一个技能，一个新的可能。找到适合你的 AI 工作流。
api-fuzzing-bug-bounty
【开发与工程】Provide comprehensive techniques for testing REST, SOAP, and GraphQL APIs during bug bounty hunting and penetration testing engagements. Covers vulnerability discovery, authentication bypass, IDOR exploitation, and API-specific attack vectors.
bb-methodology
【效率与协作】Use at the START of any bug bounty hunting session, when switching targets, or when feeling lost about what to do next.
code-audit
【开发与工程】Authorized source-code security review and SAST workflows: Semgrep and CodeQL pattern hunting, dangerous API identification, and fix verification.
hunt-auth-bypass
【开发与工程】Hunting skill for auth bypass vulnerabilities.
hunt-business-logic
【开发与工程】Hunting skill for business logic vulnerabilities.
hunt-cache-poison
【开发与工程】Hunting skill for cache poison vulnerabilities.
hunt-csrf
【开发与工程】Hunting skill for csrf vulnerabilities.
hunt-graphql
【开发与工程】Hunting skill for graphql vulnerabilities.
hunt-idor
【开发与工程】Hunting skill for idor vulnerabilities. Built from 26 public bug bounty reports. Use when hunting idor on any target.
hunt-misc
【开发与工程】Hunting skill for misc vulnerabilities. Built from 225 public bug bounty reports. Use when hunting misc on any target.
hunt-oauth
【开发与工程】Hunting skill for oauth vulnerabilities. Built from 19 public bug bounty reports. Use when hunting oauth on any target.
hunt-race-condition
【开发与工程】Hunting skill for race condition vulnerabilities.
hunt-rce
【开发与工程】Hunting skill for rce vulnerabilities. Built from 67 public bug bounty reports. Use when hunting rce on any target.
hunt-sqli
【数据与研究】Hunting skill for sqli vulnerabilities.
hunt-ssrf
【开发与工程】Hunting skill for ssrf vulnerabilities.
hunt-subdomain
【开发与工程】Hunting skill for subdomain takeover vulnerabilities.
hunt-xss
【开发与工程】Hunting skill for xss vulnerabilities.
hunt-xxe
【开发与工程】Hunting skill for xxe vulnerabilities.