hellodqy/mastermind-bug-bounty/analyst
Claude Code and agent skill by hellodqy/mastermind-bug-bounty
Trust tier 3
- community
Source check pending
Checking that the SKILL.md file is still in the repository.
Rank reconnaissance-derived attack surfaces and design evidence-driven tests without active exploitation.
Install
npx vskill@latest install hellodqy/mastermind-bug-bounty/analystSKILL.md
Attack Surface Analyst
Goal
把侦察结果变成按价值排序的攻击面队列，并识别可串联的上下游关系；本阶段不发送攻击请求。
Tools / Inputs
- Phase 0 结构化产物
- 已授权范围与技术栈指纹
references/INDEX.md，只按已选择方向读取少量资源
Constraints
- 每个攻击面必须有证据来源和可证伪假设。
- 使用归一化优先级公式并按分数降序排列。
- 本阶段不得执行主动攻击或利用。
- 硬编码 API 凭据、内网地址、Swagger/OpenAPI、Druid 路径作为
lead_only进入队列；地图 API Key、CORS 不进入队列。 - 输出必须符合
_attack_surfaces.json产物合同。
Chain-First Questions
- 这个入口能解锁哪些数据、权限、令牌或内部资产？
- 哪两个弱信号组合后会显著提高置信度？
- 验证成功后，下一次权限提升最可能在哪里？
Security
- Security scanPassed, 90 of 100Pattern checks on the skill's files.
- Model reviewPassed
Quality evaluation
- Task evaluationNot runNo evaluation yet. Run one in Skill Studio.
Source
- SKILL.md in the repositoryCheckingagents/analyst/SKILL.md
Popularity
- 7-day trend score
- 5
Not refreshed yet.
Works with
Any agent vskill installs to: 56 targets in all. These 39 have a page on this site.
- Claude Code
- Cursor
- GitHub Copilot
- Windsurf
- Codex
- Gemini CLI
- Cline
- Amp
- Roo Code
- Goose
- Continue
- Kilo Code
- Junie
- Trae
- OpenHands
- Qwen Code
- AI Agent
- Tabnine Chat
- Sourcegraph Cody
- Amazon Q
- Firebase Genkit
- Sweep
- Devin
- Phind
- Mentat
- Claude Desktop
- Aider
- GPT Pilot
- Plandex
- bolt.new
- v0
- Replit Agent
- Anse
- TypingMind
- BetterChatGPT
- LibreChat
- Warp AI
- Pieces
- Fig AI
Embed badge
[](https://verified-skill.com/skills/hellodqy/mastermind-bug-bounty/analyst)