specialized-attack-playbooks

专题实战利用:GoEdge私钥导出,灰产CDN取证,ARP MITM,CDN→S3 STS链,宝塔+UniApp,AI IDE API反代,OCS+MinIO;含references/scripts支持文件索引。Use when applying specialized playbooks for GoEdge, CDN, ARP MITM, BT Panel, OCS, MinIO.

Quality

78%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./skills/specialized-attack-playbooks/SKILL.md

Quality

Content

68%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

An aggressively dense, highly actionable collection of specialized attack playbooks with good reference navigation, but the dense all-inlined format and missing validation checkpoints on the batch/destructive operations hold workflow clarity and organization back.

Suggestions

Add explicit validation/verification checkpoints before destructive or batch steps — e.g. confirm extracted GoEdge keys base64-decode to valid PEM before reuse, and verify an S3 PutObject succeeded (head/GET the object) before treating CDN-source overwrite as achieved RCE.

Replace the pseudocode GoEdge '批量提取(Python)' loop with an executable requests session that sets the X-Cloud-Access-Token header, decodes sslCertJSON, and filters nulls — so the batch extraction is copy-paste ready like the shell commands.

Move time-sensitive facts (the 2026-04 Cursor free-API cutoff, CVE-2023-38038 / CVE-2023-28432 applicability, 宝塔<=7.7) into a dedicated '版本/弃用说明' subsection so the operational playbook body stays evergreen.

Dimension	Reasoning	Score
Conciseness	The body is densely telegraphic with no padding or explanations of concepts Claude already knows (e.g. '指纹: curl -s http://T:8002/ → {...}'); it is not a 5 because time-sensitive facts (the '2026-04起' Cursor API cutoff, inline CVE/version applicability such as CVE-2023-38038 and 宝塔<=7.7) sit in the operational flow rather than a dedicated deprecated/version-notes section.	4 / 5
Actionability	Most sections give concrete, runnable guidance — exact curl endpoints, auth headers, arpspoof/tcpdump/ip-neigh commands, ChengZi XOR byte 0x96 — but the GoEdge '批量提取(Python)' block is pseudocode (a for-loop over endpoints, not a real requests session) and several use placeholders (T, 目标IP), leaving minor gaps versus fully copy-paste-ready.	4 / 5
Workflow Clarity	Multi-step chains are clearly numbered (CDN forensics ①-⑤, S3 chain ①-⑥, ARP 部署→验证→清理) and some sections include validation (ARP '验证: pgrep -c arpspoof==4', OCS 'curl ... 返回文件内容', CDN ③真实访问验证), but the batch GoEdge key extraction (range 1-500) and the destructive S3-write step ('等效RCE') lack explicit verification checkpoints, so per the batch/destructive cap workflow clarity cannot exceed 3.	3 / 5
Progressive Disclosure	A '支持文件索引' section organizes the 20 reference/script files by category with one-line descriptions, and inline references ('参考: references/cdn-antiblock-s3-attack-chain.md', '脚本: scripts/chengzi_decrypt.py') are clearly signaled one level deep; it is not a 5 because the body itself is a long, fully-inlined ('全内联') wall of dense code blocks rather than a lean overview, and the referenced bundle files are not present in the package to verify.	4 / 5
	Total	15 / 20 Passed

Description

87%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A specific, distinctive description that covers multiple concrete attack techniques and pairs them with an explicit, product-named 'Use when' trigger. It is slightly terse in phrasing but answers both what and when clearly with low conflict risk.

Dimension	Reasoning	Score
Specificity	The description enumerates several concrete exploitation actions — 'GoEdge私钥导出', '灰产CDN取证', 'ARP MITM', 'CDN→S3 STS链', '宝塔+UniApp', 'AI IDE API反代', 'OCS+MinIO' — giving broad coverage of its niche, though each is a terse noun-phrase rather than a fully expanded verb, leaving minor descriptive gaps.	4 / 5
Completeness	It explicitly states both what it does (the colon-separated list of specialized attack techniques) and when to invoke it ('Use when applying specialized playbooks for GoEdge, CDN, ARP MITM, BT Panel, OCS, MinIO'), with concrete trigger phrases; not the level below because the 'when' is explicit and product-specific, not merely implied.	5 / 5
Trigger Term Quality	The 'Use when ...' clause lists concrete product/tech triggers users would actually name (GoEdge, CDN, ARP MITM, BT Panel, OCS, MinIO), giving good keyword coverage; the wrapper phrase 'applying specialized playbooks' is slightly less natural and a few common synonyms (e.g. 宝塔, MinIO bucket) are not surfaced.	4 / 5
Distinctiveness Conflict Risk	The niche is highly specific — specialized offensive playbooks against distinct Chinese-market products (GoEdge, 宝塔/BT Panel, OCS, MinIO, UniApp) — yielding clear, distinct triggers and minimal overlap risk with generic skills.	5 / 5
	Total	18 / 20 Passed

Validation

81%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 13 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning
metadata_field	'metadata' should map string keys to string values	Warning
referenced_paths_exist	Referenced path issues: 6 missing	Warning

	Total	13 / 16 Passed

Repository: Ed1s0nZ/CyberStrikeAI
Path: skills/specialized-attack-playbooks/SKILL.md
Commit: 893f134

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.