菜单
Autonomous end-to-end security research and full-surface bug hunting engine. Executes non-stop reconnaissance, attack-surface discovery, parameter mining, multi-stage vulnerability verification, minimal-impact PoC generation, and structured reporting on authorized targets.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/Zyrexnn/Cybermes --skill autonomous-godmode-hunter命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
正在显示 SKILL.md
Generates standardized, professional Bug Bounty vulnerability reports in markdown format following HackerOne and Bugcrowd standards.
Workspace conventions for authorized security-engagement deliverables — canonical report location (/workspace/reports/<target>/), plain files not zip, follow-the-existing-format rule, report-aggregator overwrite trap, bypass-before-clear validation gate for negative claims, and Cloudflare UA pitfalls in PoC reproduction. Use at report-writing time or before declaring any control "secure".
Hunt non-ATO account-abuse vulnerabilities — logic flaws in authentication/account endpoints that cause harm without taking over another account. Covers: per-email account-lockout DoS (rate-limit keyed on victim email instead of IP), HTTP-method anomalies on auth routes (DELETE/PUT on /login returning success), password-reset fragility and error-handling leaks, and the missing-header/CORS triage that turns these from noise into rated findings. Use when testing login/register/forgot-password/MFA endpoints, reviewing auth flow resilience, or rating auth-logic bugs that are NOT full account takeover. Complements hunt-ato (which covers takeover paths only).
| name | autonomous-godmode-hunter |
| description | Autonomous end-to-end security research and full-surface bug hunting engine. Executes non-stop reconnaissance, attack-surface discovery, parameter mining, multi-stage vulnerability verification, minimal-impact PoC generation, and structured reporting on authorized targets. |
scope.yaml or conversation prompt, proceed with aggressive, exhaustive, and continuous technical validation. [ Target Defined in scope.yaml ]
│
┌──────────────┴──────────────┐
▼ ▼
[ Passive Recon ] [ Active Discovery ]
- Subfinder / Assetfinder - HTTPx Probe & Tech Detect
- Historical URL Mining (gau) - Katana SPA / JS Crawling
│ │
└──────────────┬──────────────┘
▼
[ Attack Surface Ranking & Fuzzing ]
- Content / Directory Fuzzing (ffuf / feroxbuster)
- Parameter Mining (burp-parameter-names)
- Client-side JS Secret & Endpoint Extraction
│
▼
[ Deep Vulnerability Hypothesis ]
- Auth & Session Handling (Dual-account matrix)
- IDOR / BOLA / Mass-Assignment Testing
- Injection Vectors (SQLi, SSTI, Command Injection)
- Client-side Flaws (DOM XSS, CORS, CSRF via Puppeteer MCP)
- SSRF & OOB Interaction Testing
│
▼
[ Controlled Exploit Validation ]
- Replay & Mutate Requests
- Isolate Root Cause Flaw
- Generate Minimal-Impact PoC Script (Python)
│
▼
[ Evidence Capture & Reporting ]
- Raw HTTP Request & Response Proofs
- Write CVSS v3.1 Structured Markdown Report to reports/
subfinder -d <target> | httpx -silent -status-code -titlekatana -u <url> -silent -depth 3ffuf -u <url>/FUZZ -w /home/ikhsan/Documents/Cybermes/tools/wordlists/common.txt -mc 200,301,302,403dalfox url <url> --silencesqlmap -u "<url>?param=1" --batch --bannerpuppeteer_navigate, puppeteer_screenshot, puppeteer_evaluate) for dynamic JavaScript and DOM verification.| Vulnerability Type | Validation Standard | Evidence Requirement |
|---|---|---|
| IDOR / BOLA | Cross-tenant access between Account A & B | Both Request/Response pairs with leaked object |
| Auth Bypass | Accessing protected endpoint without valid credentials | Response payload showing privileged view |
| SQL Injection | DBMS version or deterministic differential response | Database banner or timing difference proof |
| XSS / DOM Flaw | Script execution context or DOM sink manipulation | Browser MCP console logs / DOM snapshot |
| SSRF | Server-side request callback or internal metadata fetch | Raw response headers and body |
Always create target-scoped directories before saving outputs (TARGET_SLUG e.g. example_com or 127_0_0_1_8888):
mkdir -p reports/<TARGET_SLUG>/findings reports/<TARGET_SLUG>/pocs reports/<TARGET_SLUG>/evidencelow, medium, high, critical only): reports/<TARGET_SLUG>/findings/<severity>_<vuln_name>.md (clean snake_case, no square brackets)reports/<TARGET_SLUG>/evidence/recon_notes.md (Do NOT clutter findings/ with INFO files)reports/<TARGET_SLUG>/pocs/poc_<vuln_name>.pyreports/<TARGET_SLUG>/evidence/<filename>aggregate_reports <TARGET_SLUG> to index findings into reports/<TARGET_SLUG>/SUMMARY.md.