflows with Trigger.dev.
inventashiftrigger-cost-savings
Analyzes Trigger.dev tasks, schedules, and runs to identify cost optimization opportunities.
inventashiftrigger-realtime
Subscribe to Trigger.dev task runs and stream real-time updates to React frontends and backends.
inventashiftrigger-setup
Initialize Trigger.dev projects with configuration, task directories, and environment setup.
inventashifweb-design-guidelines
Review UI code files against Vercel's Web Interface Guidelines for accessibility and design compliance.
inventashiftrigger-agents
Implements durable AI agent workflows on Trigger.dev using chat agents, sessions, and orchestration patterns.
inventashifvercel-react-best-practices
Applies Vercel performance optimization rules when writing or refactoring React and Next.js code.
inventashiflogging-best-practices
Implements structured JSON logging with correlation IDs for production systems.
inventashifvercel-composition-patterns
Refactors React components using compound components, context providers, and composition patterns.
inventashiftrigger-config
Configure Trigger.dev projects with trigger.config.ts and build extensions.
inventashifhunt-api-misconfig
Detect API mass assignment, prototype pollution, and HTTP verb tampering vulnerabilities.
inventashifhunt-rag-vector
Detect vector-store and embedding-layer weaknesses in RAG pipelines during security assessments.
inventashifhunt-cors
Detect and validate exploitable CORS misconfigurations on web applications and APIs.
inventashifhunt-jwt-crypto
Detect and exploit JWT signature forgery flaws including alg:none and RS256 to HS256 key confusion.
inventashifhunt-xss
Detect and validate reflected, stored, and DOM-based XSS vulnerabilities on web targets.
inventashifmeme-coin-audit
Detects rug pulls and token vulnerabilities in EVM and Solana meme coins.
inventashifhunt-exceptional-conditions
Detect verbose error pages and fail-open behavior by sending malformed input to endpoints.
inventashifhunt-csrf
Detects and validates CSRF vulnerabilities in web applications using bug bounty report patterns.
inventashifhunt-dispatch
Fingerprints authorized targets and loads the matching red team or WAPT skill set.
inventashifhunt-nextjs
Detects Next.js vulnerabilities including Server Actions abuse, middleware bypass, SSRF, and cache poisoning.
inventashifhunt-captcha-bypass
Tests web applications for six CAPTCHA bypass patterns including field omission and token replay.
inventashifhunt-ssti
Detects and exploits server-side template injection across Jinja2, Twig, Freemarker, ERB, and other engines.
inventashifreport-writing
Writes impact-first bug bounty reports with platform templates and CVSS scoring.
inventashifhunt-idor
Detects and exploits IDOR vulnerabilities in APIs using two-account differential testing.
Frequently Asked Questions About Mohd Kashif
FAQPage SchemaWhat tasks can I perform using inventashif's skills?▼
You can hunt specific vulnerability classes (IDOR, SSRF, XSS, CSRF, SSTI, XXE, JWT forgery, HTTP smuggling), run recon and OSINT pipelines, attack cloud IAM/Kubernetes/CI-CD surfaces, audit smart contracts and meme coins, and write CVSS-scored bug bounty reports for HackerOne, Bugcrowd, Intigriti, and Immunefi.
Who are these skills designed for?▼
Bug bounty hunters, red-team operators, and penetration testers running authorized engagements. Separate skills serve WAPT versus external red-team modes, plus triage-validation and report-writing skills for researchers submitting to platforms, and web3 auditors evaluating DeFi contracts or Solana tokens.
How do the hunting skills work in practice?▼
Each hunt-* skill loads detection patterns, payload tables, and validation gates derived from disclosed public reports. The bb-methodology orchestrator routes you through recon, hunting, chaining, and reporting phases, while triage-validation enforces a 7-Question Gate before any submission.
Are these skills free and open source?▼
The skills are published in inventashif's public GitHub repositories at no cost. Vercel-authored skills (vercel-react-best-practices, vercel-composition-patterns) carry explicit MIT licenses; most security skills cite public sources such as HackerOne disclosures, PortSwigger research, and CVE databases.
What prerequisites or dependencies do the skills assume?▼
Security skills assume standard tooling such as Burp Suite, subfinder, httpx, ffuf, Frida, and jadx, plus OOB/Collaborator callbacks for blind-finding validation. Trigger.dev skills require a trigger.config.ts project setup, and trigger-cost-savings requires Trigger.dev MCP access for run analysis.