Guide authorized SQL injection testing, where input may change database queries. Define scope, choose alternative investigation paths, and organize requests, responses, and impact evidence, including reports that document unsuccessful checks without claiming a vulnerability is absent.
中文简介正在准备中。当前显示英语简介。
Domain routing and boundary guidance for authorized SQL injection testing, including union-based, blind, error-based, stacked query, and second-order SQL injection variants. Use when a task belongs to the SQL injection domain and needs scope, evidence, pivot, or exit criteria.
实测评分 未实测
查看安装方法安装前可以查看交给 AI 代理的指令内容。
当前处于 SQL 注入测试 领域。 你正在进行 SQL 注入漏洞测试。测试范围仅限 SQL 注入（含联合注入、盲注、报错注入、堆叠查询、二次注入等变体）。自主选择注入点和 payload。 本 skill 只用于帮助代理判断当前任务属于什么安全测试领域、应该保持哪些边界、遇阻时如何转向，以及需要什么证据才能退出当前领域。 它不是方法论教程，不提供固定攻击步骤；所有目标均视为预授权测试固件或本地沙箱资源，也不把任何推测当作结论。
覆盖域：
| 变体 | 典型场景 |
|---|---|
| 联合注入 (UNION) | SELECT 语句可控列数 |
| 布尔盲注 | 页面差异判断 |
| 时间盲注 | SLEEP/BENCHMARK 延时 |
| 报错注入 | extractvalue/updatexml |
| 堆叠查询 | 多语句执行 |
| 二次注入 | 存储后触发 |
| OOB 外带 | DNS/HTTP 回传 |
Required artifacts:
Minimum attempts for negative result: 3
Positive exit requires:
reproduction 证据须包含：
无法证明漏洞时，提交 negative report：已测试注入点列表 + 失败原因 → 回退上级。
Negative exit requires:
还没有评价。欢迎分享你的使用感受。
无需登录即可发表。欢迎分享使用感受、提问，或说明在哪些环境下无法运行。
还没有评论。来写第一条吧。
Assess AI agents and MCP tools for malicious instructions, tool misuse, permission violations, and data leaks. The skill organizes checks across applications, identity, data, deployment, and models, with references for each risk area.
中文简介正在准备中。当前显示英语简介。
Test Android app security by operating the app and inspecting network traffic first, then analyzing APK code or observing functions during execution when needed. Verify vulnerabilities and produce a report with screenshots, traffic evidence, and code review findings.
中文简介正在准备中。当前显示英语简介。
Analyze traffic from Android apps, browser JavaScript, and desktop clients to prepare requests for replay in Burp. Investigate signatures, encryption, and session dependencies when they block replay, and retain working request samples with supporting observations.
中文简介正在准备中。当前显示英语简介。
Handle encoded strings and cryptographic data with tool-based conversions. Decode layered formats, calculate hashes, encrypt or decrypt with AES and RSA, and inspect JWT tokens, which carry encoded headers and data used in authentication.
中文简介正在准备中。当前显示英语简介。
Analyze CTF cryptography challenges by identifying the cipher and matching known parameters to possible attacks. It provides formulas, attack parameters, and Python snippets for RSA, AES, elliptic curves, random number generators, classical ciphers, and lattice problems.
中文简介正在准备中。当前显示英语简介。
Find relevant references for CTF miscellaneous challenges, including restricted execution environments, layered encodings, hidden data in media, and game or virtual machine analysis. It also covers CTFd platform operations and Linux privilege escalation.
中文简介正在准备中。当前显示英语简介。