테스트·보안 스킬

Complete bug bounty hunting & smart contract audit operating system. 8-phase methodology + 5 knowledge bases (attack patterns, real-world exploits, protocol playbooks, orchestrator) covering 340+ files. Use when starting a new audit, hunting bugs in DeFi protocols, building PoC exploits, writing reports, or analyzing smart contract attack surfaces.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Execute comprehensive web application security testing using Burp Suite's integrated toolset, including HTTP traffic interception and modification, request analysis and replay, automated vulnerability scanning, and manual testing workflows.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

THE master bug bounty hunting skill — hasil merge arsenal 69 skill (bughunter-os, webhunter-os, open-kritt, ghost-scan, dll) + SYADAGENTIC-bugbounty v7.1 + submission review gate. Full-spectrum: recon, attack-surface mapping, bug discovery (Web/API, smart contract, crypto, infra), exploit dev, adversarial triage, evidence packaging, and submission. HARD FLOW: policy first, full recon pass, verify everything, hub before operator report, bug-bounty-submission-review gate before ANY submit, wait for operator "gas" before platform POST. Timer triggered whenever SYADAGENTIC is bug hunting or auditing anything. Includes 13 sub-skills, 28 commands, 10 agents, 51 tools, MCP servers, wordlists, tons of references.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Security payloads, bypass tables, wordlists, gf pattern names, always-rejected bug list, and conditionally-valid-with-chain table. Use when you need specific payloads for XSS/SSRF/SQLi/XXE/NoSQLi/command injection/SSTI/IDOR/path-traversal/HTTP smuggling/WebSocket/MFA bypass, bypass techniques, or to check if a finding is submittable. Also use when asked about what NOT to submit.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Build an evidence-backed map of externally and internally reachable attack surfaces, trust boundaries, privileged transitions, security assets, and high-value audit targets before vulnerability hunting.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Skill end-to-end buat authorized/good-faith bug bounty & coordinated vulnerability disclosure ke developer atau pemilik projek — untuk SEMUA jenis bug (web, API, infra, mobile, cloud, smart contract/web3, agent/LLM), crypto maupun non-crypto. Pakai skill ini setiap kali user mau triase & verifikasi temuan, bikin PoC, NYARI kontak dev/owner (security.txt, SECURITY.md, GitHub, WHOIS, on-chain, sosmed), dan KIRIM laporan via email — baik target punya program bug bounty terdaftar (HackerOne/Immunefi/dll) maupun proyek tanpa program resmi. Trigger juga kalau user nyebut "report bug ke dev", "disclosure", "lapor kerentanan", "cari kontak owner projek", "kirim report email", "responsible disclosure", "bug bounty" — walau ga eksplisit bilang "skill". Sisi disclosure jalan buat proyek apapun; dasar pengetesan harus sah/good-faith.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Comprehensive security engineering skill for application security, penetration testing, security architecture, and compliance auditing. Includes security assessment tools, threat modeling, crypto implementation, and security automation. Use when designing security architecture, conducting penetration tests, implementing cryptography, or performing security audits.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Provide a comprehensive checklist for planning, executing, and following up on penetration tests. Ensure thorough preparation, proper scoping, and effective remediation of discovered vulnerabilities.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Smart contract development advisor based on Trail of Bits' best practices. Analyzes codebase to generate documentation/specifications, review architecture, check upgradeability patterns, assess implementation quality, identify pitfalls, review dependencies, and evaluate testing. Provides actionable recommendations.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Adversarially assess whether a verified bug primitive can be exercised by a realistic attacker in production and produce the claimed security impact with measurable reliability.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Assemble a reproducible, minimal, tamper-evident evidence bundle for a security finding, preserving provenance and separating observed facts from interpretation.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Master the complete penetration testing lifecycle from reconnaissance through reporting. This skill covers the five stages of ethical hacking methodology, essential tools, attack techniques, and professional reporting for authorized security assessments.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Analyzes smart contract codebases to identify state-changing entry points for security auditing. Detects externally callable functions that modify state, categorizes them by access level (public, admin, role-restricted, contract-only), and generates structured audit reports. Excludes view/pure/read-only functions. Use when auditing smart contracts (Solidity, Vyper, Solana/Rust, Move, TON, CosmWasm) or when asked to find entry points, audit flows, external functions, access control patterns, or privileged operations.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Localhost-only, stdlib evidence verifier: scan, JWT matrix, race controls.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Audit smart contracts for security vulnerabilities. Use when user says "audit", "review this contract", "find bugs", "bounty", "security review", or points at a repo/program for vulnerability assessment. Covers Anchor/Solana, EVM/Solidity, and general patterns. Includes content-compression workarounds.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Provide systematic methodologies for leveraging Shodan as a reconnaissance tool during penetration testing engagements.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Provide systematic methodologies for automated SQL injection detection and exploitation using SQLMap.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Master smart contract security best practices, vulnerability prevention, and secure Solidity development patterns.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Review a package expression for best-practices compliance. Use when reviewing PRs or auditing existing packages — checks meta completeness, build-system idioms (cmakeEntries, mesonEntries, pyproject), dependency placement, and packaging conventions.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Developer reference for building applications, tools, and agents on the Pi Durable agent harness (@earendil-works/pi-durable) and the pi-ai model layer. Use when writing or debugging code that imports @earendil-works/pi-durable or pi-ai: assembling a Harness over memory/SQLite/JSONL/Durable Object storage, submitting input and waiting for answers, defining tools with TypeBox schemas and structured output, calling tools from tools, hooks and guards, durable tasks with checkpoints and ownership, subagents and child tasks, documents and migrations, code mode, tool search, per-conversation environments, compaction, recovery after a crash, storage and environment conformance tests, or choosing models and providers. Also use when a durable/agent-runtime behavior question comes up: what survives a restart, why an input stayed queued, why a task is blocked or orphaned, how abort cascades, or what the Pico5 specification requires.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Remove the AI-script tells viewers hear in a TikTok spoken script and caption: 2026 vocabulary by density, reveal bridges, staccato stacks, stacked triads, performed sincerity, written-not-spoken phrasing, "hey guys" filler; caps em dashes. Includes --mode audit pre-film check (hook, completion design, caption fit) and --mode profile. Not for beating AI detectors (no edit reliably does). Not for writing from scratch (use tt-hook-scripter). Keywords: humanize script, de-AI, audit before filming.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Repurpose content into a native TikTok script and caption. Take a LinkedIn post, blog, newsletter, or X thread that worked elsewhere and rebuild it as a spoken script: hook in the first second, every line sayable in one breath, open on the payoff, a trend angle where it fits, plus a caption, published via Publora on approval. Adapts content across platforms. Not for a fresh hook (use tt-hook-scripter), not the caption only (use tt-caption-writer), not auditing a script (use tt-humanizer --mode audit).

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Audit and rewrite a TikTok profile for 2026: photo, name (searchable), username, bio (80 chars, niche clarity is everything), link (unlocks at 1k followers, plus a pre-1k workaround), up to 3 pinned videos as proof, and one-line positioning. A profile visit follows a video, so the bio must instantly answer "what do I get if I follow". Triggers on "review my TikTok profile", "fix my TikTok bio", "what to pin on TikTok", "profile audit", "niche bio". Not for writing a video script (use tt-hook-scripter).

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use tmux from the command line to run, drive, and monitor terminal programs as a coding agent (detached sessions, send-keys input injection, capture-pane output polling, formats, completion detection, and control mode). Use when a task needs long-running or interactive processes (builds, tests, servers, REPLs, watch modes, TUI apps) kept alive across turns or inspected live; skip when plain `cmd > log 2>&1 &` is enough.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.