Home / ikooky / velric-agent · GitHub

velric SKILL.md skillA

velric from ikooky/velric-agent is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.

Install it, pinned
mdr add ikooky/velric-agent/velric@git:20261106.02fabb2

Pins git:20261106.02fabb2 in mdr.lock. Pin the fingerprint instead.

Audit grade
A, 17 of 17 checks passed
Kind
SKILL.md skill
Repository
ikooky/velric-agent
Path
skills/velric/SKILL.md
Versions recorded
3
Latest version
git:20261106.02fabb2, committed Nov 6, 2026
First version recorded
Nov 6, 2026
Size
7,950 bytes
Repository stars
3
License
MIT

Web 应用攻击面测绘与越权检测工具链（velric-agent CLI）。覆盖子域/端口/敏感路径/CORS/WAF 指纹侦察、 SPA/MPA 接口枚举、无头运行时流量录制、前端权限树重建、鉴权面差分（authz-replay/role-matrix/IDOR/mass-assign）、 JWT/GraphQL/Header/Verb 绕过、PII 与凭据泄漏扫描。纯 Node 本地执行，无 LLM 依赖。 触发关键词：攻击面测绘、接口枚举、越权、IDOR、未授权访问、水平垂直越权、参数探测、隐藏参数、 权限树、流量录制、CORS、敏感路径、WAF 指纹、sourcemap 泄漏、JWT 攻击、GraphQL 鉴权、mass assignment、PII 扫描。.

Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.

What the file says

# velric-agent — Web 攻击面测绘工具链

## ACTION REQUIRED（读完后立刻执行）

1. `NOW`: 确认目标在授权测试范围内（本工具链仅用于已授权的安全测试）
2. `NOW`: 校验工具可用 —— `bash <repo>/bootstrap.sh --verify` 通过即就绪；未安装则 `git clone` 仓库后 `bash bootstrap.sh`（一条命令装完并自验，之后 skill 直接调用）
3. `NEXT`: 侦察从 `references/workflow.md` 的 Phase 0 开始，工具不是孤立的——有阶段依赖与门禁
4. `ACT`: 每个命令产物落各自的 `<outdir>/`（JSON+txt 工件），结论必须引用产物文件与真实状态码
5. `ACT`: 需要出网代理时所有命令共用 `--proxy URL` / `--proxy-pool FILE` / `--rps N` 全局限速

工具根目录 = velric-agent 仓库路径（记为 `$VELRIC`，下文命令里替换为 `node $VELRIC/scripts/velric-agent.mjs`）。

## 命令矩阵

命令一律形如 `node $VELRIC/scripts/velric-agent.mjs <subcommand>`，下表省略前缀。首次使用先 `bash $VELRIC/bootstrap.sh`。

### Phase 0 — 指纹与分类
| 命令 | 用途 |
|------|------|
| `velric-agent fingerprint <baseUrl> <outdir>` | WAF/CDN 识别、HTTP 方法枚举、Cookie 安全审计 |
| `velric-agent http-probe <url>` | 单 URL 探测（状态/标题/哈希） |

### Phase 1 — 资产面
| 命令 | 用途 |
|------|------|
| `velric-agent subdomains <domain> <outdir>` | 子域枚举（crt.sh + CNAME + 词表） |
| `velric-agent subdomain-alter <domain> <outdir> --hosts a,b` | 改写式子域生成（+`--resolve`） |
| `velric-agent port-scan <host> <outdir>` | TCP top-ports 扫描 |
| `velric-agent wayback <domain> <outdir>` | 历史 URL（web.archive.org） |
…

Read the whole file at its exact version.

How to install

The exact contents, by fingerprint
mdr add ikooky/velric-agent/velric@sha256:6903b6cd10b2176a

The line at the top of this page pins the label git:20261106.02fabb2, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.

Badge

mdr badge

[![mdr](https://markdownregistry.com/badge/art_2rf5ftqarrwk45nr.svg)](https://markdownregistry.com/a/art_2rf5ftqarrwk45nr)

0 badge image fetches in 30 days. What the badge shows.

Versions

The registry has recorded 3 versions of this file, all committed on Nov 6, 2026.

versioncommittedcommitsizeaudit
git:20261106.02fabb2 latest2026-11-06 02fabb2 7,950 BA view · diff
git:20261106.cc0dfd62026-11-06 cc0dfd6 7,913 BA view · diff
git:20261106.7e77c3a2026-11-06 7e77c3a 7,592 BA view

Audit of the latest version

A  17 of 17 checks passed. Fixed automatic checks with no AI involved, so the same checks give the same answer every run.
  • pass: Frontmatter block present
  • pass: Frontmatter declares a name
  • pass: Frontmatter declares a description
  • pass: Size between 200 bytes and 200 KB (7950 bytes)
  • pass: No zero-width or bidi control characters
  • pass: No instruction hidden inside an HTML comment
  • pass: No link to an exfiltration or paste host
  • pass: No credential-shaped string
  • pass: No instruction to send local credentials anywhere
  • pass: No text hidden with inline styles
  • pass: No prompt-injection phrasing
  • pass: No curl or wget piped into a shell
  • pass: No recursive delete of root, home or parent
  • pass: No instruction to read or print local credentials
  • pass: No base64 blob over 200 characters
  • pass: No link to a raw IP address
  • pass: No script tag

Source

GitHub

ikooky/velric-agent · 3 stars · license MIT · pushed 2026-11-06 · branch main

API

GET https://markdownregistry.com/api/v1/artifacts/art_2rf5ftqarrwk45nr
GET https://markdownregistry.com/api/v1/resolve?ref=ikooky/velric-agent/velric
GET https://markdownregistry.com/api/v1/blob/6903b6cd10b2176ad52fdf7cbb2a4ac53c9d73c9a5fb8cabce72bbe8411e3544

Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.

Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.

Browse by kind, by grade A, or by owner.