본문으로 건너뛰기
cccskills
무료GitHub에 공개

wiki-arsenal

Fast PARALLEL wiki lookup engine over wiki/techniques + wiki/payloads + wiki/tools + wiki/cheatsheets for a surface/service/vuln-class. Two modes - quick (one qmd search, cheap, fire constantly) and deep (4 parallel subagents, one per area, merged ready-to-use arsenal card, cached). This is the fast path arsenal that `arsenal` delegates to; the hunt-* skills each inline their own qmd_query and can hand off here for a parallel lookup. Use for "what do I use against <surface>", "arsenal for <X>", "deep/full arsenal", "tool + payload + technique + cheatsheet for <X>", "fast wiki lookup", "parallel wiki search", any "how do I attack/exploit <service|vuln-class>" where you want the documented tooling + payloads before hand-rolling.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Encod3d-Sec/TORCH
설치 방법 보기

포함된 파일(1)

  • SKILL.md4.0 KB

SKILL.md(원문)

설치하기 전에 에이전트에게 전달되는 지시 내용을 확인할 수 있습니다.

wiki-arsenal

The fast, wiki-first lookup engine for "what do I use against this surface". Runs the four knowledge areas in parallel so a deep lookup is one wall-clock, not four serial reads. arsenal delegates here; the hunt-* skills each carry their own wiki-first qmd_query (MCP-independent) and can hand off here for a fast parallel lookup. Never hand-roll from memory when the wiki has the answer.

Input: a surface, service, or vuln-class (e.g. Jenkins on 8080, SSRF, Kerberoasting).

0. Cache check first (0 tokens on a repeat)

Slug the surface (lowercase, non-alnum -> -). If targets/<active-eng>/arsenal/<slug>.md exists, read and return it. Do not re-spend. (<active-eng> = the dir named in targets/active.md.)

Mode: quick (DEFAULT - fire it constantly)

One mcp__wiki-search__qmd_query over the whole index (add a qmd_search keyword pass when the surface is an exact product/CVE string). Group the hits under the four areas and return each as path -> one-line snippet:

  • Techniques (wiki/techniques/)
  • Payloads (wiki/payloads/)
  • Tools (wiki/tools/)
  • Cheatsheets (wiki/cheatsheets/)

Cost ~1-2k tokens, no subagents. This is what arsenal calls by default and what you fire on every new surface to raise wiki coverage cheaply. Stop here unless the surface is worth deep prep.

Mode: deep (opt-in - "deep"/"full arsenal", or a whole service/target worth prepping)

Dispatch FOUR parallel subagents in a SINGLE message (Agent tool), one per area, with model: haiku - each only reads its area and distils a card, which a lightweight model does well at a fraction of the cost (a full-model fan-out measured ~170k tokens; haiku cuts that hard). Each is told to search only its area, read the top 2-3 matching pages, and return a compact ready-to-use card for its area ONLY (nothing else), citing the page paths it used:

AgentSearchesReturns
toolswiki/tools/the automated tool(s) to run + the exact command line
payloadswiki/payloads/ready-to-send payloads for the vuln-class
techniqueswiki/techniques/the attack steps / chain
cheatsheetswiki/cheatsheets/quick copy-paste commands

Each agent scopes its search to its area: pass a path filter to qmd, or query the whole index and keep only wiki/<area>/ hits, then read those pages. The pages an agent reads stay in that agent's context and are discarded; you ingest only its card.

Merge the four returned cards into one arsenal card, four labelled sections plus a final Sources: line listing every page used.

Persist the deep card

Write the merged card to targets/<active-eng>/arsenal/<slug>.md (create the dir on demand) with frontmatter surface: and generated:. That is the cache step 0 reads next time.

Guardrails (token control)

  • Default is quick (~1-2k tokens). Only go deep on request or for a real service/target.
  • Deep is bounded: exactly 4 agents on model: haiku, each capped to the top 2-3 pages. The cost is isolated to the subagents; your main context only gains the merged card.
  • The cache prevents re-spend on the same surface.

Hand off

The full class-specific methodology lives in the matching hunt-* skill. After the arsenal card, hand off to it (e.g. Skill(hunt-ssrf)) for the actual exploitation loop.

리뷰

아직 리뷰가 없습니다. 사용해 본 소감을 남겨 주세요.

댓글

로그인 없이 쓸 수 있습니다. 사용 후기, 질문, 작동하지 않은 환경 등을 편하게 남겨 주세요.

아직 댓글이 없습니다. 첫 댓글을 남겨 보세요.

보내면 바로 공개됩니다. 이메일 주소나 전화번호 같은 개인 정보는 쓰지 마세요. URL은 2개까지입니다.

0 / 1,000자

이 양식은 reCAPTCHA로 보호되며 Google 개인정보처리방침 및 서비스 약관이 적용됩니다.

같은 저장소의 스킬

arsenal

무료

Wiki-first "what do I use" lookup - pick the automated TOOL (wiki/tools/), then the PAYLOAD/technique (wiki/payloads/ + wiki/cheatsheets/), for a surface/service/vuln-class BEFORE hand-rolling or working from memory. Use for "tool for <service>", "automated tools for web/<service>", "what should I run on <surface>", "which tool for <X>", "payloads for <X>", "payload arsenal", "cheatsheet for <X>", "how do I exploit <tech/class>", "exploit/attack chain for <X>", "arsenal", any SSRF/XSS/SQLi/SSTI/LFI/JWT/XXE/IDOR/NoSQL/deserialization/CSRF/CORS/CRLF/GraphQL/smuggling/web-cache/OAuth/SAML/MFA/crypto/LDAP/XPath/WebAuthn/file-upload/IMDS/prompt-injection/Modbus ask, plus "privesc arsenal", "CVE arsenal", "default creds", "nuclei templates", "sqlmap/hydra/nmap/bloodhound", "password attacks".

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Encod3d-Sec/TORCH3332026년 9월 1일 업데이트

bb-workflow

무료

Autonomous bug-bounty campaign driver. Runs a full programme end to end with no operator approvals - the deterministic driver (scripts/campaign.py) owns pass state, generates the killchain board from recon, and prints the exact next action (including which Skill and tool to run) every turn. Use when starting or resuming a bug-bounty engagement, "run the bb workflow", "hunt this program", "9-pass campaign", or when handed a *.scope wildcard to test for TIER1 findings. Single agent, refuter-verified, wiki-first, tool-first.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Encod3d-Sec/TORCH3332026년 9월 1일 업데이트

campaign-health

무료

Health check for the bb/pt/ctf workflow driver subsystem - verifies everything is in place so every machine runs the same. Checks vault-content consistency (scripts present, JSON valid, routing wired, all 69 tool pages carry phase:, the tool index resolves, the hook edits are in place) AND per-machine wiring (the three workflow skills symlinked, hooks registered, imports work), then runs a live init->board->next smoke test. Use when setting up the workflow on a new machine, after a vault sync, when the driver misbehaves, or on "bb-health", "campaign health", "is the workflow set up", "check hooks and scripts", "why is the board not working".

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Encod3d-Sec/TORCH3332026년 9월 1일 업데이트

chrome-devtools-browser

무료

Bring up a REAL, visible, interactive chromium on the Kali VM that the operator logs into (Smart-ID / Mobile-ID / any manual auth or MFA/CAPTCHA), while the agent drives and observes it live through the chrome-devtools MCP (navigate, DOM snapshot, network capture, screenshots, console, evaluate). Use whenever a target needs a MANUAL login the agent cannot complete headlessly, when you need to capture an authenticated session / the real API calls a page makes, or to confirm/screenshot a DOM-XSS. Triggers - "open a browser", "log in manually", "smart-id / mobile-id / national id login", "mfa / 2fa login", "solve the captcha", "drive the browser", "capture the authenticated session / network".

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Encod3d-Sec/TORCH3332026년 9월 1일 업데이트

claude-md-improver

무료

OFFLINE FALLBACK for the claude-md-management plugin - prefer that plugin when it is installed. Audit and improve CLAUDE.md files - scan for CLAUDE.md files, evaluate quality against templates, output a report, then make targeted updates. Invoke explicitly (/claude-md-improver) when the plugin is unavailable.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Encod3d-Sec/TORCH3332026년 9월 1일 업데이트

coverage

무료

Show per-asset vuln-class coverage gaps for the active engagement so nothing in scope is skipped. Use when asked "coverage", "what haven't we tested", "test gaps", "are we thorough", or before calling an engagement done.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Encod3d-Sec/TORCH3332026년 9월 1일 업데이트

Encod3d-Sec의 스킬 모두 보기

이 스킬의 문제 신고