[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6P67MESJCD2MPR63F05P9F6":3,"skill-same:01M6P67MESJCD2MPR63F05P9F6":80},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":27,"publishedAt":48,"linkOnly":49,"markdownContent":50,"markdownBody":51,"frontMatter":52,"refName":39,"commitSha":61,"skillDirectory":62,"forksCount":13,"repositoryHtmlUrl":63,"repositoryHomepageUrl":6,"ownerHtmlUrl":64,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":65,"install":66,"resources":79},"01M6P67MESJCD2MPR63F05P9F6","hunt-shadow-api",null,"Hunt shadow \u002F zombie \u002F undocumented API surface (OWASP API9 Improper Inventory Management)","duc-duy-1612\u002FOnline-Delivery-Systems-Web","duc-duy-1612","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F192231384?v=4","01M6NSDKQQDKVTHZ8DZMZ1VYY6","01M6NSDKW8DDVTQHBT1HBDDJPT",0,"MIT","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fhunt-shadow-api\u002FSKILL.md",[17,22],{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000010","后端与接口","SCENARIO","使用场景",{"categoryNo":23,"categoryName":24,"taxonomyType":25,"taxonomyTypeDesc":26},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47],"hunt shadow api","api","Shadow","hunt","for","testing","relevant","helper","inventory management","scripts","scope","main","community","only","inventory","https","license","testing tools","research","github","2026-11-10 10:12:30",false,"---\nname: hunt-shadow-api\ndescription: Hunt shadow \u002F zombie \u002F undocumented API surface (OWASP API9 Improper\n  Inventory Management)\ncategory: security\nrisk: offensive\nsource: https:\u002F\u002Fgithub.com\u002Felementalsouls\u002FClaude-BugHunter\nsource_repo: elementalsouls\u002FClaude-BugHunter\nsource_type: community\ndate_added: '2026-09-20'\nlicense: MIT\nlicense_source: https:\u002F\u002Fgithub.com\u002Felementalsouls\u002FClaude-BugHunter\u002Fblob\u002Fmain\u002FLICENSE\ncompatibility: Requires explicit written authorization for a target scope plus the\n  relevant testing tools for this technique. Docs-only; helper scripts and commands\n  not bundled.\nsources: owasp_api_top10_2023, portswigger_research, public_research\nreport_count: 0\n---\n> **⚠️ AUTHORIZED USE ONLY**\n> This skill is for educational purposes or authorized security assessments only.\n> You must have explicit, written permission from the system owner before using this tool.\n> Misuse of this tool is illegal and strictly prohibited.\n\n> **Mandatory confirmation gate**\n> Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:\n> 1. Ask the user to state the exact target URL, IP, account, or resource.\n> 2. Ask the user to confirm written authorization and the permitted scope.\n> 3. Show the exact command(s) and explain their expected effect.\n> 4. Wait for explicit confirmation in the current conversation.\n>\n> Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.\n\n## OWASP API9 — Improper Inventory Management (Shadow \u002F Zombie APIs)\n\nAs an API evolves, old versions and internal\u002Fstaging routes routinely stay reachable without\nreceiving the same security fixes as the current version — because nobody tracks that they\nstill exist. The bug is rarely in one endpoint; it's in the **delta** between what an old\nversion enforces and what the current version enforces on the same operation.\n\n### When to use\n\nTrigger when:\n- Versioned paths are visible (`\u002Fv1\u002F`, `\u002Fv2\u002F`, `\u002Fapi\u002F2023-01-01\u002F`) or `Accept`\u002F`X-API-Version`\n  headers are in play.\n- A changelog, release notes, or deprecation notice references removed\u002Fold API behavior.\n- A mobile APK\u002FIPA (via `apk-redteam-pipeline` \u002F `ios-redteam-pipeline`) hardcodes endpoints\n  that look like an older backend version than the current web app calls.\n- Multiple OpenAPI\u002FSwagger specs are discoverable, or `info.version` in one spec implies others\n  exist.\n\nDO NOT use for single-version APIs with no version history — there's nothing to diff; go\nstraight to `hunt-api-misconfig` for direct exploitation of the one surface that exists.\n\n---\n\n## Stage 1 — Enumerate the Full Version Surface\n\n```bash\n# Path-based versioning\nfor v in v1 v2 v3 v4 beta alpha internal legacy old 2022-01-01 2023-01-01 2024-01-01; do\n  curl -s -o \u002Fdev\u002Fnull -w \"%{http_code} \u002Fapi\u002F$v\u002F\\n\" \"https:\u002F\u002F$TARGET\u002Fapi\u002F$v\u002F\"\ndone\n\n# Header-based versioning\ncurl -s -H \"X-API-Version: 1\" https:\u002F\u002F$TARGET\u002Fapi\u002Fusers\ncurl -s -H \"Accept: application\u002Fvnd.company.v1+json\" https:\u002F\u002F$TARGET\u002Fapi\u002Fusers\n\n# Subdomain-based versioning\nfor sub in api api-v1 api-v2 apiv1 apiv2 legacy-api old-api internal-api staging-api; do\n  curl -s -o \u002Fdev\u002Fnull -w \"%{http_code} $sub\\n\" \"https:\u002F\u002F$sub.$TARGET\u002F\"\ndone\n```\n\nA `200`\u002F`401`\u002F`403` on an old version path (anything but `404`\u002Fconnection-refused) means the\nversion is still live and worth carrying into Stage 3, even if it demands auth.\n\n---\n\n## Stage 2 — Pull Every Reachable Spec, Not Just the Linked One\n\n```bash\nfor path in openapi.json swagger.json v1\u002Fswagger.json v2\u002Fswagger.json v3\u002Fapi-docs \\\n            api-docs.json swagger\u002Fv1\u002Fswagger.json .well-known\u002Fopenapi.json; do\n  curl -s -o \u002Fdev\u002Fnull -w \"%{http_code} \u002F$path\\n\" \"https:\u002F\u002F$TARGET\u002F$path\"\ndone\n\n# Wayback Machine — a DEPRECATED version's spec often stays indexed after the live link is removed\ncurl -s \"http:\u002F\u002Fweb.archive.org\u002Fcdx\u002Fsearch\u002Fcdx?url=$TARGET\u002F*swagger*&output=json&collapse=urlkey\"\ncurl -s \"http:\u002F\u002Fweb.archive.org\u002Fcdx\u002Fsearch\u002Fcdx?url=$TARGET\u002F*openapi*&output=json&collapse=urlkey\"\n```\n\nWhen more than one spec resolves (a current one and an archived\u002Fold one), diff the endpoint\ninventories directly:\n```bash\njq -r '.paths | keys[]' v1-swagger.json | sort > \u002Ftmp\u002Fv1_paths.txt\njq -r '.paths | keys[]' v2-swagger.json | sort > \u002Ftmp\u002Fv2_paths.txt\ncomm -23 \u002Ftmp\u002Fv1_paths.txt \u002Ftmp\u002Fv2_paths.txt   # in v1 only — candidates for \"still live but forgotten\"\n```\nFor every path in that diff, confirm it's still reachable against the v1 base URL. A route\ndocumented only in the old spec that still returns something other than `404` is a zombie-\nendpoint candidate — carry it into Stage 3.\n\n---\n\n## Stage 3 — Behavioral Diff Between Old and Current Version\n\nFor each operation that exists in **both** versions, compare security-relevant behavior, not\nresponse shape. Response shape differences are Informational; behavioral security regressions\nare the finding.\n\n- **Auth strength.** Does the old version accept no token, an expired token, or a lower-\n  privilege token that the current version rejects?\n  ```bash\n  curl -s -H \"Authorization: Bearer $EXPIRED_TOKEN\" https:\u002F\u002F$TARGET\u002Fapi\u002Fv1\u002Fusers\u002Fme -w '\\n%{http_code}\\n'\n  curl -s -H \"Authorization: Bearer $EXPIRED_TOKEN\" https:\u002F\u002F$TARGET\u002Fapi\u002Fv2\u002Fusers\u002Fme -w '\\n%{http_code}\\n'\n  ```\n- **Rate limiting.** Burst the same number of requests against both versions' equivalent\n  endpoint; a missing `429` on the old version means rate-limiting was added later and never\n  backported.\n- **Input validation.** Send the identical injection\u002Foversized\u002Fmalformed payload to both; the\n  old version accepting what the new one rejects means hardening happened forward-only —\n  chain into whichever injection class the payload targets (`hunt-sqli`, `hunt-idor`, etc.).\n- **Field exposure.** Does the old version's response body include fields — internal IDs, other\n  users' data, internal notes, PII — that the current version has since redacted?\n\n---\n\n## Stage 4 — Deprecated \u002F Internal Routes Never Referenced by the Current UI\n\n- Grep JS bundles for API calls no visible UI flow triggers (`\u002Finternal\u002F`, `\u002Fadmin\u002F`, `\u002Fdebug\u002F`,\n  `\u002F_internal\u002F`, `\u002Ftest\u002F`, `\u002Fstaging\u002F`) — reuse `hunt-source-leak`'s JS-bundle grep patterns for\n  this specifically.\n- Check `robots.txt` \u002F `sitemap.xml` for disallowed API paths — a self-inflicted disclosure.\n- Mobile-app endpoint inventories (via `apk-redteam-pipeline` \u002F `ios-redteam-pipeline`) very\n  often reference an older backend version than the current web app calls. Treat every\n  APK\u002FIPA-sourced endpoint as a version-diff candidate against the live web API.\n\n---\n\n## False-Positive Gate\n\n- A version difference alone (different response shape, cosmetic field renaming) is\n  Informational. The finding is a **security-relevant regression** — auth, rate-limit, or\n  validation that got weaker going backward in version history.\n- Confirm the old endpoint is not simply an alias\u002Fproxy to the current implementation before\n  claiming a behavioral difference — send a payload that would actually behave differently\n  under old vs. new logic, not just compare a version string in the response body.\n- A `200` on a path that just serves a static \"this API version is deprecated, use v2\" message\n  is not a finding — confirm the underlying operation still executes.\n\n---\n\n## Severity Table\n\n| Finding | Severity |\n|---|---|\n| Old version bypasses auth entirely where current version requires it | Critical |\n| Old version missing rate-limit present on current version | Medium–High (chain via `hunt-brute-force`) |\n| Old version leaks extra fields (PII, internal IDs) vs. current | Medium–High |\n| Old version accepts payloads the current version now validates\u002Fsanitizes | High (chain to the underlying injection class) |\n| Version is reachable but behaviorally identical to current | Informational |\n\n---\n\n## Related Skills & Chains\n\n- **`hunt-api-misconfig`** — owns exploitation once a spec or endpoint is in hand (mass\n  assignment, JWT attacks, OData, Swagger-chain attacks). This skill hands it a sharper target:\n  \"here's a zombie endpoint with weaker validation than the current one.\"\n- **`hunt-subdomain`** — owns host\u002Fsubdomain-level discovery (`api-v1.target.com` as its own\n  host, potential takeover). This skill owns what happens once you're inside a given host's\n  version surface.\n- **`hunt-source-leak`** — JS-bundle grep for internal\u002Fundocumented calls; reused here\n  specifically for version-diffing rather than secret extraction.\n- **`apk-redteam-pipeline`** \u002F **`ios-redteam-pipeline`** — mobile builds routinely hardcode an\n  older API version; every mobile-sourced endpoint is a version-diff candidate.\n- **`hunt-brute-force`** — a rate-limit regression found here is only a complete finding once\n  chained to actual brute-forceable impact (login, OTP, enumeration).\n\n## When to Use\n\n- You have explicit, written authorization to assess the target in scope, and the task matches this skill's vulnerability class or technique within a bug-bounty or penetration-test engagement.\n- You need the recon, exploitation, or validation workflow described below — executed strictly inside the approved scope.\n\n## Limitations\n\n- Authorized scope only: the confirmation gate above is mandatory before any probing, exploitation, or credential-access command.\n- Docs-only import: upstream helper scripts, commands, engine, and research assets are not bundled; reinstall tooling from the source repo when needed.\n- Validate every finding (see `triage-validation`) before reporting; report via `report-writing`. Prefer a sandbox, disposable VM, or controlled lab.\n\n### Example\n\n```bash\n# Read-only first step; confirm scope before anything active.\ncat scope.txt  # target list from the authorized engagement brief\n```\n\n> Adapted from [elementalsouls\u002FClaude-BugHunter](https:\u002F\u002Fgithub.com\u002Felementalsouls\u002FClaude-BugHunter) (MIT); frontmatter, When to Use\u002FLimitations, and safety boundaries added for upstream compliance. Docs-only import: executable helpers, commands, engine, and research assets not bundled.\n","> **⚠️ AUTHORIZED USE ONLY**\n> This skill is for educational purposes or authorized security assessments only.\n> You must have explicit, written permission from the system owner before using this tool.\n> Misuse of this tool is illegal and strictly prohibited.\n\n> **Mandatory confirmation gate**\n> Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:\n> 1. Ask the user to state the exact target URL, IP, account, or resource.\n> 2. Ask the user to confirm written authorization and the permitted scope.\n> 3. Show the exact command(s) and explain their expected effect.\n> 4. Wait for explicit confirmation in the current conversation.\n>\n> Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.\n\n## OWASP API9 — Improper Inventory Management (Shadow \u002F Zombie APIs)\n\nAs an API evolves, old versions and internal\u002Fstaging routes routinely stay reachable without\nreceiving the same security fixes as the current version — because nobody tracks that they\nstill exist. The bug is rarely in one endpoint; it's in the **delta** between what an old\nversion enforces and what the current version enforces on the same operation.\n\n### When to use\n\nTrigger when:\n- Versioned paths are visible (`\u002Fv1\u002F`, `\u002Fv2\u002F`, `\u002Fapi\u002F2023-01-01\u002F`) or `Accept`\u002F`X-API-Version`\n  headers are in play.\n- A changelog, release notes, or deprecation notice references removed\u002Fold API behavior.\n- A mobile APK\u002FIPA (via `apk-redteam-pipeline` \u002F `ios-redteam-pipeline`) hardcodes endpoints\n  that look like an older backend version than the current web app calls.\n- Multiple OpenAPI\u002FSwagger specs are discoverable, or `info.version` in one spec implies others\n  exist.\n\nDO NOT use for single-version APIs with no version history — there's nothing to diff; go\nstraight to `hunt-api-misconfig` for direct exploitation of the one surface that exists.\n\n---\n\n## Stage 1 — Enumerate the Full Version Surface\n\n```bash\n# Path-based versioning\nfor v in v1 v2 v3 v4 beta alpha internal legacy old 2022-01-01 2023-01-01 2024-01-01; do\n  curl -s -o \u002Fdev\u002Fnull -w \"%{http_code} \u002Fapi\u002F$v\u002F\\n\" \"https:\u002F\u002F$TARGET\u002Fapi\u002F$v\u002F\"\ndone\n\n# Header-based versioning\ncurl -s -H \"X-API-Version: 1\" https:\u002F\u002F$TARGET\u002Fapi\u002Fusers\ncurl -s -H \"Accept: application\u002Fvnd.company.v1+json\" https:\u002F\u002F$TARGET\u002Fapi\u002Fusers\n\n# Subdomain-based versioning\nfor sub in api api-v1 api-v2 apiv1 apiv2 legacy-api old-api internal-api staging-api; do\n  curl -s -o \u002Fdev\u002Fnull -w \"%{http_code} $sub\\n\" \"https:\u002F\u002F$sub.$TARGET\u002F\"\ndone\n```\n\nA `200`\u002F`401`\u002F`403` on an old version path (anything but `404`\u002Fconnection-refused) means the\nversion is still live and worth carrying into Stage 3, even if it demands auth.\n\n---\n\n## Stage 2 — Pull Every Reachable Spec, Not Just the Linked One\n\n```bash\nfor path in openapi.json swagger.json v1\u002Fswagger.json v2\u002Fswagger.json v3\u002Fapi-docs \\\n            api-docs.json swagger\u002Fv1\u002Fswagger.json .well-known\u002Fopenapi.json; do\n  curl -s -o \u002Fdev\u002Fnull -w \"%{http_code} \u002F$path\\n\" \"https:\u002F\u002F$TARGET\u002F$path\"\ndone\n\n# Wayback Machine — a DEPRECATED version's spec often stays indexed after the live link is removed\ncurl -s \"http:\u002F\u002Fweb.archive.org\u002Fcdx\u002Fsearch\u002Fcdx?url=$TARGET\u002F*swagger*&output=json&collapse=urlkey\"\ncurl -s \"http:\u002F\u002Fweb.archive.org\u002Fcdx\u002Fsearch\u002Fcdx?url=$TARGET\u002F*openapi*&output=json&collapse=urlkey\"\n```\n\nWhen more than one spec resolves (a current one and an archived\u002Fold one), diff the endpoint\ninventories directly:\n```bash\njq -r '.paths | keys[]' v1-swagger.json | sort > \u002Ftmp\u002Fv1_paths.txt\njq -r '.paths | keys[]' v2-swagger.json | sort > \u002Ftmp\u002Fv2_paths.txt\ncomm -23 \u002Ftmp\u002Fv1_paths.txt \u002Ftmp\u002Fv2_paths.txt   # in v1 only — candidates for \"still live but forgotten\"\n```\nFor every path in that diff, confirm it's still reachable against the v1 base URL. A route\ndocumented only in the old spec that still returns something other than `404` is a zombie-\nendpoint candidate — carry it into Stage 3.\n\n---\n\n## Stage 3 — Behavioral Diff Between Old and Current Version\n\nFor each operation that exists in **both** versions, compare security-relevant behavior, not\nresponse shape. Response shape differences are Informational; behavioral security regressions\nare the finding.\n\n- **Auth strength.** Does the old version accept no token, an expired token, or a lower-\n  privilege token that the current version rejects?\n  ```bash\n  curl -s -H \"Authorization: Bearer $EXPIRED_TOKEN\" https:\u002F\u002F$TARGET\u002Fapi\u002Fv1\u002Fusers\u002Fme -w '\\n%{http_code}\\n'\n  curl -s -H \"Authorization: Bearer $EXPIRED_TOKEN\" https:\u002F\u002F$TARGET\u002Fapi\u002Fv2\u002Fusers\u002Fme -w '\\n%{http_code}\\n'\n  ```\n- **Rate limiting.** Burst the same number of requests against both versions' equivalent\n  endpoint; a missing `429` on the old version means rate-limiting was added later and never\n  backported.\n- **Input validation.** Send the identical injection\u002Foversized\u002Fmalformed payload to both; the\n  old version accepting what the new one rejects means hardening happened forward-only —\n  chain into whichever injection class the payload targets (`hunt-sqli`, `hunt-idor`, etc.).\n- **Field exposure.** Does the old version's response body include fields — internal IDs, other\n  users' data, internal notes, PII — that the current version has since redacted?\n\n---\n\n## Stage 4 — Deprecated \u002F Internal Routes Never Referenced by the Current UI\n\n- Grep JS bundles for API calls no visible UI flow triggers (`\u002Finternal\u002F`, `\u002Fadmin\u002F`, `\u002Fdebug\u002F`,\n  `\u002F_internal\u002F`, `\u002Ftest\u002F`, `\u002Fstaging\u002F`) — reuse `hunt-source-leak`'s JS-bundle grep patterns for\n  this specifically.\n- Check `robots.txt` \u002F `sitemap.xml` for disallowed API paths — a self-inflicted disclosure.\n- Mobile-app endpoint inventories (via `apk-redteam-pipeline` \u002F `ios-redteam-pipeline`) very\n  often reference an older backend version than the current web app calls. Treat every\n  APK\u002FIPA-sourced endpoint as a version-diff candidate against the live web API.\n\n---\n\n## False-Positive Gate\n\n- A version difference alone (different response shape, cosmetic field renaming) is\n  Informational. The finding is a **security-relevant regression** — auth, rate-limit, or\n  validation that got weaker going backward in version history.\n- Confirm the old endpoint is not simply an alias\u002Fproxy to the current implementation before\n  claiming a behavioral difference — send a payload that would actually behave differently\n  under old vs. new logic, not just compare a version string in the response body.\n- A `200` on a path that just serves a static \"this API version is deprecated, use v2\" message\n  is not a finding — confirm the underlying operation still executes.\n\n---\n\n## Severity Table\n\n| Finding | Severity |\n|---|---|\n| Old version bypasses auth entirely where current version requires it | Critical |\n| Old version missing rate-limit present on current version | Medium–High (chain via `hunt-brute-force`) |\n| Old version leaks extra fields (PII, internal IDs) vs. current | Medium–High |\n| Old version accepts payloads the current version now validates\u002Fsanitizes | High (chain to the underlying injection class) |\n| Version is reachable but behaviorally identical to current | Informational |\n\n---\n\n## Related Skills & Chains\n\n- **`hunt-api-misconfig`** — owns exploitation once a spec or endpoint is in hand (mass\n  assignment, JWT attacks, OData, Swagger-chain attacks). This skill hands it a sharper target:\n  \"here's a zombie endpoint with weaker validation than the current one.\"\n- **`hunt-subdomain`** — owns host\u002Fsubdomain-level discovery (`api-v1.target.com` as its own\n  host, potential takeover). This skill owns what happens once you're inside a given host's\n  version surface.\n- **`hunt-source-leak`** — JS-bundle grep for internal\u002Fundocumented calls; reused here\n  specifically for version-diffing rather than secret extraction.\n- **`apk-redteam-pipeline`** \u002F **`ios-redteam-pipeline`** — mobile builds routinely hardcode an\n  older API version; every mobile-sourced endpoint is a version-diff candidate.\n- **`hunt-brute-force`** — a rate-limit regression found here is only a complete finding once\n  chained to actual brute-forceable impact (login, OTP, enumeration).\n\n## When to Use\n\n- You have explicit, written authorization to assess the target in scope, and the task matches this skill's vulnerability class or technique within a bug-bounty or penetration-test engagement.\n- You need the recon, exploitation, or validation workflow described below — executed strictly inside the approved scope.\n\n## Limitations\n\n- Authorized scope only: the confirmation gate above is mandatory before any probing, exploitation, or credential-access command.\n- Docs-only import: upstream helper scripts, commands, engine, and research assets are not bundled; reinstall tooling from the source repo when needed.\n- Validate every finding (see `triage-validation`) before reporting; report via `report-writing`. Prefer a sandbox, disposable VM, or controlled lab.\n\n### Example\n\n```bash\n# Read-only first step; confirm scope before anything active.\ncat scope.txt  # target list from the authorized engagement brief\n```\n\n> Adapted from [elementalsouls\u002FClaude-BugHunter](https:\u002F\u002Fgithub.com\u002Felementalsouls\u002FClaude-BugHunter) (MIT); frontmatter, When to Use\u002FLimitations, and safety boundaries added for upstream compliance. Docs-only import: executable helpers, commands, engine, and research assets not bundled.\n",{"name":5,"risk":53,"source":54,"license":14,"sources":55,"category":56,"date_added":57,"description":7,"source_repo":58,"source_type":40,"report_count":13,"compatibility":59,"license_source":60},"offensive","https:\u002F\u002Fgithub.com\u002Felementalsouls\u002FClaude-BugHunter","owasp_api_top10_2023, portswigger_research, public_research","security","2026-09-20","elementalsouls\u002FClaude-BugHunter","Requires explicit written authorization for a target scope plus the relevant testing tools for this technique. Docs-only; helper scripts and commands not bundled.","https:\u002F\u002Fgithub.com\u002Felementalsouls\u002FClaude-BugHunter\u002Fblob\u002Fmain\u002FLICENSE","f3312ba749561b6159f477dbfc9313c875d40a56",".agents\u002Fskills_archive\u002Fhunt-shadow-api","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612","2026-10-25 23:50:58",{"source":8,"skillName":5,"commands":67,"prompt":77,"zipAvailable":78},[68,71,74],{"tool":69,"command":70},"npx","npx skills add duc-duy-1612\u002FOnline-Delivery-Systems-Web --skill hunt-shadow-api",{"tool":72,"command":73},"bunx","bunx skills add duc-duy-1612\u002FOnline-Delivery-Systems-Web --skill hunt-shadow-api",{"tool":75,"command":76},"pnpm","pnpm dlx skills add duc-duy-1612\u002FOnline-Delivery-Systems-Web --skill hunt-shadow-api","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fhunt-shadow-api\u002FSKILL.md",true,[],[81,104,128,149,170,194],{"skillNo":82,"name":83,"nameZh":6,"description":84,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":85,"categories":86,"keywords":90,"publishedAt":48},"01M6Q0FA5FZ410Z33Z3TFQ4DBA","zero-trust","Implement zero-trust network architecture. Configure identity-based access, micro-segmentation, and continuous verification. Use when implementing modern security architectures.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fzero-trust\u002FSKILL.md",[87],{"categoryNo":88,"categoryName":89,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000011","运维与部署",[91,92,93,94,95,96,83,97,98,99,100,41,40,39,101,102,38,37,34,103],"ZeRO","trust","zero trust","architecture","assessment","verification","segmentation","devops-security","access","configure","active","critical","implementing",{"skillNo":105,"name":106,"nameZh":6,"description":107,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":108,"categories":109,"keywords":110,"publishedAt":48},"01M6Q0F1YZJW3KX5FBKEVZ8CV4","zcode-delegate","Delegate coding tasks to the Z.AI ZCode CLI only when the user explicitly requests it, while the orchestrator retains review and landing responsibility.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fzcode-delegate\u002FSKILL.md",[],[111,112,113,114,115,116,117,118,119,120,121,122,123,41,124,40,125,126,102,127],"delegate","zcode","zcode delegate","review","cli","orchestration","tasks","run","Bash","model","node","read","orchestrator","files","desktop app","app","agent-orchestration",{"skillNo":129,"name":130,"nameZh":6,"description":131,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":132,"categories":133,"keywords":134,"publishedAt":48},"01M6Q0ETK41VGNMYEXW0T00AJN","youtube-transcript","Fetch YouTube transcripts through DeepAPI or local fallback tooling and save clean text output.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fyoutube-transcript\u002FSKILL.md",[],[135,136,137,138,47,139,46,44,43,140,141,142,143,40,39,144,145,146,147,148],"transcript","youtube transcript","youtube","safe","codex","text","fetch","tooling","clean","local","output","deepapi","youtube transcripts","blob",{"skillNo":150,"name":151,"nameZh":6,"description":152,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":153,"categories":154,"keywords":160,"publishedAt":48},"01M6Q0EPPH2PVMDW40017F8WX0","youtube-transcript-skills","Fetch YouTube video transcripts, search videos\u002Fchannels, browse channels, and extract playlists via the getyoutubetranscript.com API - free tier, no card required.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fyoutube-transcript-skills\u002FSKILL.md",[155,156,159],{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},{"categoryNo":157,"categoryName":158,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000016","图像与多媒体",{"categoryNo":23,"categoryName":24,"taxonomyType":25,"taxonomyTypeDesc":26},[135,136,137,161,138,162,47,139,44,163,29,164,165,141,166,40,39,167,168,169],"youtube transcript skills","gemini","search","Video","browse","api-integration","free","card","channels",{"skillNo":171,"name":172,"nameZh":6,"description":173,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":174,"categories":175,"keywords":180,"publishedAt":48},"01M6Q0EAB96PX83W5PTE8A0R8D","youtube-notetaker","Turn YouTube talks into local study notes with slides, transcripts, editable annotations, and a markdown-backed viewer.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fyoutube-notetaker\u002FSKILL.md",[176,179],{"categoryNo":177,"categoryName":178,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":157,"categoryName":158,"taxonomyType":20,"taxonomyTypeDesc":21},[137,181,182,115,138,183,184,185,186,44,164,187,188,189,190,39,191,144,192,193],"youtube notetaker","notetaker","workflow","official","notes","code","markdown","slides","annotations","README","study","dair-academy","viewer",{"skillNo":195,"name":196,"nameZh":6,"description":197,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":198,"categories":199,"keywords":201,"publishedAt":48},"01M6Q0E55F0GW5MX48V8HXS8B5","youtube-full","Fetch YouTube transcripts, search videos, browse channels, and extract playlists via TranscriptAPI — no yt-dlp, no Google API key, works from any cloud server.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fyoutube-full\u002FSKILL.md",[200],{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},[202,137,203,204,138,162,163,205,206,29,164,165,141,207,166,40,39,167,208,147],"youtube full","full","google","server","dlp","credits","automatic"]