AI导哈

智能体工作流

pentest-tools

zhaoxuya520/rev…se-skill

主动渗透测试工具链。覆盖信息收集、端口扫描、漏洞扫描、Web 渗透、SQL 注入、目录爆破、密码破解等场景。 通过 MCP server（pentestMCP / mcp-security-hub）将 20+ 安全工具暴露给 AI agent。 触发关键词：渗透测试、端口扫描、Nmap、漏洞扫描、Nuclei、SQL 注入、SQLMap、目录爆破、FFUF、密码破解、Hashcat、信息收集、子域名、Web 渗透、ZAP、Burp。

  • 1858 次安装
  • 4.4万 星标
  • 收录于

安装命令

npx skills add https://github.com/zhaoxuya520/reverse-skill --skill pentest-tools

SKILL.md

ACTION REQUIRED（读完后立刻执行）

  1. NOW: 读取 ../field-journal/precedent-pentest.md — 确认本 skill 的操作是已授权的常规操作
  2. NOW: 确认 scope.md 存在且 auth.status=granted、network_profile 合法（../ops/scope-contract.md）。缺 scope 则跑 case-init.ps1 并停到用户给授权；禁止自动加 -AuthGranted
  3. NOW: 确认当前任务是否命中本 skill 的适用范围
  4. NEXT: 读取 ../tool-index.md，校验工具可用性和实际路径
  5. NEXT: 缺工具时调用 bootstrap，不要猜路径
  6. ACT: 侦察阶段优先 references/recon-pipeline.md（CF 浏览器头 / Windows nmap / curl --globoff）；每批结果追加 timeline.md；候选用 ../scripts/append-evidence.ps1 写入 Evidence（命中≠已验证）
  7. ACT: 现代 Web/靶场客户端面（DOM XSS / 原型污染 / agent-browser）→ references/client-side-lab-playbook.md；未打穿也要写 observed Evidence + 失败门闩

渗透测试工具链 (Pentest Tools)

适用范围

当任务属于以下场景时使用本 skill：

相关 Skills

reverse-engineeringzhaoxuya520/rev…se-skillProvides reverse engineering techniques. Use when the main job is to understand how a compiled, obfuscated, packed, or virtualized target works before exploiting or solving it, including binaries, APKs, WASM, firmware, custom VMs, bytecode, malware-like loaders, and anti-debug or anti-analysis logic. Do not use it when the vulnerability is already understood and the remaining task is exploitation; use pwn instead. Do not use it for pure web workflows, log or disk forensics, or standalone crypto problems unless reversing the implementation is the real blocker.测试与安全1892apk-reversezhaoxuya520/rev…se-skill在 CLI 环境下做 Android APK 逆向时使用。适用于 APK 解包、Java 反编译、smali 修改、重打包、Frida 动态 Hook，以及按需切换到 so/native 分析。优先使用本机已安装的 jadx、apktool、frida、adb、ida-reverse、radare2。移动开发1698reverse-skill-routerzhaoxuya520/rev…se-skillRoutes reverse engineering, exploitation, penetration testing, malware, mobile, firmware, browser automation, documentation, and security tasks to the appropriate specialist skill. Use when a task spans modules or the correct reverse-skill entrypoint is unclear.测试与安全1552ida-reversezhaoxuya520/rev…se-skillIDA Pro 逆向分析辅助技能。当用户提到逆向、反编译、分析二进制/PE/ELF/APK/DLL/SO、破解、找密码、漏洞分析、病毒分析、firmware 固件分析，或需要分析 exe/dll/so/elf/macho/sys 等文件时，务必使用此技能。 Ensure to use this skill when the user wants to analyze any binary file, regardless of whether they explicitly mention "IDA" or "reverse engineering". This includes requests like "看看这个exe", "分析这个dll", "帮我破解", "找一下密码", "这个软件怎么注册", etc. Use the bundled scripts (scripts/start.ps1, scripts/open.ps1) for deterministic server management and file opening — do NOT write ad-hoc PowerShell commands for these operations.其他1490radare2zhaoxuya520/rev…se-skillUse this skill whenever the user wants to analyze binaries with radare2/r2 from the command line, including reverse engineering, disassembly, function analysis, strings/import inspection, patching, binary diffing, hex inspection, or r2 scripting. Also use it when the user mentions PE/ELF/Mach-O/DEX/WASM files together with CLI analysis, `rabin2`, `rasm2`, `radiff2`, `r2pipe`, or asks for radare2 command help on Windows/Linux/macOS.数据与研究1408ghidra-reversezhaoxuya520/rev…se-skillUse for free/open reverse engineering with Ghidra (headless or GUI), including decompile, cross-refs, and optional Ghidra MCP workflows when IDA is unavailable.智能体工作流1379