hunt-nodejs-permission-bypass SKILL.md skillA
hunt-nodejs-permission-bypass from galact-byte/galact-skills is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add galact-byte/galact-skills/hunt-nodejs-permission-bypass@git:20260806.bbab2e5Pins git:20260806.bbab2e5 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- galact-byte/galact-skills
- Path
skills/hunt-nodejs-permission-bypass/SKILL.md- Versions recorded
- 1
- Latest version
- git:20260806.bbab2e5, committed Aug 6, 2026
- Size
- 5,282 bytes
- Repository stars
- 7
- License
- a license file GitHub does not identify
在授权测试中核验 Node.js 权限模型（--permission / --experimental-permission，及旧 policy.json）能否被内部 API 绕过。当目标依赖 Node.js Permission Model 做沙箱隔离、需要判断给定 Node 版本下是否存在已知逃逸（inspector 断点、process.binding、fs.statfs/openAsBlob、process.mainModule.require、Module._load、path.resolve 覆盖、Uint8Array 路径、符号链接重命名）时使用。适用目标类型 Node.js 运行时 / 依赖权限模型的服务或 CLI。触发场景包括用户说"这个 Node 权限模型靠谱吗""--permission 能被绕过吗""测下 policy.json 沙箱逃逸""inspector/process.binding 能突破权限吗"。输出：给定 Node 版本下各绕过原语的命中矩阵 + 建议升级版本（含 killed 记录）。.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# hunt-nodejs-permission-bypass · Node.js 权限模型逃逸核验 只解决一件事：**判定某 Node.js 版本 + 权限配置下，已知内部 API 绕过原语还有没有效**。这是本地能力核验（不是远程扫描）——在受权限模型限制的进程里跑一批 PoC，看哪些能读到本应被禁的文件。 权限模型的隔离承诺很脆：很多逃逸是"用内部 API 绕开被拦的公开 API"。本 skill 把已知原语做成可重复的命中矩阵，帮你快速判断目标 Node 版本是否安全。PoC 只读**授权内的标记文件**验证逃逸，不做破坏。绕过原语与对应修复版本见 `reference.md`。 ## Scope（授权范围） **先确认授权，再运行 PoC。** 这些 PoC 会尝试突破沙箱读文件。 开工前落实： - 授权在**目标环境/副本**上运行 Node PoC（生产慎用，优先用同版本副本）。 - 一个**受限标记文件**路径（PoC 尝试越权读它来证明逃逸），内容无敏感信息。 - 目标 Node 版本与启动方式（`--permission` / `--experimental-permission` / `--allow-fs-read` 白名单 / policy.json）。 任一不清楚就停下问。只在授权环境跑，只读标记文件。 ## Goal 产出"该 Node 版本 + 配置下，各已知绕过原语是否仍可逃逸"的命中矩阵，给出可复现 PoC 与修复建议（升级到已修复版本 / 禁用 inspector / 避免动态 path.resolve）。 ## Workflow `scope-check → recon → hunt → validate → report`。 ### 1. scope-check - **输入**：授权 + 受限标记文件路径。 - **动作**：写 `evidence/scope.txt`（含 restricted_file / node_target）。 - **命令**：`bash tools/recon.sh --scope-only`。 - **终止条件**：`evidence/scope.txt` 存在且授权明确，否则 KILL。 ### 2. recon - **输入**：目标 Node（本机 `node` 或指定二进制）。 - **动作**：探测 Node 版本、是否支持/启用权限模型、可用绕过面。 - **输出**：`recon/node_env.json`（版本、权限模型状态、适用原语列表）。 - **命令**：`bash tools/recon.sh [--node <path>]`。 - **终止条件**：拿到版本与权限模型状态；不支持权限模型则记录结束。 ### 3. hunt …
Read the whole file at its exact version.
How to install
mdr add galact-byte/galact-skills/hunt-nodejs-permission-bypass@sha256:e89677b71ff9635bThe line at the top of this page pins the label git:20260806.bbab2e5, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_2fw3ctfdyy7f7246)
4 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 1 version of this file, committed on Aug 6, 2026.
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (5282 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
galact-byte/galact-skills · 7 stars · license a license file GitHub does not identify · pushed 2026-10-12 · branch master
API
GET https://markdownregistry.com/api/v1/artifacts/art_2fw3ctfdyy7f7246 GET https://markdownregistry.com/api/v1/resolve?ref=galact-byte/galact-skills/hunt-nodejs-permission-bypass GET https://markdownregistry.com/api/v1/blob/e89677b71ff9635b63d8603fd255a5f1c49c2b5a33275735814ea2fd921b80bf
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.