Mpx Mode Migration
didi/mpx
审计存量 Mpx 项目迁移到“mode 只负责目标筛选、srcMode 只负责源码方言”的新版编译语义。只要用户提到升级 Mpx 后检查条件编译、排查 .ali/.swan 等条件文件、mode/src-mode 区块、@mode/@mode、modeRules/srcModeRules 或外部模板迁移,就应使用本 Skill;不用于与该语义变更无关的普通 Mpx 升级。
当开始挖新目标、换会话/压缩后续挖、用户说线索板/写板/读板/建板,或信息收集、反编译、JS/接口线索需要跨轮保留时调用。负责为当前系统维护一份 Markdown 线索板(读→挖→写回),不负责拆 webpack、打越权或成稿。模板见同目录 CLUEBOARD.template.md。
$ npx skills add zhaji2333/CkSKILLS --skill hunt-clueboard -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install zhaji2333/CkSKILLS hunt-clueboard --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/zhaji2333/CkSKILLS.git skills-src && mkdir -p .claude/skills && cp -r skills-src/.agents/skills/hunt-clueboard .claude/skills/hunt-clueboard && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "hunt-clueboard" agent skill from https://github.com/zhaji2333/CkSKILLS/tree/main/.agents/skills/hunt-clueboard into .claude/skills/hunt-clueboard/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "hunt-clueboard", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/zhaji2333/CkSKILLS/tree/main/.agents/skills/hunt-clueboardType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add zhaji2333/CkSKILLS --skill hunt-clueboard -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install zhaji2333/CkSKILLS hunt-clueboard --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/zhaji2333/CkSKILLS.git skills-src && mkdir -p .agents/skills && cp -r skills-src/.agents/skills/hunt-clueboard .agents/skills/hunt-clueboard && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "hunt-clueboard" agent skill from https://github.com/zhaji2333/CkSKILLS/tree/main/.agents/skills/hunt-clueboard into .agents/skills/hunt-clueboard/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "hunt-clueboard", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add zhaji2333/CkSKILLS --skill hunt-clueboard -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install zhaji2333/CkSKILLS hunt-clueboard --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/zhaji2333/CkSKILLS.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/.agents/skills/hunt-clueboard .cursor/skills/hunt-clueboard && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "hunt-clueboard" agent skill from https://github.com/zhaji2333/CkSKILLS/tree/main/.agents/skills/hunt-clueboard into .cursor/skills/hunt-clueboard/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "hunt-clueboard", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/zhaji2333/CkSKILLS.git --path .agents/skills/hunt-clueboard--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add zhaji2333/CkSKILLS --skill hunt-clueboard -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install zhaji2333/CkSKILLS hunt-clueboard --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/zhaji2333/CkSKILLS.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/.agents/skills/hunt-clueboard .gemini/skills/hunt-clueboard && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "hunt-clueboard" agent skill from https://github.com/zhaji2333/CkSKILLS/tree/main/.agents/skills/hunt-clueboard into .gemini/skills/hunt-clueboard/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "hunt-clueboard", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install zhaji2333/CkSKILLS hunt-clueboardInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add zhaji2333/CkSKILLS --skill hunt-clueboard -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/zhaji2333/CkSKILLS.git skills-src && mkdir -p .github/skills && cp -r skills-src/.agents/skills/hunt-clueboard .github/skills/hunt-clueboard && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "hunt-clueboard" agent skill from https://github.com/zhaji2333/CkSKILLS/tree/main/.agents/skills/hunt-clueboard into .github/skills/hunt-clueboard/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "hunt-clueboard", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add zhaji2333/CkSKILLS --skill hunt-clueboard -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install zhaji2333/CkSKILLS hunt-clueboard --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/zhaji2333/CkSKILLS.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/.agents/skills/hunt-clueboard .opencode/skills/hunt-clueboard && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "hunt-clueboard" agent skill from https://github.com/zhaji2333/CkSKILLS/tree/main/.agents/skills/hunt-clueboard into .opencode/skills/hunt-clueboard/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "hunt-clueboard", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
hunt-clueboard当开始挖新目标、换会话/压缩后续挖、用户说线索板/写板/读板/建板,或信息收集、反编译、JS/接口线索需要跨轮保留时调用。负责为当前系统维护一份 Markdown 线索板(读→挖→写回),不负责拆 webpack、打越权或成稿。模板见同目录 CLUEBOARD.template.md。
Hunt Clueboard is an agent skill from zhaji2333/CkSKILLS. 当开始挖新目标、换会话/压缩后续挖、用户说线索板/写板/读板/建板,或信息收集、反编译、JS/接口线索需要跨轮保留时调用。负责为当前系统维护一份 Markdown 线索板(读→挖→写回),不负责拆 webpack、打越权或成稿。模板见同目录 CLUEBOARD.template.md。
Its SKILL.md is about 610 tokens, which your agent loads only when the skill is triggered. The skill folder holds 1 other file (for example `CLUEBOARD.template.md`).
It works with webpack. The repository describes itself as: 基于 Claude Code / Codex 的 SRC 漏洞挖掘 Agent 技能体系 —— 将顶尖安全研究员的方法论沉淀为可调度、可复用的 Skill 知识资产。 The licence is MIT.
5 steps, taken from the first numbered list in SKILL.md.
Read from SKILL.md and the folder at commit 482fe78. It shows what the files ask for, not the result of running them.
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
No scripts in the folder and no shell commands in SKILL.md.
From the folder's file list and the shell code blocks in SKILL.md.
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Hunt Clueboard loads about 606 tokens when it runs. Until then it costs about 40 tokens; SKILL.md has 160 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
The full file from zhaji2333/CkSKILLS at commit 482fe78, republished under its MIT licence (© zhaji2333). 160 words, ~606 tokens.
.claude/skills/hunt-clueboard/SKILL.md (or your agent's skills folder). This skill also uses 1 other file; get the full folder from GitHub.薄过程 skill,对标 report:report 收口成稿,本 skill 把线索从对话里拿出来落盘。不挖洞、不替代 recon-js-analysis / unauth-path-key-hunt。
定位:低配黑板架构。 专项 Skill 是知识源(往板上写假设与证据),CLUEBOARD.md 是黑板(共享工作记忆),AGENTS.md 路由 + 板上「当前焦点」是控制(决定下一步调谁)。仍是单 Agent 顺序调度,不是多知识源并行抢写。
没有板,压缩或换会话后会从主站 JS 重开一局,否定证据(SPA 壳、405、空数组、NXDOMAIN)最先丢。
不要调用
report(成稿前读板上「已证实」行)开工 → hunt-clueboard 建/读板
│
├─ 脏收集 / webpack → recon-js-analysis → 写回 1/2/3/5
├─ 零身份路径与钥 → unauth-path-key-hunt → 写回 2/3/4/7
├─ 角色 / IDOR → auth-access-control → 写回 2 鉴权列
├─ 全方法 / BOLA → api-protocol-security
└─ 成稿 → report(只读已证实)[] 必须进第 4 节。raw/。hunts/<目标短名>/CLUEBOARD.md
hunts/<目标短名>/raw/ ← 可选,JS 摘录、响应头,禁止完整 PII短名用 Host 主干,如 shop-h5、api-gw。一份目标一块板,不把多系统揉进一个文件。
建板:复制本 skill 目录 CLUEBOARD.template.md → 填目标短名和开工日。已有板则只读补写,不另起。
hunts/<短名>/CLUEBOARD.md,没有就从模板复制。recon-js-analysis / unauth-path-key-hunt 等。每条可复用判断立刻追加到对应表,状态四选一:假设 / 已证伪 / 已证实 / 待打。
| 产出 | 写入 |
|---|---|
| 新 Host、301、同 IP | §1 |
路径/方法、405、data:[] | §2 |
| getRsaKey、JSEncrypt、字段名 | §3 |
| 扫过但无效 | §4 |
| appid/密钥(打码) | §5 |
| 下一步动作 | §6 |
| ✅/❌/🔄/💡 | §7 |
出处必须能指到公开面(JS 文件、urlscan、兄弟域指纹)。没有出处的路径保持 假设。
指纹怎么分类,见 unauth-path-key-hunt P2,此处不重复。
raw/板上必须能看到失败升级已到 L4(网关 Host + 405/业务 JSON)。见 unauth-path-key-hunt P7。不到 L4 不准用主站 404 结案。
板是跨轮唯一工作记忆。压缩摘要、聊天里的接口列表都可以丢;丢板等于没挖过。
© zhaji2333, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
SKILL.md and 1 other file in .agents/skills/hunt-clueboard of zhaji2333/CkSKILLS.
Open the folder on GitHubat commit 482fe78
Hunt Clueboard next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Hunt Clueboard this skillzhaji2333/CkSKILLS | 115 | — | ~606 | Automated safety check: Pass | MIT | |
| Mpx Mode Migrationdidi/mpx | 3.9k | — | ~731 | Automated safety check: Pass | Apache-2.0 | |
| Client Request Signature Reversalawarexone/Agentic-Bug-Hunter | 5.3k | — | ~4.7k | Automated safety check: Pass | MIT | |
| Runtime Debugvercel/next.js | 143k | 1 repos | ~618 | Automated safety check: Pass | MIT | |
| Orchardcore Asset ManagerOrchardCMS/OrchardCore | 8.2k | — | ~1.5k | Automated safety check: Pass | BSD-3-Clause | |
| Codebase Wikiryuever/react-tapable-editor | 365 | — | ~1.8k | Automated safety check: Pass | None |
didi/mpx
审计存量 Mpx 项目迁移到“mode 只负责目标筛选、srcMode 只负责源码方言”的新版编译语义。只要用户提到升级 Mpx 后检查条件编译、排查 .ali/.swan 等条件文件、mode/src-mode 区块、@mode/@mode、modeRules/srcModeRules 或外部模板迁移,就应使用本 Skill;不用于与该语义变更无关的普通 Mpx 升级。
awarexone/Agentic-Bug-Hunter
Recovers a client-side request signature or anti-bot token just far enough to replay blocked requests in bug bounty testing, starting from a captured packet.
vercel/next.js
Debug and verification workflow for runtime-bundle and module-resolution regressions.
OrchardCMS/OrchardCore
Builds, watches, and manages frontend assets in OrchardCore.
ryuever/react-tapable-editor
将对话中的源码阅读与分析整理为规范化 Markdown,归档到项目 codebase-wiki/(architecture/discussion/issue/reference/roadmap)、维护 INDEX 与 references 图;支持 VitePress、Mintlify、Starlight、Fumadocs 等文档站点。适用于「保存到 wiki / 归档到…
elementor/elementor
External: Add an Editor V2 package from a third-party plugin that injects UI or in-editor MCP tools.
zhaji2333/CkSKILLS
当需要获取目标 APK、识别加固壳类型、脱壳还原 dex、反编译得到 Java/so/H5 全量源码产物,或 android-security-audit 需要可直接开挖的输入时调用。负责 APK → 全量可审计产物(壳识别 → 脱壳 → JADX 反编译 + apktool 资源 + so 提取 + H5/assets 提取)→ 标准目录交付。命中场景:JADX 打开是…
zhaji2333/CkSKILLS
当需要在不对 APK 全量反编译的前提下秒级定位硬编码密钥/签名函数/隐藏接口/调试后门,或 APK 过大(100MB)JADX 全量反编译过慢、内存吃紧,或脱壳产物(裸 dex)需要快速检索,或只想先读一下 Manifest 组件面/权限清单时调用。负责基于 Droid ASC 的零预处理快速定位(findrefs 全局交叉引用搜索 + getclass 按需反编译 + Manifest…
zhaji2333/CkSKILLS
当目标存在支付/下单/退款/提现/转账/优惠券/积分/红包/会员/订阅/审批/库存/抽奖等业务功能,或发现状态可跳变、金额参数可控、并发可重放时调用。负责业务状态机建模、金额篡改、订单状态跳变、竞态条件与重放攻击深度挖掘。
zhaji2333/CkSKILLS
当目标为 LLM 应用/Chatbot/智能客服/AI 助手/Copilot/Agent/RAG 知识库/多模态模型,或发现用户输入进入大模型提示、工具调用、知识库检索、对话记忆、文件解析,或需要测试提示词注入/越狱逃逸/System Prompt 泄露/训练数据与敏感信息泄露/RAG 检索污染/Agent 记忆污染/工具滥用与命令执行/SSRF/沙箱逃逸时调用。负责 OWASP LLM…
zhaji2333/CkSKILLS
当目标涉及云资产(对象存储/云元数据/Serverless)、容器/K8s、运维面板(宝塔/Grafana/Zabbix/Jenkins/GitLab/Nacos等)、消息队列/缓存中间件、CI/CD流水线、第三方回调集成、依赖组件CVE、信息泄露配置时调用。负责未授权访问、弱口令、云配置错误、供应链漏洞与敏感信息挖掘。
zhaji2333/CkSKILLS
当发现参数拼接SQL、动态排序/筛选、JSON查询条件可控、模板渲染、命令执行点、搜索/统计/自动补全接口时调用,进行SQL/NoSQL/命令/SSTI/表达式注入的深度挖掘。命中场景:搜索框、排序参数、登录绕过、导出条件、文件名参数、模板/报表生成、爬虫URL参数。
Works with
当开始挖新目标、换会话/压缩后续挖、用户说线索板/写板/读板/建板,或信息收集、反编译、JS/接口线索需要跨轮保留时调用。负责为当前系统维护一份 Markdown 线索板(读→挖→写回),不负责拆 webpack、打越权或成稿。模板见同目录 CLUEBOARD.template.md。. Hunt Clueboard is an agent skill from zhaji2333/CkSKILLS.
Run `npx skills add zhaji2333/CkSKILLS --skill hunt-clueboard -a claude-code`. Or copy the skill folder (.agents/skills/hunt-clueboard in zhaji2333/CkSKILLS) into .claude/skills/hunt-clueboard in your project. Claude Code loads it when a task matches its description.
Run `npx skills add zhaji2333/CkSKILLS --skill hunt-clueboard -a codex`. Or copy the skill folder (.agents/skills/hunt-clueboard in zhaji2333/CkSKILLS) into .agents/skills/hunt-clueboard in your project. Codex loads it when a task matches its description.
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add zhaji2333/CkSKILLS --skill hunt-clueboard -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/hunt-clueboard, .gemini/skills/hunt-clueboard, .github/skills/hunt-clueboard and .opencode/skills/hunt-clueboard in your project.
SKILL.md names no scripts, command-line tools or credentials: Hunt Clueboard is instructions for the agent only.
SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
Hunt Clueboard is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.
About 606 tokens (SKILL.md is roughly 2.4k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
Skills that share tags, products or a category with Hunt Clueboard: Mpx Mode Migration (didi/mpx, 3.9k stars), Client Request Signature Reversal (awarexone/Agentic-Bug-Hunter, 5.3k stars), Runtime Debug (vercel/next.js, 143k stars) and Orchardcore Asset Manager (OrchardCMS/OrchardCore, 8.2k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
zhaji2333 (a GitHub user) maintains it in zhaji2333/CkSKILLS, which has 115 GitHub stars. The repository holds 15 skills in this directory. The repository was last updated on September 15, 2026.
Source: zhaji2333/CkSKILLS on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.