recognize-attack-surface
Skill7 starsChanged 31 days agoLicence not identifiedView on GitHub
渗透测试的攻击面识别与研判总线：拿到一个目标或功能点时，先用它判断"这里可能是哪类漏洞、该用哪个 hunt skill"，并覆盖没有专用 hunt skill 的横切类别——跨组件攻击链、业务逻辑漏洞、安全配置错误、信息泄露。当用户说"从哪下手""这个功能可能有什么问题""帮我看看攻击面""该测哪类漏洞""怎么把几个小问题串成大的"时使用；也在每次渗透开局做侦察分诊时使用。输出：识别出的可疑信号 + 路由到的 hunt skill 清单 + 横切类别的研判结论。
- Reads credentials
In this repository15 other files it gives its agents.
- agent-workflowSkill
- hunt-auth-bypassSkill
- hunt-cache-poisoningSkill
- hunt-command-injectionSkill
- hunt-csrfSkill
- hunt-deserializationSkill
- hunt-nodejs-permission-bypassSkill
- hunt-open-redirectSkill
- hunt-path-traversalSkill
- hunt-prototype-pollutionSkill
- hunt-request-smugglingSkill
- hunt-sqliSkill
- hunt-ssrfSkill
- hunt-xssSkill
- hunt-xxeSkill
The file
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
No reviews yet
People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.
- It worked
- Partly
- It didn't
Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.