菜单
Use this skill when web application or API vulnerability research needs route, session, tenant, authorization, request-flow, browser-state, or business-logic surface triage.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Use this skill when MaxTAC Source should use the plugin-bundled codebase-memory-mcp MCP integration or CLI fallback for repository indexing, architecture overview, structural search, call-path tracing, diff impact mapping, ADR lookup, or code graph evidence before SAST triage, CFG work, OpenGrep authoring, or source scans.
Use this skill when MaxTAC Android needs a loop that models an Android app's user-facing resources and systematically walks activities, deep links, forms, WebViews, share targets, notifications, and other user-facing inputs for security auditing while respecting scope and safety constraints.
Use this skill when Apple Systems research needs a loop over IPSW or OTA firmware diffs, Apple security advisories, CVEs, build provenance, and binary/source patch archaeology to identify patched Apple components, infer why they changed, and enrich an ASB threat model.
Use this skill when MaxTAC Binary needs a loop to model how a binary was compiled and loaded, preserve reverse-engineering provenance, prioritize executable functions by reachability or call frequency, systematically decompile or parse functions and data structures, and produce durable functionality and security evidence.
Use this skill when MaxTAC research needs a durable security model, invariant dictionary, invariant receipts with proof obligations and refutation conditions, architecture understanding, first-order-logic-style assertions, unknown tracking, contradiction tracking, or model-backed auditor handoffs across source, web, cloud, binary, supply-chain, Android, Apple, or Microsoft targets.
Use this skill when MaxTAC research needs goal-bounded auditor subagents, verifier debate subagents, specialist bug-class review, mitigation review, or independent votes on a vulnerability hypothesis or PoV.
| name | maxtac-web-surface-triage |
| description | Use this skill when web application or API vulnerability research needs route, session, tenant, authorization, request-flow, browser-state, or business-logic surface triage. |
Use this skill as the first pass for web applications, APIs, browser-facing services, and SaaS workflows. The goal is a compact map of actors, sessions, routes, trust boundaries, state transitions, and security invariants that can be handed to Web auditors, Source/SAST tools, API fuzzing, or browser debugging.
research/.maxtac-source when code-level reachability, guard dominance, or OpenGrep rules are needed.maxtac-web-api-fuzzing for stateful API, schema, parameter, or request-sequence fuzzing.maxtac-web-browser-debugging when browser state, DOM, storage, service workers, frame/process boundaries, or network timing are part of the evidence.## Web Surface Triage Packet
- Target slice:
- Actor and starting state:
- Protected asset or trust boundary:
- Entrypoints:
- Session and identity material:
- Tenant or ownership model:
- Controlled inputs:
- Security invariant:
- Suspect guard, sink, or state transition:
- Browser/client state involved:
- Key files/routes/handlers:
- Evidence collected:
- Evidence still needed:
- Suggested tools: Source/SAST / Web API fuzzing / Browser debugging / Auditors
- Suggested auditor filters:
- Candidate hypothesis:
- Confidence: low / medium / high
Use the Web pack's auditor MCP tools when available. If those tools are not exposed in the current context, use Core's local fallback: python3 <maxtac-core-subagents-skill-dir>/scripts/audit-helper.py --catalog web --filter <term>. Good starting filters include authz, tenant, idor, oauth, saml, session, replay, approval, payment, ssrf, sql-injection, xss, websocket, http, and business-logic.