스킬 찾기

Guide a bug bounty investigation from scope checks and asset discovery to vulnerability testing, impact validation, and report writing. Covers web applications, source code, and AI features, with an emphasis on reproducible evidence of real harm.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Planning an investigation for a new bug bounty target
• Reviewing source code for risky implementation patterns
• Testing web and AI features for security flaws

Assess what exposed credentials can access in AWS, GCP, and Azure. Map permissions, test paths to higher privileges, and document demonstrated impact using benign test objects within an explicitly authorized assessment scope.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Assessing the impact of exposed cloud credentials
• Reviewing paths to higher cloud privileges
• Checking storage access with benign test objects

Explore web application vulnerabilities by class, including access control failures, XSS, and SQL injection. Use root causes, testing checklists, and examples to plan investigations and distinguish observable security impact from an initial warning sign.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Study root causes of common web vulnerabilities
• Plan checks for cross-user access control failures
• Investigate upload and authentication weaknesses

Plan explicitly permitted credential testing, from preparing password candidates and usernames to choosing a login mode. Covers breach-frequency ranking, attempt pacing, success detection, audit logs, and conditions for stopping the test.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Assess whether credential testing is permitted and practical
• Prepare target-specific candidates and usernames
• Choose a mode for the login system

Guide bug bounty work from target research and vulnerability hunting through validation and reporting. Compare authenticated users, investigate related weaknesses, and organize reproducible evidence of practical impact before preparing a submission.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Planning research for an authorized bug bounty target
• Comparing API access between two test accounts
• Reviewing source code for security weaknesses

Update application code so a developer’s mirrord session identifier travels across service calls, queues, and storage events. Reuse existing tracing tools where possible, then report which request flows carry the identifier and where it still disappears.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Route downstream requests to the same developer session
• Preserve session identifiers across queue consumers
• Carry session context through upload events

Set up one mirrord-up.yaml file to debug several related services locally at the same time. Define each application’s command, Kubernetes target, environment settings, and traffic mode, then manage the sessions together with mirrord up.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Debug an authentication service and dashboard together
• Create an initial multi-service configuration
• Route personal requests using a shared session key

Add AI models to Kiln or find available models missing from its list. The skill checks provider model identifiers and capabilities, updates model settings, runs tests against real APIs, and drafts a Discord announcement.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Adding a newly released model to Kiln
• Finding available models missing from Kiln
• Checking provider support for recently added models

Inspect public repositories, build artifacts, and container images for software supply chain risks. The skill identifies exposed internal package names, unsafe workflow configurations, and leaked secrets, while requiring build evidence before treating unclaimed package names as exploitable.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigate exposed internal package names
• Review public GitHub Actions workflows
• Inspect public container layers for secrets

Structure open-source intelligence research, meaning investigation using publicly available information, for authorized external assessments. Map organizational assets, record evidence and confidence levels, prioritize exposures, and prepare reports that explain technical findings and business risks.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Mapping an organization's externally exposed assets
• Recording evidence sources and confidence levels
• Prioritizing exposures within a limited research budget

Support authorized external security reconnaissance, the discovery of exposed systems and information. The skill provides search queries, probe references, secret detection patterns, and scoring guidance to help identify assets and organize findings with evidence and confidence levels.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Discovering public subdomains, APIs, and cloud storage
• Investigating exposed API keys and other secrets
• Identifying SSO services and Microsoft 365 exposure

Assess Microsoft 365 and Entra ID authentication using tenant discovery, login error analysis, and browser-based verification. It provides attempt tracking and evidence templates to distinguish credential results from access-policy restrictions.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Map tenants associated with corporate domains
• Interpret login errors and access-policy blocks
• Manage attempt limits during credential testing

Inspect TLS certificates, DNS records, and email authentication settings, then separate configuration advice from demonstrable vulnerabilities. The skill guides evidence collection and impact assessment for subdomain takeover, client certificate bypass, internal hostname exposure, and email spoofing.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Review TLS certificates and encryption settings
• Assess DNS records for subdomain takeover
• Validate email spoofing evidence

Investigate subdomain takeover risks caused by DNS records pointing to abandoned services. The skill covers discovery, provider error checks, resource claimability, and evidence collection, then examines potential effects on login flows, shared cookies, and trusted content.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Finding DNS records that point to abandoned services
• Manually verifying automated takeover scan results
• Assessing effects on login flows and shared cookies

Investigate SSRF, where supplied URLs cause unintended server requests, in previews, imports, proxies, and PDF generation. Confirm outbound connections, identify the responsible input, and establish whether internal services or sensitive responses are accessible.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing link previews and URL import features
• Assessing network access from PDF and screenshot generators
• Checking access to cloud metadata and internal APIs

Guide bug bounty work from checking authorized scope and discovering assets to testing web and AI features. Validate practical impact, investigate related weaknesses, and organize reproducible evidence into a vulnerability report.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Planning research for a new bug bounty target
• Reviewing source code for security weaknesses
• Testing chatbot and AI feature security

Assess what discovered cloud credentials allow across AWS, Azure, GCP, and Kubernetes. The skill guides identity checks, permission review, and paths to higher privileges, then helps document impact, activity, and cleanup within the engagement's agreed scope.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Assess permissions granted by discovered cloud credentials
• Review role trust and access across cloud accounts
• Check permissions assigned to anonymous Cognito identities

Guide bug bounty work from asset discovery to validation and reporting, while resolving local locations of security tools, wordlists, and cloned projects. It covers web and AI security testing with an emphasis on demonstrated impact.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Locate installed security tools and wordlists
• Plan reconnaissance within a program's scope
• Investigate related weaknesses and their combined impact

Inspect Android apps for embedded credentials, internal API addresses, and components exposed to other apps. The skill guides APK acquisition, code inspection, and runtime traffic analysis to support a mobile security assessment.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Inventory Android apps included in a security assessment
• Check APKs for embedded credentials and internal API addresses
• Review components that other apps can invoke

Investigate security flaws in OAuth login flows, including weak redirect checks, leaked access tokens, and skipped authentication steps. The skill guides testing of web and mobile integrations and helps document demonstrated impact and reproducible findings.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing redirect validation in social login
• Checking state and nonce validation
• Investigating mobile login links

Investigate cloud configuration weaknesses across AWS, GCP, and Azure, including public storage, exposed services, and leaked credentials. Find candidates in public information and JavaScript, then verify data access and permissions to establish practical impact.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Checking public access to S3, GCS, and Azure Blob storage
• Reviewing exposed serverless and managed services
• Assessing CloudWatch RUM guest role permissions

Convert documents, images, audio, web pages, and structured data into Markdown for AI analysis. Preserve headings, lists, tables, and links, extract text through OCR or transcription, and process multiple files or ZIP archives together.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Converting PDF and Office documents to Markdown
• Extracting text from images and audio
• Extracting web content and YouTube transcripts

Helps configure Playwright tests in automated CI/CD pipelines across major providers. Covers splitting tests across runners, Docker execution, shared login setup, code coverage, and saving reports and debugging artifacts to investigate failures.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Running Playwright tests in GitHub Actions or GitLab CI
• Splitting tests across multiple runners
• Saving traces and reports after test failures

Assess Azure, AWS, and GCP security through resource inventories, authentication checks, permission reviews, and misconfiguration testing. Supports authorized assessments that document exposed credentials, rate risks, and recommend improvements for each cloud platform.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Inventorying cloud resources and permissions
• Checking for exposed credentials and secrets
• Testing the impact of cloud misconfigurations