src-hunter
实战 SRC / 众测 / Bug bounty 漏洞挖掘工作流 skill。包含:5 阶段方法论(intake → recon → enum → hunt → report)、19 个攻击类 playbook(SQLi/XSS/RCE/SSRF/IDOR/CSRF/Path Traversal/File Upload/SSTI/XXE/Race/HTTP Smuggling/OAuth/JWT/SAML/GraphQL/Mobile/LLM/DoS)、305 个结构化 payload、263 个 WAF/EDR 绕过变体、2887 份 HackerOne 真实 High/Critical 已披露案例、77,000+ WooYun 案例统计、国产 OA / 中间件指纹库、银行 / 电信行业垂直 playbook。当用户提到 "src 挖洞 / src 漏洞挖掘 / bug bounty / 众测 / hackerone / 漏洞赏金 / SRC / 任意 X 漏洞 / 渗透测试" 或问"如何挖某个目标 / 怎么测某个 API / 如何绕过 WAF" 时触发。
- License 许可
- MIT
- 最近更新
- 2026-11-09
- Stars
- ★ 0
- Forks
- 0
01 前言 Front Matter
- name
- handoff
- description
- Compact the current conversation into a handoff document for another agent to pick up.
- argument-hint
- What will the next session be used for?
- disable-model-invocation
- true
02 资源文件 93
- 参考文档.claude-plugin/marketplace.json1.0 KB
- 其他.gitignore164 B
- 参考文档agents/openai.yaml141 B
- 许可证LICENSE1.0 KB
- 参考文档README.en.md6.1 KB
- 参考文档README.md6.2 KB
- 参考文档references/.gitkeep—
- 参考文档references/dictionaries/00-index.md2.2 KB
- 参考文档references/dictionaries/chinese-srcfingerprints.md14.5 KB
- 参考文档references/dictionaries/default-credentials-cn.md9.9 KB
- 参考文档references/industry/00-index.md2.7 KB
- 参考文档references/industry/banking-finance.md14.6 KB
- 参考文档references/industry/telecom-isp.md11.5 KB
- 参考文档references/methodology/00-index.md2.9 KB
- 参考文档references/methodology/01-attack-priority.md6.5 KB
- 参考文档references/methodology/02-bypass-toolkit.md11.3 KB
- 参考文档references/methodology/03-evidence-discipline.md7.4 KB
- 参考文档references/methodology/04-control-gap-hunting.md9.1 KB
- 参考文档references/methodology/05-srctimebox-priority.md7.7 KB
- 参考文档references/payloader/by-category/intranet/adcs攻击.md6.2 KB
- 参考文档references/payloader/by-category/intranet/exchange攻击.md5.5 KB
- 参考文档references/payloader/by-category/intranet/sharepoint攻击.md2.5 KB
- 参考文档references/payloader/by-category/intranet/信息收集.md21.5 KB
- 参考文档references/payloader/by-category/intranet/免杀与规避.md18.3 KB
- 参考文档references/payloader/by-category/intranet/凭证窃取.md34.2 KB
- 参考文档references/payloader/by-category/intranet/域渗透攻击.md18.0 KB
- 参考文档references/payloader/by-category/intranet/权限提升.md21.1 KB
- 参考文档references/payloader/by-category/intranet/权限维持.md13.6 KB
- 参考文档references/payloader/by-category/intranet/横向移动.md20.8 KB
- 参考文档references/payloader/by-category/intranet/隧道代理.md12.5 KB
- 参考文档references/payloader/by-category/web/ai安全.md31.4 KB
- 参考文档references/payloader/by-category/web/api安全.md45.1 KB
- 参考文档references/payloader/by-category/web/csrf跨站请求伪造.md23.6 KB
- 参考文档references/payloader/by-category/web/jwt安全.md19.6 KB
- 参考文档references/payloader/by-category/web/lfi-rfi文件包含.md35.1 KB
- 参考文档references/payloader/by-category/web/rce远程代码执行.md37.7 KB
- 参考文档references/payloader/by-category/web/sql-nosql注入.md61.6 KB
- 参考文档references/payloader/by-category/web/ssrf服务端请求伪造.md36.8 KB
- 参考文档references/payloader/by-category/web/ssti模板注入.md31.3 KB
- 参考文档references/payloader/by-category/web/websocket安全.md20.1 KB
- 参考文档references/payloader/by-category/web/xss跨站脚本.md43.5 KB
- 参考文档references/payloader/by-category/web/xxe实体注入.md24.3 KB
- 参考文档references/payloader/by-category/web/业务逻辑漏洞.md24.8 KB
- 参考文档references/payloader/by-category/web/云安全漏洞.md26.3 KB
- 参考文档references/payloader/by-category/web/供应链攻击.md17.4 KB
- 参考文档references/payloader/by-category/web/原型链污染.md18.6 KB
- 参考文档references/payloader/by-category/web/开放重定向.md13.6 KB
- 参考文档references/payloader/by-category/web/文件漏洞.md46.8 KB
- 参考文档references/payloader/by-category/web/框架漏洞.md67.2 KB
- 参考文档references/payloader/by-category/web/点击劫持.md13.7 KB
- 参考文档references/payloader/by-category/web/缓存与cdn安全.md16.9 KB
- 参考文档references/payloader/by-category/web/认证漏洞.md63.5 KB
- 参考文档references/payloader/by-category/web/请求走私.md21.9 KB
- 参考文档references/payloader/index.md4.7 KB
- 参考文档references/payloader/raw/navigation.json152.5 KB
- 参考文档references/payloader/raw/tools.json169.5 KB
- 参考文档references/payloader/raw/web.json1.1 MB
- 参考文档references/payloader/tools/web渗透.md12.6 KB
- 参考文档references/payloader/tools/windows渗透.md2.0 KB
- 参考文档references/payloader/tools/信息收集.md15.1 KB
- 参考文档references/payloader/tools/内网渗透.md14.9 KB
- 参考文档references/payloader/tools/凭证窃取.md2.7 KB
- 参考文档references/payloader/tools/域渗透.md883 B
- 参考文档references/payloader/tools/密码攻击.md9.1 KB
- 参考文档references/payloader/tools/权限提升.md2.1 KB
- 参考文档references/payloader/tools/漏洞利用.md9.3 KB
- 参考文档references/payloader/tools/系统命令.md7.7 KB
- 参考文档references/payloader/tools/红队工具.md799 B
- 参考文档references/payloader/tools/编码解码.md4.6 KB
- 参考文档references/payloader/tools/隧道代理.md1.1 KB
- 参考文档references/payloader/waf-bypass.md169.6 KB
- 参考文档references/playbooks/00-index.md2.7 KB
- 参考文档references/playbooks/api-rest.md45.2 KB
- 参考文档references/playbooks/arbitrary-x-authz.md20.2 KB
- 参考文档references/playbooks/dos.md28.6 KB
- 参考文档references/playbooks/file-upload.md44.3 KB
- 参考文档references/playbooks/graphql.md5.4 KB
- 参考文档references/playbooks/http-smuggling.md21.1 KB
- 参考文档references/playbooks/info-disclosure.md15.9 KB
- 参考文档references/playbooks/intranet-postexp.md107.5 KB
- 参考文档references/playbooks/llm-prompt-injection.md55.1 KB
- 参考文档references/playbooks/logic-flaws.md50.8 KB
- 参考文档references/playbooks/mobile.md13.5 KB
- 参考文档references/playbooks/oauth-saml-jwt.md77.2 KB
- 参考文档references/playbooks/path-traversal.md31.9 KB
- 参考文档references/playbooks/race-conditions.md7.1 KB
- 参考文档references/playbooks/rce.md120.5 KB
- 参考文档references/playbooks/sqli.md44.4 KB
- 参考文档references/playbooks/ssrf-cache-host.md61.5 KB
- 参考文档references/playbooks/unauth-access.md13.9 KB
- 参考文档references/playbooks/xss.md30.0 KB
- 参考文档references/templates/report-submission.md9.6 KB
- 参考文档references/tools/mcp-jshook.md15.7 KB
03 SKILL.md 正文
Write a handoff document summarising the current conversation so a fresh agent can continue the work. Save to the temporary directory of the user's OS ($TMPDIR, else /tmp; %TEMP% on Windows) - not the current workspace.
Include a "suggested skills" section in the document, naming which skills the next agent should call the Skill tool for.
Do not duplicate content already captured in other artifacts (specs, plans, ADRs, issues, commits, diffs). Reference them by path or URL instead.
Redact any sensitive information, such as API keys, passwords, or personally identifiable information.
If the user passed arguments, treat them as a description of what the next session will focus on and tailor the doc accordingly.
04 同仓库更多 Skills
create-master
基于佛教经典文献,生成特定高僧大德的 AI 教学角色
writing-dna-skill
从至少 20 篇完整文章中蒸馏可复用的写作 DNA,分析语言、文章结构、选题逻辑、素材策略、认知框架和视觉风格,并生成 Writing-DNA.md;按该 DNA 写作时会读取全部蒸馏产物和 5 篇相关原文。用于中英文作者、账号、品牌或出版物的风格分析与一致性写作。 Distill reusable Writing DNA from at least 20 complete articles for Chinese or English authors, publications, brands, and accounts; use for language, structure, topic logic, source strategy, cognitive-frame, and visual-style analysis.
stop-slop
Remove AI writing patterns from prose. Use when drafting, editing, or reviewing text to eliminate predictable AI tells.
shuorenhua
检查和清理中英文文本里的 AI 套路,适用于“去 AI 味”“说人话”“自然一点”“别像模板”“先标问题”这类改写和审稿需求;按场景控制力度,同时保留事实、术语、语域和责任主体。
naming
Name products, SaaS, brands, open source projects, bots, and apps. Use when the user needs to name something, find a brand name, or pick a product name. Metaphor-driven process that produces memorable, meaningful names and avoids AI slop.
humanizer-zh
去除文本中的 AI 生成痕迹。适用于编辑或审阅文本,使其听起来更自然、更像人类书写。 基于维基百科的"AI 写作特征"综合指南。检测并修复以下模式:夸大的象征意义、 宣传性语言、以 -ing 结尾的肤浅分析、模糊的归因、破折号过度使用、三段式法则、 AI 词汇、否定式排比、过多的连接性短语。