the-map

프레임워크와 언어의 소스코드 및 개발자 가이드를 직접 분석하여 메타적 보안 구조를 파악하는 스킬. Spring의 mass assignment, Java getHost()의 URL Confusion처럼 프레임워크/언어 설계상의 보안 함의를 소스코드 레벨에서 추출한다. GitHub 소스, 공식 문서, 보안 가이드를 직접 조회하고, 아키텍처 패턴-취약점 매핑을 생성한다. 대상: Spring, Django, Rails, Express, ASP.NET 등 프레임워크와 Java, Python, JavaScript, C# 등 언어의 표준 라이브러리. '프레임워크 보안 분석', '소스코드 보안 분석', '메타 구조 취약점', '언어 설계 취약점' 같은 표현에 트리거된다.

Generate Nuclei vulnerability detection templates from the-map taxonomy documents. This skill converts mutation variants from the-map knowledge base into production-ready Nuclei YAML templates with matchers, extractors, and workflows. Triggered when the user requests 'create Nuclei template', 'generate Nuclei YAML', 'make scanner template', or references specific vulnerabilities for automated testing. Supports both simple templates and complex workflows with chaining.

Build a comprehensive, generalized mutation/variation taxonomy for any given vulnerability topic. Triggered when the user asks for a reclassification, taxonomy, mutation catalog, variation matrix, or attack surface map for a vulnerability class — such as HTTP smuggling, deserialization, SSRF, path traversal, race conditions, prototype pollution, etc. The skill conducts systematic multi-source research (academic papers, conference talks, CVEs, bug bounties, tooling), then synthesizes findings into a unified document organized by generalized structural criteria — never by paper or source. Output is a deeply structured Markdown reference document.

Generate interactive HTML study guide reports from the-map researcher taxonomy documents (11-researchers/*.md). Produces self-contained, dark-themed HTML files with collapsible technique cards, attack chains, gap analysis tables, timelines, and tool references. Triggered when the user asks to 'create study guide', 'generate study report', 'make HTML report', 'study guide 만들어줘', 'HTML 보고서 생성', or references a researcher profile for report generation.

Analyze external research sources (URLs, papers, conference nominations, blog posts) against the-map taxonomy documents to find missing or underrepresented content. Produces a structured gap report with exact insertion points. Triggered when the user asks to 'find missing content', 'check for gaps', 'compare against source', 'what's not covered from X', or 'sync with latest research'. The skill performs multi-keyword duplicate verification to prevent false positives and false negatives.

Merge gap analysis findings into existing the-map taxonomy documents with surgical precision. Takes gap report items (from gap-analyzer or user) and produces edits that blend naturally with each target document's existing format, voice, and structure. Performs a final duplicate check before every edit. Triggered when the user asks to 'merge gaps', 'apply gap report', 'reflect findings', '반영해줘', or specifies item numbers to implement from a gap analysis. CRITICAL: Only adds content explicitly specified — never injects unrequested additions.

Generate Burp Suite bchecks (Bambdas + BChecks) from the-map taxonomy documents. This skill creates Bambdas for custom Burp Suite automation and BChecks for scanner checks based on mutation taxonomy. Triggered when the user requests 'create bchecks', 'generate Bambdas', 'make Burp scanner bchecks', or wants to automate Burp Suite workflows from taxonomy. Bchecks use a domain-specific language for lightweight scanner extensions.

Generate Burp Suite extensions from the-map vulnerability taxonomy documents. This skill reads taxonomy files from the-map knowledge base and generates fully-functional Burp Suite extensions (Java/Kotlin) with scanner checks, passive/active tests, and UI components. Triggered when the user asks to 'create Burp extension', 'generate Burp plugin', 'make Burp scanner check', or references specific vulnerability classes from the-map for tooling generation. Implements clean architecture with separated concerns: detection logic, HTTP handling, UI, and configuration.

Generate fuzzing wordlists and seed corpora from the-map taxonomy documents. This skill creates structured wordlists, parameter dictionaries, and fuzzer seeds based on mutation taxonomies. Triggered when the user requests 'create fuzzer wordlist', 'generate fuzzing seeds', 'make parameter dictionary', or wants systematic mutation seeds from taxonomy. Outputs include wordlists for ffuf/wfuzz/Burp Intruder, coverage-guided fuzzer seeds, and mutation templates.

Generate proof-of-concept exploits and attack demonstrations from the-map taxonomy documents. This skill creates working exploit code, vulnerable test applications, and complete attack chains based on mutation taxonomies. Triggered when the user requests 'create PoC', 'generate exploit', 'make attack demo', 'build vulnerable app', or wants concrete exploitation examples from taxonomy. Outputs include Python/JavaScript exploits, Docker-based vulnerable apps, and step-by-step attack guides.