Sekolah76

Bug bounty report writing for H1/Bugcrowd/Intigriti/Immunefi — report templates, human tone guidelines, impact-first writing, CVSS 3.1 scoring, title formula, impact statement formula, severity decision guide, downgrade counters, pre-submit checklist. Use after validating a finding and before submitting. Never use "could potentially" — prove it or don't report.

The English summary is being prepared. Showing the original description.

Finding validation before writing any report — 7-Question Gate (all 7 questions), 4 pre-submission gates, always-rejected list, conditionally valid with chain table, CVSS 3.1 quick reference, severity decision guide, report title formula, 60-second pre-submit checklist. Use BEFORE writing any report. One wrong answer = kill the finding and move on. Saves N/A ratio.

The English summary is being prepared. Showing the original description.

Web2 recon pipeline — subdomain enumeration (subfinder, Chaos API, assetfinder), live host discovery (dnsx, httpx), URL crawling (katana, waybackurls, gau), directory fuzzing (ffuf), JS analysis (LinkFinder, SecretFinder), continuous monitoring (new subdomain alerts, JS change detection, GitHub commit watch). Use when starting recon on any web2 target or when asked about asset discovery, subdomain enum, or attack surface mapping.

The English summary is being prepared. Showing the original description.

Complete reference for 25 web2 bug classes with root causes, detection patterns, bypass tables, and real paid examples. Covers IDOR, auth bypass, XSS, SSRF (11 IP bypass techniques), SQLi, business logic, race conditions, OAuth/OIDC (PKCE, state, alg confusion, OIDC discovery-document misconfig, Spring x-application-context leak, .env/404 differential, Kong gateway version disclosure, actuator index footprint), file upload (10 bypasses), GraphQL, LLM/AI (ASI01-ASI10 + MCP/RAG/vector poisoning), API misconfig (mass assignment, JWT attacks, prototype pollution, CORS), ATO taxonomy, SSTI, subdomain takeover, cloud/infra, HTTP smuggling, cache poisoning, MFA bypass (7 patterns), SAML attacks, error disclosure/debug endpoints, CSS injection, LFI->RCE (filter chain RCE, log poisoning, polyglot .user.ini), insecure deserialization (PHP phar, Java ysoserial, Python pickle, Node node-serialize). Use when hunting a specific vuln class or studying what makes bugs pay.

The English summary is being prepared. Showing the original description.

Smart contract security audit — 11 DeFi bug classes (accounting desync, access control, incomplete path, off-by-one, oracle, ERC4626, reentrancy, flash loan, signature replay, proxy, BFT/consensus/liveness), pre-dive kill signals (TVL < $500K etc), Foundry PoC template, grep patterns for each class, and real Immunefi paid examples. Use for any Solidity/Rust contract audit or when deciding whether a DeFi target is worth hunting.

The English summary is being prepared. Showing the original description.

Comprehensive techniques for acquiring, analyzing, and extracting artifacts from memory dumps for incident response and malware analysis.

The English summary is being prepared. Showing the original description.

Drive a **locally-running open-kritt stack** (github.com/Kritt-ai/open-kritt) from Hermes for bug-bounty code audits. open-kritt is a self-hosted Docker platform that orchestrates AI agents (Codex / Claude Code) to find real vulnerabilities in a target repo, de-duplicates, and severity-ranks the findings. Use this skill when the user asks to scan/audit a GitHub repo or a local codebase with kritt, wants AI-driven vulnerability discovery on a Solidity/ Rust/JS/Go project, or references "open-kritt" / "kritt scan". The skill talks to the kritt backend REST API at http://127.0.0.1:3002/api (override with KRITT_BACKEND_URL), so the Docker stack must be running first (`./kritt start` in the cloned repo). Capabilities: list workflows / post-scripts / local repos, launch a scan against a remote GitHub repo or a registered local folder, poll until complete, and pull ranked findings. Findings feed naturally into the bug-bounty / web3-audit workflows for PoC + reporting.

The English summary is being prepared. Showing the original description.

Provide a comprehensive checklist for planning, executing, and following up on penetration tests. Ensure thorough preparation, proper scoping, and effective remediation of discovered vulnerabilities.

The English summary is being prepared. Showing the original description.

Provide a comprehensive command reference for penetration testing tools including network scanning, exploitation, password cracking, and web application testing. Enable quick command lookup during security assessments.

The English summary is being prepared. Showing the original description.

Provide comprehensive techniques for escalating privileges from a low-privileged user to root/administrator access on compromised Linux and Windows systems. Essential for penetration testing post-exploitation phase and red team operations.

The English summary is being prepared. Showing the original description.

Comprehensive techniques for capturing, analyzing, and documenting network protocols for security research, interoperability, and debugging.

The English summary is being prepared. Showing the original description.

Red team tactics principles based on MITRE ATT&CK. Attack phases, detection evasion, reporting.

The English summary is being prepared. Showing the original description.

Implement proven methodologies and tool workflows from top security researchers for effective reconnaissance, vulnerability discovery, and bug bounty hunting. Automate common tasks while maintaining thorough coverage of attack surfaces.

The English summary is being prepared. Showing the original description.

Expert reverse engineer specializing in binary analysis, disassembly, decompilation, and software analysis. Masters IDA Pro, Ghidra, radare2, x64dbg, and modern RE toolchains.

The English summary is being prepared. Showing the original description.

Determine the minimal technical root cause of candidate security findings, separate causes from symptoms, cluster duplicates, and identify shared vulnerable abstractions.

The English summary is being prepared. Showing the original description.

Smart contract vulnerability playbook. Use when auditing Solidity/EVM contracts for reentrancy, integer overflow, access control, delegatecall, flash loan, signature replay, and MEV-related attack patterns.

The English summary is being prepared. Showing the original description.

Secret Scanner - Auto-activating skill for Security Fundamentals. Triggers on: secret scanner, secret scanner Part of the Security Fundamentals skill category.

The English summary is being prepared. Showing the original description.

Adversarial security finding triage — decide whether a candidate finding is real, reachable, exploitable, and in-scope by actively trying to falsify it before it reaches report-ready status.

The English summary is being prepared. Showing the original description.

Independent control layer for security-research agents — prevent unsafe actions, unsupported claims, scope violations, evidence contamination, target impact, and premature reporting.

The English summary is being prepared. Showing the original description.

AI-powered codebase security scanner that reasons about code like a security researcher — tracing data flows, understanding component interactions, and catching vulnerabilities that pattern-matching tools miss. Use this skill when asked to scan code for security vulnerabilities, find bugs, check for SQL injection, XSS, command injection, exposed API keys, hardcoded secrets, insecure dependencies, access control issues, or any request like "is my code secure?", "review for security issues", "audit this codebase", or "check for vulnerabilities". Covers injection flaws, authentication and access control bugs, secrets exposure, weak cryptography, insecure dependencies, and business logic issues across JavaScript, TypeScript, Python, Java, PHP, Go, Ruby, and Rust.

The English summary is being prepared. Showing the original description.

Comprehensive security engineering skill for application security, penetration testing, security architecture, and compliance auditing. Includes security assessment tools, threat modeling, crypto implementation, and security automation. Use when designing security architecture, conducting penetration tests, implementing cryptography, or performing security audits.

The English summary is being prepared. Showing the original description.

Provide systematic methodologies for leveraging Shodan as a reconnaissance tool during penetration testing engagements.

The English summary is being prepared. Showing the original description.

Audit smart contracts for security vulnerabilities. Use when user says "audit", "review this contract", "find bugs", "bounty", "security review", or points at a repo/program for vulnerability assessment. Covers Anchor/Solana, EVM/Solidity, and general patterns. Includes content-compression workarounds.

The English summary is being prepared. Showing the original description.

Master smart contract security best practices, vulnerability prevention, and secure Solidity development patterns.

The English summary is being prepared. Showing the original description.