hack

A top-level routing skill for bug bounty, web security, API security, and authorized penetration testing engagements. Rather than performing any single attack technique itself, it acts as a P0 primary router ("HackSkills") that helps an agent decide the testing phase, pick the correct vulnerability category, and load the right specialized topic skill before diving into payloads. The stated goal is to replace ad-hoc reliance on baseline model memory with a structured methodology that catches the boundary conditions real engagements hinge on.

The operating model runs in three steps: start with recon and context validation (identifying target type, identity and permission model, input locations, and output locations), route by observed behavior, then proceed through a likely-to-hit testing order. A signal-to-direction table maps observations to categories — for example, input reflecting into HTML or JS points to XSS or SSTI, a server fetching attacker-controlled URLs points to SSRF, many object IDs in APIs point to IDOR/BOLA/BFLA, and HTTP parsing anomalies point to request smuggling. From there it links out to a large core skill map covering XSS, SQLi, SSRF, XXE, SSTI, IDOR, command injection, path traversal, CSRF, JWT/OAuth, SAML, NoSQL injection, prototype pollution, race conditions, and many more.

Use this skill first when receiving a new bug bounty target, when unsure whether to load XSS/SQLi/SSRF/IDOR/JWT/API tracks, or when routing scattered findings to the right attack surface. It also encodes high-value expert intuitions baseline models often miss — reused filtering logic across pages, parameter names as an attack surface, second-order vulnerabilities, BOLA as authenticated-but-unauthorized, unpatched older API versions, and checking JWT key and algorithm context before spraying payloads. A trust model section stresses use only within authorized targets, legitimate research, defensive validation, and bug-bounty-approved rules.