[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6P5VK97T7CKSBPCXM9YA9QC":3,"skill-same:01M6P5VK97T7CKSBPCXM9YA9QC":76},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":22,"publishedAt":43,"linkOnly":44,"markdownContent":45,"markdownBody":46,"frontMatter":47,"refName":33,"commitSha":57,"skillDirectory":58,"forksCount":13,"repositoryHtmlUrl":59,"repositoryHomepageUrl":6,"ownerHtmlUrl":60,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":61,"install":62,"resources":75},"01M6P5VK97T7CKSBPCXM9YA9QC","hunt-forgot-password",null,"Hunt Forgot Password \u002F Account Recovery Authentication Flaws","duc-duy-1612\u002FOnline-Delivery-Systems-Web","duc-duy-1612","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F192231384?v=4","01M6NSDKQQDKVTHZ8DZMZ1VYY6","01M6NSDKW8DDVTQHBT1HBDDJPT",0,"MIT","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fhunt-forgot-password\u002FSKILL.md",[17],{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",[23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42],"hunt forgot password","password","hunt","for","testing","relevant","helper","scripts","scope","commands","main","community","only","recovery","https","license","authentication","testing tools","research","github","2026-11-10 10:12:30",false,"---\nname: hunt-forgot-password\ndescription: Hunt Forgot Password \u002F Account Recovery Authentication Flaws\ncategory: security\nrisk: offensive\nsource: https:\u002F\u002Fgithub.com\u002Felementalsouls\u002FClaude-BugHunter\nsource_repo: elementalsouls\u002FClaude-BugHunter\nsource_type: community\ndate_added: '2026-09-20'\nlicense: MIT\nlicense_source: https:\u002F\u002Fgithub.com\u002Felementalsouls\u002FClaude-BugHunter\u002Fblob\u002Fmain\u002FLICENSE\ncompatibility: Requires explicit written authorization for a target scope plus the\n  relevant testing tools for this technique. Docs-only; helper scripts and commands\n  not bundled.\nsources: hackerone_public, public_research\nreport_count: 6\n---\n> **⚠️ AUTHORIZED USE ONLY**\n> This skill is for educational purposes or authorized security assessments only.\n> You must have explicit, written permission from the system owner before using this tool.\n> Misuse of this tool is illegal and strictly prohibited.\n\n> **Mandatory confirmation gate**\n> Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:\n> 1. Ask the user to state the exact target URL, IP, account, or resource.\n> 2. Ask the user to confirm written authorization and the permitted scope.\n> 3. Show the exact command(s) and explain their expected effect.\n> 4. Wait for explicit confirmation in the current conversation.\n>\n> Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.\n\n## Autonomous Testing Priority\n\n**Start with username enumeration — it's the fastest win and gates the rest.**\n\n**Pattern 1 — Username enumeration (response difference for valid vs invalid email):**\n1. POST to the forgot-password endpoint with a clearly invalid email (e.g. `nonexistent@fakedomain12345.com`) — record the response body, status code, and length\n2. POST with an email you know exists (or try common patterns like `admin@target.com`, `test@target.com`, `user@target.com`)\n3. Compare responses: different message (\"Email sent\" vs \"Email not found\"), different HTTP status, or meaningfully different body length = username enumeration confirmed\n4. Proof: enumeration is confirmed when the two responses differ measurably (baseline vs probe) in message text, status code, or body length\n\n**Pattern 2 — Reset token exposed in the API response:**\nSome APIs return the reset token directly in the response body (instead of only emailing it). POST to the forgot-password endpoint and look for a token, link, or code in the JSON\u002FHTML response. If a token appears that lets you reset the password, that's an immediate account-takeover vector.\n\n**Pattern 3 — Reset token replay (reuse after use):**\n1. Complete a full password reset cycle: request token → use it to reset password\n2. Immediately try submitting the same token again to the reset-password endpoint\n3. If the second submission returns 200 or \"success\" → token not invalidated after use\n\n**Pattern 4 — No rate limit on reset requests:**\nSubmit the forgot-password endpoint 10-20 times rapidly with the same email. If all succeed without a 429, lockout, or CAPTCHA → no rate limit (enumeration + token flooding is possible).\n\n**Content-type:** Forgot-password endpoints are often JSON-based REST APIs. Use `application\u002Fx-www-form-urlencoded` only if the endpoint is a traditional HTML form (check the login page's HTML to determine form encoding).\n\n**Proof:** Username enumeration = measurably different response (body\u002Fstatus\u002Flength). Token exposure = token in response body. Token replay = second successful use of a consumed token.\n\n---\n\n## Vulnerability Classes in This Skill\n\n### 1. Username Enumeration via Password Reset\nDifferent error messages for valid vs invalid accounts leaks the user list without authentication. Even timing differences (fast \"no user found\" vs slow \"email queued\") count.\n\nHigh-value targets: admin accounts, employee email patterns, API keys derived from usernames.\n\n### 2. Weak \u002F Predictable Reset Tokens\nA reset token derived from timestamp, username, or sequential IDs can be brute-forced:\n- `base64(email + timestamp)` — decodable\n- 4-6 digit numeric code — 10K guesses, easily feasible with no rate limit\n- Sequential `token=1234`, `token=1235` — trivially enumerable\n\n### 3. Token Not Bound to Session or IP\nMost apps generate a token, email it, and accept it from any browser. A truly bound token should only work from the same IP or require the original session cookie. If neither is enforced → link forwarding = account takeover.\n\n**Token leak via `Referer` \u002F third-party resources.** When the token rides in the reset-page URL (`\u002Freset?token=…`) and that page loads any cross-origin resource (analytics, ads, fonts, a CDN image), the full URL — token included — leaks to that third party in the `Referer` header. Check the reset page's outbound requests: if the token appears in any cross-origin `Referer`, it's harvestable without the victim's inbox. Same leak via a `\u003Cmeta name=referrer>` misconfig or an outbound link the victim clicks from the reset page. Disclosed token-leak→ATO class: \u003Chttps:\u002F\u002Fhackerone.com\u002Freports\u002F173551>.\n\n### 4. Reset Link Doesn't Expire\nCommon best practice: reset tokens expire within ~15–60 minutes (no hard RFC mandates the exact value; OWASP recommends a short, single-use lifetime). If a token from 24 hours ago still works → persistence risk for phishing attacks.\n\n### 5. No Rate Limit on Reset Endpoint\nAn uncapped reset endpoint enables:\n- Email flooding (DoS against victim's inbox)\n- Token brute-force if the token space is small\n- Username enumeration at scale\n\n---\n\n## Related Skills\n\n- **`hunt-ato`** — owns the account-takeover CHAIN (password-reset is its path #1). This skill finds\u002Fproves the recovery-flow primitive; hand off to hunt-ato to assemble the full takeover.\n- **`hunt-cache-poison`** — host-header injection during reset email generation (different vulnerability, same flow)\n- **`hunt-brute-force`** — rate-limit testing pattern applies to the reset endpoint too\n- **`hunt-auth-bypass`** — if the reset flow can be skipped entirely (go to `\u002Freset-password?token=` with empty\u002Fnull token)\n- **`hunt-mfa-bypass`** — if MFA is required after reset, test the bypass there\n\n## When to Use\n\n- You have explicit, written authorization to assess the target in scope, and the task matches this skill's vulnerability class or technique within a bug-bounty or penetration-test engagement.\n- You need the recon, exploitation, or validation workflow described below — executed strictly inside the approved scope.\n\n## Limitations\n\n- Authorized scope only: the confirmation gate above is mandatory before any probing, exploitation, or credential-access command.\n- Docs-only import: upstream helper scripts, commands, engine, and research assets are not bundled; reinstall tooling from the source repo when needed.\n- Validate every finding (see `triage-validation`) before reporting; report via `report-writing`. Prefer a sandbox, disposable VM, or controlled lab.\n\n### Example\n\n```bash\n# Read-only first step; confirm scope before anything active.\ncat scope.txt  # target list from the authorized engagement brief\n```\n\n> Adapted from [elementalsouls\u002FClaude-BugHunter](https:\u002F\u002Fgithub.com\u002Felementalsouls\u002FClaude-BugHunter) (MIT); frontmatter, When to Use\u002FLimitations, and safety boundaries added for upstream compliance. Docs-only import: executable helpers, commands, engine, and research assets not bundled.\n","> **⚠️ AUTHORIZED USE ONLY**\n> This skill is for educational purposes or authorized security assessments only.\n> You must have explicit, written permission from the system owner before using this tool.\n> Misuse of this tool is illegal and strictly prohibited.\n\n> **Mandatory confirmation gate**\n> Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:\n> 1. Ask the user to state the exact target URL, IP, account, or resource.\n> 2. Ask the user to confirm written authorization and the permitted scope.\n> 3. Show the exact command(s) and explain their expected effect.\n> 4. Wait for explicit confirmation in the current conversation.\n>\n> Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.\n\n## Autonomous Testing Priority\n\n**Start with username enumeration — it's the fastest win and gates the rest.**\n\n**Pattern 1 — Username enumeration (response difference for valid vs invalid email):**\n1. POST to the forgot-password endpoint with a clearly invalid email (e.g. `nonexistent@fakedomain12345.com`) — record the response body, status code, and length\n2. POST with an email you know exists (or try common patterns like `admin@target.com`, `test@target.com`, `user@target.com`)\n3. Compare responses: different message (\"Email sent\" vs \"Email not found\"), different HTTP status, or meaningfully different body length = username enumeration confirmed\n4. Proof: enumeration is confirmed when the two responses differ measurably (baseline vs probe) in message text, status code, or body length\n\n**Pattern 2 — Reset token exposed in the API response:**\nSome APIs return the reset token directly in the response body (instead of only emailing it). POST to the forgot-password endpoint and look for a token, link, or code in the JSON\u002FHTML response. If a token appears that lets you reset the password, that's an immediate account-takeover vector.\n\n**Pattern 3 — Reset token replay (reuse after use):**\n1. Complete a full password reset cycle: request token → use it to reset password\n2. Immediately try submitting the same token again to the reset-password endpoint\n3. If the second submission returns 200 or \"success\" → token not invalidated after use\n\n**Pattern 4 — No rate limit on reset requests:**\nSubmit the forgot-password endpoint 10-20 times rapidly with the same email. If all succeed without a 429, lockout, or CAPTCHA → no rate limit (enumeration + token flooding is possible).\n\n**Content-type:** Forgot-password endpoints are often JSON-based REST APIs. Use `application\u002Fx-www-form-urlencoded` only if the endpoint is a traditional HTML form (check the login page's HTML to determine form encoding).\n\n**Proof:** Username enumeration = measurably different response (body\u002Fstatus\u002Flength). Token exposure = token in response body. Token replay = second successful use of a consumed token.\n\n---\n\n## Vulnerability Classes in This Skill\n\n### 1. Username Enumeration via Password Reset\nDifferent error messages for valid vs invalid accounts leaks the user list without authentication. Even timing differences (fast \"no user found\" vs slow \"email queued\") count.\n\nHigh-value targets: admin accounts, employee email patterns, API keys derived from usernames.\n\n### 2. Weak \u002F Predictable Reset Tokens\nA reset token derived from timestamp, username, or sequential IDs can be brute-forced:\n- `base64(email + timestamp)` — decodable\n- 4-6 digit numeric code — 10K guesses, easily feasible with no rate limit\n- Sequential `token=1234`, `token=1235` — trivially enumerable\n\n### 3. Token Not Bound to Session or IP\nMost apps generate a token, email it, and accept it from any browser. A truly bound token should only work from the same IP or require the original session cookie. If neither is enforced → link forwarding = account takeover.\n\n**Token leak via `Referer` \u002F third-party resources.** When the token rides in the reset-page URL (`\u002Freset?token=…`) and that page loads any cross-origin resource (analytics, ads, fonts, a CDN image), the full URL — token included — leaks to that third party in the `Referer` header. Check the reset page's outbound requests: if the token appears in any cross-origin `Referer`, it's harvestable without the victim's inbox. Same leak via a `\u003Cmeta name=referrer>` misconfig or an outbound link the victim clicks from the reset page. Disclosed token-leak→ATO class: \u003Chttps:\u002F\u002Fhackerone.com\u002Freports\u002F173551>.\n\n### 4. Reset Link Doesn't Expire\nCommon best practice: reset tokens expire within ~15–60 minutes (no hard RFC mandates the exact value; OWASP recommends a short, single-use lifetime). If a token from 24 hours ago still works → persistence risk for phishing attacks.\n\n### 5. No Rate Limit on Reset Endpoint\nAn uncapped reset endpoint enables:\n- Email flooding (DoS against victim's inbox)\n- Token brute-force if the token space is small\n- Username enumeration at scale\n\n---\n\n## Related Skills\n\n- **`hunt-ato`** — owns the account-takeover CHAIN (password-reset is its path #1). This skill finds\u002Fproves the recovery-flow primitive; hand off to hunt-ato to assemble the full takeover.\n- **`hunt-cache-poison`** — host-header injection during reset email generation (different vulnerability, same flow)\n- **`hunt-brute-force`** — rate-limit testing pattern applies to the reset endpoint too\n- **`hunt-auth-bypass`** — if the reset flow can be skipped entirely (go to `\u002Freset-password?token=` with empty\u002Fnull token)\n- **`hunt-mfa-bypass`** — if MFA is required after reset, test the bypass there\n\n## When to Use\n\n- You have explicit, written authorization to assess the target in scope, and the task matches this skill's vulnerability class or technique within a bug-bounty or penetration-test engagement.\n- You need the recon, exploitation, or validation workflow described below — executed strictly inside the approved scope.\n\n## Limitations\n\n- Authorized scope only: the confirmation gate above is mandatory before any probing, exploitation, or credential-access command.\n- Docs-only import: upstream helper scripts, commands, engine, and research assets are not bundled; reinstall tooling from the source repo when needed.\n- Validate every finding (see `triage-validation`) before reporting; report via `report-writing`. Prefer a sandbox, disposable VM, or controlled lab.\n\n### Example\n\n```bash\n# Read-only first step; confirm scope before anything active.\ncat scope.txt  # target list from the authorized engagement brief\n```\n\n> Adapted from [elementalsouls\u002FClaude-BugHunter](https:\u002F\u002Fgithub.com\u002Felementalsouls\u002FClaude-BugHunter) (MIT); frontmatter, When to Use\u002FLimitations, and safety boundaries added for upstream compliance. Docs-only import: executable helpers, commands, engine, and research assets not bundled.\n",{"name":5,"risk":48,"source":49,"license":14,"sources":50,"category":51,"date_added":52,"description":7,"source_repo":53,"source_type":34,"report_count":54,"compatibility":55,"license_source":56},"offensive","https:\u002F\u002Fgithub.com\u002Felementalsouls\u002FClaude-BugHunter","hackerone_public, public_research","security","2026-09-20","elementalsouls\u002FClaude-BugHunter",6,"Requires explicit written authorization for a target scope plus the relevant testing tools for this technique. Docs-only; helper scripts and commands not bundled.","https:\u002F\u002Fgithub.com\u002Felementalsouls\u002FClaude-BugHunter\u002Fblob\u002Fmain\u002FLICENSE","f3312ba749561b6159f477dbfc9313c875d40a56",".agents\u002Fskills_archive\u002Fhunt-forgot-password","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612","2026-10-25 23:50:58",{"source":8,"skillName":5,"commands":63,"prompt":73,"zipAvailable":74},[64,67,70],{"tool":65,"command":66},"npx","npx skills add duc-duy-1612\u002FOnline-Delivery-Systems-Web --skill hunt-forgot-password",{"tool":68,"command":69},"bunx","bunx skills add duc-duy-1612\u002FOnline-Delivery-Systems-Web --skill hunt-forgot-password",{"tool":71,"command":72},"pnpm","pnpm dlx skills add duc-duy-1612\u002FOnline-Delivery-Systems-Web --skill hunt-forgot-password","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fhunt-forgot-password\u002FSKILL.md",true,[],[77,100,124,145,173,197],{"skillNo":78,"name":79,"nameZh":6,"description":80,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":81,"categories":82,"keywords":86,"publishedAt":43},"01M6Q0FA5FZ410Z33Z3TFQ4DBA","zero-trust","Implement zero-trust network architecture. Configure identity-based access, micro-segmentation, and continuous verification. Use when implementing modern security architectures.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fzero-trust\u002FSKILL.md",[83],{"categoryNo":84,"categoryName":85,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000011","运维与部署",[87,88,89,90,91,92,79,93,94,95,96,35,34,33,97,98,31,30,28,99],"ZeRO","trust","zero trust","architecture","assessment","verification","segmentation","devops-security","access","configure","active","critical","implementing",{"skillNo":101,"name":102,"nameZh":6,"description":103,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":104,"categories":105,"keywords":106,"publishedAt":43},"01M6Q0F1YZJW3KX5FBKEVZ8CV4","zcode-delegate","Delegate coding tasks to the Z.AI ZCode CLI only when the user explicitly requests it, while the orchestrator retains review and landing responsibility.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fzcode-delegate\u002FSKILL.md",[],[107,108,109,110,111,112,113,114,115,116,117,118,119,35,120,34,121,122,98,123],"delegate","zcode","zcode delegate","review","cli","orchestration","tasks","run","Bash","model","node","read","orchestrator","files","desktop app","app","agent-orchestration",{"skillNo":125,"name":126,"nameZh":6,"description":127,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":128,"categories":129,"keywords":130,"publishedAt":43},"01M6Q0ETK41VGNMYEXW0T00AJN","youtube-transcript","Fetch YouTube transcripts through DeepAPI or local fallback tooling and save clean text output.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fyoutube-transcript\u002FSKILL.md",[],[131,132,133,134,42,135,41,38,37,136,137,138,139,34,33,140,141,142,143,144],"transcript","youtube transcript","youtube","safe","codex","text","fetch","tooling","clean","local","output","deepapi","youtube transcripts","blob",{"skillNo":146,"name":147,"nameZh":6,"description":148,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":149,"categories":150,"keywords":162,"publishedAt":43},"01M6Q0EPPH2PVMDW40017F8WX0","youtube-transcript-skills","Fetch YouTube video transcripts, search videos\u002Fchannels, browse channels, and extract playlists via the getyoutubetranscript.com API - free tier, no card required.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fyoutube-transcript-skills\u002FSKILL.md",[151,154,157],{"categoryNo":152,"categoryName":153,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":155,"categoryName":156,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000016","图像与多媒体",{"categoryNo":158,"categoryName":159,"taxonomyType":160,"taxonomyTypeDesc":161},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[131,132,133,163,134,164,42,135,38,165,166,167,168,137,169,34,33,170,171,172],"youtube transcript skills","gemini","search","api","Video","browse","api-integration","free","card","channels",{"skillNo":174,"name":175,"nameZh":6,"description":176,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":177,"categories":178,"keywords":183,"publishedAt":43},"01M6Q0EAB96PX83W5PTE8A0R8D","youtube-notetaker","Turn YouTube talks into local study notes with slides, transcripts, editable annotations, and a markdown-backed viewer.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fyoutube-notetaker\u002FSKILL.md",[179,182],{"categoryNo":180,"categoryName":181,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":155,"categoryName":156,"taxonomyType":20,"taxonomyTypeDesc":21},[133,184,185,111,134,186,187,188,189,38,167,190,191,192,193,33,194,140,195,196],"youtube notetaker","notetaker","workflow","official","notes","code","markdown","slides","annotations","README","study","dair-academy","viewer",{"skillNo":198,"name":199,"nameZh":6,"description":200,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":201,"categories":202,"keywords":204,"publishedAt":43},"01M6Q0E55F0GW5MX48V8HXS8B5","youtube-full","Fetch YouTube transcripts, search videos, browse channels, and extract playlists via TranscriptAPI — no yt-dlp, no Google API key, works from any cloud server.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fyoutube-full\u002FSKILL.md",[203],{"categoryNo":152,"categoryName":153,"taxonomyType":20,"taxonomyTypeDesc":21},[205,133,206,207,134,164,165,208,209,166,167,168,137,210,169,34,33,170,211,143],"youtube full","full","google","server","dlp","credits","automatic"]