Maybe4a6f7365
Community@Maybe4a6f7365
Maybe4a6f7365 provides a bug bounty hunting skill suite covering recon, CWE-class vulnerability discovery, dynamic PoC validation, and HackerOne scope/version tracking.
Agent Skills by Maybe4a6f7365
Showing 24 vetted skills indexed across 1 GitHub repositories.
Maybe4a6f7365sqli-hunter
Detect SQL injection in web inputs using boolean, error, and bounded-time differentials.
Maybe4a6f7365dynamic-poc-validation
Validates candidate vulnerabilities by executing dynamic proof-of-concept tests with independent outcome verification.
Maybe4a6f7365scope-policy-qualification
Validates bug-bounty scope and reportability against live program policies and target contracts.
Maybe4a6f7365rce-chaining
Chains proven primitives like file write, SSRF, and deserialization into remote code execution paths.
Maybe4a6f7365idor-hunter
Detect object-level authorization failures in REST and GraphQL APIs using two-principal controlled testing.
Maybe4a6f7365business-logic-hunter
Detect business-logic flaws by testing workflow invariants, limits, races, and normalization.
Maybe4a6f7365info-disclosure-hunter
Detect sensitive data exposure through serialization drift, public artifacts, and cross-origin resources.
Maybe4a6f7365path-traversal-hunter
Test file operations for path traversal using controlled canary files and encoded payloads.
Maybe4a6f7365xss-reflected-hunter
Detect reflected XSS by tracing input through redirects, Markdown renderers, and CSP-sensitive sinks.
Maybe4a6f7365ssrf-hunter
Detect server-side request forgery in URL fetchers, webhooks, and renderers using out-of-band verification.
Maybe4a6f7365duplicate-preflight
Prepares novelty-check search terms and checklists for human duplicate review before bug-bounty submission.
Maybe4a6f7365case-bundle-builder
Constructs case-bundle.yaml files from CVE/GHSA advisories, repositories, and fix-commit evidence.
Maybe4a6f7365access-control-hunter
Detects broken access-control flaws across alternate interfaces, identity lifecycles, and tenant boundaries.
Maybe4a6f7365privesc-hunter
Tests vertical privilege escalation via alternate APIs, role parameters, and capability checks.
Maybe4a6f7365patch-review-hunter
Evaluates whether security patches fully enforce the intended invariant across all reachable code paths.
Maybe4a6f7365break-assumptions
Enumerate and rank implicit developer assumptions behind an attack surface before vulnerability hunting.
Maybe4a6f7365auth-bypass-hunter
Tests OTP, OAuth, session, and API endpoints for authentication bypass vulnerabilities.
Maybe4a6f7365recon
Map a target's external attack surface and route candidates to vulnerability-class hunters.
Maybe4a6f7365xss-stored-hunter
Detect stored XSS by tracing persisted user input through storage to later render contexts.
Maybe4a6f7365version-tracker-add-target
Adds bug bounty targets with assets and version sources to a tracking database.
Maybe4a6f7365version-tracker-daily-check
Runs daily version checks across enabled sources and records changes in SQLite.
Maybe4a6f7365version-tracker-db-init
Initializes the version-tracker SQLite database with schema, indexes, and seed data.
Maybe4a6f7365version-tracker-import-h1
Import HackerOne program and scope data from bounty-targets-data JSON into a SQLite database.
Maybe4a6f7365version-tracker-discover
Re-discover relocated version sources after structural failures in version checkers.
Frequently Asked Questions About Maybe4a6f7365
FAQPage SchemaWhat tasks can I perform using Maybe4a6f7365's skills?▼
You can map a target's external attack surface, hunt CWE-class vulnerabilities (SQLi, XSS, SSRF, IDOR, path traversal, auth bypass, privilege escalation, business logic), chain primitives into RCE, dynamically validate PoCs, review patch completeness, and manage HackerOne scope and version tracking.
Who are these skills designed for?▼
They target bug bounty hunters and security researchers running authorized engagements. Skills like scope-policy-qualification enforce in-scope and program_reportable gates against live program policy, while duplicate-preflight hands novelty checks to a human querying HackerOne Hacktivity before submission.
How does a typical engagement flow through these skills?▼
Start with scope-policy-qualification at target entry, run recon to map the attack surface, apply break-assumptions, then route to CWE hunters. Qualify candidates with dynamic-poc-validation, run duplicate-preflight, and re-check policy before submission.
What prerequisites or dependencies do the version-tracker skills need?▼
The version-tracker skills require a SQLite database initialized via version-tracker-db-init, then seeded by importing HackerOne scope data from the arkadiyt/bounty-targets-data JSON feed. Daily checks dispatch to builtin or custom checkers with failure classification and auto re-discovery.
Do these skills enforce authorization and safe testing boundaries?▼
Yes. scope-policy-qualification builds an in-scope allowlist from the program policy and target contract.yaml, sets identification headers and rate budgets, and gates handoff. SQLi hunting uses safe boolean, error, and bounded-time differentials rather than destructive payloads.