'report' 검색 결과

Silent failure hunting routing. Use when a change might pass while skipping work, swallowing errors, losing evidence, weakening gates, or reporting false success; do not use for broad code review.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Produce or apply an approved report-first proposal for workflow, ROSE, skill, command, subagent, memory, install, or harness-doc changes; use after harness-issue-triage localizes a harness problem or when the user explicitly requests harness maintenance, and do not edit core harness files without explicit human approval.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Diagnose user-reported AILI/ROSE harness or workflow behavior problems without editing files; use when the user says a command, skill trigger, subagent packet, memory flow, installer, docs, or agent prompt behavior is wrong and wants to know where the issue lives and how to fix it. Do not use for normal product-code bugs; return any approved modification need to ROSE.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

E2E artifact handling routing. Use when traces, videos, screenshots, reports, or failure bundles need controlled repository-local placement; do not use for simple unit tests or production-mutating E2E flows.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Generate, edit, inspect, or verify editable PowerPoint/PPTX decks when a .pptx file is the deliverable; use for template-preserving edits and from-scratch slide production, but not for HTML/SVG mockups, PDF-only reports, or presentation advice that needs no PPTX artifact.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Generate or edit a source-grounded newsletter issue, digest, or briefing from provided or researched sources. Use for weekly/monthly updates, curated links, executive digests, community newsletters, or "turn these sources into a newsletter"; do not use for UI landing pages, marketing campaign design, unsourced news claims, or long-form research reports.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Clarify a concrete requirements decision, create one bounded static interview packet, or run an explicitly user-invoked frontier batch over a plan, decision, or idea; trigger on explicit grill/interview/refinement intent or a named material ambiguity, not on ordinary planning, implementation, research, test-plan, report-style review, or BUILD work.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Coverage review and verification sufficiency routing. Use when test coverage, uncovered paths, coverage reports, or verification adequacy need a read-only QA review; do not use for writing tests or running browser/E2E artifacts.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Code-review quality gate and test-enhancement rubric. Use when ROSE needs sharper review output contracts, severity and risk prioritization, evidence anchors, negative review cases, fixture or golden-output drift guidance, or a Chinese review report profile; do not use as a duplicate code-review agent or final PASS authority.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Audits database schemas for naming conventions, type consistency, nullability patterns, and missing constraints. Provides violations report with recommended fixes. Use for "schema validation", "database linting", "schema standards", or "consistency checks".

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Implements security headers and Content Security Policy with safe rollout strategy (report-only → enforce), testing, and compatibility checks. Use for "security headers", "CSP", "HTTP headers", or "XSS protection".

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Builds repeatable evaluation systems with golden datasets, scoring rubrics, pass/fail thresholds, and regression reports. Use for "LLM evaluation", "testing AI systems", "quality assurance", or "model benchmarking".

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Audits project dependencies for outdated packages, duplicates, heavy/problematic libraries, security vulnerabilities, and risky version combinations. Generates prioritized reports with security, performance, and maintainability insights, upgrade paths, and safe pinning recommendations. Use when users request dependency audits, package updates, security checks, or dependency optimization.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use when a study needs a preregistration or a frozen analysis plan, when confirmatory and exploratory analyses must be separated, or when every deviation from the registered plan must be logged before the result is reported.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use when selecting a statistical test with AI consultation, when assumptions need checking against the actual data, when an analysis plan or decision log must be written before running anything, or when results need APA-style reporting with effect sizes.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Hunting skill for sqli vulnerabilities. Built from 12 public bug bounty reports including modern NoSQL injection (Rocket.Chat CVE-2021-22911 MongoDB $regex, Mongoose ORM CVE-2024-53900 $where bypass), modern ORM raw-fragment SQLi (Django CVE-2024-42005, Sequelize GHSA-wrh9-cjv3-2hpw), second-order SOQL injection (HackerOne Salesforce), time-based blind SQLi in GraphQL resolvers, and SQLi on OIDC-proxy backends. Use when hunting SQLi on any target. Dedicated NoSQL operator injection (MongoDB/CouchDB $where/$regex/$ne) is owned by hunt-nosqli — NoSQL appears here only as adjacent ORM/WAF context.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Hunting skill for idor vulnerabilities. Built from 26 public bug bounty reports. Use when hunting idor on any target.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Hunting skill for xxe vulnerabilities. Built from 10 public bug bounty reports including SVG-upload XXE, Office-doc (PPTX/DOCX) XXE, SOAP XXE, SAML AssertionConsumer XXE, blind OOB XXE via DTD callback, parameter-entity XXE, XXE-to-LFI, XXE-to-SSRF, and XXE-to-RCE chains (Adobe Commerce CosmicSting CVE-2024-34102). Use when hunting XXE on any target — emphasis on OOB-Or-It-Didn't-Happen Gate for blind cases.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Hunting skill for ssrf vulnerabilities. Built from 15 public bug bounty reports including AWS metadata SSRF (HackerOne $25k Analytics PDF, Shopify Exchange $25k, Capital One 106M-record breach, Dropbox/HelloSign $4,913), GCP metadata SSRF (Snapchat $4k), Azure IMDS SSRF (Azure DevOps $15k chain, ChatGPT Custom Actions MSRC), DNS rebinding SSRF (Concrete CMS, GitLab UrlBlocker), gopher-protocol-to-Redis-RCE (Yahoo Mail $15k), link-preview SSRF (Reddit Matrix $6k), and headless-browser PDF-generator SSRF chains. Use when hunting SSRF on any target — OOB Collaborator confirmation mandatory for blind cases.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Hunting skill for graphql vulnerabilities. Built from 12 public bug bounty reports across IDOR via node() / GID, mutation IDOR including AI/LLM features, cross-tenant IDOR, SSRF via argument, batching-DoS, query-cost-bypass, SQLi via argument, broken-object-level-authz, auth-bypass via unscoped mutations, and PII exposure from missing field-level authz. Use when hunting graphql on any target.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Hunting skill for race condition vulnerabilities. Built from 12 public bug bounty reports including modern HTTP/2 single-packet attack cases (James Kettle DEF CON 2023 'Smashing the State Machine'; RyotaK / Flatt Security 10,000-request first-sequence-sync expansion 2024). Covers coupon double-redemption, gift-card double-spend, MFA-OTP-validate race, account-create race, faucet/crypto token double-mint, email-activation race, vote/upvote inflation, password-reset token race, rate-limit bypass via concurrent requests. Use when hunting race conditions, TOCTOU bugs, MFA-bypass-via-timing.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Hunting skill for xss vulnerabilities. Built from 174 public bug bounty reports. Use when hunting xss on any target. For markup injection that reflects raw HTML but does NOT execute JavaScript (no `<script>`/event-handler execution), see hunt-html-injection — escalate here once script execution is possible.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Discover a single-page-app's hidden backend API from its public JS bundle, then test that API for broken access control / missing authentication. One of the highest-yield web plays in modern recon — SPAs ship their entire backend route map to the browser, and the API behind them is frequently missing the auth middleware the login page implies. Built from an authorized engagement where this play found an unauthenticated financial API that an ASM scan reporting hundreds of 'Criticals' completely missed. Use whenever a target serves a JS-heavy SPA (React/Vue/Angular/Next), an 'app'/'console'/'dashboard'/'portal' subdomain, or any `*api*` host shows up in recon. Leaked build artifacts (source maps / .env / .git / asset-manifest) are owned by hunt-source-leak; API version-inventory and behavioral diffing by hunt-shadow-api; this skill owns mapping a live SPA's backend routes from its JS bundle and testing them for broken access control / missing auth.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Hunting skill for misc vulnerabilities. Built from 225 public bug bounty reports. Use when hunting misc on any target.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.