Claude Skills by ok-helloworld

github.com/ok-helloworld

18 skillsA× 14B× 40 installs40 views

vibe-pentestAAI 渗透测试：多 Agent 并行架构的 Web 应用渗透测试技能。流程: 指纹识别 → 后台入口扫描 → API 预扫描 → 浏览器登录提取凭证（可选） → GoSpider 爬虫 → 过滤数据 → 指纹汇总 → 多 Agent 并行渗透测试 → 攻击链分析 → 漏洞证据复查 → 生成报告。securitypythongoVotes: 0GitHub stars: 319
Api AgentA负责 API 安全类漏洞检测：未授权访问/BOLA/BFLA/批量赋值/GraphQL 深度测试/ API 参数篡改/隐藏参数发现/WebSocket 安全/API 版本枚举/ 过度数据暴露securitypythongoVotes: 0GitHub stars: 319
Auth AgentA负责认证与会话类漏洞检测：认证绕过/暴力破解/会话管理/OAuth/SAML/ 密码重置绕过/验证码绕过/不安全随机数/用户枚举/OIDC/CSRF。受控密码测试为条件执行：根据用户授权、测试账号情况、验证码类型和登录保护强度自主决策。泄露的 JWT/密钥/硬编码凭据由 api-agent 验证，不在本 Agent 职责内。securitypythongoVotes: 0GitHub stars: 319
Business AgentA负责业务逻辑漏洞检测：业务流程绕过、状态机缺陷、竞态滥用、价格篡改、优惠券滥用、库存与数量操纵，以及订单、支付、订阅等场景中的业务规则滥用securitypythonphpVotes: 0GitHub stars: 319
File AgentB负责文件类漏洞检测：路径穿越/LFI/RFI/LFI→RCE、任意文件上传、文件包含、任意文件下载、Zip Slip、SVG/CSV 注入、PHP Wrapper 利用、PEARCMD RCE、编辑器路径利用、敏感文件泄露与文件解析链风险。securitypythonphpVotes: 0GitHub stars: 319
Injection AgentA负责所有注入类漏洞检测：SQLi/NoSQL/XSS(存储/反射/DOM)/SSRF/XXE/SSTI/RCE/反序列化/CRLF/XSLT/EL/JNDIsecurityjavascriptpythonVotes: 0GitHub stars: 319
Skills DirectorySkills Directory Look up any of 103,619 scanned skills — grade, score, and every finding. Free.Check a skill
Misc AgentA负责外围攻击面与协议边界安全检测：信息泄露/开放重定向/CORS/CSP/安全头/目录索引/子域名接管/Web缓存欺骗/Clickjacking/Host头攻击securitypythonphpVotes: 0GitHub stars: 319
Poc AgentB基于指纹识别结果（tech_stack），优先匹配本地 POC；在用户明确授权时补充联网搜索 POC，并通过 http_test.py 验证已知漏洞。工作流程：读取指纹识别结果 → 提取关键字搜索本地与联网 POC → 整理待验证清单 → 解析 POC 定义 → 构造 http_test.py 命令 → 评估匹配器 → 回填 findings。securitypythonjavaVotes: 0GitHub stars: 319
Vuln Analysis AgentAVibe Pentest 漏洞综合分析 Agent。固定负责 Phase 5.5 攻击链分析与 Phase 5.6 漏洞证据复查：读取已启用的渗透 Agent 的 findings，输出 attack_chains.jsontestingpythonphpVotes: 0GitHub stars: 319
Auth Bypass TechniquesAAccess control bypass methodology. Use when a resource returns 401/403 or redirects to login, and you need to test whether the access control itself is flawed via path normalization, method override, routing-header confusion or content-type tricks. Not a WAF bypass skill.securityjavaphpVotes: 0GitHub stars: 319
Business Logic VulnerabilitiesBBusiness logic vulnerability playbook. Use when reasoning about workflows, race conditions, price manipulation, coupon abuse, state machines, and multi-step authorization gaps.securitypythonrustVotes: 0GitHub stars: 319
Csp Bypass AdvancedAAdvanced Content Security Policy bypass techniques. Use when XSS or data exfiltration is blocked by CSP and you need to find policy weaknesses, trusted endpoint abuse, nonce leakage, or exfiltration channels that CSP cannot block.securityjavascriptrustVotes: 0GitHub stars: 319
Ghost Bits Cast AttackBJava "Ghost Bits" / Cast Attack playbook (Black Hat Asia 2026). Use when attacking Java services where 16-bit char is silently narrowed to 8-bit byte to bypass WAF/IDS for SQL injection, deserialization RCE, file upload (Webshell), path traversal, CRLF injection, request smuggling, and SMTP injection. Affects Tomcat, Spring, Jetty, Undertow, Vert.x, Jackson, Fastjson, Apache Commons BCEL, Apache HttpClient, Angus Mail, JDK HttpServer, Lettuce, Jodd, XMLWriter and re-enables many "patched" CVE...securitypythongoVotes: 0GitHub stars: 319
Http Parameter PollutionAHTTP Parameter Pollution (HPP): duplicate query/body keys parsed differently by servers, proxies, WAFs, and app frameworks. Use when filters and application layers disagree on which value wins, enabling bypass, SSRF second URL, logic abuse, or CSRF token confusion.developmentjavascriptpythonVotes: 0GitHub stars: 319
Request SmugglingAHTTP request smuggling and desynchronization testing. Use when front proxies, CDNs, or load balancers disagree with the origin on message framing (Content-Length vs Transfer-Encoding), on HTTP/2→HTTP/1 translation, or when exploring client-side desync via browser fetch pipelines.securityjavascriptpythonVotes: 0GitHub stars: 319
Sqli Sql InjectionASQL injection playbook. Use when input reaches SQL queries, authentication logic, sorting, filtering, reporting, or DB-specific blind and out-of-band execution paths.securityrustgoVotes: 0GitHub stars: 319
Waf Bypass TechniquesAWAF bypass methodology and generic evasion techniques. Use when a web application firewall blocks injection payloads (SQLi, XSS, RCE) and you need to craft bypasses using encoding, protocol-level tricks, or WAF-specific weaknesses.securitypythonrustVotes: 0GitHub stars: 319
Xss Cross Site ScriptingAXSS playbook. Use when user-controlled content reaches HTML, attributes, JavaScript, DOM sinks, uploads, or multi-context rendering paths.developmentjavascriptrustVotes: 0GitHub stars: 319