Agent skill

Hunt Clueboard

by zhaji2333 in zhaji2333/CkSKILLS

当开始挖新目标、换会话/压缩后续挖、用户说线索板/写板/读板/建板,或信息收集、反编译、JS/接口线索需要跨轮保留时调用。负责为当前系统维护一份 Markdown 线索板(读→挖→写回),不负责拆 webpack、打越权或成稿。模板见同目录 CLUEBOARD.template.md。

MITAuto-check passed

Install Hunt Clueboard

skills CLI
$ npx skills add zhaji2333/CkSKILLS --skill hunt-clueboard -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install zhaji2333/CkSKILLS hunt-clueboard --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/zhaji2333/CkSKILLS.git skills-src && mkdir -p .claude/skills && cp -r skills-src/.agents/skills/hunt-clueboard .claude/skills/hunt-clueboard && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
hunt-clueboard
GitHub stars
115
Token cost
~606 tokens
SKILL.md length
160 words
Files
2
Skills in repo
15
Repo updated
First seen
Licence
MIT

At a glance

当开始挖新目标、换会话/压缩后续挖、用户说线索板/写板/读板/建板,或信息收集、反编译、JS/接口线索需要跨轮保留时调用。负责为当前系统维护一份 Markdown 线索板(读→挖→写回),不负责拆 webpack、打越权或成稿。模板见同目录 CLUEBOARD.template.md。

  • Works in 5 steps: 先读后挖。 板上已证伪的 Host/路径本轮禁止当新发现再扫一遍。 → 当轮写回。 线索不进板,本轮收集不算完成。禁止「等下再整理」。 → 板是台账不是日记。 只写判断、出处、状态、下一步。 → …
  • SKILL.md covers 何时调用, 和挖洞 skill 的关系, 铁律 and 文件位置, plus 3 more sections
  • Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md

What it does

Hunt Clueboard is an agent skill from zhaji2333/CkSKILLS. 当开始挖新目标、换会话/压缩后续挖、用户说线索板/写板/读板/建板,或信息收集、反编译、JS/接口线索需要跨轮保留时调用。负责为当前系统维护一份 Markdown 线索板(读→挖→写回),不负责拆 webpack、打越权或成稿。模板见同目录 CLUEBOARD.template.md。

Its SKILL.md is about 610 tokens, which your agent loads only when the skill is triggered. The skill folder holds 1 other file (for example `CLUEBOARD.template.md`).

It works with webpack. The repository describes itself as: 基于 Claude Code / Codex 的 SRC 漏洞挖掘 Agent 技能体系 —— 将顶尖安全研究员的方法论沉淀为可调度、可复用的 Skill 知识资产。 The licence is MIT.

Example prompts

  • “/hunt-clueboard”

Workflow steps

5 steps, taken from the first numbered list in SKILL.md.

  1. 先读后挖。 板上已证伪的 Host/路径本轮禁止当新发现再扫一遍。
  2. 当轮写回。 线索不进板,本轮收集不算完成。禁止「等下再整理」。
  3. 板是台账不是日记。 只写判断、出处、状态、下一步。
  4. 否定证据优先。 主站没有、SPA 壳、NXDOMAIN、错字段 [] 必须进第 4 节。
  5. PII 不进板。 字段名和条数可以写;完整银行账号/手机/证件不写。原料进 raw/。

What it can do on your machine

Read from SKILL.md and the folder at commit 482fe78. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    No scripts in the folder and no shell commands in SKILL.md.

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Hunt Clueboard loads about 606 tokens when it runs. Until then it costs about 40 tokens; SKILL.md has 160 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~40
When it runs · the whole SKILL.md, loaded when a task matches
~606

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from zhaji2333/CkSKILLS at commit 482fe78, republished under its MIT licence (© zhaji2333). 160 words, ~606 tokens.

Download SKILL.mdSave it as .claude/skills/hunt-clueboard/SKILL.md (or your agent's skills folder). This skill also uses 1 other file; get the full folder from GitHub.
name
hunt-clueboard
description
当开始挖新目标、换会话/压缩后续挖、用户说线索板/写板/读板/建板,或信息收集、反编译、JS/接口线索需要跨轮保留时调用。负责为当前系统维护一份 Markdown 线索板(读→挖→写回),不负责拆 webpack、打越权或成稿。模板见同目录 CLUEBOARD.template.md。

hunt-clueboard — 当前目标线索板(工作记忆)

薄过程 skill,对标 report:report 收口成稿,本 skill 把线索从对话里拿出来落盘。不挖洞、不替代 recon-js-analysis / unauth-path-key-hunt。

定位:低配黑板架构。 专项 Skill 是知识源(往板上写假设与证据),CLUEBOARD.md 是黑板(共享工作记忆),AGENTS.md 路由 + 板上「当前焦点」是控制(决定下一步调谁)。仍是单 Agent 顺序调度,不是多知识源并行抢写。

没有板,压缩或换会话后会从主站 JS 重开一局,否定证据(SPA 壳、405、空数组、NXDOMAIN)最先丢。

何时调用

  • 新目标开工、攻击面梳理开始
  • 用户说「线索板 / 写板 / 读板 / 建板 / 继续挖」
  • 会话压缩后续挖、换人/换会话接着测
  • 本轮产生了 Host/路径/密钥/证伪结果,必须写回

不要调用

  • 还在问「要不要做线索板」的概念题 → 直接按本文建板
  • 漏洞已确认只成稿 → report(成稿前读板上「已证实」行)
  • 拆 JS / 打未授权 / 打越权本身 → 对应挖洞 skill;本 skill 只规定读写

和挖洞 skill 的关系

开工 → hunt-clueboard 建/读板
         │
         ├─ 脏收集 / webpack     → recon-js-analysis   → 写回 1/2/3/5
         ├─ 零身份路径与钥       → unauth-path-key-hunt → 写回 2/3/4/7
         ├─ 角色 / IDOR          → auth-access-control  → 写回 2 鉴权列
         ├─ 全方法 / BOLA        → api-protocol-security
         └─ 成稿                 → report(只读已证实)

铁律

  1. 先读后挖。 板上已证伪的 Host/路径本轮禁止当新发现再扫一遍。
  2. 当轮写回。 线索不进板,本轮收集不算完成。禁止「等下再整理」。
  3. 板是台账不是日记。 只写判断、出处、状态、下一步。
  4. 否定证据优先。 主站没有、SPA 壳、NXDOMAIN、错字段 [] 必须进第 4 节。
  5. PII 不进板。 字段名和条数可以写;完整银行账号/手机/证件不写。原料进 raw/。

文件位置

hunts/<目标短名>/CLUEBOARD.md
hunts/<目标短名>/raw/          ← 可选,JS 摘录、响应头,禁止完整 PII

短名用 Host 主干,如 shop-h5、api-gw。一份目标一块板,不把多系统揉进一个文件。

建板:复制本 skill 目录 CLUEBOARD.template.md → 填目标短名和开工日。已有板则只读补写,不另起。

读写协议

开工(每轮对话第一次碰这个目标)
  1. 找 hunts/<短名>/CLUEBOARD.md,没有就从模板复制。
  2. 读第 0/1/4/6 节,把「当前焦点」当成本轮第一任务。
  3. 再调 recon-js-analysis / unauth-path-key-hunt 等。
挖的过程中

每条可复用判断立刻追加到对应表,状态四选一:假设 / 已证伪 / 已证实 / 待打。

产出写入
新 Host、301、同 IP§1
路径/方法、405、data:[]§2
getRsaKey、JSEncrypt、字段名§3
扫过但无效§4
appid/密钥(打码)§5
下一步动作§6
✅/❌/🔄/💡§7

出处必须能指到公开面(JS 文件、urlscan、兄弟域指纹)。没有出处的路径保持 假设。

指纹怎么分类,见 unauth-path-key-hunt P2,此处不重复。

收工(本轮结束前)
  • 更新「当前焦点」为下一轮第一件事
  • 假设仍超过 5 条就删最弱的或标证伪
  • 板超过约 200 行:判断留在板上,原料搬 raw/
下「无此接口」之前

板上必须能看到失败升级已到 L4(网关 Host + 405/业务 JSON)。见 unauth-path-key-hunt P7。不到 L4 不准用主站 404 结案。

禁止写成什么样

  • 聊天记录粘贴、整份 bundle、HAR 全文
  • 「今天测了很久」类过程散文
  • 无状态的 URL 清单(必须有指纹和状态列)
  • 把登录 Network 截图 URL 写成「已证实出处」(只能进假设,待公开面复原)

交接一句

板是跨轮唯一工作记忆。压缩摘要、聊天里的接口列表都可以丢;丢板等于没挖过。

© zhaji2333, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 1 other file in .agents/skills/hunt-clueboard of zhaji2333/CkSKILLS.

  • SKILL.md
  • CLUEBOARD.template.md

Open the folder on GitHubat commit 482fe78

Compare with similar skills

Hunt Clueboard next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Hunt Clueboard compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Hunt Clueboard this skillzhaji2333/CkSKILLS115—~606Automated safety check: PassMIT
Mpx Mode Migrationdidi/mpx3.9k—~731Automated safety check: PassApache-2.0
Client Request Signature Reversalawarexone/Agentic-Bug-Hunter5.3k—~4.7kAutomated safety check: PassMIT
Runtime Debugvercel/next.js143k1 repos~618Automated safety check: PassMIT
Orchardcore Asset ManagerOrchardCMS/OrchardCore8.2k—~1.5kAutomated safety check: PassBSD-3-Clause
Codebase Wikiryuever/react-tapable-editor365—~1.8kAutomated safety check: PassNone

Similar skills

  • 审计存量 Mpx 项目迁移到“mode 只负责目标筛选、srcMode 只负责源码方言”的新版编译语义。只要用户提到升级 Mpx 后检查条件编译、排查 .ali/.swan 等条件文件、mode/src-mode 区块、@mode/@mode、modeRules/srcModeRules 或外部模板迁移,就应使用本 Skill;不用于与该语义变更无关的普通 Mpx 升级。

    3.9k GitHub stars~731 tokensUpdated yesterday
    DevelopmentAuto-check passed
  • Client Request Signature Reversal

    awarexone/Agentic-Bug-Hunter

    Recovers a client-side request signature or anti-bot token just far enough to replay blocked requests in bug bounty testing, starting from a captured packet.

    5.3k GitHub stars~4.7k tokensUpdated yesterday
    SecurityAuto-check passed
  • Runtime Debug

    vercel/next.js

    Official

    Debug and verification workflow for runtime-bundle and module-resolution regressions.

    143k GitHub starsUsed in 1 repo~618 tokens
    DevelopmentAuto-check passed
  • Orchardcore Asset Manager

    OrchardCMS/OrchardCore

    Builds, watches, and manages frontend assets in OrchardCore.

    8.2k GitHub stars~1.5k tokensUpdated yesterday
    Frontend & DesignAuto-check passed
  • Codebase Wiki

    ryuever/react-tapable-editor

    将对话中的源码阅读与分析整理为规范化 Markdown,归档到项目 codebase-wiki/(architecture/discussion/issue/reference/roadmap)、维护 INDEX 与 references 图;支持 VitePress、Mintlify、Starlight、Fumadocs 等文档站点。适用于「保存到 wiki / 归档到…

    365 GitHub stars~1.8k tokensUpdated 4 mo ago
    Knowledge ManagementAuto-check passed
  • Add Editor Package

    elementor/elementor

    External: Add an Editor V2 package from a third-party plugin that injects UI or in-editor MCP tools.

    7.1k GitHub stars~1.7k tokensUpdated yesterday
    Auto-check passed

More from zhaji2333/CkSKILLS

All 15 skills in this repo
  • Apk Reversing

    zhaji2333/CkSKILLS

    当需要获取目标 APK、识别加固壳类型、脱壳还原 dex、反编译得到 Java/so/H5 全量源码产物,或 android-security-audit 需要可直接开挖的输入时调用。负责 APK → 全量可审计产物(壳识别 → 脱壳 → JADX 反编译 + apktool 资源 + so 提取 + H5/assets 提取)→ 标准目录交付。命中场景:JADX 打开是…

    115 GitHub stars~1.7k tokensUpdated 26 days ago
    Auto-check passed
  • Asc Fast Hunt

    zhaji2333/CkSKILLS

    当需要在不对 APK 全量反编译的前提下秒级定位硬编码密钥/签名函数/隐藏接口/调试后门,或 APK 过大(100MB)JADX 全量反编译过慢、内存吃紧,或脱壳产物(裸 dex)需要快速检索,或只想先读一下 Manifest 组件面/权限清单时调用。负责基于 Droid ASC 的零预处理快速定位(findrefs 全局交叉引用搜索 + getclass 按需反编译 + Manifest…

    115 GitHub stars~3.3k tokensUpdated 26 days ago
    Auto-check passed
  • Business Logic Race

    zhaji2333/CkSKILLS

    当目标存在支付/下单/退款/提现/转账/优惠券/积分/红包/会员/订阅/审批/库存/抽奖等业务功能,或发现状态可跳变、金额参数可控、并发可重放时调用。负责业务状态机建模、金额篡改、订单状态跳变、竞态条件与重放攻击深度挖掘。

    115 GitHub stars~466 tokensUpdated 26 days ago
    Auto-check passed
  • AI LLM Agent Security

    zhaji2333/CkSKILLS

    当目标为 LLM 应用/Chatbot/智能客服/AI 助手/Copilot/Agent/RAG 知识库/多模态模型,或发现用户输入进入大模型提示、工具调用、知识库检索、对话记忆、文件解析,或需要测试提示词注入/越狱逃逸/System Prompt 泄露/训练数据与敏感信息泄露/RAG 检索污染/Agent 记忆污染/工具滥用与命令执行/SSRF/沙箱逃逸时调用。负责 OWASP LLM…

    115 GitHub stars~4.7k tokensUpdated 26 days ago
    Auto-check: warnings
  • Cloud Infra Supply Chain

    zhaji2333/CkSKILLS

    当目标涉及云资产(对象存储/云元数据/Serverless)、容器/K8s、运维面板(宝塔/Grafana/Zabbix/Jenkins/GitLab/Nacos等)、消息队列/缓存中间件、CI/CD流水线、第三方回调集成、依赖组件CVE、信息泄露配置时调用。负责未授权访问、弱口令、云配置错误、供应链漏洞与敏感信息挖掘。

    115 GitHub stars~688 tokensUpdated 26 days ago
    Auto-check: warnings
  • Injection Vulns

    zhaji2333/CkSKILLS

    当发现参数拼接SQL、动态排序/筛选、JSON查询条件可控、模板渲染、命令执行点、搜索/统计/自动补全接口时调用,进行SQL/NoSQL/命令/SSTI/表达式注入的深度挖掘。命中场景:搜索框、排序参数、登录绕过、导出条件、文件名参数、模板/报表生成、爬虫URL参数。

    115 GitHub stars~579 tokensUpdated 26 days ago
    Auto-check passed

Works with

Questions about Hunt Clueboard

What does Hunt Clueboard do?

当开始挖新目标、换会话/压缩后续挖、用户说线索板/写板/读板/建板,或信息收集、反编译、JS/接口线索需要跨轮保留时调用。负责为当前系统维护一份 Markdown 线索板(读→挖→写回),不负责拆 webpack、打越权或成稿。模板见同目录 CLUEBOARD.template.md。. Hunt Clueboard is an agent skill from zhaji2333/CkSKILLS.

How do I install Hunt Clueboard in Claude Code?

Run `npx skills add zhaji2333/CkSKILLS --skill hunt-clueboard -a claude-code`. Or copy the skill folder (.agents/skills/hunt-clueboard in zhaji2333/CkSKILLS) into .claude/skills/hunt-clueboard in your project. Claude Code loads it when a task matches its description.

How do I install Hunt Clueboard in Codex?

Run `npx skills add zhaji2333/CkSKILLS --skill hunt-clueboard -a codex`. Or copy the skill folder (.agents/skills/hunt-clueboard in zhaji2333/CkSKILLS) into .agents/skills/hunt-clueboard in your project. Codex loads it when a task matches its description.

Can I use Hunt Clueboard in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add zhaji2333/CkSKILLS --skill hunt-clueboard -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/hunt-clueboard, .gemini/skills/hunt-clueboard, .github/skills/hunt-clueboard and .opencode/skills/hunt-clueboard in your project.

What does Hunt Clueboard need to run?

SKILL.md names no scripts, command-line tools or credentials: Hunt Clueboard is instructions for the agent only.

Does Hunt Clueboard access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Hunt Clueboard safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Hunt Clueboard use?

Hunt Clueboard is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Hunt Clueboard use?

About 606 tokens (SKILL.md is roughly 2.4k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Hunt Clueboard?

Skills that share tags, products or a category with Hunt Clueboard: Mpx Mode Migration (didi/mpx, 3.9k stars), Client Request Signature Reversal (awarexone/Agentic-Bug-Hunter, 5.3k stars), Runtime Debug (vercel/next.js, 143k stars) and Orchardcore Asset Manager (OrchardCMS/OrchardCore, 8.2k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Hunt Clueboard?

zhaji2333 (a GitHub user) maintains it in zhaji2333/CkSKILLS, which has 115 GitHub stars. The repository holds 15 skills in this directory. The repository was last updated on September 15, 2026.

Source: zhaji2333/CkSKILLS on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.