[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6F7ENFD4S84P4F8WJQK5T2B":3,"skill-same:01M6F7ENFD4S84P4F8WJQK5T2B":73},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":42,"linkOnly":43,"markdownContent":44,"markdownBody":45,"frontMatter":46,"refName":30,"commitSha":53,"skillDirectory":54,"forksCount":55,"repositoryHtmlUrl":56,"repositoryHomepageUrl":6,"ownerHtmlUrl":57,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":58,"install":59,"resources":72},"01M6F7ENFD4S84P4F8WJQK5T2B","hunt-dispatch",null,"Skill-set loader for \u002Fhunt orchestrator.","boisenoise\u002Fskills-collections","boisenoise","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F193180?v=4","01M6CDBDQK6BDN55ZMA6B6PKBM","01M6CDBDVSJ3JPTBYN26FZ7TZK",13,"MIT","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-hunt-dispatch\u002FSKILL.md",[],[18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41],"hunt dispatch","dispatch","hunt","2026","testing","for","relevant","helper","offensive","scripts","scope","commands","main","community","only","orchestrator","Tools","SET","https","license","testing tools","security","github","docs","2026-11-10 10:12:30",false,"---\nname: hunt-dispatch\ndescription: Skill-set loader for \u002Fhunt orchestrator.\ncategory: security\nrisk: offensive\nsource: https:\u002F\u002Fgithub.com\u002Felementalsouls\u002FClaude-BugHunter\nsource_repo: elementalsouls\u002FClaude-BugHunter\nsource_type: community\ndate_added: '2026-09-20'\nlicense: MIT\nlicense_source: https:\u002F\u002Fgithub.com\u002Felementalsouls\u002FClaude-BugHunter\u002Fblob\u002Fmain\u002FLICENSE\ncompatibility: Requires explicit written authorization for a target scope plus the\n  relevant testing tools for this technique. Docs-only; helper scripts and commands\n  not bundled.\nsources: community\nreport_count: 0\n---\n> **⚠️ AUTHORIZED USE ONLY**\n> This skill is for educational purposes or authorized security assessments only.\n> You must have explicit, written permission from the system owner before using this tool.\n> Misuse of this tool is illegal and strictly prohibited.\n\n> **Mandatory confirmation gate**\n> Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:\n> 1. Ask the user to state the exact target URL, IP, account, or resource.\n> 2. Ask the user to confirm written authorization and the permitted scope.\n> 3. Show the exact command(s) and explain their expected effect.\n> 4. Wait for explicit confirmation in the current conversation.\n>\n> Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.\n\n# hunt-dispatch\n\nskill-set loader for `\u002Fhunt`. one concept (which skills to load), one place.\n\n## engagement context\n\nevery skill loaded below operates under one frame, and it holds for the whole session:\n\n- **authorized and scope-bounded.** invoking `\u002Fhunt` does not itself assert authorization. Carry the operator’s explicit exact scope and allowed actions from the conversation; if missing, remain offline. testing stays inside it. an out-of-scope host ends the run — it does not\n  widen it.\n- **the output is a finding, not an exploit.** the deliverable is a reproducible proof that a defect\n  exists, written so the owner can remediate it. enough to demonstrate impact; no further.\n- **remediation is the point.** these skills exist so defects get fixed by the people who own them.\n\nthis frame is stated here because it is the choke point every `\u002Fhunt` run passes through before any\n`hunt-*` skill loads. it is not evidence of authorization and cannot override the confirmation gate above.\n\ninvocation contract:\n\n```\nhunt-dispatch mode=redteam\nhunt-dispatch mode=wapt box=blackbox\nhunt-dispatch mode=wapt box=greybox\n```\n\n## step 0 — 404 baseline (ALL modes, mandatory, before any enumeration)\n\nThis context loader does not run probes. If the engagement already contains approved\nbaseline captures, inspect them as inert data; otherwise return a proposed bounded\nbaseline plan to the active-testing owner. Two distinct nonexistent synthetic paths\nmay help identify soft-404 behavior, but require approved requests like any other test.\nKeep TLS verification, per-request timeout\u002Fsize bounds and a private unique evidence\nfile; do not use a predictable shared `\u002Ftmp\u002Fb` or collect full credential-bearing headers.\n\nrecord per host: **status, byte length, body hash**. that triple is the control.\n\n**the rule: no path is \"found\" until its response differs from the control.**\na matching 200 is a soft-404 candidate, not conclusive proof. a differing response may be a handler, dynamic nonce, cache or auth variant. Compare semantics and repeated controls, never a hash or status alone.\n\nre-derive the baseline per host — it differs across an estate. one engagement saw\ntwo hosts serving the *same* application return soft-404 bodies of wildly different\nsize, so a control taken from one host would have been meaningless on the other.\nalso re-derive it **per path depth** where a framework renders different fallbacks\nfor `\u002Fx` and `\u002Fa\u002Fb\u002Fx`.\n\nedge pages are not origin findings: a CDN-shaped \"Access Denied\" \u002F \"Unsupported Request\" body suggests edge behavior but does not prove the origin was never reached. classify it as edge\nbehaviour and move on.\n\n## step 1 — fingerprint (red team only)\n\nfingerprint **every** live host, not just the apex. for multi-host \u002F wildcard\ntargets the platform-skill routing must be driven by all banners, not one host's.\n\nInspect already-collected headers\u002FHTML for version-specific candidates. Redirects\ndo not expand scope: record each Location, approve its authority before fetching,\nand never forward credentials across origins. Record collection errors\u002Fcoverage,\nnot a clean verdict; a banner is a stack hypothesis, not a version\u002Fvulnerability proof.\nNo fingerprint loop is executed by this loader.\n\nlook for the following signals → platform skill mapping:\n\n```\nokta.com | auth0.com | pingidentity         →  okta-attack\nlogin.microsoftonline.com | outlook | sts   →  m365-entra-attack\npulse | fortinet | ivanti | citrix          →  enterprise-vpn-attack\nvsphere | vcenter | :9443                   →  vmware-vcenter-attack\namazonaws | azure | googleapis | gcp        →  cloud-iam-deep\ngithub.com\u002F\u003Corg>\u002F                           →  supply-chain-attack-recon\n.apk | play.google.com                      →  apk-redteam-pipeline\nMongoDB | mongoose | CouchDB | Redis        →  hunt-nosqli\n?page= | ?file= | ?path= | php wrapper      →  hunt-lfi\nrO0A | VIEWSTATE | rememberMe cookie        →  hunt-deserialization\nAccess-Control-Allow-Origin header          →  hunt-cors\n\u002Fforgot-password | \u002Freset | X-Forwarded    →  hunt-host-header\n?redirect= | ?next= | ?return= | ?url=     →  hunt-open-redirect\nOTP | \u002Fverify | \u002F2fa | no-rate-limit        →  hunt-brute-force\nSet-Cookie session | PHPSESSID              →  hunt-session\nActive Directory | LDAP | OpenLDAP | ADFS  →  hunt-ldap\n__NEXT_DATA__ | \u002F_next\u002F | buildId           →  hunt-nextjs\nX-Powered-By: Express | Node.js | .js stack →  hunt-nodejs\npostMessage | dangerouslySetInnerHTML        →  hunt-dom\nWebSocket | ws:\u002F\u002F | socket.io               →  hunt-websocket\ngRPC | :50051 | application\u002Fgrpc            →  hunt-grpc\nlaravel_session | Ignition | Telescope       →  hunt-laravel\nX-Application-Context | Whitelabel | \u002Factuator → hunt-springboot\n:6443 | :10250 | :2379 | kubectl            →  hunt-k8s\n.github\u002Fworkflows | Jenkins | GitLab CI     →  hunt-cicd\n.js.map | swagger.json | \u002F.env              →  hunt-source-leak\nHSTS missing | SPF | DMARC | AXFR           →  hunt-tls-network\n```\n\n### conflict resolution & load budget\n\nreal targets almost always return multiple signals at once — e.g. a single host\ncan show Cloudflare (CDN) + `login.microsoftonline.com` (redirect) + `__NEXT_DATA__`\n(Next.js front end) + `amazonaws` (origin) simultaneously. loading every match\nblindly can pull 20-plus skills and blow the context window, drowning the\nhigh-signal skill in noise. apply this precedence and cap:\n\n**priority order (load highest tiers first, stop at the cap):**\n\n```\ntier 1  identity \u002F SSO fabric    okta-attack, m365-entra-attack\n        (own the auth boundary — highest blast radius if compromised)\ntier 2  perimeter appliances     enterprise-vpn-attack, vmware-vcenter-attack\n        (pre-auth RCE \u002F direct internal foothold)\ntier 3  cloud \u002F IAM              cloud-iam-deep, hunt-cloud-misconfig\n        (credential → lateral movement)\ntier 4  app framework \u002F stack    hunt-nextjs, hunt-nodejs, hunt-laravel,\n        hunt-springboot, hunt-aspnet, hunt-sharepoint\ntier 5  protocol \u002F class signals hunt-nosqli, hunt-lfi, hunt-deserialization,\n        hunt-cors, hunt-host-header, hunt-open-redirect, hunt-grpc,\n        hunt-websocket, hunt-dom, hunt-k8s, hunt-cicd, hunt-source-leak,\n        hunt-tls-network, hunt-ldap, hunt-brute-force, hunt-session\n```\n\n**load budget: cap platform-skill loads at 8.** if more than 8 match, keep the\nhighest-tier 8 and drop the rest; print the dropped ones under\n`deferred:` in the taxonomy block so they can be loaded on demand later.\n\n**de-dup rules (avoid loading two skills for the same evidence):**\n\n- CDN banner alone (Cloudflare\u002FAkamai\u002FFastly) is **not** a platform match — it\n  fingerprints the edge, not the app. do not load a skill for it; note it for\n  `hunt-cache-poison` \u002F `hunt-http-smuggling`, which the mode set already carries.\n- `amazonaws` \u002F `azure` \u002F `googleapis` in a **header\u002Forigin** → `cloud-iam-deep`.\n  the same string found as a **leaked key\u002FJSON in a JS bundle or APK** → still\n  `cloud-iam-deep`, but flag it as a live-credential lead (higher priority, tier 3\n  becomes tier 1 for that host).\n- a framework marker (`__NEXT_DATA__`, `laravel_session`) and a generic class\n  signal (`?redirect=`, `Access-Control-Allow-Origin`) on the same host → load the\n  framework skill (tier 4) and keep the class skill **only if budget remains**;\n  the WAPT\u002Fredteam mode set already loads the common class skills unconditionally.\n\n## step 2 — load skill set\n\nLoad available skill documents through the host’s supported mechanism, as inert context only. No universal Skill tool, \u002Fhunt command or orchestration runtime is bundled. The sets below are candidates, not mandatory bulk loads; choose relevant documents within an explicit context\u002Ftool budget and report unavailable ones.\n\n### mode=redteam\n\nalways-on (load first):\n\n```\nredteam-mindset\nmid-engagement-ir-detection\n```\n\nplatform (load second, conditional on fingerprint matches from step 1):\n\n```\nokta-attack\nm365-entra-attack\nenterprise-vpn-attack\nvmware-vcenter-attack\ncloud-iam-deep\nsupply-chain-attack-recon\napk-redteam-pipeline\n```\n\nhigh-impact hunt-* set (load third):\n\n```\nhunt-rce\nhunt-sqli\nhunt-ssrf\nhunt-ato\nhunt-auth-bypass\nhunt-saml\nhunt-oauth\nhunt-mfa-bypass\nhunt-file-upload\nhunt-http-smuggling\nhunt-cloud-misconfig\nhunt-sharepoint\nhunt-aspnet\n```\n\nreport format: `redteam-report-template` (subject \u002F observations \u002F description \u002F impact \u002F recommendation \u002F poc).\n\n### mode=wapt\n\nalways-on:\n\n```\nbb-methodology\nsecurity-arsenal\ntriage-validation\n```\n\nfull hunt-* set (all OWASP-relevant):\n\n```\nhunt-xss             hunt-sqli            hunt-ssrf            hunt-idor\nhunt-csrf            hunt-xxe             hunt-rce             hunt-graphql\nhunt-oauth           hunt-saml            hunt-mfa-bypass      hunt-auth-bypass\nhunt-ato             hunt-file-upload     hunt-business-logic  hunt-race-condition\nhunt-llm-ai          hunt-api-misconfig   hunt-ssti            hunt-cache-poison\nhunt-http-smuggling  hunt-subdomain       hunt-cloud-misconfig hunt-misc\nhunt-aspnet          hunt-sharepoint      hunt-ntlm-info\nhunt-lfi             hunt-nosqli          hunt-deserialization\nhunt-cors            hunt-host-header     hunt-open-redirect\nhunt-brute-force     hunt-session         hunt-ldap\nhunt-nextjs          hunt-nodejs          hunt-dom\nhunt-websocket       hunt-grpc            hunt-laravel\nhunt-springboot      hunt-k8s             hunt-cicd\nhunt-source-leak     hunt-tls-network\n```\n\nreport format: `report-writing` (`bugcrowd-reporting` if the target is on bugcrowd).\n\nbox=greybox: credentials are not assumed captured or valid; use only host-approved secret handles for owner-controlled test identities.\n\n**do not fan out across the authenticated hunt-\\* set until the creds are\nvalidated.** `\u002Fhunt` only prompts for and stores creds (commands\u002Fhunt.md) — it\ndoes not confirm they work. firing every authenticated test with dead, MFA-gated,\nor wrong-role creds wastes the whole run and produces false \"no auth surface\"\nconclusions. run a single low-cost auth preflight first:\n\nThe active-testing owner may propose one approved identity check using a private\nsecret handle and an actual documented identity endpoint; do not print `\u002Fapi\u002Fme`\nresponses or put cookies\u002Ftokens in CLI arguments. Never guess an endpoint\u002Fmethod\nas a safe read. Record a sanitized identity\u002Ftenant\u002Frole outcome and failures only.\n\nconfirm three things from the preflight, and record them for the hunt-\\* skills:\n\n1. **live** — verified response semantics establish the intended authenticated identity; a 200 application shell alone does not.\n2. **role\u002Fprivilege** — the `\u002Fapi\u002Fme` (or equivalent) body shows the expected\n   role\u002Ftenant\u002Fscopes. IDOR and authz tests need a known baseline identity; a\n   silently-admin or silently-readonly cred skews every authz finding.\n3. **not MFA-gated** — login did not stop at a 2fa\u002Fstep-up challenge. if it did,\n   you hold creds but **not** a session — default to least capability and confirm\n   with the operator before claiming authenticated reach.\n\nif the preflight fails, do **not** silently continue as blackbox — surface\n\"greybox creds did not validate (HTTP {code} \u002F MFA challenge)\" so the operator\ncan re-supply. only after a clean preflight: apply the validated session to every\nauthenticated test.\n\n## step 3 — taxonomy print (once, at session start)\n\nemit a deterministic block. plain text, lowercase, colon-delimited, no decoration.\n\n### mode=redteam\n\n```\nloaded for red team: {N} skills\n  mindset:    redteam-mindset\n  platform:   {fingerprint-matched skills (\u003C=8, tier order), or \"none detected\"}\n  deferred:   {platform skills past the 8-cap, or omit line if none}\n  auth:       hunt-ato, hunt-auth-bypass, hunt-saml, hunt-oauth, hunt-mfa-bypass\n  inj:        hunt-rce, hunt-sqli, hunt-ssrf, hunt-file-upload\n  infra:      hunt-http-smuggling, hunt-cloud-misconfig\n  stack:      hunt-sharepoint, hunt-aspnet\n  ir:         mid-engagement-ir-detection\n```\n\n### mode=wapt\n\n```\nloaded for wapt ({blackbox|greybox}): {N} skills\n  inj:        hunt-xss, hunt-sqli, hunt-ssrf, hunt-rce, hunt-xxe, hunt-ssti, hunt-file-upload\n  authz:      hunt-idor, hunt-auth-bypass, hunt-ato\n  auth:       hunt-oauth, hunt-saml, hunt-mfa-bypass\n  api:        hunt-graphql, hunt-api-misconfig\n  logic:      hunt-business-logic, hunt-race-condition\n  infra:      hunt-http-smuggling, hunt-cache-poison\n  recon:      hunt-subdomain\n  cloud:      hunt-cloud-misconfig\n  ai:         hunt-llm-ai\n  stack:      hunt-aspnet, hunt-sharepoint, hunt-ntlm-info\n  misc:       hunt-misc, hunt-csrf\n  reporting:  bb-methodology, security-arsenal, triage-validation\n```\n\n## subagent scope inheritance\n\nif any part of the hunt is delegated to subagents, scope does **not** inherit\nimplicitly. every subagent prompt must carry:\n\n1. **the authorized host list, verbatim, as data.** not \"the target estate\", not\n   \"*.target.com\" — the explicit list. a subagent cannot infer the boundary.\n2. **the discovered-host rule:** hosts found mid-run (via CT logs, CSP headers,\n   JS bundles, CNAME chains, error messages) are **report-only**. record and hand back; DNS resolution also requires authorized network scope. never probe, never write, until the operator re-authorizes.\n3. **a deny-list of action-executing endpoints, applied BEFORE any allow-list.**\n   names are a warning heuristic, not an action-safety guarantee; verify documented endpoint semantics and explicit allowlisted method\u002Fresource operations. Deny suspicious names such as: `refund`, `settle`, `payout`, `transfer`, `adjust`,\n   `disburse`, `create`, `update`, `delete`, `rotate`, `reset`, `send`, `initiate`,\n   `generate`, `process`. only then allow read-shaped names. order matters —\n   a path like `refund\u002Fbatch\u002Fstatus` matches the read-shaped keyword \"status\"\n   but is a refund route; an allow-list applied first would probe it.\n4. **\"read-only\" spelled out as forbidden verbs**, not as an adjective. \"read-only\"\n   is routinely interpreted as \"don't be destructive\", which does not stop an agent\n   sending `{}` to an endpoint whose name starts with `generate*` and creating a\n   real record on production.\n\n**lesson from an authorized engagement:** a subagent was told READ-ONLY and still\n(a) created a live record on production because it expected `{}` to return a\nvalidation error, and (b) wrote an object to a cloud bucket that was never on the\nauthorized list — one the parent prompt had named only for a DNS check. both were\ndisclosed in the deliverable. the fix is structural: pass scope as data, deny\nby verb before allowing by verb, and treat every discovered host as out of scope\nuntil told otherwise.\n\n## step 4 — return control to \u002Fhunt\n\nafter taxonomy print, return a plan to the authorized host\u002Foperator. No `\u002Fhunt` orchestrator or delegation engine is bundled; delegation requires host\u002Fuser authority and exact scope\u002Fbudget propagation. do not run probes here — this skill only loads context.\n\n## privacy\n\nnever echo back, log, or persist:\n- SOW \u002F scope-of-work \u002F engagement-letter content\n- grey box credentials (kept in session memory by `\u002Fhunt`, never written to disk)\n- client identifiers in user-level memory\n\n---\n\n## Related Skills & Chains\n\n- **`bb-methodology`** — When PART 0 mode confirmation completes. Workflow primitive: `bb-methodology` confirms engagement type (red team vs WAPT vs bug bounty); the answer feeds directly into this skill's `mode=redteam` \u002F `mode=wapt` invocation.\n- **`redteam-mindset`** + **`mid-engagement-ir-detection`** — When `mode=redteam` is loaded. Workflow primitive: these are the always-on skills loaded first by step 2 of the redteam flow before any platform skill or hunt-* skill.\n- **`okta-attack`** \u002F **`m365-entra-attack`** \u002F **`enterprise-vpn-attack`** \u002F **`vmware-vcenter-attack`** \u002F **`cloud-iam-deep`** \u002F **`supply-chain-attack-recon`** \u002F **`apk-redteam-pipeline`** — When fingerprint signals match. Workflow primitive: step 1's curl fingerprint scan against `recon\u002F\u003Ctarget>\u002Flive-hosts.txt` maps banner \u002F domain signals to one or more of these platform skills.\n- **`hunt-rce`** \u002F **`hunt-sqli`** \u002F **`hunt-ssrf`** \u002F **`hunt-ato`** \u002F **all other hunt-* skills`** — When the mode-specific skill set is being printed. Workflow primitive: this skill is the loader; it names the hunt-* skills but does not run probes — actual hunting happens after step 4 returns control to `\u002Fhunt`.\n- **`report-writing`** vs **`redteam-report-template`** — When the taxonomy print specifies the report format. Workflow primitive: `mode=wapt` ends with `report-writing` as the deliverable format; `mode=redteam` ends with `redteam-report-template` instead.\n\n## When to Use\n\n- You have explicit, written authorization to assess the target in scope, and the task matches this skill's vulnerability class or technique within a bug-bounty or penetration-test engagement.\n- You need the recon, exploitation, or validation workflow described below — executed strictly inside the approved scope.\n\n## Limitations\n\n- Authorized scope only: the confirmation gate above is mandatory before any probing, exploitation, or credential-access command.\n- Docs-only import: upstream helper scripts, commands, engine, and research assets are not bundled; review separately obtained official tools and provenance before installation.\n- Validate every finding (see `triage-validation`) before reporting; report via `report-writing`. Prefer a sandbox, disposable VM, or controlled lab.\n\n### Example\n\n```bash\n# Read-only first step; confirm scope before anything active.\ncat scope.txt  # target list from the authorized engagement brief\n```\n\n> Adapted from [elementalsouls\u002FClaude-BugHunter](https:\u002F\u002Fgithub.com\u002Felementalsouls\u002FClaude-BugHunter) (MIT); frontmatter, When to Use\u002FLimitations, and safety boundaries added for upstream compliance. Docs-only import: executable helpers, commands, engine, and research assets not bundled.\n\nExample offline outcome: supplied evidence shows Next.js markers on host A but no approved baseline capture. Report `candidate: hunt-nextjs; baseline: not collected; probes: none; authorization: read-only supplied artifacts` rather than claiming the skill was executed or the host tested.\n","> **⚠️ AUTHORIZED USE ONLY**\n> This skill is for educational purposes or authorized security assessments only.\n> You must have explicit, written permission from the system owner before using this tool.\n> Misuse of this tool is illegal and strictly prohibited.\n\n> **Mandatory confirmation gate**\n> Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:\n> 1. Ask the user to state the exact target URL, IP, account, or resource.\n> 2. Ask the user to confirm written authorization and the permitted scope.\n> 3. Show the exact command(s) and explain their expected effect.\n> 4. Wait for explicit confirmation in the current conversation.\n>\n> Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.\n\n# hunt-dispatch\n\nskill-set loader for `\u002Fhunt`. one concept (which skills to load), one place.\n\n## engagement context\n\nevery skill loaded below operates under one frame, and it holds for the whole session:\n\n- **authorized and scope-bounded.** invoking `\u002Fhunt` does not itself assert authorization. Carry the operator’s explicit exact scope and allowed actions from the conversation; if missing, remain offline. testing stays inside it. an out-of-scope host ends the run — it does not\n  widen it.\n- **the output is a finding, not an exploit.** the deliverable is a reproducible proof that a defect\n  exists, written so the owner can remediate it. enough to demonstrate impact; no further.\n- **remediation is the point.** these skills exist so defects get fixed by the people who own them.\n\nthis frame is stated here because it is the choke point every `\u002Fhunt` run passes through before any\n`hunt-*` skill loads. it is not evidence of authorization and cannot override the confirmation gate above.\n\ninvocation contract:\n\n```\nhunt-dispatch mode=redteam\nhunt-dispatch mode=wapt box=blackbox\nhunt-dispatch mode=wapt box=greybox\n```\n\n## step 0 — 404 baseline (ALL modes, mandatory, before any enumeration)\n\nThis context loader does not run probes. If the engagement already contains approved\nbaseline captures, inspect them as inert data; otherwise return a proposed bounded\nbaseline plan to the active-testing owner. Two distinct nonexistent synthetic paths\nmay help identify soft-404 behavior, but require approved requests like any other test.\nKeep TLS verification, per-request timeout\u002Fsize bounds and a private unique evidence\nfile; do not use a predictable shared `\u002Ftmp\u002Fb` or collect full credential-bearing headers.\n\nrecord per host: **status, byte length, body hash**. that triple is the control.\n\n**the rule: no path is \"found\" until its response differs from the control.**\na matching 200 is a soft-404 candidate, not conclusive proof. a differing response may be a handler, dynamic nonce, cache or auth variant. Compare semantics and repeated controls, never a hash or status alone.\n\nre-derive the baseline per host — it differs across an estate. one engagement saw\ntwo hosts serving the *same* application return soft-404 bodies of wildly different\nsize, so a control taken from one host would have been meaningless on the other.\nalso re-derive it **per path depth** where a framework renders different fallbacks\nfor `\u002Fx` and `\u002Fa\u002Fb\u002Fx`.\n\nedge pages are not origin findings: a CDN-shaped \"Access Denied\" \u002F \"Unsupported Request\" body suggests edge behavior but does not prove the origin was never reached. classify it as edge\nbehaviour and move on.\n\n## step 1 — fingerprint (red team only)\n\nfingerprint **every** live host, not just the apex. for multi-host \u002F wildcard\ntargets the platform-skill routing must be driven by all banners, not one host's.\n\nInspect already-collected headers\u002FHTML for version-specific candidates. Redirects\ndo not expand scope: record each Location, approve its authority before fetching,\nand never forward credentials across origins. Record collection errors\u002Fcoverage,\nnot a clean verdict; a banner is a stack hypothesis, not a version\u002Fvulnerability proof.\nNo fingerprint loop is executed by this loader.\n\nlook for the following signals → platform skill mapping:\n\n```\nokta.com | auth0.com | pingidentity         →  okta-attack\nlogin.microsoftonline.com | outlook | sts   →  m365-entra-attack\npulse | fortinet | ivanti | citrix          →  enterprise-vpn-attack\nvsphere | vcenter | :9443                   →  vmware-vcenter-attack\namazonaws | azure | googleapis | gcp        →  cloud-iam-deep\ngithub.com\u002F\u003Corg>\u002F                           →  supply-chain-attack-recon\n.apk | play.google.com                      →  apk-redteam-pipeline\nMongoDB | mongoose | CouchDB | Redis        →  hunt-nosqli\n?page= | ?file= | ?path= | php wrapper      →  hunt-lfi\nrO0A | VIEWSTATE | rememberMe cookie        →  hunt-deserialization\nAccess-Control-Allow-Origin header          →  hunt-cors\n\u002Fforgot-password | \u002Freset | X-Forwarded    →  hunt-host-header\n?redirect= | ?next= | ?return= | ?url=     →  hunt-open-redirect\nOTP | \u002Fverify | \u002F2fa | no-rate-limit        →  hunt-brute-force\nSet-Cookie session | PHPSESSID              →  hunt-session\nActive Directory | LDAP | OpenLDAP | ADFS  →  hunt-ldap\n__NEXT_DATA__ | \u002F_next\u002F | buildId           →  hunt-nextjs\nX-Powered-By: Express | Node.js | .js stack →  hunt-nodejs\npostMessage | dangerouslySetInnerHTML        →  hunt-dom\nWebSocket | ws:\u002F\u002F | socket.io               →  hunt-websocket\ngRPC | :50051 | application\u002Fgrpc            →  hunt-grpc\nlaravel_session | Ignition | Telescope       →  hunt-laravel\nX-Application-Context | Whitelabel | \u002Factuator → hunt-springboot\n:6443 | :10250 | :2379 | kubectl            →  hunt-k8s\n.github\u002Fworkflows | Jenkins | GitLab CI     →  hunt-cicd\n.js.map | swagger.json | \u002F.env              →  hunt-source-leak\nHSTS missing | SPF | DMARC | AXFR           →  hunt-tls-network\n```\n\n### conflict resolution & load budget\n\nreal targets almost always return multiple signals at once — e.g. a single host\ncan show Cloudflare (CDN) + `login.microsoftonline.com` (redirect) + `__NEXT_DATA__`\n(Next.js front end) + `amazonaws` (origin) simultaneously. loading every match\nblindly can pull 20-plus skills and blow the context window, drowning the\nhigh-signal skill in noise. apply this precedence and cap:\n\n**priority order (load highest tiers first, stop at the cap):**\n\n```\ntier 1  identity \u002F SSO fabric    okta-attack, m365-entra-attack\n        (own the auth boundary — highest blast radius if compromised)\ntier 2  perimeter appliances     enterprise-vpn-attack, vmware-vcenter-attack\n        (pre-auth RCE \u002F direct internal foothold)\ntier 3  cloud \u002F IAM              cloud-iam-deep, hunt-cloud-misconfig\n        (credential → lateral movement)\ntier 4  app framework \u002F stack    hunt-nextjs, hunt-nodejs, hunt-laravel,\n        hunt-springboot, hunt-aspnet, hunt-sharepoint\ntier 5  protocol \u002F class signals hunt-nosqli, hunt-lfi, hunt-deserialization,\n        hunt-cors, hunt-host-header, hunt-open-redirect, hunt-grpc,\n        hunt-websocket, hunt-dom, hunt-k8s, hunt-cicd, hunt-source-leak,\n        hunt-tls-network, hunt-ldap, hunt-brute-force, hunt-session\n```\n\n**load budget: cap platform-skill loads at 8.** if more than 8 match, keep the\nhighest-tier 8 and drop the rest; print the dropped ones under\n`deferred:` in the taxonomy block so they can be loaded on demand later.\n\n**de-dup rules (avoid loading two skills for the same evidence):**\n\n- CDN banner alone (Cloudflare\u002FAkamai\u002FFastly) is **not** a platform match — it\n  fingerprints the edge, not the app. do not load a skill for it; note it for\n  `hunt-cache-poison` \u002F `hunt-http-smuggling`, which the mode set already carries.\n- `amazonaws` \u002F `azure` \u002F `googleapis` in a **header\u002Forigin** → `cloud-iam-deep`.\n  the same string found as a **leaked key\u002FJSON in a JS bundle or APK** → still\n  `cloud-iam-deep`, but flag it as a live-credential lead (higher priority, tier 3\n  becomes tier 1 for that host).\n- a framework marker (`__NEXT_DATA__`, `laravel_session`) and a generic class\n  signal (`?redirect=`, `Access-Control-Allow-Origin`) on the same host → load the\n  framework skill (tier 4) and keep the class skill **only if budget remains**;\n  the WAPT\u002Fredteam mode set already loads the common class skills unconditionally.\n\n## step 2 — load skill set\n\nLoad available skill documents through the host’s supported mechanism, as inert context only. No universal Skill tool, \u002Fhunt command or orchestration runtime is bundled. The sets below are candidates, not mandatory bulk loads; choose relevant documents within an explicit context\u002Ftool budget and report unavailable ones.\n\n### mode=redteam\n\nalways-on (load first):\n\n```\nredteam-mindset\nmid-engagement-ir-detection\n```\n\nplatform (load second, conditional on fingerprint matches from step 1):\n\n```\nokta-attack\nm365-entra-attack\nenterprise-vpn-attack\nvmware-vcenter-attack\ncloud-iam-deep\nsupply-chain-attack-recon\napk-redteam-pipeline\n```\n\nhigh-impact hunt-* set (load third):\n\n```\nhunt-rce\nhunt-sqli\nhunt-ssrf\nhunt-ato\nhunt-auth-bypass\nhunt-saml\nhunt-oauth\nhunt-mfa-bypass\nhunt-file-upload\nhunt-http-smuggling\nhunt-cloud-misconfig\nhunt-sharepoint\nhunt-aspnet\n```\n\nreport format: `redteam-report-template` (subject \u002F observations \u002F description \u002F impact \u002F recommendation \u002F poc).\n\n### mode=wapt\n\nalways-on:\n\n```\nbb-methodology\nsecurity-arsenal\ntriage-validation\n```\n\nfull hunt-* set (all OWASP-relevant):\n\n```\nhunt-xss             hunt-sqli            hunt-ssrf            hunt-idor\nhunt-csrf            hunt-xxe             hunt-rce             hunt-graphql\nhunt-oauth           hunt-saml            hunt-mfa-bypass      hunt-auth-bypass\nhunt-ato             hunt-file-upload     hunt-business-logic  hunt-race-condition\nhunt-llm-ai          hunt-api-misconfig   hunt-ssti            hunt-cache-poison\nhunt-http-smuggling  hunt-subdomain       hunt-cloud-misconfig hunt-misc\nhunt-aspnet          hunt-sharepoint      hunt-ntlm-info\nhunt-lfi             hunt-nosqli          hunt-deserialization\nhunt-cors            hunt-host-header     hunt-open-redirect\nhunt-brute-force     hunt-session         hunt-ldap\nhunt-nextjs          hunt-nodejs          hunt-dom\nhunt-websocket       hunt-grpc            hunt-laravel\nhunt-springboot      hunt-k8s             hunt-cicd\nhunt-source-leak     hunt-tls-network\n```\n\nreport format: `report-writing` (`bugcrowd-reporting` if the target is on bugcrowd).\n\nbox=greybox: credentials are not assumed captured or valid; use only host-approved secret handles for owner-controlled test identities.\n\n**do not fan out across the authenticated hunt-\\* set until the creds are\nvalidated.** `\u002Fhunt` only prompts for and stores creds (commands\u002Fhunt.md) — it\ndoes not confirm they work. firing every authenticated test with dead, MFA-gated,\nor wrong-role creds wastes the whole run and produces false \"no auth surface\"\nconclusions. run a single low-cost auth preflight first:\n\nThe active-testing owner may propose one approved identity check using a private\nsecret handle and an actual documented identity endpoint; do not print `\u002Fapi\u002Fme`\nresponses or put cookies\u002Ftokens in CLI arguments. Never guess an endpoint\u002Fmethod\nas a safe read. Record a sanitized identity\u002Ftenant\u002Frole outcome and failures only.\n\nconfirm three things from the preflight, and record them for the hunt-\\* skills:\n\n1. **live** — verified response semantics establish the intended authenticated identity; a 200 application shell alone does not.\n2. **role\u002Fprivilege** — the `\u002Fapi\u002Fme` (or equivalent) body shows the expected\n   role\u002Ftenant\u002Fscopes. IDOR and authz tests need a known baseline identity; a\n   silently-admin or silently-readonly cred skews every authz finding.\n3. **not MFA-gated** — login did not stop at a 2fa\u002Fstep-up challenge. if it did,\n   you hold creds but **not** a session — default to least capability and confirm\n   with the operator before claiming authenticated reach.\n\nif the preflight fails, do **not** silently continue as blackbox — surface\n\"greybox creds did not validate (HTTP {code} \u002F MFA challenge)\" so the operator\ncan re-supply. only after a clean preflight: apply the validated session to every\nauthenticated test.\n\n## step 3 — taxonomy print (once, at session start)\n\nemit a deterministic block. plain text, lowercase, colon-delimited, no decoration.\n\n### mode=redteam\n\n```\nloaded for red team: {N} skills\n  mindset:    redteam-mindset\n  platform:   {fingerprint-matched skills (\u003C=8, tier order), or \"none detected\"}\n  deferred:   {platform skills past the 8-cap, or omit line if none}\n  auth:       hunt-ato, hunt-auth-bypass, hunt-saml, hunt-oauth, hunt-mfa-bypass\n  inj:        hunt-rce, hunt-sqli, hunt-ssrf, hunt-file-upload\n  infra:      hunt-http-smuggling, hunt-cloud-misconfig\n  stack:      hunt-sharepoint, hunt-aspnet\n  ir:         mid-engagement-ir-detection\n```\n\n### mode=wapt\n\n```\nloaded for wapt ({blackbox|greybox}): {N} skills\n  inj:        hunt-xss, hunt-sqli, hunt-ssrf, hunt-rce, hunt-xxe, hunt-ssti, hunt-file-upload\n  authz:      hunt-idor, hunt-auth-bypass, hunt-ato\n  auth:       hunt-oauth, hunt-saml, hunt-mfa-bypass\n  api:        hunt-graphql, hunt-api-misconfig\n  logic:      hunt-business-logic, hunt-race-condition\n  infra:      hunt-http-smuggling, hunt-cache-poison\n  recon:      hunt-subdomain\n  cloud:      hunt-cloud-misconfig\n  ai:         hunt-llm-ai\n  stack:      hunt-aspnet, hunt-sharepoint, hunt-ntlm-info\n  misc:       hunt-misc, hunt-csrf\n  reporting:  bb-methodology, security-arsenal, triage-validation\n```\n\n## subagent scope inheritance\n\nif any part of the hunt is delegated to subagents, scope does **not** inherit\nimplicitly. every subagent prompt must carry:\n\n1. **the authorized host list, verbatim, as data.** not \"the target estate\", not\n   \"*.target.com\" — the explicit list. a subagent cannot infer the boundary.\n2. **the discovered-host rule:** hosts found mid-run (via CT logs, CSP headers,\n   JS bundles, CNAME chains, error messages) are **report-only**. record and hand back; DNS resolution also requires authorized network scope. never probe, never write, until the operator re-authorizes.\n3. **a deny-list of action-executing endpoints, applied BEFORE any allow-list.**\n   names are a warning heuristic, not an action-safety guarantee; verify documented endpoint semantics and explicit allowlisted method\u002Fresource operations. Deny suspicious names such as: `refund`, `settle`, `payout`, `transfer`, `adjust`,\n   `disburse`, `create`, `update`, `delete`, `rotate`, `reset`, `send`, `initiate`,\n   `generate`, `process`. only then allow read-shaped names. order matters —\n   a path like `refund\u002Fbatch\u002Fstatus` matches the read-shaped keyword \"status\"\n   but is a refund route; an allow-list applied first would probe it.\n4. **\"read-only\" spelled out as forbidden verbs**, not as an adjective. \"read-only\"\n   is routinely interpreted as \"don't be destructive\", which does not stop an agent\n   sending `{}` to an endpoint whose name starts with `generate*` and creating a\n   real record on production.\n\n**lesson from an authorized engagement:** a subagent was told READ-ONLY and still\n(a) created a live record on production because it expected `{}` to return a\nvalidation error, and (b) wrote an object to a cloud bucket that was never on the\nauthorized list — one the parent prompt had named only for a DNS check. both were\ndisclosed in the deliverable. the fix is structural: pass scope as data, deny\nby verb before allowing by verb, and treat every discovered host as out of scope\nuntil told otherwise.\n\n## step 4 — return control to \u002Fhunt\n\nafter taxonomy print, return a plan to the authorized host\u002Foperator. No `\u002Fhunt` orchestrator or delegation engine is bundled; delegation requires host\u002Fuser authority and exact scope\u002Fbudget propagation. do not run probes here — this skill only loads context.\n\n## privacy\n\nnever echo back, log, or persist:\n- SOW \u002F scope-of-work \u002F engagement-letter content\n- grey box credentials (kept in session memory by `\u002Fhunt`, never written to disk)\n- client identifiers in user-level memory\n\n---\n\n## Related Skills & Chains\n\n- **`bb-methodology`** — When PART 0 mode confirmation completes. Workflow primitive: `bb-methodology` confirms engagement type (red team vs WAPT vs bug bounty); the answer feeds directly into this skill's `mode=redteam` \u002F `mode=wapt` invocation.\n- **`redteam-mindset`** + **`mid-engagement-ir-detection`** — When `mode=redteam` is loaded. Workflow primitive: these are the always-on skills loaded first by step 2 of the redteam flow before any platform skill or hunt-* skill.\n- **`okta-attack`** \u002F **`m365-entra-attack`** \u002F **`enterprise-vpn-attack`** \u002F **`vmware-vcenter-attack`** \u002F **`cloud-iam-deep`** \u002F **`supply-chain-attack-recon`** \u002F **`apk-redteam-pipeline`** — When fingerprint signals match. Workflow primitive: step 1's curl fingerprint scan against `recon\u002F\u003Ctarget>\u002Flive-hosts.txt` maps banner \u002F domain signals to one or more of these platform skills.\n- **`hunt-rce`** \u002F **`hunt-sqli`** \u002F **`hunt-ssrf`** \u002F **`hunt-ato`** \u002F **all other hunt-* skills`** — When the mode-specific skill set is being printed. Workflow primitive: this skill is the loader; it names the hunt-* skills but does not run probes — actual hunting happens after step 4 returns control to `\u002Fhunt`.\n- **`report-writing`** vs **`redteam-report-template`** — When the taxonomy print specifies the report format. Workflow primitive: `mode=wapt` ends with `report-writing` as the deliverable format; `mode=redteam` ends with `redteam-report-template` instead.\n\n## When to Use\n\n- You have explicit, written authorization to assess the target in scope, and the task matches this skill's vulnerability class or technique within a bug-bounty or penetration-test engagement.\n- You need the recon, exploitation, or validation workflow described below — executed strictly inside the approved scope.\n\n## Limitations\n\n- Authorized scope only: the confirmation gate above is mandatory before any probing, exploitation, or credential-access command.\n- Docs-only import: upstream helper scripts, commands, engine, and research assets are not bundled; review separately obtained official tools and provenance before installation.\n- Validate every finding (see `triage-validation`) before reporting; report via `report-writing`. Prefer a sandbox, disposable VM, or controlled lab.\n\n### Example\n\n```bash\n# Read-only first step; confirm scope before anything active.\ncat scope.txt  # target list from the authorized engagement brief\n```\n\n> Adapted from [elementalsouls\u002FClaude-BugHunter](https:\u002F\u002Fgithub.com\u002Felementalsouls\u002FClaude-BugHunter) (MIT); frontmatter, When to Use\u002FLimitations, and safety boundaries added for upstream compliance. Docs-only import: executable helpers, commands, engine, and research assets not bundled.\n\nExample offline outcome: supplied evidence shows Next.js markers on host A but no approved baseline capture. Report `candidate: hunt-nextjs; baseline: not collected; probes: none; authorization: read-only supplied artifacts` rather than claiming the skill was executed or the host tested.\n",{"name":5,"risk":26,"source":47,"license":14,"sources":31,"category":39,"date_added":48,"description":7,"source_repo":49,"source_type":31,"report_count":50,"compatibility":51,"license_source":52},"https:\u002F\u002Fgithub.com\u002Felementalsouls\u002FClaude-BugHunter","2026-09-20","elementalsouls\u002FClaude-BugHunter",0,"Requires explicit written authorization for a target scope plus the relevant testing tools for this technique. Docs-only; helper scripts and commands not bundled.","https:\u002F\u002Fgithub.com\u002Felementalsouls\u002FClaude-BugHunter\u002Fblob\u002Fmain\u002FLICENSE","7bf2279c8a65758319526a721d5c4b75683aec9c","skills\u002Fantigravity-hunt-dispatch",3,"https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections","https:\u002F\u002Fgithub.com\u002Fboisenoise","2026-11-14 14:18:11",{"source":8,"skillName":5,"commands":60,"prompt":70,"zipAvailable":71},[61,64,67],{"tool":62,"command":63},"npx","npx skills add boisenoise\u002Fskills-collections --skill hunt-dispatch",{"tool":65,"command":66},"bunx","bunx skills add boisenoise\u002Fskills-collections --skill hunt-dispatch",{"tool":68,"command":69},"pnpm","pnpm dlx skills add boisenoise\u002Fskills-collections --skill hunt-dispatch","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-hunt-dispatch\u002FSKILL.md",true,[],[74,101,127,151,170,193],{"skillNo":75,"name":76,"nameZh":6,"description":77,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":78,"licenseFileUrl":79,"sourceHtmlUrl":80,"categories":81,"keywords":82,"publishedAt":42},"01M6WNH92BHVFXHGPDZCPJ0AG0","web-access","Use Treg for public web or platform data only when existing search, browser and connected tools cannot cover the task, with explicit cost and data boundaries.","Apache-2.0","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-web-access\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-web-access\u002FSKILL.md",[],[83,84,85,86,87,88,89,90,34,91,92,32,93,94,95,96,97,98,99,100,21],"web","access","web access","official","development","browser","search","data","read","fetch","youtube","free tools","platform","critical","free","cover","normal","when",{"skillNo":102,"name":103,"nameZh":6,"description":104,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":78,"licenseFileUrl":105,"sourceHtmlUrl":106,"categories":107,"keywords":113,"publishedAt":42},"01M6WNF9XAYAB2CZDDJBAKNM93","treg","Use the Treg CLI or MCP catalog to discover, price and call authorized external tools with team-scoped credentials and a user-approved budget.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-treg\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-treg\u002FSKILL.md",[108],{"categoryNo":109,"categoryName":110,"taxonomyType":111,"taxonomyTypeDesc":112},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[103,114,115,40,86,87,37,34,116,117,118,119,120,121,122,96,123,124,125,126,21],"MCP","cli","Budget","credentials","team","catalog","use","call","discover","external tools","with","scoped","blob",{"skillNo":128,"name":129,"nameZh":6,"description":130,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":78,"licenseFileUrl":131,"sourceHtmlUrl":132,"categories":133,"keywords":139,"publishedAt":42},"01M6WN93MEAZ4E41DYAHJRPHQT","recruit","Turn a job description into an evidence-linked candidate shortlist through Treg, with job-related ranking and optional authorized business contact enrichment.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-recruit\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-recruit\u002FSKILL.md",[134],{"categoryNo":135,"categoryName":136,"taxonomyType":137,"taxonomyTypeDesc":138},"01JBSEEDCAT000000000000038","人力资源","PROFESSION","适用职业",[129,40,86,37,36,140,141,142,143,144,96,145,146,147,124,23,148,149,150,126,103,21],"email","enrichment","business","evidence","phone","ranking","post","job description","person","candidate","reason",{"skillNo":152,"name":153,"nameZh":6,"description":154,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":78,"licenseFileUrl":155,"sourceHtmlUrl":156,"categories":157,"keywords":158,"publishedAt":42},"01M6WN8R5RXSMHM9B4D9FAFX42","rea-growth","Analyze a company’s public growth and content through Treg, distinguish observations from hypotheses, and produce an evidence-linked playbook within an approved budget.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-rea-growth\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-rea-growth\u002FSKILL.md",[],[159,160,161,40,86,37,162,163,36,164,116,165,166,167,143,96,168,169,126,103,21],"growth","rea","rea growth","produce","content","playbook","marketing","analyze","public","observations","company",{"skillNo":171,"name":172,"nameZh":6,"description":173,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":78,"licenseFileUrl":174,"sourceHtmlUrl":175,"categories":176,"keywords":177,"publishedAt":42},"01M6WN2EVE3RQRGWAKBT4S7YT2","make-ugc","Create original AI UGC-style product videos through Treg: research hooks, approve a licensed presenter and voice, generate clips, add captions and report costs.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-make-ugc\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-make-ugc\u002FSKILL.md",[],[178,179,40,180,86,181,37,182,183,184,185,186,96,187,188,189,190,191,192,126],"make","make ugc","research","create","Video","Captions","ads","short","hooks","head","style","niche","trending","talking-head","approve",{"skillNo":194,"name":195,"nameZh":6,"description":196,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":78,"licenseFileUrl":197,"sourceHtmlUrl":198,"categories":199,"keywords":200,"publishedAt":42},"01M6WN10ARAA63Y8K1YNGXJ2RM","lead-signals","Find and qualify public buying signals through Treg, rank fitting business accounts and optionally enrich authorized business contact information.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-lead-signals\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-lead-signals\u002FSKILL.md",[],[201,202,203,40,86,37,204,205,142,206,207,96,208,209,210,211,212,213,214,126],"signals","lead","lead signals","how","find","ready","as","how to","qualify","people","information","enrich","changes","funding"]