[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6F7JS19F3M5ENWEX92HC2QN":3,"skill-same:01M6F7JS19F3M5ENWEX92HC2QN":86},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":27,"publishedAt":54,"linkOnly":55,"markdownContent":56,"markdownBody":57,"frontMatter":58,"refName":42,"commitSha":66,"skillDirectory":67,"forksCount":68,"repositoryHtmlUrl":69,"repositoryHomepageUrl":6,"ownerHtmlUrl":70,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":71,"install":72,"resources":85},"01M6F7JS19F3M5ENWEX92HC2QN","hunt-shadow-api",null,"Hunt shadow \u002F zombie \u002F undocumented API surface (OWASP API9 Improper Inventory Management)","boisenoise\u002Fskills-collections","boisenoise","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F193180?v=4","01M6CDBDQK6BDN55ZMA6B6PKBM","01M6CDBDVSJ3JPTBYN26FZ7TZK",12,"MIT","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-hunt-shadow-api\u002FSKILL.md",[17,22],{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000010","后端与接口","SCENARIO","使用场景",{"categoryNo":23,"categoryName":24,"taxonomyType":25,"taxonomyTypeDesc":26},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53],"hunt shadow api","api","Shadow","hunt","2026","testing","for","relevant","helper","inventory management","offensive","scripts","scope","commands","main","community","only","inventory","Tools","owasp","https","license","testing tools","research","security","github","2026-11-10 10:12:30",false,"---\nname: hunt-shadow-api\ndescription: Hunt shadow \u002F zombie \u002F undocumented API surface (OWASP API9 Improper\n  Inventory Management)\ncategory: security\nrisk: offensive\nsource: https:\u002F\u002Fgithub.com\u002Felementalsouls\u002FClaude-BugHunter\nsource_repo: elementalsouls\u002FClaude-BugHunter\nsource_type: community\ndate_added: '2026-09-20'\nlicense: MIT\nlicense_source: https:\u002F\u002Fgithub.com\u002Felementalsouls\u002FClaude-BugHunter\u002Fblob\u002Fmain\u002FLICENSE\ncompatibility: Requires explicit written authorization for a target scope plus the\n  relevant testing tools for this technique. Docs-only; helper scripts and commands\n  not bundled.\nsources: owasp_api_top10_2023, portswigger_research, public_research\nreport_count: 0\n---\n> **⚠️ AUTHORIZED USE ONLY**\n> This skill is for educational purposes or authorized security assessments only.\n> You must have explicit, written permission from the system owner before using this tool.\n> Misuse of this tool is illegal and strictly prohibited.\n\n> **Mandatory confirmation gate**\n> Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:\n> 1. Ask the user to state the exact target URL, IP, account, or resource.\n> 2. Ask the user to confirm written authorization and the permitted scope.\n> 3. Show the exact command(s) and explain their expected effect.\n> 4. Wait for explicit confirmation in the current conversation.\n>\n> Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.\n\n## OWASP API9 — Improper Inventory Management (Shadow \u002F Zombie APIs)\n\nAs an API evolves, old versions and internal\u002Fstaging routes routinely stay reachable without\nreceiving the same security fixes as the current version — because nobody tracks that they\nstill exist. The bug is rarely in one endpoint; it's in the **delta** between what an old\nversion enforces and what the current version enforces on the same operation.\n\n### When to use\n\nTrigger when:\n- Versioned paths are visible (`\u002Fv1\u002F`, `\u002Fv2\u002F`, `\u002Fapi\u002F2023-01-01\u002F`) or `Accept`\u002F`X-API-Version`\n  headers are in play.\n- A changelog, release notes, or deprecation notice references removed\u002Fold API behavior.\n- A mobile APK\u002FIPA (via `apk-redteam-pipeline` \u002F `ios-redteam-pipeline`) hardcodes endpoints\n  that look like an older backend version than the current web app calls.\n- Multiple OpenAPI\u002FSwagger specs are discoverable, or `info.version` in one spec implies others\n  exist.\n\nDO NOT use for single-version APIs with no version history — there's nothing to diff; go\nstraight to `hunt-api-misconfig` for direct exploitation of the one surface that exists.\n\n---\n\n## Stage 1 — Enumerate the Full Version Surface\n\n```bash\n# Path-based versioning\nfor v in v1 v2 v3 v4 beta alpha internal legacy old 2022-01-01 2023-01-01 2024-01-01; do\n  curl -s -o \u002Fdev\u002Fnull -w \"%{http_code} \u002Fapi\u002F$v\u002F\\n\" \"https:\u002F\u002F$TARGET\u002Fapi\u002F$v\u002F\"\ndone\n\n# Header-based versioning\ncurl -s -H \"X-API-Version: 1\" https:\u002F\u002F$TARGET\u002Fapi\u002Fusers\ncurl -s -H \"Accept: application\u002Fvnd.company.v1+json\" https:\u002F\u002F$TARGET\u002Fapi\u002Fusers\n\n# Subdomain-based versioning\nfor sub in api api-v1 api-v2 apiv1 apiv2 legacy-api old-api internal-api staging-api; do\n  curl -s -o \u002Fdev\u002Fnull -w \"%{http_code} $sub\\n\" \"https:\u002F\u002F$sub.$TARGET\u002F\"\ndone\n```\n\nA `200`\u002F`401`\u002F`403` is a discovery lead, not proof an API version exists: compare a random nonexistent route and inspect content\u002Frouting because catch-all pages and gateways can return the same status for every path.\n\n---\n\n## Stage 2 — Pull Every Reachable Spec, Not Just the Linked One\n\n```bash\nfor path in openapi.json swagger.json v1\u002Fswagger.json v2\u002Fswagger.json v3\u002Fapi-docs \\\n            api-docs.json swagger\u002Fv1\u002Fswagger.json .well-known\u002Fopenapi.json; do\n  curl -s -o \u002Fdev\u002Fnull -w \"%{http_code} \u002F$path\\n\" \"https:\u002F\u002F$TARGET\u002F$path\"\ndone\n\n# Wayback Machine — a DEPRECATED version's spec often stays indexed after the live link is removed\ncurl -s \"http:\u002F\u002Fweb.archive.org\u002Fcdx\u002Fsearch\u002Fcdx?url=$TARGET\u002F*swagger*&output=json&collapse=urlkey\"\ncurl -s \"http:\u002F\u002Fweb.archive.org\u002Fcdx\u002Fsearch\u002Fcdx?url=$TARGET\u002F*openapi*&output=json&collapse=urlkey\"\n```\n\nWhen more than one spec resolves (a current one and an archived\u002Fold one), diff the endpoint\ninventories directly:\n```bash\njq -r '.paths | keys[]' v1-swagger.json | sort > \u002Ftmp\u002Fv1_paths.txt\njq -r '.paths | keys[]' v2-swagger.json | sort > \u002Ftmp\u002Fv2_paths.txt\ncomm -23 \u002Ftmp\u002Fv1_paths.txt \u002Ftmp\u002Fv2_paths.txt   # in v1 only — candidates for \"still live but forgotten\"\n```\nFor every path in that diff, confirm it's still reachable against the v1 base URL. A route\ndocumented only in the old spec that still returns something other than `404` is a zombie-\nendpoint candidate — carry it into Stage 3.\n\n---\n\n## Stage 3 — Behavioral Diff Between Old and Current Version\n\nFor each operation that exists in **both** versions, compare security-relevant behavior, not\nresponse shape. Response shape differences are Informational; behavioral security regressions\nare the finding.\n\n- **Auth strength.** Does the old version accept no token, an expired token, or a lower-\n  privilege token that the current version rejects?\n  ```bash\n  curl -s -H \"Authorization: Bearer $EXPIRED_TOKEN\" https:\u002F\u002F$TARGET\u002Fapi\u002Fv1\u002Fusers\u002Fme -w '\\n%{http_code}\\n'\n  curl -s -H \"Authorization: Bearer $EXPIRED_TOKEN\" https:\u002F\u002F$TARGET\u002Fapi\u002Fv2\u002Fusers\u002Fme -w '\\n%{http_code}\\n'\n  ```\n- **Rate limiting.** Compare only within the explicitly authorized rate\u002Frequest budget and test-account scope. Absence of `429` alone does not establish a missing control; rate limits may depend on identity, window, gateway or other signals. Record actual impact without brute-force escalation unless separately authorized.\n- **Input validation.** Send the identical injection\u002Foversized\u002Fmalformed payload to both; the\n  old version accepting what the new one rejects means hardening happened forward-only —\n  chain into whichever injection class the payload targets (`hunt-sqli`, `hunt-idor`, etc.).\n- **Field exposure.** Does the old version's response body include fields — internal IDs, other\n  users' data, internal notes, PII — that the current version has since redacted?\n\n---\n\n## Stage 4 — Deprecated \u002F Internal Routes Never Referenced by the Current UI\n\n- Grep JS bundles for API calls no visible UI flow triggers (`\u002Finternal\u002F`, `\u002Fadmin\u002F`, `\u002Fdebug\u002F`,\n  `\u002F_internal\u002F`, `\u002Ftest\u002F`, `\u002Fstaging\u002F`) — reuse `hunt-source-leak`'s JS-bundle grep patterns for\n  this specifically.\n- Check `robots.txt` \u002F `sitemap.xml` for disallowed API paths — a self-inflicted disclosure.\n- Mobile-app endpoint inventories (via `apk-redteam-pipeline` \u002F `ios-redteam-pipeline`) very\n  often reference an older backend version than the current web app calls. Treat every\n  APK\u002FIPA-sourced endpoint as a version-diff candidate against the live web API.\n\n---\n\n## False-Positive Gate\n\n- A version difference alone (different response shape, cosmetic field renaming) is\n  Informational. The finding is a **security-relevant regression** — auth, rate-limit, or\n  validation that got weaker going backward in version history.\n- Confirm the old endpoint is not simply an alias\u002Fproxy to the current implementation before\n  claiming a behavioral difference — send a payload that would actually behave differently\n  under old vs. new logic, not just compare a version string in the response body.\n- A `200` on a path that just serves a static \"this API version is deprecated, use v2\" message\n  is not a finding — confirm the underlying operation still executes.\n\n---\n\n## Severity Table\n\n| Finding | Severity |\n|---|---|\n| Old version bypasses auth entirely where current version requires it | Critical |\n| Old version missing rate-limit present on current version | Medium–High (chain via `hunt-brute-force`) |\n| Old version leaks extra fields (PII, internal IDs) vs. current | Medium–High |\n| Old version accepts payloads the current version now validates\u002Fsanitizes | High (chain to the underlying injection class) |\n| Version is reachable but behaviorally identical to current | Informational |\n\n---\n\n## Related Skills & Chains\n\n- **`hunt-api-misconfig`** — owns exploitation once a spec or endpoint is in hand (mass\n  assignment, JWT attacks, OData, Swagger-chain attacks). This skill hands it a sharper target:\n  \"here's a zombie endpoint with weaker validation than the current one.\"\n- **`hunt-subdomain`** — owns host\u002Fsubdomain-level discovery (`api-v1.target.com` as its own\n  host, potential takeover). This skill owns what happens once you're inside a given host's\n  version surface.\n- **`hunt-source-leak`** — JS-bundle grep for internal\u002Fundocumented calls; reused here\n  specifically for version-diffing rather than secret extraction.\n- **`apk-redteam-pipeline`** \u002F **`ios-redteam-pipeline`** — mobile builds routinely hardcode an\n  older API version; every mobile-sourced endpoint is a version-diff candidate.\n- **`hunt-brute-force`** — a rate-limit regression found here is only a complete finding once\n  chained to actual brute-forceable impact (login, OTP, enumeration).\n\n## When to Use\n\n- You have explicit, written authorization to assess the target in scope, and the task matches this skill's vulnerability class or technique within a bug-bounty or penetration-test engagement.\n- You need the recon, exploitation, or validation workflow described below — executed strictly inside the approved scope.\n\n## Limitations\n\n- Authorized scope only: the confirmation gate above is mandatory before any probing, exploitation, or credential-access command.\n- Docs-only import: upstream helper scripts, commands, engine, and research assets are not bundled; reinstall tooling from the source repo when needed.\n- Validate every finding (see `triage-validation`) before reporting; report via `report-writing`. Prefer a sandbox, disposable VM, or controlled lab.\n\n### Example\n\n```bash\n# Read-only first step; confirm scope before anything active.\ncat scope.txt  # target list from the authorized engagement brief\n```\n\n> Adapted from [elementalsouls\u002FClaude-BugHunter](https:\u002F\u002Fgithub.com\u002Felementalsouls\u002FClaude-BugHunter) (MIT); frontmatter, When to Use\u002FLimitations, and safety boundaries added for upstream compliance. Docs-only import: executable helpers, commands, engine, and research assets not bundled.\n","> **⚠️ AUTHORIZED USE ONLY**\n> This skill is for educational purposes or authorized security assessments only.\n> You must have explicit, written permission from the system owner before using this tool.\n> Misuse of this tool is illegal and strictly prohibited.\n\n> **Mandatory confirmation gate**\n> Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:\n> 1. Ask the user to state the exact target URL, IP, account, or resource.\n> 2. Ask the user to confirm written authorization and the permitted scope.\n> 3. Show the exact command(s) and explain their expected effect.\n> 4. Wait for explicit confirmation in the current conversation.\n>\n> Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.\n\n## OWASP API9 — Improper Inventory Management (Shadow \u002F Zombie APIs)\n\nAs an API evolves, old versions and internal\u002Fstaging routes routinely stay reachable without\nreceiving the same security fixes as the current version — because nobody tracks that they\nstill exist. The bug is rarely in one endpoint; it's in the **delta** between what an old\nversion enforces and what the current version enforces on the same operation.\n\n### When to use\n\nTrigger when:\n- Versioned paths are visible (`\u002Fv1\u002F`, `\u002Fv2\u002F`, `\u002Fapi\u002F2023-01-01\u002F`) or `Accept`\u002F`X-API-Version`\n  headers are in play.\n- A changelog, release notes, or deprecation notice references removed\u002Fold API behavior.\n- A mobile APK\u002FIPA (via `apk-redteam-pipeline` \u002F `ios-redteam-pipeline`) hardcodes endpoints\n  that look like an older backend version than the current web app calls.\n- Multiple OpenAPI\u002FSwagger specs are discoverable, or `info.version` in one spec implies others\n  exist.\n\nDO NOT use for single-version APIs with no version history — there's nothing to diff; go\nstraight to `hunt-api-misconfig` for direct exploitation of the one surface that exists.\n\n---\n\n## Stage 1 — Enumerate the Full Version Surface\n\n```bash\n# Path-based versioning\nfor v in v1 v2 v3 v4 beta alpha internal legacy old 2022-01-01 2023-01-01 2024-01-01; do\n  curl -s -o \u002Fdev\u002Fnull -w \"%{http_code} \u002Fapi\u002F$v\u002F\\n\" \"https:\u002F\u002F$TARGET\u002Fapi\u002F$v\u002F\"\ndone\n\n# Header-based versioning\ncurl -s -H \"X-API-Version: 1\" https:\u002F\u002F$TARGET\u002Fapi\u002Fusers\ncurl -s -H \"Accept: application\u002Fvnd.company.v1+json\" https:\u002F\u002F$TARGET\u002Fapi\u002Fusers\n\n# Subdomain-based versioning\nfor sub in api api-v1 api-v2 apiv1 apiv2 legacy-api old-api internal-api staging-api; do\n  curl -s -o \u002Fdev\u002Fnull -w \"%{http_code} $sub\\n\" \"https:\u002F\u002F$sub.$TARGET\u002F\"\ndone\n```\n\nA `200`\u002F`401`\u002F`403` is a discovery lead, not proof an API version exists: compare a random nonexistent route and inspect content\u002Frouting because catch-all pages and gateways can return the same status for every path.\n\n---\n\n## Stage 2 — Pull Every Reachable Spec, Not Just the Linked One\n\n```bash\nfor path in openapi.json swagger.json v1\u002Fswagger.json v2\u002Fswagger.json v3\u002Fapi-docs \\\n            api-docs.json swagger\u002Fv1\u002Fswagger.json .well-known\u002Fopenapi.json; do\n  curl -s -o \u002Fdev\u002Fnull -w \"%{http_code} \u002F$path\\n\" \"https:\u002F\u002F$TARGET\u002F$path\"\ndone\n\n# Wayback Machine — a DEPRECATED version's spec often stays indexed after the live link is removed\ncurl -s \"http:\u002F\u002Fweb.archive.org\u002Fcdx\u002Fsearch\u002Fcdx?url=$TARGET\u002F*swagger*&output=json&collapse=urlkey\"\ncurl -s \"http:\u002F\u002Fweb.archive.org\u002Fcdx\u002Fsearch\u002Fcdx?url=$TARGET\u002F*openapi*&output=json&collapse=urlkey\"\n```\n\nWhen more than one spec resolves (a current one and an archived\u002Fold one), diff the endpoint\ninventories directly:\n```bash\njq -r '.paths | keys[]' v1-swagger.json | sort > \u002Ftmp\u002Fv1_paths.txt\njq -r '.paths | keys[]' v2-swagger.json | sort > \u002Ftmp\u002Fv2_paths.txt\ncomm -23 \u002Ftmp\u002Fv1_paths.txt \u002Ftmp\u002Fv2_paths.txt   # in v1 only — candidates for \"still live but forgotten\"\n```\nFor every path in that diff, confirm it's still reachable against the v1 base URL. A route\ndocumented only in the old spec that still returns something other than `404` is a zombie-\nendpoint candidate — carry it into Stage 3.\n\n---\n\n## Stage 3 — Behavioral Diff Between Old and Current Version\n\nFor each operation that exists in **both** versions, compare security-relevant behavior, not\nresponse shape. Response shape differences are Informational; behavioral security regressions\nare the finding.\n\n- **Auth strength.** Does the old version accept no token, an expired token, or a lower-\n  privilege token that the current version rejects?\n  ```bash\n  curl -s -H \"Authorization: Bearer $EXPIRED_TOKEN\" https:\u002F\u002F$TARGET\u002Fapi\u002Fv1\u002Fusers\u002Fme -w '\\n%{http_code}\\n'\n  curl -s -H \"Authorization: Bearer $EXPIRED_TOKEN\" https:\u002F\u002F$TARGET\u002Fapi\u002Fv2\u002Fusers\u002Fme -w '\\n%{http_code}\\n'\n  ```\n- **Rate limiting.** Compare only within the explicitly authorized rate\u002Frequest budget and test-account scope. Absence of `429` alone does not establish a missing control; rate limits may depend on identity, window, gateway or other signals. Record actual impact without brute-force escalation unless separately authorized.\n- **Input validation.** Send the identical injection\u002Foversized\u002Fmalformed payload to both; the\n  old version accepting what the new one rejects means hardening happened forward-only —\n  chain into whichever injection class the payload targets (`hunt-sqli`, `hunt-idor`, etc.).\n- **Field exposure.** Does the old version's response body include fields — internal IDs, other\n  users' data, internal notes, PII — that the current version has since redacted?\n\n---\n\n## Stage 4 — Deprecated \u002F Internal Routes Never Referenced by the Current UI\n\n- Grep JS bundles for API calls no visible UI flow triggers (`\u002Finternal\u002F`, `\u002Fadmin\u002F`, `\u002Fdebug\u002F`,\n  `\u002F_internal\u002F`, `\u002Ftest\u002F`, `\u002Fstaging\u002F`) — reuse `hunt-source-leak`'s JS-bundle grep patterns for\n  this specifically.\n- Check `robots.txt` \u002F `sitemap.xml` for disallowed API paths — a self-inflicted disclosure.\n- Mobile-app endpoint inventories (via `apk-redteam-pipeline` \u002F `ios-redteam-pipeline`) very\n  often reference an older backend version than the current web app calls. Treat every\n  APK\u002FIPA-sourced endpoint as a version-diff candidate against the live web API.\n\n---\n\n## False-Positive Gate\n\n- A version difference alone (different response shape, cosmetic field renaming) is\n  Informational. The finding is a **security-relevant regression** — auth, rate-limit, or\n  validation that got weaker going backward in version history.\n- Confirm the old endpoint is not simply an alias\u002Fproxy to the current implementation before\n  claiming a behavioral difference — send a payload that would actually behave differently\n  under old vs. new logic, not just compare a version string in the response body.\n- A `200` on a path that just serves a static \"this API version is deprecated, use v2\" message\n  is not a finding — confirm the underlying operation still executes.\n\n---\n\n## Severity Table\n\n| Finding | Severity |\n|---|---|\n| Old version bypasses auth entirely where current version requires it | Critical |\n| Old version missing rate-limit present on current version | Medium–High (chain via `hunt-brute-force`) |\n| Old version leaks extra fields (PII, internal IDs) vs. current | Medium–High |\n| Old version accepts payloads the current version now validates\u002Fsanitizes | High (chain to the underlying injection class) |\n| Version is reachable but behaviorally identical to current | Informational |\n\n---\n\n## Related Skills & Chains\n\n- **`hunt-api-misconfig`** — owns exploitation once a spec or endpoint is in hand (mass\n  assignment, JWT attacks, OData, Swagger-chain attacks). This skill hands it a sharper target:\n  \"here's a zombie endpoint with weaker validation than the current one.\"\n- **`hunt-subdomain`** — owns host\u002Fsubdomain-level discovery (`api-v1.target.com` as its own\n  host, potential takeover). This skill owns what happens once you're inside a given host's\n  version surface.\n- **`hunt-source-leak`** — JS-bundle grep for internal\u002Fundocumented calls; reused here\n  specifically for version-diffing rather than secret extraction.\n- **`apk-redteam-pipeline`** \u002F **`ios-redteam-pipeline`** — mobile builds routinely hardcode an\n  older API version; every mobile-sourced endpoint is a version-diff candidate.\n- **`hunt-brute-force`** — a rate-limit regression found here is only a complete finding once\n  chained to actual brute-forceable impact (login, OTP, enumeration).\n\n## When to Use\n\n- You have explicit, written authorization to assess the target in scope, and the task matches this skill's vulnerability class or technique within a bug-bounty or penetration-test engagement.\n- You need the recon, exploitation, or validation workflow described below — executed strictly inside the approved scope.\n\n## Limitations\n\n- Authorized scope only: the confirmation gate above is mandatory before any probing, exploitation, or credential-access command.\n- Docs-only import: upstream helper scripts, commands, engine, and research assets are not bundled; reinstall tooling from the source repo when needed.\n- Validate every finding (see `triage-validation`) before reporting; report via `report-writing`. Prefer a sandbox, disposable VM, or controlled lab.\n\n### Example\n\n```bash\n# Read-only first step; confirm scope before anything active.\ncat scope.txt  # target list from the authorized engagement brief\n```\n\n> Adapted from [elementalsouls\u002FClaude-BugHunter](https:\u002F\u002Fgithub.com\u002Felementalsouls\u002FClaude-BugHunter) (MIT); frontmatter, When to Use\u002FLimitations, and safety boundaries added for upstream compliance. Docs-only import: executable helpers, commands, engine, and research assets not bundled.\n",{"name":5,"risk":38,"source":59,"license":14,"sources":60,"category":52,"date_added":61,"description":7,"source_repo":62,"source_type":43,"report_count":63,"compatibility":64,"license_source":65},"https:\u002F\u002Fgithub.com\u002Felementalsouls\u002FClaude-BugHunter","owasp_api_top10_2023, portswigger_research, public_research","2026-09-20","elementalsouls\u002FClaude-BugHunter",0,"Requires explicit written authorization for a target scope plus the relevant testing tools for this technique. Docs-only; helper scripts and commands not bundled.","https:\u002F\u002Fgithub.com\u002Felementalsouls\u002FClaude-BugHunter\u002Fblob\u002Fmain\u002FLICENSE","7bf2279c8a65758319526a721d5c4b75683aec9c","skills\u002Fantigravity-hunt-shadow-api",3,"https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections","https:\u002F\u002Fgithub.com\u002Fboisenoise","2026-11-10 14:20:15",{"source":8,"skillName":5,"commands":73,"prompt":83,"zipAvailable":84},[74,77,80],{"tool":75,"command":76},"npx","npx skills add boisenoise\u002Fskills-collections --skill hunt-shadow-api",{"tool":78,"command":79},"bunx","bunx skills add boisenoise\u002Fskills-collections --skill hunt-shadow-api",{"tool":81,"command":82},"pnpm","pnpm dlx skills add boisenoise\u002Fskills-collections --skill hunt-shadow-api","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-hunt-shadow-api\u002FSKILL.md",true,[],[87,114,138,160,179,201],{"skillNo":88,"name":89,"nameZh":6,"description":90,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":91,"licenseFileUrl":92,"sourceHtmlUrl":93,"categories":94,"keywords":95,"publishedAt":54},"01M6WNH92BHVFXHGPDZCPJ0AG0","web-access","Use Treg for public web or platform data only when existing search, browser and connected tools cannot cover the task, with explicit cost and data boundaries.","Apache-2.0","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-web-access\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-web-access\u002FSKILL.md",[],[96,97,98,99,100,101,102,103,46,104,105,44,106,107,108,109,110,111,112,113,32],"web","access","web access","official","development","browser","search","data","read","fetch","youtube","free tools","platform","critical","free","cover","normal","when",{"skillNo":115,"name":116,"nameZh":6,"description":117,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":91,"licenseFileUrl":118,"sourceHtmlUrl":119,"categories":120,"keywords":124,"publishedAt":54},"01M6WNF9XAYAB2CZDDJBAKNM93","treg","Use the Treg CLI or MCP catalog to discover, price and call authorized external tools with team-scoped credentials and a user-approved budget.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-treg\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-treg\u002FSKILL.md",[121],{"categoryNo":122,"categoryName":123,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000023","Skill与智能体开发",[116,125,126,53,99,100,49,46,127,128,129,130,131,132,133,109,134,135,136,137,32],"MCP","cli","Budget","credentials","team","catalog","use","call","discover","external tools","with","scoped","blob",{"skillNo":139,"name":140,"nameZh":6,"description":141,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":91,"licenseFileUrl":142,"sourceHtmlUrl":143,"categories":144,"keywords":148,"publishedAt":54},"01M6WN93MEAZ4E41DYAHJRPHQT","recruit","Turn a job description into an evidence-linked candidate shortlist through Treg, with job-related ranking and optional authorized business contact enrichment.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-recruit\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-recruit\u002FSKILL.md",[145],{"categoryNo":146,"categoryName":147,"taxonomyType":25,"taxonomyTypeDesc":26},"01JBSEEDCAT000000000000038","人力资源",[140,53,99,49,48,149,150,151,152,153,109,154,155,156,135,34,157,158,159,137,116,32],"email","enrichment","business","evidence","phone","ranking","post","job description","person","candidate","reason",{"skillNo":161,"name":162,"nameZh":6,"description":163,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":91,"licenseFileUrl":164,"sourceHtmlUrl":165,"categories":166,"keywords":167,"publishedAt":54},"01M6WN8R5RXSMHM9B4D9FAFX42","rea-growth","Analyze a company’s public growth and content through Treg, distinguish observations from hypotheses, and produce an evidence-linked playbook within an approved budget.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-rea-growth\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-rea-growth\u002FSKILL.md",[],[168,169,170,53,99,49,171,172,48,173,127,174,175,176,152,109,177,178,137,116,32],"growth","rea","rea growth","produce","content","playbook","marketing","analyze","public","observations","company",{"skillNo":180,"name":181,"nameZh":6,"description":182,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":91,"licenseFileUrl":183,"sourceHtmlUrl":184,"categories":185,"keywords":186,"publishedAt":54},"01M6WN2EVE3RQRGWAKBT4S7YT2","make-ugc","Create original AI UGC-style product videos through Treg: research hooks, approve a licensed presenter and voice, generate clips, add captions and report costs.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-make-ugc\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-make-ugc\u002FSKILL.md",[],[187,188,53,51,99,189,49,190,191,192,193,194,109,195,196,197,198,199,200,137],"make","make ugc","create","Video","Captions","ads","short","hooks","head","style","niche","trending","talking-head","approve",{"skillNo":202,"name":203,"nameZh":6,"description":204,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":91,"licenseFileUrl":205,"sourceHtmlUrl":206,"categories":207,"keywords":208,"publishedAt":54},"01M6WN10ARAA63Y8K1YNGXJ2RM","lead-signals","Find and qualify public buying signals through Treg, rank fitting business accounts and optionally enrich authorized business contact information.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-lead-signals\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-lead-signals\u002FSKILL.md",[],[209,210,211,53,99,49,212,213,151,214,215,109,216,217,218,219,220,221,222,137],"signals","lead","lead signals","how","find","ready","as","how to","qualify","people","information","enrich","changes","funding"]