Agent Skills › XiaomingX/mimofan › vuln-hunt

vuln-hunt

GitHub

用于在真实项目中定位并复现漏洞的长周期安全分析技能，涵盖攻击面侦察、假设验证、链追踪及PoC执行。

crates/tui/assets/skills/vuln-hunt/SKILL.md XiaomingX/mimofan

Trigger Scenarios

需要发现并复现具体漏洞进行深度安全审计

Install

npx skills add XiaomingX/mimofan --skill vuln-hunt -g -y

More Options

Non-standard path

npx skills add https://github.com/XiaomingX/mimofan/tree/main/crates/tui/assets/skills/vuln-hunt -g -y

Use without installing

npx skills use XiaomingX/mimofan@vuln-hunt

指定 Agent (Claude Code)

npx skills add XiaomingX/mimofan --skill vuln-hunt -a claude-code -g -y

安装 repo 全部 skill

npx skills add XiaomingX/mimofan --all -g -y

预览 repo 内 skill

npx skills add XiaomingX/mimofan --list

SKILL.md

Frontmatter

{
    "name": "vuln-hunt",
    "description": "Long-horizon security workflow to FIND AND REPRODUCE a vulnerability in a real project (e.g. fastjson deserialization gadget, Spring Boot RCE) using hypothesis\/evidence tracking, gadget-chain tracing, and a realized run_poc."
}

Vuln Hunt (long-horizon security analysis)

Use this skill when the task is to find AND reproduce a vulnerability in a real project (e.g. fastjson deserialization gadget, Spring Boot RCE), not to merely classify code.

Workflow (follow in order; do not skip steps)

Recon: enumerate attack surface — deps, entry points, sinks (call_graph, ast_query, security_audit/semgrep).
Hypothesize: for each suspected sink, register a hypothesis with hypothesis action=create stating the claimed exploit class + CVE.
Trace: run gadget_chain_trace for the sink; identify which gadgets are PRESENT vs MISSING in the target — the missing ones are what you must prove reachable or rule out. Cross-check with call_graph reachability.
Gather evidence: for every hypothesis, call hypothesis action=add_evidence with concrete code references / taint paths BEFORE concluding.
Reproduce: build a candidate PoC and run run_poc with an expect string that proves the vulnerable behavior. realized=true => exploit confirmed.
Verdict: hypothesis action=resolve verdict=confirmed|refuted — this is REFUSED unless evidence was attached (consistency gate). Never assert a finding without evidence + a realized PoC.