SkillTrust

← All skills

src-hunter

32 / 100 · High risk

Only if you trust the author. Some of what it can do is expected: a coding skill usually runs build and test commands.

By longwangjiang88/SusuAIOverclock-pojia (GitHub) · coding · 42 stars · scanned at commit 667b2db

实战 SRC / 众测 / Bug bounty 漏洞挖掘工作流 skill。包含：5 阶段方法论（intake → recon → enum → hunt → report）、19 个攻击类 playbook（SQLi/XSS/RCE/SSRF/IDOR/CSRF/Path Traversal/File Upload/SSTI/XXE/Race/HTTP Smuggling/OAuth/JWT/SAML/GraphQL/Mobile/LLM/DoS）、305 个结构化 payload、263 个 WAF/EDR 绕过变体、2887 份 HackerOne 真实 High/Critical 已披露案例、77,000+ WooYun 案例统计、国产 OA / 中间件指纹库、银行 / 电信行业垂直 playbook。当用户提到 "src 挖洞 / src 漏洞挖掘 / bug bounty / 众测 / hackerone / 漏洞赏金 / SRC / 任意 X 漏洞 / 渗透测试" 或问"如何挖某个目标 / 怎么测某个 API / 如何绕过 WAF" 时触发。

Works with any agent that supports SKILL.md skills.

What this skill can do

Sends data to these websites: target$path, target, attacker.cc, 169.254.169.254, exchange.com, sharepoint.com

This is disclosed by the author in the skill's SKILL.md or README.

Found in 730 places.

Show 17 more

and 710 more places

Contains code that is hidden or hard to read

The author does not mention this.

Found in 15 places.

Show 12 more

Downloads and installs other software

The author does not mention this.

Found in 25 places.

Show 17 more

and 5 more places

Runs commands on your computer

The author does not mention this. Expected for a coding skill.

Found in 113 places.

Show 17 more

and 93 more places

Reads your saved credentials, such as SSH keys or .env files

This is disclosed by the author in the skill's SKILL.md or README.

Found in 9 places.

Show 6 more

Changes files outside its own folder

The author does not mention this.

Found in 2 places.

Safer alternatives

Low-risk skills in the same category (coding) that look related. Check that one does what you need.

Other copies in this repository

longwangjiang88/SusuAIOverclock-pojia has 1 more folder with a skill named src-hunter. This page shows the lowest-scoring copy.

Install

Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.

if [ -e ~/.agents/skills/'src-hunter' ] || [ -L ~/.agents/skills/'src-hunter' ]; then echo 'A skill folder named src-hunter already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/longwangjiang88/SusuAIOverclock-pojia' "$d" && git -C "$d" checkout --quiet '667b2db2746516eae05412bbdcad77515d528f37' -- 'packed-packs/codex/materials/skills/zzy-codex5.6/zzy-reverse-skill/skills/pentest-tools/src-hunter' && mkdir -p ~/.agents/skills && cp -R "$d"/'packed-packs/codex/materials/skills/zzy-codex5.6/zzy-reverse-skill/skills/pentest-tools/src-hunter' ~/.agents/skills/'src-hunter' && rm -rf "$d"; fi

Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'src-hunter' ~/.claude/skills/'src-hunter' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.

Badge for your README

The badge for longwangjiang88/SusuAIOverclock-pojia shows the score of its lowest-scoring skill.

SkillTrust badge for longwangjiang88/SusuAIOverclock-pojia

[![SkillTrust](https://zalavijaysinh.github.io/skilltrust/badges/longwangjiang88/SusuAIOverclock-pojia.svg)](https://zalavijaysinh.github.io/skilltrust/repos/longwangjiang88/SusuAIOverclock-pojia/)

Score history

DateVersionScore
2026-11-08667b2db30

Also found in

Identical copies of this skill exist at: