Individual skill
secknowledge-skill
Web+AI 安全测试知识库。融合 WooYun 88,636 案例 + 先知 L1-L4 方法论 + GAARM 150 风险 + OWASP Top 10 (LLM/ASI/WSTG)。 TRIGGER when 任务是实战安全测试：渗透测试、漏洞挖掘/利用、红队攻防、安全审计 (SAST/DAST)、 CTF、AI/LLM 安全测试 (Prompt 注入/越狱/MCP/Agent/沙箱逃逸)。用户明确给出测试目标 (URL/代码/模型/Agent 架构) 且意图是"测试/审计/挖漏洞/利用"。 DO NOT trigger: - 安全概念讨论（"什么是 XSS"、"SQL 注入原理是什么"）→ 普通问答 - 非安全性质的 code review / debug / 性能优化 → code-audit-skill 或其他 - 修复语法错误 / 业务逻辑 bug → 普通编程协助 - 纯 Web 白盒代码审计（完整项目目录 / Source-Sink 污点分析）→ code-audit-skill - 仅引用 CVE 编号查文档 → WebSearch 边界细则: CTF 短代码片段 + 利用思路 → 本 Skill；完整项目目录 + 系统白盒审计 → code-audit-skill
deepsec/spear/skills/specialized/secknowledge-skill/SKILL.md
Source commit fff031fc01fb36b95348214c8ee359f6ede8aa8b
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- Yes
- Repository scan complete
- No
- Skill scan complete
- Yes
- Observed behavior
- Network or broad shell
- Last checked
- Nov 4, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 509
- Repository last updated
- Aug 24, 2026
- License
- MIT
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
- agent Repository topic
- ai Repository topic
- ai-agents Repository topic
- aisecurity Repository topic
- cybersecurity Repository topic
- plugin Repository topic
- security Repository topic
- vscode Repository topic
- vulnerability Repository topic
- hacker Repository topic
- data Derived category
- security Derived category
- data-databases Derived category
- security-application Derived category
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Browse files
SKILL.mdcore · 13,980 bytesreferences/ai-app-agent-cot.mddoc · 19,923 bytesreferences/ai-app-deploy.mddoc · 4,639 bytesreferences/ai-app-frontier.mddoc · 6,377 bytesreferences/ai-app-mcp.mddoc · 8,848 bytesreferences/ai-app-prompt.mddoc · 19,159 bytesreferences/ai-app-train.mddoc · 15,158 bytesreferences/ai-baseline-app.mddoc · 9,808 bytesreferences/ai-baseline-deploy.mddoc · 19,841 bytesreferences/ai-baseline-escape.mddoc · 6,665 bytesreferences/ai-baseline-train.mddoc · 6,563 bytesreferences/ai-data-app.mddoc · 34,268 bytesreferences/ai-data-deploy.mddoc · 7,250 bytesreferences/ai-data-train.mddoc · 22,125 bytesreferences/ai-identity-app.mddoc · 33,617 bytesreferences/ai-identity-deploy.mddoc · 7,316 bytesreferences/ai-identity-train.mddoc · 5,185 bytesreferences/ai-model-content.mddoc · 23,471 bytesreferences/ai-model-copyright.mddoc · 4,870 bytesreferences/ai-model-deploy.mddoc · 5,826 bytesreferences/ai-model-extraction.mddoc · 12,678 bytesreferences/ai-model-hallucination.mddoc · 9,878 bytesreferences/ai-model-jailbreak.mddoc · 13,758 bytesreferences/ai-model-misuse.mddoc · 19,252 bytesreferences/ai-model-train.mddoc · 10,638 bytesreferences/gaarm-risk-matrix.mddoc · 14,478 bytesreferences/testing-methodology.mddoc · 25,804 bytesreferences/vulnclaw-ctf-src-routing.mddoc · 4,007 bytesreferences/web-deployment-security.mddoc · 15,314 bytesreferences/web-deser.mddoc · 4,414 bytesreferences/web-leak.mddoc · 3,377 bytesreferences/web-logic-auth.mddoc · 16,770 bytesreferences/web-modern-protocols.mddoc · 10,589 bytesreferences/web-rce.mddoc · 7,055 bytesreferences/web-sqli-fushuling-one-pass.mddoc · 7,925 bytesreferences/web-sqli.mddoc · 7,018 bytesreferences/web-ssrf-misc.mddoc · 6,126 bytesreferences/web-traversal.mddoc · 3,551 bytesreferences/web-upload.mddoc · 5,450 bytesreferences/web-xss.mddoc · 5,167 bytesreferences/web-xxe.mddoc · 3,183 bytes
Read excerpt
# Web 和 AI 安全测试知识库
> 知识源: WooYun 88,636 漏洞 × 先知 5,600+ 文档 × GAARM 150 AI 风险 × OWASP
> 架构: SKILL.md（路由）→ references/（按场景加载）
## VulnClaw 集成说明
- 本 Skill 集成自 `Pa55w0rd/secknowledge-skill`，在 VulnClaw 中作为 `secknowledge-skill` specialized skill 使用；上游声明为 MIT License。
- CTF/SRC 场景先加载 `references/vulnclaw-ctf-src-routing.md` 判断资料入口，再按漏洞类型加载 `web-*`、`ai-*`、`testing-methodology.md` 或 `gaarm-risk-matrix.md`。
- 与 VulnClaw 现有技能协同：CTF 单题技巧优先结合 `ctf-web`/`ctf-crypto`/`ctf-misc`，SRC 和实战漏洞挖掘优先使用本 Skill 的方法论、案例映射、风险矩阵和证据约束。
- 输出时保留上游的授权边界、引用标注和"假设/确认"区分；未能从 reference 佐证的 payload、CVE、GAARM/OWASP 编号必须明确标注为未核对。
## 触发条件
