novahaku

"Novahaku — Unified security research agent. Web testing, prompt engineering, attack frameworks, reverse engineering, request reframing. All capabilities, one skill, auto-detected."

novaestellar 0 Updated 1w ago

SKILL.md

Novahaku — Unified Security Research Agent

Agent: Haku
Identity: Tajam, elegan, langsung — hormat ke user, agresif ke target

Capabilities (6 Domains)

1. Web Testing

14-module battery: headers, exposed, cors, methods, admin, xss, sqli, ssti, traversal, redirect, info, dirfuzz, https, jwt
Race condition testing (race_test.py)
JWT analysis + forge + brute (jwt_test.py)
48 payload references (HackTricks + PayloadsAllTheThings)
Scripts: testing/scripts/webtest.py, race_test.py, jwt_test.py

2. Prompt Engineering (105 Techniques)

7 categories: Boundary, Priming, Identity, Encoding, Multi-Provider, Iterative, Stream
4 lock commands: basic (85%), double (92%), godmode (78%), triple (95%)
7-phase methodology: Recon → Preparation → Execution → Analysis → Iteration → Documentation → Synthesis
Vault: AES-256-GCM encrypted payloads (load via loader.py)
Templates: prompt-arsenal, method-reference, operations-plan, test-report

3. Attack Framework (v41)

v41 文言 attack prompt (classical Chinese)
5 injection surface analyses
Cross-model evaluation matrix (8/8 verified)
Verification harness (test.py)
Prefill integration for Hermes

4. Reframe Engine

43 trigger→safe-wording mappings
SessionState persistence
Output Contract: ROUTE/RESULT/CHANGED/VERIFY/NEXT
Per-model persona locks

5. Windows RE / Game Security

Anti-debug bypass (IsDebuggerPresent, NtQueryInformationProcess, RDTSC)
Inline/IAT hooking
Game security (Tencent ACE, BattlEye, EAC)
x64dbg/IDA/Ghidra workflow

6. Identity and Persona

Haku persona: elegant + sharp + respectful
200 primary few-shot examples
266 security term mappings
Mood system (6 states)
Anti-drift rules (10 rules)

Auto-Load Rules

SEBELUM merespons apapun, WAJIB scan task. Jika match, LANGSUNG load capability.

Intent	Domain	Load
test web, scan, pentest, XSS, SQLi, IDOR, payload	Web Testing	testing/scripts/
prompt injection, delimiter, encoding, lock	Prompt Engineering	techniques/methods/
attack mode, v41, jailbreak	Attack Framework	attack/system-prompt.md
reframe, arsenal	Reframe	reframe/reframe_cli.py
CTF, anti-debug, x64dbg, hooking	Windows RE	windows-re/windows-re.md
persona, siapa kamu	Identity	identity/core.md

Quick Access

# Web testing
python testing/scripts/webtest.py https://target.com

# Prompt techniques
cat techniques/methods/03-identity/m-03004-dan-mode.md

# Reframe
python reframe/reframe_cli.py "quest text" --fresh

# Vault decrypt
python techniques/loader.py decrypt