Agent Skills
› PentesterFlow/agent
› my-skill
my-skill
GitHub提供安全测试流程指导，包含使用curl和http工具进行目标探测、引用载荷文件执行检查脚本的具体命令，以及验证漏洞影响并调用confirm_finding报告发现的标准化步骤。
Trigger Scenarios
需要对外部目标进行HTTP探测或安全扫描
发现潜在漏洞需按标准流程复现并报告
Install
npx skills add PentesterFlow/agent --skill my-skill -g -y
SKILL.md
Frontmatter
{
"name": "my-skill",
"description": "One line on what this playbook does, then a \"Use when ...\" clause so the agent knows when to load it (e.g. \"Use when the target exposes X \/ you see Y in requests\"). Max 1024 chars. This description is the ONLY thing the model sees until it loads the skill — make the trigger conditions explicit, since there is no separate `triggers` list.",
"allowed-tools": [
"http",
"shell",
"file_write"
]
}
my-skill playbook
State the goal in one or two sentences — what the operator is trying to achieve — and the scope rules (authorized targets only).
1. First step
Concrete, copy-pasteable commands. Default to curl + the http tool; only
reach for specialised scanners when the user asks.
curl -ksS "https://TARGET/..."
Reference bundled files (e.g. a wordlist under payloads/) with
read_payloads(skill="my-skill", file="list.txt"), or shell scripts via the
${SKILL_DIR} placeholder:
${SKILL_DIR}/scripts/check.sh https://TARGET
2. Next step
...
Reporting
What proves the bug, the concrete impact in one sentence, and remediation.
When you have a reproduced finding with a real request/response, call
confirm_finding.
Version History
- 117c95c Current 2026-07-22 09:38
