查找技能

Detect XML/SVG/YAML entity expansion (Billion Laughs) vulnerabilities in parsers that allow unbounded entity definitions.

中文简介正在准备中。当前显示原文说明。

Detect method clobbering via user-controlled object keys that overwrite built-in methods like toString, valueOf, or hasOwnProperty, causing crashes or logic bypass.

中文简介正在准备中。当前显示原文说明。

You are helping a penetration tester perform password spraying against

中文简介正在准备中。当前显示原文说明。

Cloud IAM red-team attack chain across AWS, Azure, GCP — focused on EXTERNAL exploitation paths and post-credential-discovery privilege analysis. Covers IAM enumeration (aws iam, az role, gcloud iam), STS/AssumeRole chaining, Azure Managed Identity abuse (via SSRF/leak), GCP service account JSON abuse, IMDSv1/v2 attacks via SSRF, K8s ServiceAccount token privilege analysis once held (token discovery / cluster exposure is owned by hunt-k8s), role-trust-policy confused-deputy, cross-account assume-role enumeration, IAM privilege escalation patterns (24+ AWS, 8+ Azure, 6+ GCP), and AWS Cognito Identity Pool unauthenticated-role attack chain (GetId → GetCredentialsForIdentity → IAM role abuse). Built for the case where recon yields a credential (key, JSON, token) and you need to know what it grants and how to escalate. Use when an AWS key / Azure secret / GCP service account JSON / K8s SA token surfaces from a code repo, JS bundle, APK, breach corpus, or SSRF chain.

中文简介正在准备中。当前显示原文说明。

AI/LLM security offensive checklist: prompt injection, jailbreaking, model extraction, training data poisoning, adversarial inputs, LLM-assisted attack automation, and AI system reconnaissance. Use when assessing AI/ML systems, red-teaming LLMs, or researching AI attack vectors.

中文简介正在准备中。当前显示原文说明。

You are helping a penetration tester establish persistent access in Active

中文简介正在准备中。当前显示原文说明。

Mine GitHub Security Advisories and CVE databases for incomplete fixes, finding variant vulnerabilities in patched code or similar patterns in related packages.

中文简介正在准备中。当前显示原文说明。

You are helping a penetration tester enumerate an Active Directory domain and

中文简介正在准备中。当前显示原文说明。

Okta-as-IdP red-team attack chain — tenant discovery, user enumeration (multiple vectors), authentication flow analysis (factors enumeration, push-notification fatigue, SMS bypass), password spray with lockout discipline, Okta-specific phishing primitives (kits, FastPass abuse, OIDC redirect_uri tampering), MFA enumeration, post-compromise admin API surface. Many enterprise orgs use Okta instead of (or alongside) Entra ID. Distinct endpoints, distinct rate-limiting, distinct factor flows. Use when recon shows `<tenant>.okta.com`, `<tenant>.okta-emea.com`, `<tenant>.oktapreview.com`, or autodiscover-style records pointing at Okta IdP.

中文简介正在准备中。当前显示原文说明。

Detect OS command injection via shell execution sinks where user-controlled input reaches system commands without proper sanitization.

中文简介正在准备中。当前显示原文说明。

Systematic false positive elimination for security findings. 6-gate verification, 13-item checklist, devil's advocate questioning. MANDATORY before any CVE submission.

中文简介正在准备中。当前显示原文说明。

You are helping a penetration tester establish persistence through AD CS

中文简介正在准备中。当前显示原文说明。

Detect authentication and authorization bypass vulnerabilities including missing auth middleware, JWT algorithm confusion, IDOR, and session fixation.

中文简介正在准备中。当前显示原文说明。

1. POST to the forgot-password endpoint with a clearly invalid email (e.g. nonexistent@fakedomain12345.com) — record the response body, status code, and length

中文简介正在准备中。当前显示原文说明。

You are helping a penetration tester extract credentials from Active

中文简介正在准备中。当前显示原文说明。

You are helping a penetration tester exploit ADCS through template/CA access

中文简介正在准备中。当前显示原文说明。

You are helping a penetration tester exploit misconfigured AD CS certificate

中文简介正在准备中。当前显示原文说明。

You are helping a penetration tester exploit misconfigured Active Directory

中文简介正在准备中。当前显示原文说明。

You are helping a penetration tester force remote systems to authenticate

中文简介正在准备中。当前显示原文说明。

You are helping a penetration tester with offline credential and file cracking.

中文简介正在准备中。当前显示原文说明。

Guide for continuous improvement, error proofing, and standardization. Use this skill when the user wants to improve code quality, refactor, or discuss process improvements.

中文简介正在准备中。当前显示原文说明。

Control Home Assistant smart home devices, run automations, and receive webhook events. Use when controlling lights, switches, climate, scenes, scripts, or any HA entity. Supports bidirectional communication via REST API (outbound) and webhooks (inbound triggers from HA automations).

中文简介正在准备中。当前显示原文说明。

Read and manage email via IMAP (ProtonMail Bridge, Gmail, etc.). Check for new/unread messages, fetch content, search mailboxes, and mark as read/unread. Works with any IMAP server including ProtonMail Bridge.

中文简介正在准备中。当前显示原文说明。

Control LG smart appliances via ThinQ API. Use when user asks about their fridge, washer, dryer, AC, or other LG appliances. Supports checking status, changing temperature, toggling modes (express, eco), and monitoring door status.

中文简介正在准备中。当前显示原文说明。