Security

wgpsec Bundle

CTF 挑战中的源码审计方法。当发现 .git 目录、.bak/.zip 备份、/proc/self/environ 泄露源码时使用。与真实代码审计不同——CTF 源码中的漏洞是故意设置的，通常只有 1-2 个关键点。先找危险函数（sink），再追溯输入（source）到该函数的路径。覆盖 PHP/Python/Node.js/Java 四种语言的危险函数和漏洞模式

wgpsec Bundle

CTF Web 挑战的总体方法论。当面对 CTF 靶场、xbow benchmark、Web 安全挑战赛时使用。包含挑战类型快速识别、攻击策略选择决策树、常见出题模式、何时切换方向的判断标准。与 exploit/ 下的具体漏洞技能配合使用

wgpsec Bundle

IOC（失陷指标）分析与对抗方法论。蓝队视角：如何收集、富化、关联 IOC 进行威胁猎杀。红队视角：如何避免自身基础设施和工具产生可识别的 IOC，以及如何使 IOC 快速失效。当红队需要评估自身暴露面或规划 C2 基础设施时使用

wgpsec Bundle

APT 模拟与情报驱动红队方法论。基于已知 APT 组织的 TTP（MITRE ATT&CK）设计红队行动计划。当需要模拟特定威胁组织、设计高仿真攻击演练、或根据威胁情报制定攻击策略时使用

wgpsec Bundle

401/403 访问拒绝绕过与 Spring MVC .do 鉴权绕过方法论。当遇到管理后台、API 端点返回 401/403 Forbidden、Spring MVC .do 接口鉴权绕过、302 登录跳转（login_tologin.do）、越权注册（registersysuser、goedituser）等场景时使用。覆盖路径操纵、HTTP 方法篡改、Header 注入、协议降级、.do 后缀鉴权绕过、302 跳转绕过、组合攻击

wgpsec Bundle

移动 App 后端 API 安全测试。当目标是移动应用的后端接口、发现 /api/v1/ 等移动端 API 路径、或需要测试 App 与服务器之间的通信安全时使用。覆盖 API 端点发现、认证机制测试、业务逻辑漏洞、移动端特有的安全问题

wgpsec Bundle

REST/GraphQL API 安全测试方法论。当目标有 API 端点（/api/、JSON 响应）、Swagger/OpenAPI 文档暴露、通过 js-api-extract 或目录扫描获得端点列表时使用。覆盖 API 发现、认证测试、框架识别、语义分析智能 Fuzz（根据端点语义推断参数名/类型/业务含义构造精准 payload）、Prototype Pollution、请求走私。IDOR → idor-methodology | GraphQL → graphql-methodology | CSRF → csrf-methodology。任何涉及 API 端点安全测试、参数发现、权限边界测试的场景都应使用此 skill

wgpsec Skill

Session cookie 分析与伪造方法论。当发现 Web 应用使用 cookie 进行认证、需要判断 cookie 类型并选择伪造方法时使用。覆盖 unsigned base64 cookie 直接伪造、Flask 签名 cookie（flask-unsign 爆破密钥）、加密/二进制 cookie 的识别。本技能负责 cookie 类型判断和分流：如果判断为 JWT（三段式 eyJ 开头），应转至 jwt-attack-methodology；如果判断为加密 cookie 需要 Padding Oracle，应转至 crypto-web-attack

wgpsec Bundle

CSRF 跨站请求伪造检测与利用。当目标表单/API 缺少 CSRF Token、使用 Cookie 认证、有敏感操作（修改密码/转账/绑定邮箱）时使用。通过诱导受害者点击链接以其身份执行操作

wgpsec Bundle

IDOR 不安全直接对象引用与未授权访问检测与利用。当 API/URL 中出现 user_id、account、订单号、文件名等可预测标识符，或需要测试水平越权（访问他人数据）、垂直越权（普通用户获取 admin 管理员权限）、接口越权时使用。覆盖 ID 遍历、绕过技巧（参数污染/编码/方法切换）、多步 IDOR 链、文件资源 IDOR、批量操作越权、间接引用枚举、框架特征利用、UUID 猜测、响应对比分析、写操作越权、JWT Claims 篡改、token/session 权限校验绕过、role/permission 检查缺失。发现 API 端点后务必加载本 skill 检查越权和未授权访问问题

zakirkun Bundle

Detects DOM-based Cross-Site Scripting (XSS) vulnerabilities in JavaScript

zakirkun Bundle

Detects missing X-Frame-Options or Content-Security-Policy frame-ancestors directives.

zakirkun Bundle

Detects old API versions that may lack current security controls and deprecated endpoints still accessible in production.

zakirkun Bundle

Detects JSONP endpoints that reflect user-controlled callback names without validation, enabling XSS.

zakirkun Bundle

Detects insecure GraphQL configurations including enabled introspection, unbounded query depth, and missing authentication on resolvers.

zakirkun Bundle

Detects missing or misconfigured HTTP security headers that protect against common browser-based attacks.

zakirkun Bundle

Detects network configurations that fail to apply security controls to IPv6, allowing bypass via IPv6 tunneling.

zakirkun Bundle

Detects insecure WebSocket implementations including missing origin validation, lack of authentication, and message injection risks.

zakirkun Bundle

Detects user input embedded in PDF or document generation without sanitization, enabling XSS through PDF rendering and data exfiltration.

zakirkun Bundle

Detects iOS ATS exceptions that allow insecure HTTP connections or disable certificate validation.

zakirkun Bundle

Detects API versioning patterns where newer security controls do not apply to older API versions still in use.

zakirkun Bundle

Detects initialization vectors generated using non-cryptographic random functions, compromising cipher security.

zakirkun Bundle

Detects insecure Android WebView configurations enabling XSS, JavaScript bridge abuse, and remote code execution.

zakirkun Bundle

Detects Android TrustManager implementations that accept all certificates, disabling SSL/TLS security.

zakirkun Bundle

Detects HTTP response splitting via CRLF injection in response headers, enabling cache poisoning and XSS.

zakirkun Bundle

Detects patterns that allow direct manipulation of the JavaScript prototype chain, enabling prototype pollution and security bypass.

zakirkun Bundle

Detects authentication and authorization events that are not logged, hampering incident detection and forensics.

leadmagic Bundle

Vendor contracts, MSAs, DPAs, and procurement for B2B SaaS — master service agreements, service level agreements, data processing agreements, order forms, vendor security assessments, and contract negotiation playbooks. Use when selling to enterprise (inbound contracts), buying from vendors (outbound procurement), negotiating terms, or building standard agreement templates. Triggers on: "MSA", "SLA agreement", "data processing agreement", "order form", "vendor security review", "enterprise contract", "procurement".

leadmagic Bundle

Design or audit a cold-email sequence architecture: audience and trigger, offer, touch cadence, branch logic, channel roles, sending constraints, measurement, and governance. Use when planning outbound strategy, a multi-touch cadence, a sequence blueprint, or diagnosis of low reply and meeting rates. Use a copywriting skill for final messages and deliverability skills for infrastructure.

leadmagic Bundle

Security assessment and vendor risk management for B2B SaaS — penetration testing, vulnerability scanning, bug bounty programs, security questionnaires (VSAQ/SIG/CAIQ), incident response planning, disaster recovery, and passing enterprise security reviews. Use when responding to vendor security assessments, preparing for enterprise procurement, or building a security program. Triggers on: "security assessment", "penetration test", "bug bounty", "security questionnaire", "VSAQ", "incident response", "vendor review".

leadmagic Bundle

Revenue team onboarding — security access provisioning, ramp schedules, 30-60-90 plans, Slack engagement, shadowing, certification, and time-to-first-meeting reduction. Use when onboarding SDRs, AEs, managers, or RevOps hires. Triggers on: "sales onboarding", "SDR ramp", "30-60-90 sales", "reduce ramp time", "Slack for sales team", "security onboarding employees", "new rep onboarding", "sales bootcamp".

gigik2a Skill

Specialista nella redazione di contratti per investimenti in token immobiliari: subscription agreement token security, patto parasociale SPV tokenizzato, accordo di gestione ManagementCo/SlotCo, lettera di intenti Founding Members, lock-up agreement token holder, side letter investitore istituzionale, termsheet offerta ECSP, contratto di custodia token (wallet custody), accordo di distribuzione rendimenti, regolamento assemblee token holder, drag-along tag-along clausole su token, pre-emption rights tokenizzati. Usa SEMPRE questa skill per: "contratto per investitore token", "subscription agreement crowdfunding immobiliare", "patto parasociale SPV", "accordo soci con token", "lettera fondatori progetto tokenizzato", "lock-up sui token", "side letter istituzionale", "clausole di uscita token holder", "regolamento governance SPV tokenizzato", "accordo ManagementCo", "drag-along token", "pre-emption su token immobiliare", "contratto di gestione property".

gigik2a Skill

Suite K2-AI Real Estate Tokenization (1.999-19.999 EUR + setup SPV): TGC Token-Gated Club, tokenizzazione asset immobiliari italiani via SPV, ECSP Reg. UE 2020/1503, smart contract ERC-3643 T-REX (compliance on-chain), MiCAR, DLT Pilot Regime, due diligence immobiliare, business plan 14 anni con waterfall distribuzioni, KYC/AML investitori, governance assemblee on-chain, secondary market MTF/OTC, Notti Club token (utility ricettiva). ATTIVA SEMPRE QUESTO ORCHESTRATORE K2-AI per: tokenizzazione immobiliare, real estate token, ECSP crowdfunding, ERC-3643 T-REX, MiCAR compliance, DLT Pilot, SPV tokenization, fractional ownership immobiliare, TGC Token-Gated Club, founding members onboarding, waterfall distribuzioni token holder, Notti Club token ricettivo, secondary market token immobiliare, smart contract audit, KYC/AML whitelist on-chain, governance assemblee, NAV calcolo, lifecycle SlotCo SPV, multiasset tokenization. Workflow K2-AI: scoring immobile (yield/localizzazione/tokenizzabilita), DD completa, busine

ferroxlabs Skill

Diagnose an existing funnel. Classifies stages, identifies likely dropoff points against the math, runs a stage-by-stage audit, and produces a prioritized fix list ranked by impact over effort. Use when the user has a live funnel and wants a structured, multi-step diagnosis that finds the leaks and recommends prioritized fixes. Do NOT use to design a new funnel from scratch or for a question one atomic audit skill can answer without the full stage-by-stage diagnosis.

ferroxlabs Skill

Generate 5-10 ranked headline angles for an offer or page, each with Method reasoning, then refine the winner. Use when the user wants headline options for a page or asset, with the Method logic behind each angle and an interactive refine loop. Do NOT use when the user wants a full sales letter (use wayland-full-sales-asset) or a copy audit (use wayland-conversion-audit).

ferroxlabs Skill

Build a complete sales asset end-to-end via The Donahoe Method: diagnostic → primitives → fingerprint → page → integrity-gate → visual → audit → report. Composite orchestrator that calls 14-16 sub-skills via delegate_task in an 8-phase DAG (sequential where dependencies require it, parallel where they don't). Produces a client-ready full-asset bundle. Use when the user has a product brief and wants the full agency-replacement deliverable in one run - not for single-primitive work. Not for live-page audit (use /market landing) and not for partial Method runs (call individual /convert sub-skills).