analyst-overview
Root pointer for the analyst's vulnerability research playbooks. Load this first at iteration start to see the full catalog of vuln-class and chain-building skills.
소스 정보
- 저장소
- BitterSecurity/Decepticon
- 최근 소스 활동
- 2026년 8월 17일 22:24
- 감지된 SKILL.md 언어
- 영어
- 스타
- 5,565
- 포크
- 1,053
설치 방법
기본적으로 소스를 먼저 확인하는 Prompt가 선택됩니다. 직접 명령으로 전환하거나 로컬 사본을 다운로드할 수도 있습니다.
소스 파일 검토
설치 여부를 결정하기 전에 SKILL.md와 SkillsMP에 표시된 보조 파일을 읽어 보세요.
파일 탐색기
35 개 파일SKILL.md 표시 중
SKILL.md
소스 지침 · 읽기 전용 미리보기- name
- analyst-overview
- description
- Root pointer for the analyst's vulnerability research playbooks. Load this first at iteration start to see the full catalog of vuln-class and chain-building skills.
- metadata
- {"subdomain":"analyst","when_to_use":"analyst overview vulnerability research playbook catalog chain building routing iteration start","upstream_ref":"Decepticon analyst lane: vulnerability research playbook catalog"}
# Analyst Skill Catalog
The analyst has specialised playbooks under this tree. Load the one
matching your current hunting lane — don't load them all at once.
## Taint / source-review playbooks
Use when you have source code and are hunting a specific weakness class.
| Skill | Use for |
|---------------------------------------------|----------------------------------------------------------------|
| `/skills/standard/analyst/sql-injection/SKILL.md` | String-concat + format-string → SQL sink |
| `/skills/standard/analyst/ssrf/SKILL.md` | User-controlled URL reaches http client |
| `/skills/standard/analyst/deserialization/SKILL.md` | pickle / Java ObjectInputStream / .NET BinaryFormatter / YAML |
| `/skills/standard/analyst/ssti/SKILL.md` | User input rendered by Jinja/Twig/Freemarker/Velocity |
| `/skills/standard/analyst/xxe/SKILL.md` | XML parser with external entity expansion enabled |
| `/skills/standard/analyst/path-traversal/SKILL.md` | User input reaches filesystem path |
| `/skills/standard/analyst/prototype-pollution/SKILL.md` | JS merge / assign / clone of untrusted object |
| `/skills/standard/analyst/command-injection/SKILL.md`| User input → shell, exec, system |
| `/skills/standard/analyst/idor/SKILL.md` | Missing authorization check on object reference |
| `/skills/standard/analyst/auth-bypass/SKILL.md` | Broken auth state machine, missing session checks |
| `/skills/standard/analyst/prompt-injection/SKILL.md` | LLM prompts built from untrusted input |
## Research expansion playbooks
| Skill | Use for |
|---|---|
| `/skills/standard/analyst/patch-diff/SKILL.md` | Pinned vulnerable-to-fixed differential testing and variant analysis |
| `/skills/standard/analyst/pattern-exhaustion/SKILL.md` | Independent validation of related root-cause candidates |
## Chain playbooks
Use when you have a bag of individual findings and want to combine them
into a critical impact chain.
| Skill | Use for |
|---------------------------------------------|----------------------------------------------------------------|
| `/skills/standard/analyst/chains/ssrf-to-rce/SKILL.md` | SSRF → metadata → IAM → RCE |
| `/skills/standard/analyst/chains/xss-to-takeover/SKILL.md` | Self-XSS → CSRF → admin creds |
| `/skills/standard/analyst/chains/cred-reuse/SKILL.md` | Low-priv cred → service pivot → domain admin |
| `/skills/standard/analyst/chains/idor-to-priv-esc/SKILL.md` | IDOR on settings → role elevation |
## Workflow
1. `kg_stats` — see what you already know.
2. Identify the target's language / framework.
3. Load the matching vuln-class skill (one or two per iteration).
4. Run the skill's recipe, record findings as graph nodes.
5. When enough vulns exist, load a chain playbook and call
`plan_attack_chains(promote=True)` to persist any complete chains.
GitHub에서 보기