菜单
Reusable attack patterns distilled from disclosed vulnerability reports. Use when hunting for vulnerabilities to understand common exploitation chains, or when you're stuck and need to think about what typically goes wrong in a given feature type.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Security research methodology — 5-phase workflow (intake → recon → enum → hunt → report). Routes to specialized technique modules. Use when the user asks to audit, penetration test, bug bounty, find vulnerabilities, exploit a target, or perform any security assessment.
AI/ML attack techniques — prompt injection, indirect/RAG poisoning, tool-calling manipulation, adversarial examples, model extraction, membership inference, training data extraction. Use when the target involves LLM agents, chatbots, ML model APIs, image classifiers, or federated learning systems.
Binary exploitation techniques — buffer overflow, format string, heap exploitation, ROP, kernel exploitation, sandbox escape, shellcode. Use when the target is a native binary (ELF/PE), remote service with memory corruption, or kernel module. Requires pwntools, GDB, and binary analysis tools.
Cryptography attack techniques — RSA, ECC, symmetric ciphers, hash collisions, PRNG attacks, lattice/LWE. Use when the challenge involves encryption, decryption, key recovery, nonce reuse, padding oracles, or cryptanalysis of custom schemes.
Forensic analysis techniques — disk, memory, network, steganography, side-channel analysis. Use when given a disk image (.dd, .E01, .raw), memory dump (.vmem, .raw), packet capture (.pcap, .pcapng), image/audio file with hidden data, or side-channel trace.
Malware analysis techniques — static triaging, dynamic sandboxing, PE/.NET analysis, C2 protocol identification. Use when analyzing a suspicious binary, script, document, or network capture from a potentially compromised system.
| name | security-patterns |
| description | Reusable attack patterns distilled from disclosed vulnerability reports. Use when hunting for vulnerabilities to understand common exploitation chains, or when you're stuck and need to think about what typically goes wrong in a given feature type. |
| license | MIT |
| compatibility | Requires filesystem-based agent with read access to the patterns directory. |
| allowed-tools | Bash Read Glob Grep |
| metadata | {"user-invocable":"true","argument-hint":"<pattern-category>"} |
Distilled patterns from disclosed cases. Each pattern describes: what it is, signals to look for, typical exploitation flow, and generalized examples.
| Category | Document | Focus |
|---|---|---|
| Password reset step-skip, SSO token theft, weak session keys, remember-me tokens | Auth Vulnerabilities | Authentication flaws |
| Direct input concatenation, NoSQL operator injection, blind SQL, second-order injection | Injection Patterns | Injection variants |
| Email verification bypass, unauthenticated API access, subscription manipulation, IDOR | Authorization Bypass | AuthZ bypass |
| Payment tampering, race conditions, password reset logic, CAPTCHA bypass, coupon abuse | Business Logic Flaws | Logic flaws |
| Hop-by-hop header leakage, Alt-Svc credential leak, directory/file enumeration | Information Disclosure | Info leaks |
| Unauthenticated endpoints, IDOR, BOLA, mass assignment, GraphQL introspection | API Vulnerabilities | API issues |
| Multi-step chains combining multiple low-severity issues into critical impact | Chained Attacks | Attack chains |
1. Identify the feature type you're testing (auth, API, payment, file handling)
2. Load the corresponding pattern document
3. Check each pattern against the target: "Does our target have this signal?"
4. For each matching signal, follow the exploitation flow
5. Chain low-severity findings using chained-attacks patterns
For vendor-specific fingerprints and default credentials (especially China-market enterprise software), load: