Product & Planning

haibo3434358 Skill

验证码/短信验证码/邮件验证码/滑块/人机验证绕过方法论。当登录、注册、找回密码、短信发送、邮箱验证、支付确认、MFA、评论提交等流程出现 captcha/code/otp/sms/email verify/geetest/TCaptcha 时使用。覆盖验证码重放、泄露、万能码、空值绕过、接收者未绑定、限频绕过、短信轰炸和时间窗口问题。

haibo3434358 Skill

Session cookie 分析与伪造方法论。当发现 Web 应用使用 cookie 进行认证、需要判断 cookie 类型并选择伪造方法时使用。覆盖 unsigned base64 cookie 直接伪造、Flask 签名 cookie（flask-unsign 爆破密钥）、加密/二进制 cookie 的识别。本技能负责 cookie 类型判断和分流：如果判断为 JWT（三段式 eyJ 开头），应转至 jwt-attack-methodology；如果判断为加密 cookie 需要 Padding Oracle，应转至 crypto-web-attack

haibo3434358 Skill

站点爬取/功能发现策略方法论。在 Phase 0 站点探索阶段使用。定义如何系统性发现网站页面、SPA 路由、按钮、表单、XHR/Fetch、API 端点、JS 隐藏路径、登录后功能、多角色差异、WebSocket、GraphQL、上传/导入/导出/支付等入口，并为每个入口生成漏洞假设。

haibo3434358 Skill

JavaScript 静态分析提取隐藏 API 端点 + Source Map 深度利用。当目标是 SPA/前后端分离、Vue/React/Angular/Vite/Webpack、常规目录扫描收效甚微、或需要从 JS bundle/source map/localStorage/config 中提取 API、密钥、内部域名、WebSocket、GraphQL、路由和前端权限逻辑时使用。发现端点后应路由到 api-fuzz、idor、auth-bypass 等专项测试。

haibo3434358 Skill

上线后渗透测试场景剧本。生产环境，低噪音模式。不影响线上服务，以被动分析和最小化 PoC 验证为主。

haibo3434358 Bundle

IDOR/BOLA 越权漏洞完整方法论 — 基于 250+ HackerOne 真实报告 + Intigriti/CN-SEC 实战技巧提炼。覆盖水平越权、垂直越权、盲 IDOR、GraphQL IDOR、二阶 IDOR、多租户越权、API 版本降级、文件资源 IDOR、批量操作越权、403 绕过。任何出现 user_id/order_id/file_id/org_id/tenant_id/uuid/资源 ID/批量 ids/导出任务/对象归属的场景都必须使用此 skill。

haibo3434358 Skill

多角色/多账号/多租户对比分析方法论。当有游客、普通用户 A/B、VIP、商户、子账号、管理员、审核员、客服、租户 A/B 等测试身份时使用。通过对比不同角色看到的页面、API、数据、按钮、菜单、响应字段和操作结果来发现未授权、IDOR、垂直越权、租户越权、Mass Assignment。

haibo3434358 Skill

目标全景画像与攻击面优先级分析。当需要系统性整理目标资产、技术栈、认证体系、API 风格、权限/租户模型、业务高价值功能、WAF/CDN/中间件、移动端/小程序入口，并推断最该优先测试的漏洞类型时使用。适合在 recon-full 或 crawl 后生成结构化目标档案。

haibo3434358 Skill

渗透测试元方法论 — Agent 的核心思维框架。定义'像人一样渗透'的思考方式：自适应、从失败中学习、多向量思考。所有其他 Skills 的上层指导原则。

haibo3434358 Skill

采样验证与归纳推断策略。当发现大量同类接口/功能需要测试同一种漏洞时，通过采样验证少量接口推断全局结论，避免穷举浪费时间。适用于：统一鉴权检测、CSRF 防护检测、CORS 配置检测、响应头安全检测等批量场景。

haibo3434358 Skill

入口点 → 漏洞类型 → SKILL 映射表。Agent 在 Phase 2 测试功能点时，根据此表判断该入口点最可能存在什么漏洞，精准加载对应 SKILL。这是 Agent 渗透决策的核心路由表 — 定义'至少测什么'，但不限制你的推理。

haibo3434358 Skill

用户枚举与敏感数据遍历方法论。当目标有注册、登录、找回密码、搜索用户等功能时使用。覆盖用户名/手机号/邮箱枚举（通过注册/登录/密码重置接口的差异响应）、批量数据导出越权、订单号/发票号等业务ID遍历。SRC 常见中危漏洞。

haibo3434358 Skill

无账号登录页面快速测试策略。当用户只给了一个登录页面 URL 且没有提供账号密码时使用。在没有认证凭据的情况下，能测试的范围有限，应在3分钟内快速完成外围测试。不要花大量时间在无法深入的功能上。

haibo3434358 Bundle

国产组件指纹 + 默认凭据 + 高危路径知识库 — 覆盖致远/通达/泛微/用友/金蝶/蓝凌等国产 OA，Nacos/XXL-JOB/Druid/Apollo 等中间件，RuoYi/JeecgBoot 等国产框架。含指纹识别、默认密码、高危路径、WooYun 高频参数字典。当目标指纹识别出国产组件时自动加载。

haibo3434358 Skill

认证绕过完整方法论 — 基于 300+ HackerOne/Bugcrowd 真实报告提炼。覆盖未授权访问、登录逻辑缺陷、MFA 绕过、Session 管理攻击、认证降级、默认/泄露凭据、注册逻辑漏洞、API 认证缺失、Response 篡改、Race Condition 认证绕过。任何出现 login/session/token/cookie/Authorization/MFA/2FA/验证码/注册验证/受保护 API 的场景都必须使用此 skill。

haibo3434358 Skill

攻击面发现总控方法论。在爬取、抓包、JS 分析、API 文档分析、登录后探索、多角色对比阶段使用。用于把页面、接口、参数、Header、Cookie、WebSocket、GraphQL、上传、导入导出、支付、回调、对象存储等所有外部输入点系统性枚举出来，并把每个入口映射到后续漏洞 discovery skill。

haibo3434358 Skill

业务逻辑分析方法论。在 Phase 1 功能分析阶段使用。用于理解 Web 应用业务模型、关键流程、状态流转、金额/数量/优惠券/订单/审批/邀请/积分/库存/支付回调等高价值逻辑入口，并把每个流程转化为可测试的业务漏洞假设。

haibo3434358 Skill

通用漏洞发现方法论 — 当遇到不在已有SKILL覆盖范围内的场景时，教LLM如何系统性地发现漏洞。覆盖：输入点穷举、响应差异分析、边界条件探测、未知技术栈适应、容易被忽略的攻击面。

haibo3434358 Skill

Web 应用敏感信息泄露检测与利用。当发现 .git/.svn 目录、备份文件路径(.bak/.zip/.tar.gz)、.env 配置文件、Swagger/OpenAPI 文档、debug 页面等信息泄露点时使用。也适用于发现源码泄露后的深入利用：git 历史审计（git log -p -S 搜索已删除的密码和 flag）、svn wc.db 文件列表提取、.DS_Store 目录枚举。优先于漏洞利用——信息泄露可直接提供凭据和攻击路径，往往比直接挖漏洞更快进入系统

looker-open-source Skill

Comprehensive guide for using `looker-cli`. Covers profile setup and defaults, using the --profile flag, persistent logins (`session login`), command discovery (`meta tree` & `meta search`), and request body inspection (`--describe-body` & `--template`).

looker-open-source Skill

Looker Developer Onboarding: Step 2. Verifies that the Looker CLI is available in the PATH, or installs it from GitHub Releases if missing. Only execute this after Step 1 (Data Discovery using `exploring-data-for-looker`).

looker-open-source Skill

Orchestrates the entire E2E Looker developer onboarding journey. This is the MUST-READ parent skill that coordinates the overall process. Start here when beginning a new Looker setup. It guides you to act as an informative, transparent guide, leading the user in sequence through: Pre-flight, Discovery, CLI, Auth, Connect, Project, Model, Dashboard.

lytics Skill

Discover and interpret profile schema fields, types, and sample values for field mapping. Use when the user wants to find schema fields, understand field types, or discover what data is available in the profile schema.

maystudios Skill

Use Hermes Tweet with Hermes Agent for X/Twitter endpoint discovery, public reads, private action-gated reads, audience analysis, thread planning, and guarded publishing. Use when a project needs Hermes-native social research or publishing workflows.

opensealai Bundle

Use this skill when the user asks which creators or UGC partners rank for specified search terms, or requests a shortlist based on ranked search evidence. Evaluate a supplied creator with named-account evidence instead.

opensealai Bundle

Use this skill when the user asks for an executive, leadership, board, client, or senior-stakeholder summary of SocialSeal results. Convert detailed tracking/readout evidence into a concise business-language update with scope, decisions, risks, examples, and next priorities rather than repeating the full analysis.

picsart Skill

Five brand direction variations for pitch discovery.

policyengine Skill

Curated anchor list of PolicyEngine's previously-published scored reforms, plus the map of the real prior-scores infrastructure in this repo (presets, the scorekeepers registry, the /prior-scores command, and the prior-scores-finder agent). Use to find a benchmark magnitude to anchor a new analysis (Stage 3 / Stage 5 of /analyze-policy) or to cite PE's prior work on a similar reform. Triggers: "prior PE score", "PolicyEngine has scored", "what did PE find", "PE benchmark", "anchor reform", "comparable reform", "EITC expansion scored", "CTC expansion scored", "SALT cap analysis", "state CTC analysis", "ARPA reform impact", "American Family Act score", "published_scores", "preset reform", "scorekeepers". NOT for: broader blog discovery (see policyengine-research-lookup) or diagnosing why a run mismatches a prior (see policyengine-calibration-diagnostics).

jawhnycooke Skill

This skill should be used when the user asks to "create a plugin", "build a new plugin", "scaffold a plugin", "make a Claude Code plugin", "design a plugin", or needs guidance on the end-to-end plugin creation workflow including discovery, component planning, design, implementation, validation, and testing.

jelbirt Skill

Figure out the logical next steps for the current project by delegating a token-efficient review to a subagent that reads the repo state, git history, and the most recent plan/roadmap docs, then returns a prioritized short list. Use whenever the user asks "what's next", "what should I work on", "next steps", "where did we leave off", "what's left", "help me plan the next session", or seems unsure how to move the project forward — even if they don't say "next-steps" explicitly.

kalyvask Skill

Adversarially re-review a PM artifact, recommendation, or AI-generated critique that already exists. Use as a second pass after another skill (pm-evaluator, pm-prd-drafter, pm-decision-coach, pm-value-hypothesis-tester) has produced output, or on any external AI output the user wants pressure-tested before deferring to it. Plays the role of a hostile exec, skeptical board member, or competing PM — looking for what the first pass missed, what bias it brought, and what would not survive a real review. Returns the three load-bearing holes, what's already strong enough to keep, and the specific re-writes that would close the gaps.

kalyvask Skill

Grade a PM's written analysis, strategy memo, PRD, or proposal against the five-criterion PM evaluation rubric. Use when the user shares a PM artifact (a memo, a deck draft, a PRD, an analysis of a real product situation) and wants honest critique — or when reviewing your own draft before sending it up the chain. Returns a score, the strongest sections, the weakest sections, and specific re-work recommendations.

kalyvask Skill

Draft or critique a PRD against the repo's PRD template and problem-framing rubric. Use when the user is starting a PRD, sharing a PRD draft for review, or stuck on a specific PRD section (problem statement, success metrics, scope, kill criteria). Pushes back on vague problem statements, generic success metrics, and feature-laundry-list scope. Returns either a structured PRD draft or a section-by-section critique with specific re-writes.

kalyvask Skill

Given a calendar event (or upcoming meeting context), draft a one-page meeting brief. Identifies attendees, pulls relevant project state and stakeholder context, surfaces last interaction and open commitments, and drafts an opinionated prep doc. Use 15-30 minutes before any meeting that matters — exec review, stakeholder check-in, customer call, decision point.

kalyvask Skill

Critically review the user-facing surface of a PRD, design spec, or feature proposal against behavioral and UX principles. Use when a PM has a solution in hand and wants the design layer pressure-tested — defaults, friction placement, choice architecture, information density, AI surface decisions, agentic surfaces (attribution, approval gates, autonomy), peak-and-end moments. Distinct from pm-red-team (strategy adversary) and pm-evaluator (rubric scoring); this skill stays at the design layer and asks whether the design works with human cognition or against it. Returns the three load-bearing design holes with specific re-writes.

kalyvask Skill

Load the PM agent's persistent context — personal style and preferences from `you.md`, the active project list, cross-project stakeholders, and the relevant project's state. Use as the first step in any PM workflow when you need the agent to understand the user's current work before doing anything else. The other operate-stage skills (pm-morning-brief, pm-meeting-prep, pm-meeting-debrief, pm-weekly-review, pm-stakeholder-tracker) chain to this skill first.