Menu
Four-phase autonomous bug bounty workflow. Python handles deterministic collection and verifier support; AI owns prioritization, attack reasoning, and autonomous direction changes.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Four-phase autonomous bug bounty orchestration. Phase 0 maps external assets with deterministic Python helpers, Phase 1 lets AI prioritize attack surfaces, Phase 2 gives AI autonomous attack control, and Phase 3 produces verifier-only reports.
Report generation agent. Convert verifier-confirmed findings into a fixed evidence-based report without adding speculative impact.
Rank reconnaissance-derived attack surfaces and design evidence-driven tests without active exploitation.
Test ranked attack surfaces autonomously, preserve evidence, and turn new access into additional attack-chain hypotheses.
A compact routing skill for choosing vulnerability hypotheses; detailed payloads live in references, not here.
API exploration agent. Use endpoint signatures and real response values to expand attack surfaces; do not stop at the first finding.
| name | mastermind-workflow |
| description | Four-phase autonomous bug bounty workflow. Python handles deterministic collection and verifier support; AI owns prioritization, attack reasoning, and autonomous direction changes. |
| metadata | {"tags":"bug-bounty,workflow,autonomous-security,four-phase","version":"4.3.1"} |
Use progressive disclosure:
references/INDEX.md, and only when Phase 1/2 has selected a concrete direction.Do not preload all reference modules. The workflow should preserve AI attention for prioritization, chaining, and verifier-backed decisions.
Phase 0 | 资产侦察
↓
Phase 1 | 攻击面分析
↓
Phase 2 | 自主攻击
↓
Phase 3 | 报告生成
AI directive:
摸清这个目标所有对外资产。
给 AI 的工具清单只描述能力，不规定顺序：
Python 负责确定性执行：
_endpoint_params.json、_source_leaks.txt、_headers.txt 等结构化结果AI 拿到 Python 输出后自行做开放判断。例如 Actuator 和 Druid 同时 200 时，AI 应主动联想到 Spring Boot 暴露面组合，而不是等待写死规则触发。
本阶段不动手，只分析。
AI 必须基于 Phase 0 结果输出：
confidence、impact、exploitability、priority_score每个漏洞假设都必须带 0 到 1 的置信度：
< 0.4：低信度，直接换方向，除非新证据几乎零成本可获得。0.4 <= confidence < 0.8：中信度，继续收集证据。>= 0.8：高信度，进入验证和利用。置信度来自：
多个攻击面排队时使用：
priority_score = (impact * 0.4 + exploitability * 0.3 + confidence * 0.2) / 0.9
影响程度参考：RCE 1.0，已证明的敏感数据泄露 0.8，越权/IDOR 0.7，XSS 0.3。硬编码 API 凭据和内网/Swagger/OpenAPI/Druid 路径先作为线索验证；只有成功访问敏感数据、执行敏感操作或完成有效绕过后，才按实际影响评分。失败线索不展示。CORS、地图 API Key 直接忽略。
可利用性参考：未授权 1.0，需要弱口令 0.6，需要特定条件 0.4。
核心规则只有一句：
按优先级逐个测，每测完一个自己判断继续还是换方向还是收手，不要问用户要不要继续，只有测完所有面、找到确定高危、或者连续五次没进展才停。
执行循环：
confidence、impact、exploitability、priority_scorePython 在本阶段只提供确定性支撑：
_endpoint_params.json × _leaked_values.json 联动注入本阶段不需要 AI 发挥。
只报告 Verifier 确认过的漏洞，固定模板如下：
原则：