haryy985

AI Agent 系统安全测试execution-framework。当目标系统使用 AI Agent 执行工具调用、多 Agent 协作、 或自主决策时触发。覆盖 OWASP Agentic AI Security Top 10 (ASI01-ASI10):...

AI 系统身份与权限安全测试execution-framework。当目标系统涉及 Agent 身份认证、多 Agent 权限管理、 角色设定安全、会话管理、或 MCP/API 凭据管控时触发。 覆盖: 角色逃逸(假定场景/假定角色/遗忘法/目标劫持)、权限失...

API authentication and JWT abuse playbook. Use when testing bearer tokens, API keys, claim trust, header spoofing, rate limits, an...

API authorization and BOLA testing playbook. Use when APIs expose object identifiers, nested resources, hidden writable fields, or...

haryy985/yunkun-console-preview

API reconnaissance and documentation review playbook. Use when discovering endpoints, schemas, versions, OpenAPI specs, hidden doc...

Unified API security lane for authorized REST, GraphQL, gateway, token, object authorization, file, and asynchronous API review.

Authorized business-flow integrity lane for payment, order, quota, coupon, identity, approval, workflow, and state-transition revi...

haryy985/yunkun-console-preview

GraphQL API 安全测试。当发现 /graphql 端点、POST JSON 查询、GraphQL Playground/Explorer 页面、响应中有 data/errors JSON 结构时使用。包含 Introspection 泄露、注入攻击、...

IDOR and broken object authorization testing playbook. Use when requests expose object identifiers, tenant boundaries, writable fi...

OAuth 2.0 / OIDC / SSO authentication-flow router and attack guide. Use when the target shows third-party login, redirect_uri para...

Automate browser interactions, test web pages and work with Playwright tests.

AI/LLM 间接 Prompt 注入攻击。当目标 AI 系统会处理外部数据源（网页、文档、邮件、数据库、API 返回）时使用。覆盖间接注入、工具链劫持、RAG 投毒、数据外泄等技术。OWASP LLM Top 10 #1 漏洞类别

Race condition and TOCTOU testing for web apps. Use when testing one-time operations, concurrent HTTP abuse, rate-limit bypass, Tu...

Reconnaissance and methodology playbook. Use when mapping assets, discovering endpoints, fingerprinting technology, and building a...

HTTP request smuggling and desynchronization testing. Use when front proxies, CDNs, or load balancers disagree with the origin on ...

通过 ScopeSentry MCP 管理安全扫描平台（项目、任务、模板、资产、节点）。在用户提到 ScopeSentry、MCP、API Key、扫描任务、资产查询时使用。

Use when planning systematic security testing (L1-L4 thinking pyramid, WooYun formula, OWASP/WSTG mapping).

Deep routing entry for the Clown 2.1 authorized security workflow. It coordinates collection, target profiling, specialist validat...

Clown 2.1 information collection and evidence-normalization workflow for authorized targets. Use Grok orchestration, FOFA-style se...

Target inventory, technology graph, trust-boundary, and attack-surface prioritization lane for authorized reviews.

haryy985/yunkun-console-preview

Iterative authorized SRC discovery and validation lane. It keeps one bounded hypothesis active, prevents idle scanning, and return...

Evidence, severity, reproduction, and submission-quality lane for authorized security findings.

服务端请求伪造(SSRF)的检测与利用execution-framework。当目标有 URL 获取/预览/导入功能、PDF 生成、Webhook、远程图片加载、RSS 导入时使用。包含 IP 过滤绕过大全、协议利用(file/gopher/dict)、云元数...

Target inventory, technology graph, trust-boundary, and attack-surface prioritization lane for authorized reviews.

WebSocket handshake, CSWSH, tooling (wsrepl, ws-harness, Burp), and common flaws. Use when apps use real-time channels, chat, noti...