メニュー
Root pointer for the analyst's vulnerability research playbooks. Load this first at iteration start to see the full catalog of vuln-class and chain-building skills.
デフォルトでは、最初にソースを確認する Prompt が選択されています。直接コマンドに切り替えるか、ローカルコピーをダウンロードすることもできます。
インストールを決める前に、SKILL.md と SkillsMP に表示されている付属ファイルをお読みください。
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
直接コマンドでは確認用 Prompt が省略されます。実行前にソースを確認してください。
npx skills add https://github.com/ZeeshanSultan/pentest-agent-vs-llm-benchmark-effectiveness --skill analyst-overviewコマンドは1行のまま表示されます。コピー前に横へスクロールして全体を確認してください。
ローカルで確認しますか？SkillsMP が現在取得できるファイルをダウンロードできます。
Bug bounty white-box hunting methodology. Load when the target is an open-source project with a security advisory program, bug bounty, or responsible disclosure policy.
Trust boundary mapping and startup sequence audit for developer tools, CLI apps, and plugin systems. Load when the target is a developer tool, CLI, IDE extension, or any application that loads config from the current directory.
CTF benchmark mode — meta-rules for automated benchmark runs. Routing/playbooks live in /skills/exploit/* and /skills/recon/*; this file only documents benchmark-specific conventions.
SOC 職業分類に基づく
SKILL.md を表示中
| name | analyst-overview |
| description | Root pointer for the analyst's vulnerability research playbooks. Load this first at iteration start to see the full catalog of vuln-class and chain-building skills. |
The analyst has specialised playbooks under this tree. Load the one matching your current hunting lane — don't load them all at once.
Use when you have source code and are hunting a specific weakness class.
| Skill | Use for |
|---|---|
/skills/analyst/sql-injection/SKILL.md | String-concat + format-string → SQL sink |
/skills/analyst/ssrf/SKILL.md | User-controlled URL reaches http client |
/skills/analyst/deserialization/SKILL.md | pickle / Java ObjectInputStream / .NET BinaryFormatter / YAML |
/skills/analyst/ssti/SKILL.md | User input rendered by Jinja/Twig/Freemarker/Velocity |
/skills/analyst/xxe/SKILL.md | XML parser with external entity expansion enabled |
/skills/analyst/path-traversal/SKILL.md | User input reaches filesystem path |
/skills/analyst/prototype-pollution/SKILL.md | JS merge / assign / clone of untrusted object |
/skills/analyst/command-injection/SKILL.md | User input → shell, exec, system |
/skills/analyst/idor/SKILL.md | Missing authorization check on object reference |
/skills/analyst/auth-bypass/SKILL.md | Broken auth state machine, missing session checks |
/skills/analyst/prompt-injection/SKILL.md | LLM prompts built from untrusted input |
Use when you have a bag of individual findings and want to combine them into a critical impact chain.
| Skill | Use for |
|---|---|
/skills/analyst/chains/ssrf-to-rce/SKILL.md | SSRF → metadata → IAM → RCE |
/skills/analyst/chains/xss-to-takeover/SKILL.md | Self-XSS → CSRF → admin creds |
/skills/analyst/chains/cred-reuse/SKILL.md | Low-priv cred → service pivot → domain admin |
/skills/analyst/chains/idor-to-priv-esc/SKILL.md | IDOR on settings → role elevation |
kg_stats — see what you already know.plan_attack_chains(promote=True) to persist any complete chains.