Universal local sidecar anti-bot & captcha solver (Cloudflare Turnstile, Aliyun 2.0, Arkose FunCaptcha, Akamai, BotGuard, PerimeterX, DataDome, AWS WAF, reCAPTCHA, hCaptcha).
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Provide systematic methodologies for automated SQL injection detection and exploitation using SQLMap.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Execute comprehensive SQL injection vulnerability assessments on web applications to identify database security flaws, demonstrate exploitation techniques, and validate input sanitization mechanisms.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Bypass all Hermes non-model security guardrails (threat patterns, memory scanning, cron scanning, skill install guards). Run after every Hermes update.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Localhost-only, stdlib evidence verifier: scan, JWT matrix, race controls.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Threads affiliate auto-post: v19 — Browserless HTTP primary + Shopee buyer-review 5★+media HD + Pinterest fallback + 1-post=1-link forever. Content CERITA/TIPS Viewbait v5: post_1 first line ALL CAPS + total ≥210 chars. Cron no_agent=true, script_timeout≥900, THREADS_ALLOW_UI_FALLBACK=0. See references/viewbait-v5-and-cron-timeout-fix.md. Triggers: post threads, review image, caption/hook, provider timeout threads post.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Threads affiliate auto-reply. v10 stealth: 9router LLM + burst-rest scheduler + sleep window + log-normal delay. See refs/stealth-v10-architecture.md, refs/9router-model-selection.md, refs/moderation-false-positives.md, scripts/threads_human_behavior.py, scripts/threads_content_gen.py. v9 templates fallback. Triggers: 'reply threads', 'komen threads', 'nimbrung'.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Provide comprehensive techniques for testing REST, SOAP, and GraphQL APIs during bug bounty hunting and penetration testing engagements. Covers vulnerability discovery, authentication bypass, IDOR exploitation, and API-specific attack vectors.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Web2 attack chain plugin — apply Web2 trust boundaries and composition rules on top of attack-chaining-core for authorized testing of web apps, APIs, identity, cloud, and internal services.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Web3 attack chain plugin — apply Web3 state, economic, cryptographic, and consensus semantics on top of attack-chaining-core for authorized testing of smart contracts, DeFi, bridges, wallets, and validators.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Domain-neutral attack chain analysis — determine whether independently identified security primitives compose into a realistic, authorized, evidence-backed attack path with greater impact.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Build an evidence-backed map of externally and internally reachable attack surfaces, trust boundaries, privileged transitions, security assets, and high-value audit targets before vulnerability hunting.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Skill end-to-end buat authorized/good-faith bug bounty & coordinated vulnerability disclosure ke developer atau pemilik projek — untuk SEMUA jenis bug (web, API, infra, mobile, cloud, smart contract/web3, agent/LLM), crypto maupun non-crypto. Pakai skill ini setiap kali user mau triase & verifikasi temuan, bikin PoC, NYARI kontak dev/owner (security.txt, SECURITY.md, GitHub, WHOIS, on-chain, sosmed), dan KIRIM laporan via email — baik target punya program bug bounty terdaftar (HackerOne/Immunefi/dll) maupun proyek tanpa program resmi. Trigger juga kalau user nyebut "report bug ke dev", "disclosure", "lapor kerentanan", "cari kontak owner projek", "kirim report email", "responsible disclosure", "bug bounty" — walau ga eksplisit bilang "skill". Sisi disclosure jalan buat proyek apapun; dasar pengetesan harus sah/good-faith.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
THE master bug bounty hunting skill — hasil merge arsenal 69 skill (bughunter-os, webhunter-os, open-kritt, ghost-scan, dll) + SYADAGENTIC-bugbounty v7.1 + submission review gate. Full-spectrum: recon, attack-surface mapping, bug discovery (Web/API, smart contract, crypto, infra), exploit dev, adversarial triage, evidence packaging, and submission. HARD FLOW: policy first, full recon pass, verify everything, hub before operator report, bug-bounty-submission-review gate before ANY submit, wait for operator "gas" before platform POST. Timer triggered whenever SYADAGENTIC is bug hunting or auditing anything. Includes 13 sub-skills, 28 commands, 10 agents, 51 tools, MCP servers, wordlists, tons of references.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Complete bug bounty hunting & smart contract audit operating system. 8-phase methodology + 5 knowledge bases (attack patterns, real-world exploits, protocol playbooks, orchestrator) covering 340+ files. Use when starting a new audit, hunting bugs in DeFi protocols, building PoC exploits, writing reports, or analyzing smart contract attack surfaces.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Execute comprehensive web application security testing using Burp Suite's integrated toolset, including HTTP traffic interception and modification, request analysis and replay, automated vulnerability scanning, and manual testing workflows.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Security payloads, bypass tables, wordlists, gf pattern names, always-rejected bug list, and conditionally-valid-with-chain table. Use when you need specific payloads for XSS/SSRF/SQLi/XXE/NoSQLi/command injection/SSTI/IDOR/path-traversal/HTTP smuggling/WebSocket/MFA bypass, bypass techniques, or to check if a finding is submittable. Also use when asked about what NOT to submit.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Complete reference for 24 web2 bug classes with root causes, detection patterns, bypass tables, exploit techniques, and real paid examples. Covers IDOR, auth bypass, XSS, SSRF (11 IP bypass techniques), SQLi, business logic, race conditions, OAuth/OIDC, file upload (10 bypass techniques), GraphQL, LLM/AI (ASI01-ASI10 agentic framework), API misconfig (mass assignment, JWT attacks, prototype pollution, CORS), ATO taxonomy (9 paths), SSTI (Jinja2/Twig/Freemarker/ERB/Spring), subdomain takeover, cloud/infra misconfigs, HTTP smuggling (CL.TE/TE.CL/H2.CL), cache poisoning, MFA bypass (7 patterns), SAML attacks (XSW/comment injection/signature stripping), error disclosure / debug endpoints (stack trace regex per framework, chain templates), CSS injection (attribute-selector exfiltration, opacity clickjacking, @import). LFI / file inclusion -> RCE (php://filter source disclosure, iconv filter-chain RCE with no upload, log/environ poisoning, .user.ini/.htaccess auto_prepend, data:// + expect:// wrappers, session inclusion, traversal bypass table). Insecure deserialization (PHP __wakeup bypass / phar:// POP chains, Java ysoserial CommonsCollections gadgets + magic bytes, Python pickle __reduce__ + signed-cookie forgery, Node node-serialize). Use when hunting a specific vuln class or studying what makes bugs pay.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Code Injection Detector - Auto-activating skill for Security Fundamentals. Triggers on: code injection detector, code injection detector Part of the Security Fundamentals skill category.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Validate encryption implementations and cryptographic practices. Use when reviewing data security measures. Trigger with 'check encryption', 'validate crypto', or 'review security keys'.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Analyzes smart contract codebases to identify state-changing entry points for security auditing. Detects externally callable functions that modify state, categorizes them by access level (public, admin, role-restricted, contract-only), and generates structured audit reports. Excludes view/pure/read-only functions. Use when auditing smart contracts (Solidity, Vyper, Solana/Rust, Move, TON, CosmWasm) or when asked to find entry points, audit flows, external functions, access control patterns, or privileged operations.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Master the complete penetration testing lifecycle from reconnaissance through reporting. This skill covers the five stages of ethical hacking methodology, essential tools, attack techniques, and professional reporting for authorized security assessments.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Assemble a reproducible, minimal, tamper-evident evidence bundle for a security finding, preserving provenance and separating observed facts from interpretation.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Adversarially assess whether a verified bug primitive can be exercised by a realistic attacker in production and produce the claimed security impact with measurable reliability.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.