メニュー
This skill should be used when analyzing discovered source code for security issues. Helps identify dangerous functions, hardcoded secrets, and vulnerable packages.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
This skill should be used when the user asks about "Active Directory", "Kerberoasting", "AS-REP roasting", "LDAP enumeration", "BloodHound", "DCSync", "Pass-the-Hash", "Golden Ticket", or needs guidance on attacking Windows domain environments.
This skill covers Cacti network monitoring tool exploitation including authenticated RCE via graph templates (CVE-2025-24367), unauthenticated command injection (CVE-2022-46169), and authentication bypass techniques.
This skill should be used when the user asks about "searchsploit", "CVE exploits", "exploit database", "common vulnerabilities", "reverse shells", "webshells", or needs guidance on exploiting common vulnerabilities and services.
This skill covers container escape techniques for Docker, LXC/LXD, and Kubernetes environments. Includes Docker socket escape, Docker Desktop API escape (192.168.65.7:2375), privileged container breakout, and capability-based escapes.
This skill should be used when the user asks about "password cracking", "brute force", "hydra", "hashcat", "john", "credential stuffing", "password spraying", or needs guidance on credential-based attacks.
This skill should be used when stuck on a CTF challenge or when the user asks to look up a writeup. Use EARLY when brute forcing or guessing seems like the only option - writeups often reveal the intended path. Trigger on: "look up writeup", "how do others solve", "stuck", "what's the intended path", machine names like "Soulmate", "Headless".
| name | Source Code Security Patterns |
| description | This skill should be used when analyzing discovered source code for security issues. Helps identify dangerous functions, hardcoded secrets, and vulnerable packages. |
| version | 1.0.0 |
Common backup/source locations to check:
| Pattern | Risk | Notes |
|---|---|---|
| js2py with user input | Critical | Check CVE-2024-28397 |
| yaml.load() no Loader | Critical | Use safe_load |
| subprocess shell=True | High | Command injection |
| render_template_string | High | SSTI |
| debug=True in Flask | Medium | Debugger access |
| Hardcoded secret_key | High | Session forgery |
| Pattern | Risk | Notes |
|---|---|---|
| system/passthru/shell calls | Critical | Command injection |
| include with variable | Critical | LFI/RFI |
| unserialize user data | Critical | Object injection |
| Pattern | Risk | Notes |
|---|---|---|
| spawn/run with user input | High | Command injection |
| vm.runIn* functions | High | Sandbox escape |
| SQL string concatenation | High | SQL injection |
# Passwords and keys
grep -rniE "(password|secret|token|api.?key)\s*[:=]" .
# Database URLs
grep -rniE "(mysql|postgres|mongo)://" .
# Private keys
grep -rnl "PRIVATE KEY" .
# Env files
find . -name ".env*"