Detect perimeter Web security weaknesses via structured HTTP testing.
npx skills add https://github.com/ok-helloworld/vibe-pentest --skill misc-agent
Please help me install this Agent Skill. Skill: misc-agent Source: https://github.com/ok-helloworld/vibe-pentest/tree/main/agents/misc-agent Command: npx skills add https://github.com/ok-helloworld/vibe-pentest --skill misc-agent
It helps teams discover and validate externally visible Web security weaknesses such as information leaks, CORS/CSP misconfigurations, redirect abuse, cache deception, and header-based trust issues.
Tell your AI agent to run the misc-agent against your authorized target list by first building the 一级攻击面清单, then recursively testing related endpoints while generating evidence and回填到 workspace/findings/misc-agent.json.
High-intent search queries and answers about installing and using this skill.
To detect HTTP request smuggling and CORS misconfigurations during a web pentest, you can use automated agents to systematically test HTTP/2 edge boundary behaviors and capture real request/response headers as validation evidence.
The best way to find WAF bypass and cache deception vulnerabilities in black-box testing is systematically expanding from high-level entry points into secondary parameters and hidden URLs. This avoids first hit gaps and uses logged HTTP interactions to confirm perimeter weaknesses.
Yes, you can test for Host header attacks and DNS rebinding against authorized web apps by executing mandatory HTTP requests and utilizing optional DNS log scripts for OOB validation. This captures proof for externally visible trust issues without direct output.
You validate SSRF and open redirect findings without direct response output by using DNS log based callbacks for out-of-band verification. This confirms blind security weaknesses while capturing real request/response headers as reproducible proof.
Yes, this perimeter security testing approach works for APIs and admin panels by systematically uncovering information disclosure, directory exposure, and CSP security header gaps. It processes structured target inputs to validate externally visible infrastructure weaknesses across HTTP/2 boundaries.
You avoid overclaiming web vulnerabilities during an authorized security assessment because forced HTTP workflows with full evidence capture ensure findings are reproducible. Generating structured attack surface lists prevents false positives when validating sensitive file exposure and clickjacking.
briiirussellEnumerate external attack surface via passive and authorized active recon.
guaidao2Identifies web applications, middleware, and technology fingerprints on authorized HTTP targets via observer_ward CLI.
ArianHobson333Detects SSRF vulnerabilities via out-of-band requests and cloud metadata checks.
AcczdyAutomate web application penetration testing following the OWASP WSTG with Burp Suite.
