[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6F4BTPPC5PYQRJADBJ2PJ79":3,"skill-same:01M6F4BTPPC5PYQRJADBJ2PJ79":79},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":41,"linkOnly":42,"markdownContent":43,"markdownBody":44,"frontMatter":45,"refName":30,"commitSha":53,"skillDirectory":54,"forksCount":55,"repositoryHtmlUrl":56,"repositoryHomepageUrl":6,"ownerHtmlUrl":57,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":58,"install":59,"resources":72},"01M6F4BTPPC5PYQRJADBJ2PJ79","bug-bounty",null,"Complete bug bounty workflow","boisenoise\u002Fskills-collections","boisenoise","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F193180?v=4","01M6CDBDQK6BDN55ZMA6B6PKBM","01M6CDBDVSJ3JPTBYN26FZ7TZK",12,"MIT","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-bug-bounty\u002FSKILL.md",[],[18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40],"bug bounty","bug","2026","testing","blob","for","relevant","helper","complete","scripts","scope","commands","main","community","only","public","https","license","testing tools","workflow","research","security","github","2026-11-10 10:12:30",false,"---\nname: bug-bounty\ndescription: Complete bug bounty workflow\ncategory: security\nrisk: offensive\nsource: https:\u002F\u002Fgithub.com\u002Felementalsouls\u002FClaude-BugHunter\nsource_repo: elementalsouls\u002FClaude-BugHunter\nsource_type: community\ndate_added: '2026-09-20'\nlicense: MIT\nlicense_source: https:\u002F\u002Fgithub.com\u002Felementalsouls\u002FClaude-BugHunter\u002Fblob\u002Fmain\u002FLICENSE\ncompatibility: Requires explicit written authorization for a target scope plus the\n  relevant testing tools for this technique. Docs-only; helper scripts and commands\n  not bundled.\nsources: community, public_research\n---\n> **⚠️ AUTHORIZED USE ONLY**\n> This skill is for educational purposes or authorized security assessments only.\n> You must have explicit, written permission from the system owner before using this tool.\n> Misuse of this tool is illegal and strictly prohibited.\n\n> **Mandatory confirmation gate**\n> Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:\n> 1. Ask the user to state the exact target URL, IP, account, or resource.\n> 2. Ask the user to confirm written authorization and the permitted scope.\n> 3. Show the exact command(s) and explain their expected effect.\n> 4. Wait for explicit confirmation in the current conversation.\n>\n> Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.\n\n# Bug bounty review workflow\n\n## When to Use\n\nUse for an explicitly authorized bug-bounty engagement, scoped source review or\nlab reproduction. This skill organizes evidence and reporting; it does not grant\npermission to test every asset owned by an organization or any discovered host.\nThe mandatory confirmation gate above applies to each active command.\n\n## Scope and plan\n\nRecord the program policy URL and retrieval time, exact allowed assets\u002Faccounts,\nallowed techniques, exclusions, rate\u002Fconcurrency limits, test window, data-handling\nrules and stop conditions. Ownership is not authorization. Resolve ambiguous scope\nwith the program before testing. Do not pivot into third-party services, metadata,\nCI runners or unrelated accounts because a vulnerability appears to permit it.\n\nBegin with already authorized local source, architecture and documented public\nmaterial. Check authentication, object\u002Ftenant authorization, input handling,\nworkflow state, cache boundaries and dependency provenance. Treat scanner output,\nfingerprints, secret-pattern matches and CVE-version matches as leads.\n\n## Validate with minimum impact\n\nUse synthetic records and two accounts controlled by the engagement. Request\napproval for an exact bounded test with expected effect and rollback. Demonstrate\nthe smallest effect sufficient to establish the security boundary failure; stop\nwhen evidence is adequate. Never require stolen money, real-user PII, production\ncredential use, persistence or a destructive exploit as a prerequisite for reporting.\nA source-proven issue can be reported with its runtime uncertainty clearly stated.\n\nConditions, authentication and user interaction do not invalidate a vulnerability.\nSeparate confirmed behavior, inferred impact and untested hypotheses. Do not apply\nan “always rejected” list across programs; eligibility and payout are program\npolicy, while risk and remediation may remain relevant even without a bounty.\nTimeboxes guide prioritization, not proof that a host is safe after five minutes.\n\n## Example: static first step\n\n```text\nEvidence record:\n- Scope: approved local checkout at full commit SHA\n- Observation: route reads object ID from user input\n- Expected boundary: caller must belong to the object's tenant\n- Current evidence: missing authorization in this code path\n- Untested: deployed reachability and compensating middleware\n- Proposed test: two controlled accounts and one synthetic object, pending approval\n```\n\nStore source\u002Fversion, timestamps, redacted requests, role\u002Ftenant and expected vs\nactual result. Keep evidence private with restricted retention. Discovery of a\ncredential requires immediate stop, redaction and owner notification through the\napproved channel, not testing the credential against production services.\n\n## Report and handoff\n\nUse [detailed evidence guidance](references\u002Fdetails.md). Include prerequisites,\nexact affected version\u002Flocation, safe reproduction, evidence, bounded impact,\nremaining uncertainty and remediation. Calculate the full CVSS vector using the\nprogram's requested version; do not assign severity from vulnerability name alone.\nReturn a draft unless submission\u002Fpublic disclosure is explicitly authorized.\n\n## Limitations and provenance\n\nThis is a docs-only adaptation of\n[elementalsouls\u002FClaude-BugHunter](https:\u002F\u002Fgithub.com\u002Felementalsouls\u002FClaude-BugHunter),\nwith declared upstream MIT attribution retained. No external tools, helper engine,\nslash command or engagement scaffold is bundled. Verify separately installed\nskills and prerequisites before routing to them. Do not fetch moving branches or\ninstall tools from historical snippets; a separately authorized installation must\npin and inspect artifacts before activation. No historical payout, “top 1%”,\nzero-misfire or live-test certification is established by this local tree.\n","> **⚠️ AUTHORIZED USE ONLY**\n> This skill is for educational purposes or authorized security assessments only.\n> You must have explicit, written permission from the system owner before using this tool.\n> Misuse of this tool is illegal and strictly prohibited.\n\n> **Mandatory confirmation gate**\n> Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:\n> 1. Ask the user to state the exact target URL, IP, account, or resource.\n> 2. Ask the user to confirm written authorization and the permitted scope.\n> 3. Show the exact command(s) and explain their expected effect.\n> 4. Wait for explicit confirmation in the current conversation.\n>\n> Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.\n\n# Bug bounty review workflow\n\n## When to Use\n\nUse for an explicitly authorized bug-bounty engagement, scoped source review or\nlab reproduction. This skill organizes evidence and reporting; it does not grant\npermission to test every asset owned by an organization or any discovered host.\nThe mandatory confirmation gate above applies to each active command.\n\n## Scope and plan\n\nRecord the program policy URL and retrieval time, exact allowed assets\u002Faccounts,\nallowed techniques, exclusions, rate\u002Fconcurrency limits, test window, data-handling\nrules and stop conditions. Ownership is not authorization. Resolve ambiguous scope\nwith the program before testing. Do not pivot into third-party services, metadata,\nCI runners or unrelated accounts because a vulnerability appears to permit it.\n\nBegin with already authorized local source, architecture and documented public\nmaterial. Check authentication, object\u002Ftenant authorization, input handling,\nworkflow state, cache boundaries and dependency provenance. Treat scanner output,\nfingerprints, secret-pattern matches and CVE-version matches as leads.\n\n## Validate with minimum impact\n\nUse synthetic records and two accounts controlled by the engagement. Request\napproval for an exact bounded test with expected effect and rollback. Demonstrate\nthe smallest effect sufficient to establish the security boundary failure; stop\nwhen evidence is adequate. Never require stolen money, real-user PII, production\ncredential use, persistence or a destructive exploit as a prerequisite for reporting.\nA source-proven issue can be reported with its runtime uncertainty clearly stated.\n\nConditions, authentication and user interaction do not invalidate a vulnerability.\nSeparate confirmed behavior, inferred impact and untested hypotheses. Do not apply\nan “always rejected” list across programs; eligibility and payout are program\npolicy, while risk and remediation may remain relevant even without a bounty.\nTimeboxes guide prioritization, not proof that a host is safe after five minutes.\n\n## Example: static first step\n\n```text\nEvidence record:\n- Scope: approved local checkout at full commit SHA\n- Observation: route reads object ID from user input\n- Expected boundary: caller must belong to the object's tenant\n- Current evidence: missing authorization in this code path\n- Untested: deployed reachability and compensating middleware\n- Proposed test: two controlled accounts and one synthetic object, pending approval\n```\n\nStore source\u002Fversion, timestamps, redacted requests, role\u002Ftenant and expected vs\nactual result. Keep evidence private with restricted retention. Discovery of a\ncredential requires immediate stop, redaction and owner notification through the\napproved channel, not testing the credential against production services.\n\n## Report and handoff\n\nUse [detailed evidence guidance](references\u002Fdetails.md). Include prerequisites,\nexact affected version\u002Flocation, safe reproduction, evidence, bounded impact,\nremaining uncertainty and remediation. Calculate the full CVSS vector using the\nprogram's requested version; do not assign severity from vulnerability name alone.\nReturn a draft unless submission\u002Fpublic disclosure is explicitly authorized.\n\n## Limitations and provenance\n\nThis is a docs-only adaptation of\n[elementalsouls\u002FClaude-BugHunter](https:\u002F\u002Fgithub.com\u002Felementalsouls\u002FClaude-BugHunter),\nwith declared upstream MIT attribution retained. No external tools, helper engine,\nslash command or engagement scaffold is bundled. Verify separately installed\nskills and prerequisites before routing to them. Do not fetch moving branches or\ninstall tools from historical snippets; a separately authorized installation must\npin and inspect artifacts before activation. No historical payout, “top 1%”,\nzero-misfire or live-test certification is established by this local tree.\n",{"name":5,"risk":46,"source":47,"license":14,"sources":48,"category":39,"date_added":49,"description":7,"source_repo":50,"source_type":31,"compatibility":51,"license_source":52},"offensive","https:\u002F\u002Fgithub.com\u002Felementalsouls\u002FClaude-BugHunter","community, public_research","2026-09-20","elementalsouls\u002FClaude-BugHunter","Requires explicit written authorization for a target scope plus the relevant testing tools for this technique. Docs-only; helper scripts and commands not bundled.","https:\u002F\u002Fgithub.com\u002Felementalsouls\u002FClaude-BugHunter\u002Fblob\u002Fmain\u002FLICENSE","7bf2279c8a65758319526a721d5c4b75683aec9c","skills\u002Fantigravity-bug-bounty",3,"https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections","https:\u002F\u002Fgithub.com\u002Fboisenoise","2026-11-11 14:20:43",{"source":8,"skillName":5,"commands":60,"prompt":70,"zipAvailable":71},[61,64,67],{"tool":62,"command":63},"npx","npx skills add boisenoise\u002Fskills-collections --skill bug-bounty",{"tool":65,"command":66},"bunx","bunx skills add boisenoise\u002Fskills-collections --skill bug-bounty",{"tool":68,"command":69},"pnpm","pnpm dlx skills add boisenoise\u002Fskills-collections --skill bug-bounty","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-bug-bounty\u002FSKILL.md",true,[73],{"path":74,"resourceType":75,"resourceTypeDesc":76,"sizeBytes":77,"sourceHtmlUrl":78},"references\u002Fdetails.md","REFERENCE","参考文档",7565,"https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-bug-bounty\u002Freferences\u002Fdetails.md",[80,108,133,157,175,197],{"skillNo":81,"name":82,"nameZh":6,"description":83,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":84,"licenseFileUrl":85,"sourceHtmlUrl":86,"categories":87,"keywords":88,"publishedAt":41},"01M6WNH92BHVFXHGPDZCPJ0AG0","web-access","Use Treg for public web or platform data only when existing search, browser and connected tools cannot cover the task, with explicit cost and data boundaries.","Apache-2.0","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-web-access\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-web-access\u002FSKILL.md",[],[89,90,91,92,93,94,95,96,97,98,99,32,100,101,102,103,104,105,106,107,20],"web","access","web access","official","development","browser","search","data","Tools","read","fetch","youtube","free tools","platform","critical","free","cover","normal","when",{"skillNo":109,"name":110,"nameZh":6,"description":111,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":84,"licenseFileUrl":112,"sourceHtmlUrl":113,"categories":114,"keywords":120,"publishedAt":41},"01M6WNF9XAYAB2CZDDJBAKNM93","treg","Use the Treg CLI or MCP catalog to discover, price and call authorized external tools with team-scoped credentials and a user-approved budget.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-treg\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-treg\u002FSKILL.md",[115],{"categoryNo":116,"categoryName":117,"taxonomyType":118,"taxonomyTypeDesc":119},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[110,121,122,40,92,93,35,97,123,124,125,126,127,128,129,103,130,131,132,22,20],"MCP","cli","Budget","credentials","team","catalog","use","call","discover","external tools","with","scoped",{"skillNo":134,"name":135,"nameZh":6,"description":136,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":84,"licenseFileUrl":137,"sourceHtmlUrl":138,"categories":139,"keywords":145,"publishedAt":41},"01M6WN93MEAZ4E41DYAHJRPHQT","recruit","Turn a job description into an evidence-linked candidate shortlist through Treg, with job-related ranking and optional authorized business contact enrichment.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-recruit\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-recruit\u002FSKILL.md",[140],{"categoryNo":141,"categoryName":142,"taxonomyType":143,"taxonomyTypeDesc":144},"01JBSEEDCAT000000000000038","人力资源","PROFESSION","适用职业",[135,40,92,35,34,146,147,148,149,150,103,151,152,153,131,23,154,155,156,22,110,20],"email","enrichment","business","evidence","phone","ranking","post","job description","person","candidate","reason",{"skillNo":158,"name":159,"nameZh":6,"description":160,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":84,"licenseFileUrl":161,"sourceHtmlUrl":162,"categories":163,"keywords":164,"publishedAt":41},"01M6WN8R5RXSMHM9B4D9FAFX42","rea-growth","Analyze a company’s public growth and content through Treg, distinguish observations from hypotheses, and produce an evidence-linked playbook within an approved budget.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-rea-growth\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-rea-growth\u002FSKILL.md",[],[165,166,167,40,92,35,168,169,34,170,123,171,172,33,149,103,173,174,22,110,20],"growth","rea","rea growth","produce","content","playbook","marketing","analyze","observations","company",{"skillNo":176,"name":177,"nameZh":6,"description":178,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":84,"licenseFileUrl":179,"sourceHtmlUrl":180,"categories":181,"keywords":182,"publishedAt":41},"01M6WN2EVE3RQRGWAKBT4S7YT2","make-ugc","Create original AI UGC-style product videos through Treg: research hooks, approve a licensed presenter and voice, generate clips, add captions and report costs.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-make-ugc\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-make-ugc\u002FSKILL.md",[],[183,184,40,38,92,185,35,186,187,188,189,190,103,191,192,193,194,195,196,22],"make","make ugc","create","Video","Captions","ads","short","hooks","head","style","niche","trending","talking-head","approve",{"skillNo":198,"name":199,"nameZh":6,"description":200,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":84,"licenseFileUrl":201,"sourceHtmlUrl":202,"categories":203,"keywords":204,"publishedAt":41},"01M6WN10ARAA63Y8K1YNGXJ2RM","lead-signals","Find and qualify public buying signals through Treg, rank fitting business accounts and optionally enrich authorized business contact information.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-lead-signals\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-lead-signals\u002FSKILL.md",[],[205,206,207,40,92,35,208,209,148,210,211,103,212,213,214,215,216,217,218,22],"signals","lead","lead signals","how","find","ready","as","how to","qualify","people","information","enrich","changes","funding"]