src-hunter SKILL.md skillA
src-hunter from novaestellar/novahaku is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add novaestellar/novahaku/src-hunter@git:20260926.721cd96Pins git:20260926.721cd96 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- novaestellar/novahaku
- Path
testing/pentest-tools/src-hunter/SKILL.md- Versions recorded
- 3
- Latest version
- git:20260926.721cd96, committed Sep 26, 2026
- First version recorded
- Sep 10, 2026
- Size
- 11,962 bytes
- Repository stars
- 28
- License
- MIT
实战 SRC / 众测 / Bug bounty 漏洞挖掘工作流 skill。包含：5 阶段方法论（intake → recon → enum → hunt → report）、19 个攻击类 playbook（SQLi/XSS/RCE/SSRF/IDOR/CSRF/Path Traversal/File Upload/SSTI/XXE/Race/HTTP Smuggling/OAuth/JWT/SAML/GraphQL/Mobile/LLM/DoS）、305 个结构化 payload、263 个 WAF/EDR 绕过变体、2887 份 HackerOne 真实 High/Critical 已披露案例、77,000+ WooYun 案例统计、国产 OA / 中间件指纹库、银行 / 电信行业垂直 playbook。当用户提到 "src 挖洞 / src 漏洞挖掘 / bug bounty / 众测 / hackerone / 漏洞赏金 / SRC / 任意 X 漏洞 / 渗透测试" 或问"如何挖某个目标 / 怎么测某个 API / 如何绕过 WAF" 时触发。.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
## ACTION REQUIRED（读完后立刻执行） 2. `NOW`: 读取 `../../field-journal/precedent-pentest.md` — 日常操作说明，不代替 scope 3. `NOW`: 确认当前任务是否命中本 skill 的适用范围 4. `NEXT`: 读取 `../../tool availability`，校验工具可用性和实际路径 5. `NEXT`: 缺工具时调用 bootstrap，不要猜路径 6. `ACT`: 进入工作流。默认只读 playbook 骨架；`payloader/`、`waf-bypass.md` 仅在 scope 已 granted 且用户明确要 payload 时打开 7. `MUST NOT` 把「2887 H1 报告」当成本仓已跟踪目录（`h1-reports/` 不在树里） 8. `MUST NOT` 因 payload corpus 触发杀毒告警而关闭防护；优先核对 Git blob/hash 与安全复审报告（`docs/SECURITY-REVIEW-2026-09-03.md`，未随本仓库分发） # SRC Hunter — 实战漏洞挖掘工作流 实战 Security Response Center / 众测 / Bug bounty 挖洞 skill。把白盒方法论翻译为黑盒探测，叠加真实案例统计与 payload 库。 --- ## 何时使用本 skill **关键词命中**： - "src 挖洞" / "src 漏洞" / "src 测试" / "Security Response Center" - "bug bounty" / "漏洞赏金" / "众测" - "hackerone" / "h1" / "bugcrowd" / "intigriti" / "yeswehack" - "如何挖 / 怎么测 / 怎么打 + 某目标 / 某接口 / 某参数" - "WAF 绕过" / "绕过 WAF" / "WAF bypass" - "任意账号 / 任意修改 / 任意删除 / 任意操作" 类越权 - "密码重置" / "找回密码" 类逻辑 - "未授权访问" / "默认凭据" / "Actuator" / "Spring 暴露" / "Redis 未授权" - 用户给一个 URL 或 API endpoint 让你测 **不应使用本 skill**： - 纯白盒源码审计（用 `code-audit` skill） - 已知漏洞的修复 / 防御问答（用通用对话） - 单独的 CTF 题目（这是真实环境工作流） --- ## 工作流 — 5 阶段 ### Phase 1 · Intake（接单） 输入：程序名 / SRC 入口 URL / 子域。 …
Read the whole file at its exact version.
How to install
mdr add novaestellar/novahaku/src-hunter@sha256:182b1354ee61629cThe line at the top of this page pins the label git:20260926.721cd96, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_lllmy5loxzc2qqau)
3 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 3 versions of this file, between Sep 10, 2026 and Sep 26, 2026, about one every 8 days.
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| git:20260926.721cd96 latest | 2026-09-26 | 721cd96 | 11,962 B | A | view · diff |
| git:20260923.6f7e0fc | 2026-09-23 | 6f7e0fc | 11,956 B | A | view · diff |
| git:20260910.546fe86 | 2026-09-10 | 546fe86 | 11,909 B | A | view |
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (11962 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
novaestellar/novahaku · 28 stars · license MIT · pushed 2026-09-28 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_lllmy5loxzc2qqau GET https://markdownregistry.com/api/v1/resolve?ref=novaestellar/novahaku/src-hunter GET https://markdownregistry.com/api/v1/blob/182b1354ee61629c959c8d2920eb3e81ccdafef3fd466a73425077b72cee7ece
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.