haryy985/yunkun-console-preview/skill

Clown 2.1 Deep Entry

Read this file after the package root entry when the task needs detailed routing. The canonical workflow is:

scope -> profile -> collect -> normalize -> prioritize
      -> hypothesis -> validate -> evidence -> report -> replay

Route Table

Canonical Knowledge Base

The detailed checks live in knowledge-base/. Start with knowledge-base/README.md, then open the smallest file matching the current signal:

• recon-methodology.md for asset and route modeling;
• idor-test.md for object and function authorization;
• authbypass-test.md and oauth-jwt-test.md for identity and token

boundaries;

• api-gateway-test.md, graphql-test.md, and websocket-test.md for API

transport and schema boundaries;

• logic-test.md and race-condition-test.md for business-state integrity;
• injection-test.md, ssrf-test.md, xss-test.md, and

file-upload-test.md for input and content boundaries;

• info-leak-test.md, path-traversal-lfi-test.md, and

http-smuggling-test.md for exposure and request-boundary signals.

Evidence Contract

Every lane must preserve:

scope_ref:
run_id:
asset:
source:
observed_at:
hypothesis:
baseline:
mutation:
response_delta:
state_effect:
impact:
cleanup:
evidence:
status:
next_action:

The status is one of confirmed, incomplete, negative, or blocked. Missing proof is recorded as a gap; it is never filled by inference.

Operating Rules

• Use passive collection first.
• Keep one active hypothesis per branch.
• Change one variable per validation.
• Preserve provenance and redact secrets.
• Stop on scope ambiguity, rate limiting, unexpected state change, or

unbounded impact.

• Load one expert module only when a primary lane identifies a concrete need.
• Return all expert results to the same evidence contract.

The architecture contract is in references/architecture/route-contract.md. The machine-readable registry is in references/architecture/skill-registry.json.