hunt-credentials skillA
This file is byte-identical to the first copy the registry indexed. Same content hash, same audit grade.
hunt-credentials is agent-read markdown (skill) from cha0upup/leoai: 在已授权的 Puppet 立足点上定向搜集与红队任务相关的应用、JVM、数据库、SSH、云和服务账号凭据线索，建立“凭据—身份—目标—用途”映射。当需要扩大访问、接近指定业务目标或判断当前主机凭据价值时使用。.
Indexed from public GitHub and served as immutable, content-addressed versions. Install it pinned to an exact SHA-256 with the mdr CLI, and every file is verified against the hash recorded here before it reaches your agent. The deterministic audit below grades the latest version, and the same file always earns the same grade.
What the file says
# 定向凭据猎取 目标不是尽可能多地抓取秘密，而是找到能推进当前任务的最少凭据，并说明它能用于哪个明确目标。 ## 行动目标 - 定位当前进程、当前用户和已确认应用目录中的凭据来源。 - 将每条线索关联到身份、服务、目标和预期权限。 - 优先识别能推进演练目标、横向移动或访问高价值服务的凭据。 - 为受控验证提供最小输入，不在本 skill 内使用凭据登录。 ## 授权与 ROE - 风险等级：medium；访问模式：read-only-sensitive。 - 只检查当前 JVM、当前用户目录和已确认部署目录。 - 不批量读取其他用户目录、浏览器或无关个人数据。 - 不读取或保存私钥正文；优先引用目标上的路径和指纹。 - 不下载、上传或修改凭据文件，不使用发现的凭据发起认证。 - 已发现的凭据在回复、计划结果、摘要和报告中保留完整原值及来源。 ## OPSEC 预算 - Java 目标最多一次 `harvestAll`。 - 系统枚举最多一次合并 `exec`；递归搜索只允许一个已确认目录。 - 候选文件先列元数据，按任务相关性选择后再读取；不要整目录导出。 - 结果达到任务所需的可用凭据后停止扩张搜索。 ## 工作流 1. 读取侦察摘要和用户目标，确定所需凭据类型与目标服务。 2. 创建 4 步以内计划：运行时采集、系统线索、定向读取、价值排序与交接。 3. Java 应用调用一次 `harvestAll`；非 Java 目标跳过。 4. 用一次受限 `exec` 枚举环境、进程参数和当前用户候选文件。 5. 只对高相关候选调用 `readTextFile`、`searchFileContent` 或 `ResourceTools`。 6. 解析占位符和连接关系，构建凭据—目标矩阵，去重并保留原值。 7. 输出可复用线索及来源；系统会从成功工具结果中自动维护侦察摘要。 ## 系统枚举 Linux/macOS： ```bash echo '=== ENV ==='; env | grep -iE 'password|passwd|secret|token|credential|api[_-]?key|access[_-]?key|jdbc|redis|nacos' 2>/dev/null echo '=== PROCESS ARGS ==='; ps -eo pid,user,comm,args --no-header 2>/dev/null | grep -iE 'password|passwd|secret|token|jdbc:|redis|nacos|vault|aws|azure|gcp' | grep -v grep | head -80 …
Read the whole file at its exact version.
How to install
mdr add cha0upup/leoai/hunt-credentials@git:20260811.70d939dmdr add cha0upup/leoai/hunt-credentials@sha256:b093752f833c44e4Pin to a label to follow the author's releases, or to a sha256 to freeze the exact bytes forever. Either way the resolved hash is written to mdr.lock, and mdr install reproduces it on any machine.
[](https://markdownregistry.com/a/art_yhkqvsc7lcsjt75m)
1 badge views in 30 days
Versions
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| git:20260811.70d939d latest | 2026-08-11 | 70d939d | 5,744 B | A | view · diff |
| git:20260803.d1bb122 | 2026-08-03 | d1bb122 | 5,813 B | A | view · diff |
| git:20260802.c3cfa70 | 2026-08-02 | c3cfa70 | 5,794 B | A | view · diff |
| git:20260801.6c9c129 | 2026-08-01 | 6c9c129 | 5,803 B | A | view · diff |
| git:20260619.8264b54 | 2026-06-19 | 8264b54 | 12,469 B | F | view |
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (5744 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
cha0upup/leoai · 307 stars · license GPL-3.0 · pushed 2026-09-19 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_yhkqvsc7lcsjt75m GET https://markdownregistry.com/api/v1/resolve?ref=cha0upup/leoai/hunt-credentials GET https://markdownregistry.com/api/v1/blob/b093752f833c44e4c984e9af55b3af8517b921f9b2714c72d66fdc33845986df
Your agent does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.