yhy0

Use when building or updating vulnerability pattern Skills from multiple sources: GitHub Security Advisories (GHSA), HackerOne Hacktivity, or NVD. Triggers on keywords: GHSA, CVE, vulnerability skill, vuln pattern, update skills, security advisory, HackerOne,…

Use when building or updating vulnerability pattern Skills from multiple sources: GitHub Security Advisories (GHSA), HackerOne Hacktivity, or NVD. Triggers on keywords: GHSA, CVE, vulnerability skill, vuln pattern, update skills, security advisory, HackerOne,…

Use when auditing Go code involving authentication flows, RBAC policies, Kubernetes admission webhooks, JWT/OAuth token validation, or privilege escalation in cloud-native infrastructure. Covers CWE-287/863/269/284/285/862. Keywords: authentication bypass,…

Use when auditing Go code involving TLS configuration, certificate validation, JWT token parsing, SAML assertion verification, webhook signature checking, or cryptographic operations. Covers CWE-295/347/345. Keywords: InsecureSkipVerify, TLS, mTLS,…

Use when auditing Go code involving goroutine management, channel operations, HTTP request handling, resource allocation, or panic recovery. Covers CWE-400/770/476. Keywords: denial of service, goroutine leak, channel deadlock, panic recover, io.ReadAll,…

Use when auditing Go code involving logging, error handling, HTTP response data, Kubernetes Secret management, or credential storage. Covers CWE-200/532/522/312/552. Keywords: information disclosure, credential leak, log exposure, Kubernetes Secret, json tag,…

Use when auditing Go code involving OS command execution, SQL queries, template rendering, or child command invocation. Covers CWE-78/89/77/94/88. Keywords: command injection, SQL injection, exec.Command, os/exec, database/sql, text/template, html/template,…

Use when auditing Go code involving file path operations, archive extraction, symlink handling, container volume mounts, or HTTP file serving. Covers CWE-22/59. Keywords: path traversal, directory traversal, filepath.Join, symlink, archive extraction, zip…

Use when facing AI security challenges involving prompt injection, LLM jailbreaks, or AI agent exploitation

Use when facing binary exploitation (PWN) or reverse engineering challenges involving memory corruption, ROP chains, shellcode, binary analysis, decompilation, unpacking, or dynamic tracing

Use when facing cryptography challenges involving cipher analysis, key recovery, mathematical attacks, or protocol weaknesses

Use when transferring files between remote environments and local Docker containers via litterbox.catbox.moe relay or base64 chunked fallback

Use when facing digital forensics or misc challenges involving disk images, memory dumps, network captures, steganography, file format analysis, encoding puzzles, sandbox escapes, or archive manipulation

Use when conducting penetration testing, post-exploitation, lateral movement, domain attacks, cloud exploitation (AWS/GCP/Azure), container escape, or Kubernetes cluster attacks

Use when stuck, looping on same approach, making no progress after multiple tool calls, or receiving a stagnation warning from the system. Also trigger when you catch yourself retrying the same command with minor variations, getting repeated Permission denied…

Use when facing web security challenges involving injection, authentication bypass, IDOR, access control, CSRF, HRS, server-side vulnerabilities, or web application exploitation

Orchestrates SecMentor cybersecurity tutoring: routing, progress 1.1 protocol, evidence rules, P0 gate. Use when starting SecMentor, 学网络安全, or continuing learner/progress.json.

Writes SecMentor daily/weekly reviews to journal and events jsonl; updates still_fuzzy and recent_events without bloating progress.json. Use on 小结/复盘.

Delivers SecMentor lessons with dynamic labs, structured evidence, mastery levels, and remediation from curriculum.yaml. Use after P0/placement when continuing study, 做实验, 验收, or 下一章.

SecMentor HTML for progress cards (Kami) and celebration pages with fireworks when points/milestones unlock. Quizzes stay chat-first. Use for 进度, 积分板, 烟花庆祝, 里程碑.

Runs SecMentor placement via chat-first interview and dynamic quizzes; sets recommended_start_after_p0 while keeping current_stage at P0. Use on 摸底/重测 or placement.status not done.

Guides Yakit/Burp and dynamic lab environments for SecMentor. Labs folder is optional examples; no pinned images or topic hard-binds. Use for 环境/代理/Docker/靶场.

扫描当前项目的技术栈、目录结构和代码约定，自动生成 before-modify（修改前检查清单）和 project-structure（项目结构索引）两个 skills，帮助 Claude 在后续开发中保持代码风格一致、避免重复实现 (user)

当项目结构发生变化（如新增目录、引入新框架、重构代码）后，重新扫描项目并增量更新已有的 before-modify 和 project-structure skills，保留用户自定义的规则 (user)

Open or attach to a ChYing desktop project, wait for its local MCP server, and return the exact ready MCP URL. Use when an agent needs ChYing HTTP history, Repeater, Intruder, passive-scan, or project-scoped MCP tools. Prefer attaching when the user already…