[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6DBVRYDH69VRW2SCX03KD75":3,"skill-same:01M6DBVRYDH69VRW2SCX03KD75":57},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":30,"linkOnly":31,"markdownContent":32,"markdownBody":33,"frontMatter":34,"refName":37,"commitSha":38,"skillDirectory":39,"forksCount":14,"repositoryHtmlUrl":40,"repositoryHomepageUrl":6,"ownerHtmlUrl":41,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":42,"install":43,"resources":56},"01M6DBVRYDH69VRW2SCX03KD75","security-bounty-hunter",null,"Hunt for exploitable, bounty-worthy security issues in repositories. Focuses on remotely reachable vulnerabilities that qualify for real reports instead of noisy local-only findings.","Prekzursil\u002Fagent-skills-toolchain","Prekzursil","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F54636077?v=4","01M6DACZ1PCQHD99SCR1YXG28B","Andrei Mihai Visalon","01M6DACZ670WZF535V3WYYSS4Z",0,"MIT","https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fsecurity-bounty-hunter\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29],"security","security bounty hunter","hunter","vulnerabilities","issues","direct","only","reports","hunt","local","adaptation","2026-11-10 10:12:30",false,"---\nname: security-bounty-hunter\ndescription: Hunt for exploitable, bounty-worthy security issues in repositories. Focuses on remotely reachable vulnerabilities that qualify for real reports instead of noisy local-only findings.\norigin: ECC direct-port adaptation\nversion: \"1.0.0\"\n---\n\n# Security Bounty Hunter\n\nUse this when the goal is practical vulnerability discovery for responsible disclosure or bounty submission, not a broad best-practices review.\n\n## When to Use\n\n- Scanning a repository for exploitable vulnerabilities\n- Preparing a Huntr, HackerOne, or similar bounty submission\n- Triage where the question is \"does this actually pay?\" rather than \"is this theoretically unsafe?\"\n\n## How It Works\n\nBias toward remotely reachable, user-controlled attack paths and throw away patterns that platforms routinely reject as informative or out of scope.\n\n## In-Scope Patterns\n\nThese are the kinds of issues that consistently matter:\n\n| Pattern | CWE | Typical impact |\n| --- | --- | --- |\n| SSRF through user-controlled URLs | CWE-918 | internal network access, cloud metadata theft |\n| Auth bypass in middleware or API guards | CWE-287 | unauthorized account or data access |\n| Remote deserialization or upload-to-RCE paths | CWE-502 | code execution |\n| SQL injection in reachable endpoints | CWE-89 | data exfiltration, auth bypass, data destruction |\n| Command injection in request handlers | CWE-78 | code execution |\n| Path traversal in file-serving paths | CWE-22 | arbitrary file read or write |\n| Auto-triggered XSS | CWE-79 | session theft, admin compromise |\n\n## Skip These\n\nThese are usually low-signal or out of bounty scope unless the program says otherwise:\n\n- Local-only `pickle.loads`, `torch.load`, or equivalent with no remote path\n- `eval()` or `exec()` in CLI-only tooling\n- `shell=True` on fully hardcoded commands\n- Missing security headers by themselves\n- Generic rate-limiting complaints without exploit impact\n- Self-XSS requiring the victim to paste code manually\n- CI\u002FCD injection that is not part of the target program scope\n- Demo, example, or test-only code\n\n## Workflow\n\n1. Check scope first: program rules, SECURITY.md, disclosure channel, and exclusions.\n2. Find real entrypoints: HTTP handlers, uploads, background jobs, webhooks, parsers, and integration endpoints.\n3. Run static tooling where it helps, but treat it as triage input only.\n4. Read the real code path end to end.\n5. Prove user control reaches a meaningful sink.\n6. Confirm exploitability and impact with the smallest safe PoC possible.\n7. Check for duplicates before drafting a report.\n\n## Example Triage Loop\n\n```bash\nsemgrep --config=auto --severity=ERROR --severity=WARNING --json\n```\n\nThen manually filter:\n\n- drop tests, demos, fixtures, vendored code\n- drop local-only or non-reachable paths\n- keep only findings with a clear network or user-controlled route\n\n## Report Structure\n\n```markdown\n## Description\n[What the vulnerability is and why it matters]\n\n## Vulnerable Code\n[File path, line range, and a small snippet]\n\n## Proof of Concept\n[Minimal working request or script]\n\n## Impact\n[What the attacker can achieve]\n\n## Affected Version\n[Version, commit, or deployment target tested]\n```\n\n## Quality Gate\n\nBefore submitting:\n\n- The code path is reachable from a real user or network boundary\n- The input is genuinely user-controlled\n- The sink is meaningful and exploitable\n- The PoC works\n- The issue is not already covered by an advisory, CVE, or open ticket\n- The target is actually in scope for the bounty program\n","# Security Bounty Hunter\n\nUse this when the goal is practical vulnerability discovery for responsible disclosure or bounty submission, not a broad best-practices review.\n\n## When to Use\n\n- Scanning a repository for exploitable vulnerabilities\n- Preparing a Huntr, HackerOne, or similar bounty submission\n- Triage where the question is \"does this actually pay?\" rather than \"is this theoretically unsafe?\"\n\n## How It Works\n\nBias toward remotely reachable, user-controlled attack paths and throw away patterns that platforms routinely reject as informative or out of scope.\n\n## In-Scope Patterns\n\nThese are the kinds of issues that consistently matter:\n\n| Pattern | CWE | Typical impact |\n| --- | --- | --- |\n| SSRF through user-controlled URLs | CWE-918 | internal network access, cloud metadata theft |\n| Auth bypass in middleware or API guards | CWE-287 | unauthorized account or data access |\n| Remote deserialization or upload-to-RCE paths | CWE-502 | code execution |\n| SQL injection in reachable endpoints | CWE-89 | data exfiltration, auth bypass, data destruction |\n| Command injection in request handlers | CWE-78 | code execution |\n| Path traversal in file-serving paths | CWE-22 | arbitrary file read or write |\n| Auto-triggered XSS | CWE-79 | session theft, admin compromise |\n\n## Skip These\n\nThese are usually low-signal or out of bounty scope unless the program says otherwise:\n\n- Local-only `pickle.loads`, `torch.load`, or equivalent with no remote path\n- `eval()` or `exec()` in CLI-only tooling\n- `shell=True` on fully hardcoded commands\n- Missing security headers by themselves\n- Generic rate-limiting complaints without exploit impact\n- Self-XSS requiring the victim to paste code manually\n- CI\u002FCD injection that is not part of the target program scope\n- Demo, example, or test-only code\n\n## Workflow\n\n1. Check scope first: program rules, SECURITY.md, disclosure channel, and exclusions.\n2. Find real entrypoints: HTTP handlers, uploads, background jobs, webhooks, parsers, and integration endpoints.\n3. Run static tooling where it helps, but treat it as triage input only.\n4. Read the real code path end to end.\n5. Prove user control reaches a meaningful sink.\n6. Confirm exploitability and impact with the smallest safe PoC possible.\n7. Check for duplicates before drafting a report.\n\n## Example Triage Loop\n\n```bash\nsemgrep --config=auto --severity=ERROR --severity=WARNING --json\n```\n\nThen manually filter:\n\n- drop tests, demos, fixtures, vendored code\n- drop local-only or non-reachable paths\n- keep only findings with a clear network or user-controlled route\n\n## Report Structure\n\n```markdown\n## Description\n[What the vulnerability is and why it matters]\n\n## Vulnerable Code\n[File path, line range, and a small snippet]\n\n## Proof of Concept\n[Minimal working request or script]\n\n## Impact\n[What the attacker can achieve]\n\n## Affected Version\n[Version, commit, or deployment target tested]\n```\n\n## Quality Gate\n\nBefore submitting:\n\n- The code path is reachable from a real user or network boundary\n- The input is genuinely user-controlled\n- The sink is meaningful and exploitable\n- The PoC works\n- The issue is not already covered by an advisory, CVE, or open ticket\n- The target is actually in scope for the bounty program\n",{"name":5,"origin":35,"version":36,"description":7},"ECC direct-port adaptation","1.0.0","main","a298c929b6cbd662e1fce54302ce520d5ceea1a5",".agents\u002Fskills\u002Fsecurity-bounty-hunter","https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain","https:\u002F\u002Fgithub.com\u002FPrekzursil","2026-11-02 14:30:57",{"source":8,"skillName":5,"commands":44,"prompt":54,"zipAvailable":55},[45,48,51],{"tool":46,"command":47},"npx","npx skills add Prekzursil\u002Fagent-skills-toolchain --skill security-bounty-hunter",{"tool":49,"command":50},"bunx","bunx skills add Prekzursil\u002Fagent-skills-toolchain --skill security-bounty-hunter",{"tool":52,"command":53},"pnpm","pnpm dlx skills add Prekzursil\u002Fagent-skills-toolchain --skill security-bounty-hunter","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fsecurity-bounty-hunter\u002FSKILL.md",true,[],[58,80,110,137,150,166],{"skillNo":59,"name":60,"nameZh":6,"description":61,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":62,"categories":63,"keywords":64,"publishedAt":30},"01M6DF7D7478R55P46REYH4QAC","clarify-requirements","Resolve genuine pre-execution ambiguity by scanning repo context, generating 1-6 grounded options, and asking 1-3 focused questions via AskUserQuestion. NOT for mid-task use (injection risk); NOT when the goal is already unambiguous; use to disambiguate vague prompts before any file edits.","https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002Ftools\u002Fworkspace-hooks\u002Fskills\u002Fclarify-requirements\u002FSKILL.md",[],[65,66,67,68,69,70,71,72,73,74,75,76,77,78,79],"clarify requirements","clarify","requirements","risk","options","task","prompts","goal","scanning","use","context","repo","injection","execution","file",{"skillNo":81,"name":82,"nameZh":6,"description":83,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":84,"categories":85,"keywords":91,"publishedAt":30},"01M6DF79CA4BHJS66J8EZDBPWJ","openmm-md","Run FREE, open-source, Windows-native GPU molecular dynamics via the openmm-md MCP (OpenMM + CUDA on the local NVIDIA GPU). Use for protein \u002F protein-ligand MD when you want a free stack or are on Windows without a Schrodinger license. Covers the full workflow (prepare, solvate, minimize, equilibrate, production, analyze, mmgbsa) AND an honest decision guide vs Schrodinger Desmond, including how to run Desmond legitimately on Linux or a cloud GPU with a real license. This is a deliberately LESSER free alternative and does NOT replace the schrodinger MCP tools. Do NOT use it to pick a free tool when a validated FEP+, WaterMap, IFD-MD, or Prime MM-GBSA result is actually required.","https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002Ftools\u002Fmcp\u002Fopenmm-md-mcp\u002Fskill\u002Fopenmm-md\u002FSKILL.md",[86],{"categoryNo":87,"categoryName":88,"taxonomyType":89,"taxonomyTypeDesc":90},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[92,93,94,95,96,97,98,99,100,101,102,103,104,105,74,106,107,28,108,109],"openmm md","how","decision","pick","linux","analyze","tool","stack","open","NVIDIA","gpu","license","workflow","windows","free","molecular dynamics","do","MCP",{"skillNo":111,"name":112,"nameZh":6,"description":113,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":114,"categories":115,"keywords":122,"publishedAt":30},"01M6DF76C1MG85VEWP8VZCBNMN","visual-review","Take screenshots of web pages and UI using Playwright for visual review and iteration","https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002Ftools\u002Feditor\u002Fmetaswarm\u002Fskills\u002Fvisual-review\u002FSKILL.md",[116,119],{"categoryNo":117,"categoryName":118,"taxonomyType":89,"taxonomyTypeDesc":90},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":120,"categoryName":121,"taxonomyType":89,"taxonomyTypeDesc":90},"01JBSEEDCAT000000000000008","测试与质量",[123,124,125,126,127,128,129,130,131,132,93,133,134,135,136],"review","visual","visual review","pages","web","false","iteration","take","check","slides","ui","screenshot","playwright","screenshots",{"skillNo":138,"name":139,"nameZh":6,"description":140,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":141,"categories":142,"keywords":143,"publishedAt":30},"01M6DF73AQVCBZKEN0YXEX9FXP","status","Diagnostic status report — shows metaswarm installation state, project setup, and potential issues","https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002Ftools\u002Feditor\u002Fmetaswarm\u002Fskills\u002Fstatus\u002FSKILL.md",[],[139,144,145,146,147,148,23,149],"setup","report","project","installation","project setup","state",{"skillNo":151,"name":152,"nameZh":6,"description":153,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":154,"categories":155,"keywords":157,"publishedAt":30},"01M6DF6X6C2XB0P6GX76P7TTYV","start","Use when starting work on any task, when the user mentions metaswarm, or when the user wants to begin tracked development work","https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002Ftools\u002Feditor\u002Fmetaswarm\u002Fskills\u002Fstart\u002FSKILL.md",[156],{"categoryNo":87,"categoryName":88,"taxonomyType":89,"taxonomyTypeDesc":90},[152,158,70,159,160,161,74,162,163,164,165],"start issue","issue","ready","work on issue","user","work","work on","development",{"skillNo":167,"name":144,"nameZh":6,"description":168,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":169,"categories":170,"keywords":171,"publishedAt":30},"01M6DF6QMJ9AJKFKHHKRT005PQ","Interactive project setup — detects your project, configures metaswarm, writes project-local files","https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002Ftools\u002Feditor\u002Fmetaswarm\u002Fskills\u002Fsetup\u002FSKILL.md",[],[144,146,28,172,148,173],"files","interactive"]