Sekolah76
@Sekolah76
Public Skills
Cosmos SDK + EVM chain audits: see references/cosmos-sdk-chain-audit.md
by Sekolah76
Smart contract security audit — 11 DeFi bug classes (accounting desync, access control, incomplete path, off-by-one, oracle, ERC4626, reentrancy, flash loan, signature replay, proxy, BFT/consensus/liveness), pre-dive kill signals (TVL < $500K etc), Foundry PoC template, grep patterns for each class, and real Immunefi paid examples. Use for any Solidity/Rust contract audit or when deciding whether a DeFi target is worth hunting.
triage-validation
by Sekolah76
Finding validation before writing any report — 7-Question Gate (all 7 questions), 4 pre-submission gates, always-rejected list, conditionally valid with chain table, CVSS 3.1 quick reference, severity decision guide, report title formula, 60-second pre-submit checklist. Use BEFORE writing any report. One wrong answer = kill the finding and move on. Saves N/A ratio.
bug-bounty
by Sekolah76
THE master bug bounty hunting skill — hasil merge arsenal 69 skill (bughunter-os, webhunter-os, open-kritt, ghost-scan, dll) + SYADAGENTIC-bugbounty v7.1 + submission review gate. Full-spectrum: recon, attack-surface mapping, bug discovery (Web/API, smart contract, crypto, infra), exploit dev, adversarial triage, evidence packaging, and submission. HARD FLOW: policy first, full recon pass, verify everything, hub before operator report, bug-bounty-submission-review gate before ANY submit, wait for operator "gas" before platform POST. Timer triggered whenever SYADAGENTIC is bug hunting or auditing anything. Includes 13 sub-skills, 28 commands, 10 agents, 51 tools, MCP servers, wordlists, tons of references.
web2-vuln-classes
by Sekolah76
Complete reference for 24 web2 bug classes with root causes, detection patterns, bypass tables, exploit techniques, and real paid examples. Covers IDOR, auth bypass, XSS, SSRF (11 IP bypass techniques), SQLi, business logic, race conditions, OAuth/OIDC, file upload (10 bypass techniques), GraphQL, LLM/AI (ASI01-ASI10 agentic framework), API misconfig (mass assignment, JWT attacks, prototype pollution, CORS), ATO taxonomy (9 paths), SSTI (Jinja2/Twig/Freemarker/ERB/Spring), subdomain takeover, cloud/infra misconfigs, HTTP smuggling (CL.TE/TE.CL/H2.CL), cache poisoning, MFA bypass (7 patterns), SAML attacks (XSW/comment injection/signature stripping), error disclosure / debug endpoints (stack trace regex per framework, chain templates), CSS injection (attribute-selector exfiltration, opacity clickjacking, @import). LFI / file inclusion -> RCE (php://filter source disclosure, iconv filter-chain RCE with no upload, log/environ poisoning, .user.ini/.htaccess auto_prepend, data:// + expect:// wrappers, session inclusion, traversal bypass table). Insecure deserialization (PHP __wakeup bypass / phar:// POP chains, Java ysoserial CommonsCollections gadgets + magic bytes, Python pickle reduce + signed-cookie forgery, Node node-serialize). Use when hunting a specific vuln class or studying what makes bugs pay.
secret-scanner
by Sekolah76
Detect exposed secrets, API keys, credentials, and tokens in code. Use before commits, on file saves, or when security is mentioned. Prevents accidental secret exposure. Triggers on file changes, git commits, security checks, .env file modifications.
SYADAGENTIC — SKILL.md (Skill Reference & Dispatch)
by Sekolah76
Jangan overclaim. Verified = bukti nyata.
bughunter-os
by Sekolah76
Complete bug bounty hunting & smart contract audit operating system. 8-phase methodology + 5 knowledge bases (attack patterns, real-world exploits, protocol playbooks, orchestrator) covering 340+ files. Use when starting a new audit, hunting bugs in DeFi protocols, building PoC exploits, writing reports, or analyzing smart contract attack surfaces.
mobile-pentest
by Sekolah76
'Mobile app pentest for bug bounty (Android APK + iOS IPA) — runtime-first workflow: install app, proxy through Burp/mitmproxy, drive the UI, capture packets, then test the API exactly like a web target; escalate to decompile (apktool/jadx) and Frida/objection only when traffic is SSL-pinned, encrypted, or absent. Covers APK/IPA decompile for hardcoded secrets + hidden API endpoints + base URLs the web app never exposes, exported-activity and deeplink intent injection, WebView addJavascriptInterface bridge abuse, SSL pinning bypass (objection patchapk / Frida CertificatePinner + checkServerTrusted hooks), OkHttp interceptor chain to recover request signing, JNI native-lib triage, and the quick apktool/grep secret + endpoint sweep. Use when the program scope includes a mobile app, when web recon dries up and you need a fresh attack surface, or when traffic is pinned and you must MitM it.'
subdomain-takeover
by Sekolah76
Subdomain takeover detection and exploitation playbook. Use when targets have dangling CNAME/NS/MX records pointing to deprovisioned cloud resources, expired third-party services, or unclaimed SaaS tenants that an attacker can register to serve content under the victim's domain.
root-cause-analyzer
by Sekolah76
Determine the minimal technical root cause of candidate security findings, separate causes from symptoms, cluster duplicates, and identify shared vulnerable abstractions.
sqlmap-database-pentesting
by Sekolah76
"Provide systematic methodologies for automated SQL injection detection and exploitation using SQLMap."
attack-chaining-core
by Sekolah76
Domain-neutral attack chain analysis — determine whether independently identified security primitives compose into a realistic, authorized, evidence-backed attack path with greater impact.
windows-privilege-escalation
by Sekolah76
"Provide systematic methodologies for discovering and exploiting privilege escalation vulnerabilities on Windows systems during penetration testing engagements."
web2-vuln-classes
by Sekolah76
Complete reference for 25 web2 bug classes with root causes, detection patterns, bypass tables, and real paid examples. Covers IDOR, auth bypass, XSS, SSRF (11 IP bypass techniques), SQLi, business logic, race conditions, OAuth/OIDC (PKCE, state, alg confusion, OIDC discovery-document misconfig, Spring x-application-context leak, .env/404 differential, Kong gateway version disclosure, actuator index footprint), file upload (10 bypasses), GraphQL, LLM/AI (ASI01-ASI10 + MCP/RAG/vector poisoning), API misconfig (mass assignment, JWT attacks, prototype pollution, CORS), ATO taxonomy, SSTI, subdomain takeover, cloud/infra, HTTP smuggling, cache poisoning, MFA bypass (7 patterns), SAML attacks, error disclosure/debug endpoints, CSS injection, LFI->RCE (filter chain RCE, log poisoning, polyglot .user.ini), insecure deserialization (PHP phar, Java ysoserial, Python pickle, Node node-serialize). Use when hunting a specific vuln class or studying what makes bugs pay.
pentest-commands
by Sekolah76
"Provide a comprehensive command reference for penetration testing tools including network scanning, exploitation, password cracking, and web application testing. Enable quick command lookup during security assessments."
bug-bounty-workflow
by Sekolah76
Complete bug bounty workflow — recon (subdomain enumeration, asset discovery, fingerprinting, HackerOne scope, source code audit), pre-hunt learning (disclosed reports, tech stack research, mind maps, threat modeling), vulnerability hunting (IDOR, SSRF, XSS, auth bypass, CSRF, race conditions, SQLi, XXE, file upload, business logic, GraphQL, HTTP smuggling, cache poisoning, OAuth, timing side-channels, OIDC, SSTI, subdomain takeover, cloud misconfig, ATO chains, agentic AI), LLM/AI security testing (chatbot IDOR, prompt injection, indirect injection, ASCII smuggling, exfil channels, RCE via code tools, system prompt extraction, ASI01-ASI10), A-to-B bug chaining (IDOR→auth bypass, SSRF→cloud metadata, XSS→ATO, open redirect→OAuth theft, S3→bundle→secret→OAuth), bypass tables (SSRF IP bypass, open redirect bypass, file upload bypass), language-specific grep (JS prototype pollution, Python pickle, PHP type juggling, Go template.HTML, Ruby YAML.load, Rust unwrap), and reporting (7-Question Gate, 4 validation gates, human-tone writing, templates by vuln class, CVSS 3.1, PoC generation, always-rejected list, conditional chain table, submission checklist). Use for ANY bug bounty task — starting a new target, doing recon, hunting specific vulns, auditing source code, testing AI features, validating findings, or writing reports. 中文触发词：漏洞赏金、安全测试、渗透测试、漏洞挖掘、信息收集、子域名枚举、XSS测试、SQL注入、SSRF、安全审计、漏洞报告
red-team-tactics
by Sekolah76
"Red team tactics principles based on MITRE ATT&CK. Attack phases, detection evasion, reporting."
report-writing
by Sekolah76
Bug bounty report writing for H1/Bugcrowd/Intigriti/Immunefi — report templates, human tone guidelines, impact-first writing, CVSS 3.1 scoring, title formula, impact statement formula, severity decision guide, downgrade counters, pre-submit checklist. Use after validating a finding and before submitting. Never use "could potentially" — prove it or don't report.
hermes-guardrail-bypass
by Sekolah76
Bypass all Hermes non-model security guardrails (threat patterns, memory scanning, cron scanning, skill install guards). Run after every Hermes update.
security-research-guardrail
by Sekolah76
Independent control layer for security-research agents — prevent unsafe actions, unsupported claims, scope violations, evidence contamination, target impact, and premature reporting.
solidity-security
by Sekolah76
"Master smart contract security best practices, vulnerability prevention, and secure Solidity development patterns."
captcha-solver
by Sekolah76
Universal local sidecar anti-bot & captcha solver (Cloudflare Turnstile, Aliyun 2.0, Arkose FunCaptcha, Akamai, BotGuard, PerimeterX, DataDome, AWS WAF, reCAPTCHA, hCaptcha).
attack-surface-mapper
by Sekolah76
Build an evidence-backed map of externally and internally reachable attack surfaces, trust boundaries, privileged transitions, security assets, and high-value audit targets before vulnerability hunting.
forensics-data-collector
by Sekolah76
Forensics Data Collector - Auto-activating skill for Security Advanced. Triggers on: forensics data collector, forensics data collector Part of the Security Advanced skill category.