# Hack

Entry P0 primary router and operating doctrine for HackSkills.

- Repository: https://github.com/yaklang/hack-skills (2601 stars)
- Category: Testing
- License: MIT
- Last updated: 2026-09-13
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add yaklang/hack-skills --skill hack -g -a claude-code -y`
Codex: `npx skills add yaklang/hack-skills --skill hack -g -a codex -y`
Cursor: `npx skills add yaklang/hack-skills --skill hack -g -a cursor -y`
Gemini CLI: `npx skills add yaklang/hack-skills --skill hack -g -a gemini-cli -y`

## Description

Entry P0 primary router and operating doctrine for HackSkills. Use when the task involves web application testing, API security assessment, recon, vulnerability triage, exploit path planning, authorized pentest, code audit, source-leak mining, middleware audit, SOC triage, detection engineering, incident response, or choosing the right next category skill before any deep topic skill. Also use when the user mentions 安全工程师, 渗透测试, 红队, 蓝队, 代码审计, 源码泄露, SRC. Enforce impact-first testing, finish the current asset cluster before expanding, follow half-chains to real control, and require live verification of secrets.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# HACKING SKILLS / HackSkills

## Overview

This is the **master quality gate and technical router** for authorized bug bounty, web/API security, pentest, code audit, source-leak work, and (when the task is blue) SOC / detection / IR.

It does not replace specialized techniques. It makes the agent:

1. Pass the start gate (authorization, role, scope, success definition)
2. Spend effort on paths that reach real control
3. Route by observed behavior to the correct category / deep topic skill
4. Prefer structured methodology over baseline-model memory and scanner dumps

This file is a quality gate, not a capability ceiling. Surfaces not listed here stay in play if field evidence exists.

This file is not an exploit cookbook. Weaponized details live in deep topic skills and are used only on authorized targets.

Load on demand:

- Red-team execution → [RED_TEAM.md](./RED_TEAM.md)
- Test matrix and effort → [TEST_MATRIX.md](./TEST_MATRIX.md)
- Blue-team execution → [BLUE_TEAM.md](./BLUE_TEAM.md)
- Code audit → [CODE_AUDIT.md](./CODE_AUDIT.md)
- Source leak → [SOURCE_LEAK.md](./SOURCE_LEAK.md)
- Evidence and report → [EVIDENCE_REPORT.md](./EVIDENCE_REPORT.md)

## 0. Task Start Gate

Complete in order. Stop if any item is missing:

The rest: https://github.com/yaklang/hack-skills/blob/HEAD/skills/hack/SKILL.md