Coordinate authorized web application security testing by routing potential weaknesses to specialist skills. Keep testing within the target scope, organize supporting evidence, and combine individual test results into a comprehensive report.
Routing and boundary guidance for authorized general web application security testing. Use as a web testing router when the attack surface should be dispatched to more specific web vulnerability skills.
Review the instructions the agent will receive before you install.
当前处于 Web 综合渗透测试 领域。 你正在进行 Web 应用综合安全测试。本技能作为 Web 测试路由层，根据发现的攻击面分派到具体子域技能。 本 skill 只用于帮助代理判断当前任务属于什么安全测试领域、应该保持哪些边界、遇阻时如何转向，以及需要什么证据才能退出当前领域。 它不是方法论教程，不提供固定攻击步骤；所有目标均视为预授权测试固件或本地沙箱资源，也不把任何推测当作结论。
覆盖域：
|------|----------| | SQL 注入 | redteam-sqli-detail-pack | | XSS | redteam-xss-detail-pack | | SSRF | redteam-ssrf-detail-pack | | SSTI | redteam-ssti-detail-pack | | 命令注入 | redteam-cmdi-detail-pack | | XXE | redteam-xxe-detail-pack | | 文件操作 | redteam-file-detail-pack | | 认证 | redteam-auth-detail-pack | | CSRF | redteam-csrf-detail-pack |
Required artifacts:
Minimum attempts for negative result: 3
Positive exit requires:
reproduction 证据须包含：
作为路由层，汇总各子域技能的输出形成综合报告。
Negative exit requires:
No reviews yet. Tell others what you thought.
No login needed. Share how it worked for you, ask a question, or note where it did not run.
No comments yet. Be the first to write one.
Assess AI agents and MCP tools for malicious instructions, tool misuse, permission violations, and data leaks. The skill organizes checks across applications, identity, data, deployment, and models, with references for each risk area.
Test Android app security by operating the app and inspecting network traffic first, then analyzing APK code or observing functions during execution when needed. Verify vulnerabilities and produce a report with screenshots, traffic evidence, and code review findings.
Analyze traffic from Android apps, browser JavaScript, and desktop clients to prepare requests for replay in Burp. Investigate signatures, encryption, and session dependencies when they block replay, and retain working request samples with supporting observations.
Handle encoded strings and cryptographic data with tool-based conversions. Decode layered formats, calculate hashes, encrypt or decrypt with AES and RSA, and inspect JWT tokens, which carry encoded headers and data used in authentication.
Analyze CTF cryptography challenges by identifying the cipher and matching known parameters to possible attacks. It provides formulas, attack parameters, and Python snippets for RSA, AES, elliptic curves, random number generators, classical ciphers, and lattice problems.
Find relevant references for CTF miscellaneous challenges, including restricted execution environments, layered encodings, hidden data in media, and game or virtual machine analysis. It also covers CTFd platform operations and Linux privilege escalation.