How do I install the Analyst Overview skill?

Run npx skillmds@latest add purpleailab/analyst-overview in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Analyst Overview safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Analyst Overview?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Analyst Overview free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Analyst Overview?

purpleailab (@purpleailab) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Analyst Overview by purpleailab — Agent Skill

Name: Analyst Overview
Author: purpleailab

File contents

Analyst Skill Catalog

The analyst has specialised playbooks under this tree. Load the one matching your current hunting lane — don't load them all at once.

Taint / source-review playbooks

Use when you have source code and are hunting a specific weakness class.

Skill	Use for
`/skills/standard/analyst/sql-injection/SKILL.md`	String-concat + format-string → SQL sink
`/skills/standard/analyst/ssrf/SKILL.md`	User-controlled URL reaches http client
`/skills/standard/analyst/deserialization/SKILL.md`	pickle / Java ObjectInputStream / .NET BinaryFormatter / YAML
`/skills/standard/analyst/ssti/SKILL.md`	User input rendered by Jinja/Twig/Freemarker/Velocity
`/skills/standard/analyst/xxe/SKILL.md`	XML parser with external entity expansion enabled
`/skills/standard/analyst/path-traversal/SKILL.md`	User input reaches filesystem path
`/skills/standard/analyst/prototype-pollution/SKILL.md`	JS merge / assign / clone of untrusted object
`/skills/standard/analyst/command-injection/SKILL.md`	User input → shell, exec, system
`/skills/standard/analyst/idor/SKILL.md`	Missing authorization check on object reference
`/skills/standard/analyst/auth-bypass/SKILL.md`	Broken auth state machine, missing session checks
`/skills/standard/analyst/prompt-injection/SKILL.md`	LLM prompts built from untrusted input

Research expansion playbooks

Skill	Use for
`/skills/standard/analyst/patch-diff/SKILL.md`	Pinned vulnerable-to-fixed differential testing and variant analysis
`/skills/standard/analyst/pattern-exhaustion/SKILL.md`	Independent validation of related root-cause candidates

Chain playbooks

Use when you have a bag of individual findings and want to combine them into a critical impact chain.

Skill	Use for
`/skills/standard/analyst/chains/ssrf-to-rce/SKILL.md`	SSRF → metadata → IAM → RCE
`/skills/standard/analyst/chains/xss-to-takeover/SKILL.md`	Self-XSS → CSRF → admin creds
`/skills/standard/analyst/chains/cred-reuse/SKILL.md`	Low-priv cred → service pivot → domain admin
`/skills/standard/analyst/chains/idor-to-priv-esc/SKILL.md`	IDOR on settings → role elevation

Workflow

kg_stats — see what you already know.
Identify the target's language / framework.
Load the matching vuln-class skill (one or two per iteration).
Run the skill's recipe, record findings as graph nodes.
When enough vulns exist, load a chain playbook and call plan_attack_chains(promote=True) to persist any complete chains.

---name: analyst-overviewdescription: Root pointer for the analyst's vulnerability research playbooks. Load this first at iteration start to see the full catalog of vuln-class and chain-building skills.---# Analyst Skill CatalogThe analyst has specialised playbooks under this tree. Load the onematching your current hunting lane — don't load them all at once.## Taint / source-review playbooksUse when you have source code and are hunting a specific weakness class.| Skill | Use for ||---------------------------------------------|----------------------------------------------------------------|| `/skills/standard/analyst/sql-injection/SKILL.md` | String-concat + format-string → SQL sink || `/skills/standard/analyst/ssrf/SKILL.md` | User-controlled URL reaches http client || `/skills/standard/analyst/deserialization/SKILL.md` | pickle / Java ObjectInputStream / .NET BinaryFormatter / YAML || `/skills/standard/analyst/ssti/SKILL.md` | User input rendered by Jinja/Twig/Freemarker/Velocity || `/skills/standard/analyst/xxe/SKILL.md` | XML parser with external entity expansion enabled || `/skills/standard/analyst/path-traversal/SKILL.md` | User input reaches filesystem path || `/skills/standard/analyst/prototype-pollution/SKILL.md` | JS merge / assign / clone of untrusted object || `/skills/standard/analyst/command-injection/SKILL.md`| User input → shell, exec, system || `/skills/standard/analyst/idor/SKILL.md` | Missing authorization check on object reference || `/skills/standard/analyst/auth-bypass/SKILL.md` | Broken auth state machine, missing session checks || `/skills/standard/analyst/prompt-injection/SKILL.md` | LLM prompts built from untrusted input |## Research expansion playbooks| Skill | Use for ||---|---|| `/skills/standard/analyst/patch-diff/SKILL.md` | Pinned vulnerable-to-fixed differential testing and variant analysis || `/skills/standard/analyst/pattern-exhaustion/SKILL.md` | Independent validation of related root-cause candidates |## Chain playbooksUse when you have a bag of individual findings and want to combine theminto a critical impact chain.| Skill | Use for ||---------------------------------------------|----------------------------------------------------------------|| `/skills/standard/analyst/chains/ssrf-to-rce/SKILL.md` | SSRF → metadata → IAM → RCE || `/skills/standard/analyst/chains/xss-to-takeover/SKILL.md` | Self-XSS → CSRF → admin creds || `/skills/standard/analyst/chains/cred-reuse/SKILL.md` | Low-priv cred → service pivot → domain admin || `/skills/standard/analyst/chains/idor-to-priv-esc/SKILL.md` | IDOR on settings → role elevation |## Workflow1. `kg_stats` — see what you already know.2. Identify the target's language / framework.3. Load the matching vuln-class skill (one or two per iteration).4. Run the skill's recipe, record findings as graph nodes.5. When enough vulns exist, load a chain playbook and call `plan_attack_chains(promote=True)` to persist any complete chains.

Frequently asked questions

Analyst Overview