菜单
Root pointer for the analyst's vulnerability research playbooks. Load this first at iteration start to see the full catalog of vuln-class and chain-building skills.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/PurpleAILAB/Decepticon --skill analyst-overview命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
正在显示 SKILL.md
| name | analyst-overview |
| description | Root pointer for the analyst's vulnerability research playbooks. Load this first at iteration start to see the full catalog of vuln-class and chain-building skills. |
| metadata | {"subdomain":"analyst","when_to_use":"analyst overview vulnerability research playbook catalog chain building routing iteration start"} |
The analyst has specialised playbooks under this tree. Load the one matching your current hunting lane — don't load them all at once.
Use when you have source code and are hunting a specific weakness class.
| Skill | Use for |
|---|---|
/skills/standard/analyst/sql-injection/SKILL.md | String-concat + format-string → SQL sink |
/skills/standard/analyst/ssrf/SKILL.md | User-controlled URL reaches http client |
/skills/standard/analyst/deserialization/SKILL.md | pickle / Java ObjectInputStream / .NET BinaryFormatter / YAML |
/skills/standard/analyst/ssti/SKILL.md | User input rendered by Jinja/Twig/Freemarker/Velocity |
/skills/standard/analyst/xxe/SKILL.md | XML parser with external entity expansion enabled |
/skills/standard/analyst/path-traversal/SKILL.md | User input reaches filesystem path |
/skills/standard/analyst/prototype-pollution/SKILL.md |
| JS merge / assign / clone of untrusted object |
/skills/standard/analyst/command-injection/SKILL.md | User input → shell, exec, system |
/skills/standard/analyst/idor/SKILL.md | Missing authorization check on object reference |
/skills/standard/analyst/auth-bypass/SKILL.md | Broken auth state machine, missing session checks |
/skills/standard/analyst/prompt-injection/SKILL.md | LLM prompts built from untrusted input |
Use when you have a bag of individual findings and want to combine them into a critical impact chain.
| Skill | Use for |
|---|---|
/skills/standard/analyst/chains/ssrf-to-rce/SKILL.md | SSRF → metadata → IAM → RCE |
/skills/standard/analyst/chains/xss-to-takeover/SKILL.md | Self-XSS → CSRF → admin creds |
/skills/standard/analyst/chains/cred-reuse/SKILL.md | Low-priv cred → service pivot → domain admin |
/skills/standard/analyst/chains/idor-to-priv-esc/SKILL.md | IDOR on settings → role elevation |
kg_stats — see what you already know.plan_attack_chains(promote=True) to persist any complete chains.7-question gate run before promoting a finding to FINDING + opening a report. Kills weak/non-impactful findings before they reach the report stage and damage validity ratio.
Stage 3 triage and verification playbook. Crafts minimal PoCs, runs them with ZFP controls, promotes validated bugs to FINDING nodes with CVSS. Load at verifier-agent startup.
Mandatory first-turn startup procedure — checks for existing engagements, resume/new selection, workspace initialization.
基于 SOC 职业分类
