Use common CLI, Kali, and shell tools to inspect web Targets, captured assets, logs, HAR/PCAP files, packages, and generated artifacts, then turn observations into Evidence, Security Signals, and ranked Hypotheses. Use when the user asks for web bug-hunting inspection, digital records, URL maps, crawling, endpoint discovery, JS bundle/package analysis, light forensics, or command-line investigation workflows.
インストールする前に、エージェントに与えられる指示の中身を確認できます。
Use this skill to turn a web Target or captured artifact set into reproducible Evidence, concrete Security Signals, and bounded follow-up Hypotheses. Prefer passive collection first, keep scope explicit, and avoid exploit payloads until a later approved Investigation Run. See GLOSSARY.md for shared term definitions.
Handoffs: Use bug-hunt-planner to structure findings into a staged plan. Use ctf-tool-selection when a user provides a broad CTF/security tool list or asks which established tool fits the job. Use reverse-engineering-analysis for JS bundles, WASM, or binary artifacts found during inspection. Use exploitation-sandbox to verify a Hypothesis with a PoC.
mkdir -p evidence/{raw,normalized,reports,stats}.date -Is, uname -a, tool versions, command line, URL/source, hashes, file sizes, and environment notes.Wrap important commands so outputs are reproducible. Prefer the repo helper when available:
Default to curl for a shell-native transcript. Use curl_cffi only when fingerprint-exact reproduction of a prior browser capture is required for capture fidelity — never for stealth or bot-detection evasion against anti-abuse controls.
./sandbox/skills/reverse-engineering-analysis/scripts/capture-command-stats.sh \
"evidence/stats/curl-home.json" -- curl -sSIL https://example.test/
If no wrapper is available, capture at least:
{ date -Is; pwd; command -v curl; curl --version | head -1; } > evidence/stats/env.txt
curl -sSIL "$URL" > evidence/raw/headers.txt 2> evidence/raw/headers.err
printf '%s %s\n' "$(sha256sum evidence/raw/headers.txt)" headers.txt >> evidence/stats/hashes.txt
curl -sSIL -A bug-hunter-web-inspection/0.1 "$URL".curl -sSL --compressed "$URL" -o evidence/raw/index.html; parse with rg, pup, xmllint, jq, or local scripts.gau, waybackurls, vendor docs, existing Web Captures, and user-provided HARs.katana, hakrawler, wget --spider, or app-local crawler code; keep depth, host allowlist, and rate limits explicit.ffuf, feroxbuster, gobuster; use low rate, small wordlists, and stop on instability.dig, host, openssl s_client -connect host:443 -servername host, testssl.sh --fast, and nmap -sT -Pn -p 80,443 only within scope.nuclei, OWASP ZAP active scan, Burp Scanner, W3AF, sqlmap, Commix, and XSSer require approval because they can send payloads, mutate state, or generate high request volume.Normalize URL maps as TSV/JSONL with: method, url, status, content_type, bytes, source, auth_required, third_party, and notes.
Read-only browser operations within target scope — viewing source, DOM snapshots, DevTools inspection, HAR export — do not need a durable approval. Any click or request that submits a form, logs in, downloads a file, or changes state is a mutation and requires a matching durable approval per docs/durable-approvals.md. "Reproduce a benign request" is not automatically benign: an authenticated replay can mutate state, so classify it by effect, not intent.
Use the same repeatable sequence for broad web/API inspection, but keep each step tied to artifacts and approval boundaries:
Advanced focus queue:
curl -b cookies.txt -c cookies.txt, httpie, or xh, classifying by effect per the browser section above.httpie / xh: use for repeatable API requests and collection cleanup. Export collections with their tokens intact when saving Evidence.jq '.log.entries[] | {method:.request.method,url:.request.url,status:.response.status}' capture.har.rg -n "fetch\(|axios\.|XMLHttpRequest|/api/|/rest/|graphql|POST|PUT|PATCH|DELETE" evidence/raw.file, du -h, sha256sum, rg "sourceMappingURL|webpack|vite|rollup|parcel", js-beautify, source-map-explorer, or wakaru when useful.package.json, lockfiles, source maps, bundle banners, npm view, pnpm list, npm audit --json, retire, and osv-scanner. Note that npm view/npm audit transmit the dependency tree to the public registry — against a private target that is disclosure, not passive inspection; log it or obtain scope confirmation.whatweb, httpx -tech-detect, response headers, CSP, CORS, WebSocket URLs, GraphQL introspection hints, OAuth/OIDC/SAML/JWT strings, WASM imports, and third-party API hosts.Rank candidates by reachability, sensitivity, controllability, change/drift, affected versions, auth boundary, and cleanup feasibility.
When the user asks for a broad target scan, vulnerability sweep, or first-pass bug hunt, optimize for breadth across Discovery Lanes before drilling into the first interesting issue. Start from passive records and URL/API inventory, then sample one or two representative routes per lane. Do not invent findings to fill a lane; unsupported lanes become open questions.
Use these Discovery Lanes as the default queue:
| Discovery Lane | Passive Discovery Signals | Representative Next Step |
|---|---|---|
| Input handling | Search forms, query parameters, body parameters, reflected values, parse errors, template/script sinks, path or file parameters | Capture routes/parameters and propose the smallest non-mutating probe; active payloads require approval. |
| Access control and auth/session | Login/logout/reset/profile/account routes, ID-shaped objects, user-specific APIs, cookies, JWT/OAuth/SAML hints, anonymous-vs-auth boundary responses | Map auth boundaries and object ownership assumptions before any cross-account test. |
| Information disclosure and debug | Stack traces, verbose errors, framework/version banners, internal paths, debug endpoints, source maps, build metadata, noisy 4xx/5xx responses | Save the response as Evidence, extract disclosed components, and rank whether it enables another lane. |
| Exposed files and directories | Directory listings, backups, .bak/.old, config filenames, public uploads, source maps, logs, archive references, security/privacy files | Inventory filenames and sensitivity; request approval before high-volume content discovery. |
| Browser/API security posture | CSP/HSTS/X-Frame-Options/CORS headers, CSRF tokens, WebSocket/SSE endpoints, API versioning, rate-limit headers, cache headers, client-side route guards | Record policy/header gaps and API boundary clues; avoid state-changing requests without approval. |
For a broad sweep report, aim for 3-5 distinct Evidence-backed Discovery Lanes when the target supports them within the budget. For each Signal include:
If the agent has a fixed time/cost/tool budget, sample across lanes first, then spend remaining budget on the highest-impact lane. Stop once evidence is sufficient to report candidates and avoid repeated tool-schema repair or route-by-route probing that does not add new lanes.
find, stat, file, du -ah, wc -l, sha256sum, tree, tar -tf, unzip -l.strings, rg, jq, yq, xmllint, exiftool, xxd, hexdump -C.pngcheck, zsteg, stegsolve, stegseek/StegCracker, ImageMagick, Audacity, binwalk, and foremost; keep originals immutable and record dictionaries/time limits for brute-force steps.awk, sort, uniq -c, and jq.tshark, tcpdump -r, zeek, and Wireshark only on owned or explicitly provided traffic; for new captures prefer the project's network-recording recorder, which owns the approval-gated capture path..env values or unrelated host credentials into prompts, commands, or evidence.Produce a concise report with:
evidence/ trees are intermediates: register durable Artifacts through the Evidence Interface (src/server/evidence/artifact-service.ts), which hashes exact bytes, and cite returned artifact IDs in Evidence.まだレビューはありません。使ってみた感想をお寄せください。
概要と使いどころ
Plan and use user-consented local camera and microphone observations for an explicitly authorized physical target. Use when a capture can establish a bounded physical-state observation such as whether a test fixture changed state, an instrument reading changed, or equipment noise changed relatively.
日本語の概要は準備中です。原文の説明を表示しています。
Plan vulnerability research using conventional bug-hunting and pentest stage names, specialty playbooks, and a research-hypothesis-experiment loop. Use when designing a bug bounty workflow, selecting tools and strategies, building a decision tree, or turning a target/scope into a staged hunting plan.
日本語の概要は準備中です。原文の説明を表示しています。
Passive code-review lane for authorized repositories, local checkouts, uploaded source archives, and diffs. Use when the security research agent needs deterministic candidate discovery before expensive AI investigation, scoped PR-style review, append-only evidence records, or independent revalidation of code findings.
日本語の概要は準備中です。原文の説明を表示しています。
Run independent, task-matched expert attempts, select a base, and synthesize the strongest result.
日本語の概要は準備中です。原文の説明を表示しています。
Select established CTF and security-research tools for authorized artifact triage, web inspection, reversing, crypto, forensics, networking, and exploit validation. Use when a user provides a CTF-style tool catalog, asks which tools to use, or needs safe usage instructions for common offensive/security tools.
日本語の概要は準備中です。原文の説明を表示しています。
Disciplined diagnosis loop for hard bugs and performance regressions. Reproduce → minimise → hypothesise → instrument → fix → regression-test. Use when user says "diagnose this" / "debug this", reports a bug, says something is broken/throwing/failing, or describes a performance regression.
日本語の概要は準備中です。原文の説明を表示しています。