Assess the storage and retrieval layers of RAG systems, which search documents to support AI answers. Test persistent document poisoning, cross-tenant access, source-text leaks, and manipulated search rankings using independently verifiable evidence.
Test APIs and forms with unexpected input to uncover error responses that expose internal details. The skill checks response bodies for stack traces, server paths, and library information, preserving specific evidence rather than treating every server error as a vulnerability.
Prepare a /hunt security assessment by loading skills for the selected mode and, for red team work, detected platforms. Summarize the loaded set, select reporting formats, and check supplied credentials before authenticated testing.
Investigate browser-side security flaws in DOM handling, cross-window messages, Service Workers, and CSS. Trace untrusted input to sensitive operations and verify observable impact, helping distinguish reproducible vulnerabilities from harmless signals.
Assess externally exposed enterprise SSL VPN gateways by identifying products, checking known vulnerabilities, and reviewing authentication backends and SAML settings. The skill provides vendor-specific checks and a staged workflow that starts with less disruptive identification before deeper testing.
Guide bug bounty work from checking authorized scope and discovering assets to testing web and AI features. Validate practical impact, investigate related weaknesses, and organize reproducible evidence into a vulnerability report.
Assess what discovered cloud credentials allow across AWS, Azure, GCP, and Kubernetes. The skill guides identity checks, permission review, and paths to higher privileges, then helps document impact, activity, and cleanup within the engagement's agreed scope.
Assess login and verification code protections, identify response differences that reveal registered accounts, and distinguish visible blocks from silent throttling. The skill guides evidence gathering to verify weaknesses and assess their practical impact.
Investigate cloud configuration weaknesses across AWS, GCP, and Azure, including public storage, exposed services, and leaked credentials. Find candidates in public information and JavaScript, then verify data access and permissions to establish practical impact.
Test CDN-backed websites for cache poisoning and Web Cache Deception, where private pages are mistakenly cached as public content. The skill guides cache behavior checks, input testing, and independent-client verification to establish reproducible impact.
Test for race conditions, where simultaneous requests disrupt expected processing order. Investigate duplicate redemptions, balance or vote changes, and authentication or request-limit failures, then verify actual effects and record reproducibility.
Investigate LDAP and XPath injection in directory searches and XML-backed authentication. The skill guides checks for login bypasses and information leaks, uses control responses to reduce false positives, and distinguishes Active Directory from other LDAP directories.
Investigate security flaws in OAuth login flows, including weak redirect checks, leaked access tokens, and skipped authentication steps. The skill guides testing of web and mobile integrations and helps document demonstrated impact and reproducible findings.
Review build and deployment pipelines for unsafe workflows, exposed credentials, and configuration flaws across GitHub Actions, Jenkins, GitLab CI, and Terraform state files. Use concrete evidence and false-positive checks to distinguish exploitable issues from suspicious settings.
Find open redirects, where a website sends visitors to an externally controlled address. Check URL parameters and browser scripts, confirm actual navigation, and investigate whether the redirect can expose OAuth authorization codes or enable server-side access to internal services.
Investigate CSRF, where a page causes unwanted actions through a signed-in user's session. The skill covers tokens, cookie settings, JSON APIs, and account linking, with guidance for browser-based demonstrations and assessing account or financial impact.
Test whether CAPTCHA protections actually block form actions on the server. The skill checks missing or empty fields, reused tokens, tokens accepted for other actions, and inconsistent enforcement, then confirms bypasses through completed actions such as registration or login.
Investigate clickjacking, where a hidden page tricks users into unintended clicks. Check protective headers, then verify in a real browser whether the embedded page retains authentication and allows sensitive actions.
Assess Kubernetes and Docker security across exposed APIs, access permissions, service account tokens, and container boundaries. Use actual data reads or command output to establish impact and distinguish information exposure from broader compromise.
Inspect Android apps for embedded credentials, internal API addresses, and components exposed to other apps. The skill guides APK acquisition, code inspection, and runtime traffic analysis to support a mobile security assessment.
Assess Node.js applications for unsafe input handling and configuration weaknesses. The skill covers prototype pollution, where shared object properties are altered, plus template and command injection, proxy trust issues, and file exposure, with checks for observable impact.
Investigate IDOR, an access control flaw that exposes other users' resources through changed IDs. The skill guides REST API and GraphQL testing, checks boundaries between organizations, and helps document reproducible data exposure or unauthorized changes.
Investigate authentication gaps across single sign-on, APIs, and legacy login endpoints. The skill helps map entry points, compare their protections, test token trust between portals, and document whether a flaw grants access to protected accounts or functions.
Test APIs for NoSQL injection, where user input changes database queries unexpectedly. The skill focuses on MongoDB login bypass, unauthorized data retrieval, and response timing checks, and also covers Redis command injection through server-side requests.
Is this your account? Link GitHub to bring it onto your creator page (Japanese)