菜单
Four-phase autonomous bug bounty workflow. Python handles deterministic collection and verifier support; AI owns prioritization, attack reasoning, and autonomous direction changes.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Four-phase autonomous bug bounty orchestration. Phase 0 maps external assets with deterministic Python helpers, Phase 1 lets AI prioritize attack surfaces, Phase 2 gives AI autonomous attack control, and Phase 3 produces verifier-only reports.
Report generation agent. Convert verifier-confirmed findings into a fixed evidence-based report without adding speculative impact.
Rank reconnaissance-derived attack surfaces and design evidence-driven tests without active exploitation.
Test ranked attack surfaces autonomously, preserve evidence, and turn new access into additional attack-chain hypotheses.
A compact routing skill for choosing vulnerability hypotheses; detailed payloads live in references, not here.
API exploration agent. Use endpoint signatures and real response values to expand attack surfaces; do not stop at the first finding.
| name | mastermind-workflow |
| description | Four-phase autonomous bug bounty workflow. Python handles deterministic collection and verifier support; AI owns prioritization, attack reasoning, and autonomous direction changes. |
| metadata | {"tags":"bug-bounty,workflow,autonomous-security,four-phase","version":"4.3.1"} |
Use progressive disclosure:
references/INDEX.md, and only when Phase 1/2 has selected a concrete direction.Do not preload all reference modules. The workflow should preserve AI attention for prioritization, chaining, and verifier-backed decisions.
Phase 0 | 资产侦察
↓
Phase 1 | 攻击面分析
↓
Phase 2 | 自主攻击
↓
Phase 3 | 报告生成
AI directive:
摸清这个目标所有对外资产。
给 AI 的工具清单只描述能力，不规定顺序：
Python 负责确定性执行：
_endpoint_params.json、_source_leaks.txt、_headers.txt 等结构化结果AI 拿到 Python 输出后自行做开放判断。例如 Actuator 和 Druid 同时 200 时，AI 应主动联想到 Spring Boot 暴露面组合，而不是等待写死规则触发。
本阶段不动手，只分析。
AI 必须基于 Phase 0 结果输出：
confidence、impact、exploitability、priority_score每个漏洞假设都必须带 0 到 1 的置信度：
< 0.4：低信度，直接换方向，除非新证据几乎零成本可获得。0.4 <= confidence < 0.8：中信度，继续收集证据。>= 0.8：高信度，进入验证和利用。置信度来自：
多个攻击面排队时使用：
priority_score = (impact * 0.4 + exploitability * 0.3 + confidence * 0.2) / 0.9
影响程度参考：RCE 1.0，已证明的敏感数据泄露 0.8，越权/IDOR 0.7，XSS 0.3。硬编码 API 凭据和内网/Swagger/OpenAPI/Druid 路径先作为线索验证；只有成功访问敏感数据、执行敏感操作或完成有效绕过后，才按实际影响评分。失败线索不展示。CORS、地图 API Key 直接忽略。
可利用性参考：未授权 1.0，需要弱口令 0.6，需要特定条件 0.4。
核心规则只有一句：
按优先级逐个测，每测完一个自己判断继续还是换方向还是收手，不要问用户要不要继续，只有测完所有面、找到确定高危、或者连续五次没进展才停。
执行循环：
confidence、impact、exploitability、priority_scorePython 在本阶段只提供确定性支撑：
_endpoint_params.json × _leaked_values.json 联动注入本阶段不需要 AI 发挥。
只报告 Verifier 确认过的漏洞，固定模板如下：
原则：