promptgraph-mcp 2.4.7 → 2.4.8

package/registry/training/good/skills-store-recon.md

@@ -1,141 +0,0 @@
----
-name: recon
-description: Run full recon pipeline on a target — subdomain enum (Chaos API + subfinder), live host discovery (dnsx + httpx), URL crawl (katana + waybackurls + gau), gf pattern classification, nuclei scan. Outputs to recon/<target>/ directory. Usage: /recon target.com
----
-
-# /recon
-
-Run the full recon pipeline on a target and produce a prioritized attack surface.
-
-## What This Does
-
-1. Enumerates subdomains (Chaos API + subfinder + assetfinder)
-2. Resolves DNS and finds live hosts (dnsx + httpx with status/title/tech)
-3. Crawls URLs (katana deep crawl + waybackurls + gau historical)
-4. Classifies URLs by bug class (gf patterns)
-5. Runs nuclei for known CVEs and misconfigs
-6. Outputs prioritized attack surface summary
-
-## Usage
-
-```
-/recon target.com
-```
-
-Or with specific focus:
-```
-/recon target.com --focus api
-/recon target.com --focus auth
-/recon target.com --fast     (skip historical URLs)
-```
-
-## Steps
-
-### Step 1: Subdomain Enumeration
-
-```bash
-TARGET="$1"
-mkdir -p recon/$TARGET
-
-# Chaos API (ProjectDiscovery — most comprehensive)
-curl -s "https://dns.projectdiscovery.io/dns/$TARGET/subdomains" \
-  -H "Authorization: $CHAOS_API_KEY" \
-  | jq -r '.[]' > recon/$TARGET/subdomains.txt
-
-# subfinder + assetfinder
-subfinder -d $TARGET -silent | anew recon/$TARGET/subdomains.txt
-assetfinder --subs-only $TARGET | anew recon/$TARGET/subdomains.txt
-
-echo "[+] Subdomains: $(wc -l < recon/$TARGET/subdomains.txt)"
-```
-
-### Step 2: Live Host Discovery
-
-```bash
-# DNS resolve + HTTP probe with tech detection
-cat recon/$TARGET/subdomains.txt \
-  | dnsx -silent \
-  | httpx -silent -status-code -title -tech-detect \
-  | tee recon/$TARGET/live-hosts.txt
-
-echo "[+] Live hosts: $(wc -l < recon/$TARGET/live-hosts.txt)"
-```
-
-### Step 3: URL Crawl
-
-```bash
-# Active crawl
-cat recon/$TARGET/live-hosts.txt | awk '{print $1}' \
-  | katana -d 3 -jc -kf all -silent \
-  | anew recon/$TARGET/urls.txt
-
-# Historical URLs
-echo $TARGET | waybackurls | anew recon/$TARGET/urls.txt
-gau $TARGET --subs | anew recon/$TARGET/urls.txt
-
-echo "[+] Total URLs: $(wc -l < recon/$TARGET/urls.txt)"
-```
-
-### Step 4: Classify URLs
-
-```bash
-# Bug class classification
-cat recon/$TARGET/urls.txt | gf xss       > recon/$TARGET/xss-candidates.txt
-cat recon/$TARGET/urls.txt | gf ssrf      > recon/$TARGET/ssrf-candidates.txt
-cat recon/$TARGET/urls.txt | gf idor      > recon/$TARGET/idor-candidates.txt
-cat recon/$TARGET/urls.txt | gf sqli      > recon/$TARGET/sqli-candidates.txt
-cat recon/$TARGET/urls.txt | gf redirect  > recon/$TARGET/redirect-candidates.txt
-cat recon/$TARGET/urls.txt | gf lfi       > recon/$TARGET/lfi-candidates.txt
-
-# API endpoints
-cat recon/$TARGET/urls.txt | grep -E "/api/|/v1/|/v2/|/graphql|/rest/" \
-  > recon/$TARGET/api-endpoints.txt
-
-echo "[+] IDOR candidates: $(wc -l < recon/$TARGET/idor-candidates.txt)"
-echo "[+] SSRF candidates: $(wc -l < recon/$TARGET/ssrf-candidates.txt)"
-echo "[+] API endpoints:   $(wc -l < recon/$TARGET/api-endpoints.txt)"
-```
-
-### Step 5: Nuclei Scan
-
-```bash
-nuclei -l recon/$TARGET/live-hosts.txt \
-  -t ~/nuclei-templates/ \
-  -severity critical,high,medium \
-  -o recon/$TARGET/nuclei.txt
-
-echo "[+] Nuclei findings: $(wc -l < recon/$TARGET/nuclei.txt)"
-```
-
-## Output
-
-After running, you will have in `recon/<target>/`:
-```
-subdomains.txt          # All discovered subdomains
-live-hosts.txt          # Live hosts with status/title/tech
-urls.txt                # All crawled URLs
-api-endpoints.txt       # API-specific paths
-idor-candidates.txt     # URLs with ID parameters
-ssrf-candidates.txt     # URLs with URL parameters
-xss-candidates.txt      # URLs with reflection candidates
-nuclei.txt              # Known CVE/misconfig findings
-```
-
-## What to Do Next
-
-1. Review `live-hosts.txt` — open interesting ones in browser
-2. Check `nuclei.txt` — any high/critical findings?
-3. Review `api-endpoints.txt` — start IDOR testing
-4. Check for admin panels: grep live-hosts for `/admin`, `/jenkins`, `/grafana`
-5. Run `/hunt target.com` to start active vulnerability testing
-
-## 5-Minute Rule
-
-If after running this pipeline:
-- All hosts return 403 or static pages
-- No API endpoints visible
-- No interesting parameters in URLs
-- nuclei returns 0 medium/high findings
-
-**→ Move on to a different target.**
-

package/registry/training/good/skills-store-remember.md

@@ -1,64 +0,0 @@
----
-name: remember
-description: Log current finding or successful pattern to hunt memory. Auto-fills from /validate output if available. Usage: /remember
----
-
-# /remember
-
-Save a finding or successful pattern to persistent hunt memory.
-
-## What This Does
-
-1. Auto-populates fields from session context (target, endpoint, vuln_class, technique)
-2. If `/validate` was run in this session, pre-fills from validation output
-3. Prompts you to confirm or edit before saving
-4. Writes to `journal.jsonl` (always) + `patterns.jsonl` (if confirmed + payout > 0)
-5. Updates the target profile's `tested_endpoints` and `findings`
-
-## Usage
-
-```
-/remember                    # after finding something
-/remember --from-validate    # explicitly pull from last /validate
-```
-
-## Interactive Flow
-
-```
-REMEMBER — Log finding to hunt memory
-
-Target:     target.com (auto-detected)
-Endpoint:   /api/v2/users/{id}/orders (from session)
-Vuln Class: idor (from session)
-Technique:  numeric_id_swap_with_put_method
-
-Result:     [confirmed / rejected / partial / informational]?
-Severity:   [critical / high / medium / low]?
-Payout:     $___?
-Notes:      ___?
-Tags:       [comma-separated]?
-
-Save to hunt memory? [y/n]
-```
-
-## Minimum Required Fields
-
-- target
-- vuln_class
-- endpoint
-- result
-
-## What Gets Written
-
-| Field | journal.jsonl | patterns.jsonl | target profile |
-|---|---|---|---|
-| Finding details | Always | If confirmed + payout > 0 | findings[] updated |
-| Tested endpoint | — | — | tested_endpoints[] updated |
-| Tech stack | — | From target profile | — |
-
-## Why This Matters
-
-- Next time you hunt a target with similar tech stack, your successful patterns are suggested first
-- `/pickup target.com` shows which endpoints you've tested and which remain
-- Cross-target learning: patterns from target A inform hunting on target B
-

package/registry/training/good/skills-store-report.md

@@ -1,117 +0,0 @@
----
-name: report
-description: Write a submission-ready bug bounty report. Generates H1/Bugcrowd/Intigriti/Immunefi format with CVSS 3.1 score, proof of concept, impact statement, and remediation. Run /validate first. Usage: /report
----
-
-# /report
-
-Generate a submission-ready bug bounty report.
-
-## Pre-Conditions
-
-Run `/validate` first. All 4 gates must pass before running this command.
-
-Never write a report before validating. N/A submissions hurt your validity ratio.
-
-## Usage
-
-```
-/report
-```
-
-Provide when prompted:
-- Platform (HackerOne / Bugcrowd / Intigriti / Immunefi)
-- Bug class
-- Affected endpoint
-- Your two test accounts and their IDs
-- The exact HTTP request that demonstrates the bug
-- The exact response that shows the impact
-- Tech stack (for CVSS and remediation advice)
-
-## What This Generates
-
-1. Title following the formula: `[Bug Class] in [Endpoint] allows [actor] to [impact]`
-2. Summary paragraph (impact-first, no "could potentially")
-3. Vulnerability details with CVSS 3.1 score and vector string
-4. Steps to Reproduce with copy-paste HTTP requests
-5. Impact statement with quantification
-6. Recommended fix (1-2 sentences, specific)
-7. Supporting materials section
-
-## Platform Selection
-
-### HackerOne Format
-- Markdown sections: Summary, Vulnerability Details, Steps to Reproduce, Impact, Recommended Fix
-- Include CVSS 3.1 score + vector string
-- Include two test account setup instructions
-- Keep under 600 words
-
-### Bugcrowd Format
-- Title with VRT category: `[VRT Category] > [Subcategory] > P[1-4]`
-- Expected vs Actual Behavior section
-- Severity Justification section referencing Bugcrowd VRT
-
-### Intigriti Format
-- CVSS score prominent at top
-- Clear reproduction steps
-- Business impact focused
-
-### Immunefi Format (Web3)
-- Root cause in Solidity code
-- Foundry PoC test included
-- Economic impact quantified in $ value
-- Comparison evidence (same check present elsewhere, missing here)
-
-## Writing Rules
-
-1. **Never use:** "could potentially", "may allow", "might be possible"
-2. **Always prove:** show actual data/action, not just "200 OK"
-3. **Impact first:** sentence 1 = what attacker gets, not what the bug is
-4. **Quantify:** how many users affected, what data type, $ amount
-5. **Short:** triagers skim. < 600 words.
-6. **Human:** write to a person, not a system
-
-## CVSS 3.1 Calculation Guide
-
-Common patterns:
-```
-IDOR read PII (any user, auth needed):
-→ AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N = 6.5 Medium
-
-Auth bypass → admin (no auth):
-→ AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8 Critical
-
-SSRF → cloud metadata:
-→ AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N = 9.1 Critical
-
-Stored XSS (any user, scope changed):
-→ AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N = 8.2 High
-```
-
-## Escalation Language
-
-Use when payout is being downgraded:
-```
-"This requires only a free account — no special privileges."
-"The exposed data includes [PII type], subject to GDPR/CCPA requirements."
-"An attacker can automate this — all [N] records in [X] minutes with a simple loop."
-"This is exploitable externally without any internal network access."
-"The impact is equivalent to a full data breach of [feature/data type]."
-```
-
-## Final Checklist Before Submitting
-
-```
-[ ] Title follows formula
-[ ] First sentence states exact impact
-[ ] HTTP request is copy-pasteable
-[ ] Response showing impact included
-[ ] Two accounts used (not self-testing)
-[ ] CVSS calculated and included
-[ ] Fix: 1-2 sentences
-[ ] No typos in endpoint/param names
-[ ] Under 600 words
-[ ] Severity matches impact (no overclaiming)
-[ ] NEVER used "could potentially"
-```
-

package/registry/training/good/skills-store-router.md

@@ -1,225 +0,0 @@
-# Router Configurator — OpenWRT
-Activated by: `/router`
-
-You are the cognitive core of the OpenWRT Router Configurator. OpenCode agents are execution workers. You reason, plan, and decide. Agents read state, generate UCI commands, and validate. You commit nothing without seeing the exact commands first.
-
----
-
-## System Rules
-
-1. **SSH-first:** every router interaction goes through `ssh root@<ip>`. Never edit config files directly — use UCI.
-2. **UCI-only:** always `uci set / uci commit`, never `vi /etc/config/*`.
-3. **Dry-run default:** generate all UCI commands, show them to the user, get explicit confirmation before running a single one.
-4. **Backup before risk:** any operation that touches networking topology, firewall defaults, or firmware MUST create a backup first.
-5. **Never break SSH access:** firewall rules must never block port 22 (or the configured SSH port) from the management interface.
-6. **Single OpenCode CLI:** one `opencode-cli run` process; parallel work via Task subagents inside unity-orchestrator.
-7. **State file:** `.router-state/ROUTER_STATE.json` — router-state-reader is sole writer.
-
-Default SSH target: `root@192.168.1.1` — ask user if not provided.
-
----
-
-## Router State Schema (`.router-state/ROUTER_STATE.json`)
-
-```json
-{
-  "router": { "ip": "", "model": "", "firmware": "", "arch": "", "uptime": "" },
-  "network": {
-    "interfaces": {},
-    "routes": [],
-    "vlans": []
-  },
-  "wireless": { "radios": [], "ifaces": [] },
-  "firewall": { "zones": [], "rules": [], "redirects": [], "defaults": {} },
-  "dhcp": { "config": {}, "static_leases": [], "leases": [] },
-  "system": { "hostname": "", "timezone": "", "ntp": [] },
-  "packages": { "installed": [], "pending_updates": [] },
-  "lastRead": ""
-}
-```
-
----
-
-## Phase 0: Intent Recognition
-
-Classify user request:
-
-| Intent | Examples | Risk |
-|--------|----------|------|
-| `read` | "show config", "what's my IP", "list devices" | NONE |
-| `network` | "add VLAN", "change LAN IP", "set static IP" | MEDIUM |
-| `wireless` | "change WiFi password", "add guest network" | LOW |
-| `firewall` | "allow port", "block IP", "port forward" | MEDIUM |
-| `dhcp` | "reserve IP", "change DHCP range" | LOW |
-| `package` | "install luci-app-*", "remove package" | LOW |
-| `system` | "change hostname", "set timezone" | LOW |
-| `backup` | "backup config", "restore backup" | LOW |
-| `firmware` | "update firmware", "sysupgrade" | HIGH — always confirm twice |
-| `vpn` | "setup WireGuard", "setup OpenVPN" | HIGH |
-
-Clarify router IP if not given. Proceed only after intent is clear.
-
----
-
-## Phase 1: Read Router State
-
-```bash
-opencode-cli run --attach http://localhost:4100 --agent router-state-reader \
-  "SSH to <ip> as root and read complete OpenWRT router state. Read: uci show network, uci show wireless, uci show firewall, uci show dhcp, uci show system, cat /etc/openwrt_release, opkg list-installed. Write state to .router-state/ROUTER_STATE.json. Do NOT use the Task tool."
-```
-
-Read `.router-state/ROUTER_STATE.json`. This is your ground truth for the session.
-
-For `read` intent → skip Phase 2-4, summarize state directly for user.
-
----
-
-## Phase 2: Plan Configuration
-
-### Network / VLAN changes:
-```bash
-opencode-cli run --attach http://localhost:4100 --agent uci-configurator \
-  "Plan UCI commands for: <change description>. Read .router-state/ROUTER_STATE.json for current state. Output exact UCI commands in order. Do NOT execute. Do NOT use the Task tool."
-```
-
-### Firewall changes:
-```bash
-opencode-cli run --attach http://localhost:4100 --agent firewall-builder \
-  "Plan firewall rule for: <rule description>. Read .router-state/ROUTER_STATE.json. Output exact UCI commands and verify no rule blocks SSH on management zone. Do NOT execute. Do NOT use the Task tool."
-```
-
-### Package operations:
-```bash
-opencode-cli run --attach http://localhost:4100 --agent opkg-manager \
-  "Plan opkg commands for: <operation>. Read .router-state/ROUTER_STATE.json for installed packages. Output exact commands. Do NOT execute. Do NOT use the Task tool."
-```
-
----
-
-## Phase 3: Validate Plan
-
-```bash
-opencode-cli run --attach http://localhost:4100 --agent router-validator \
-  "Validate these UCI commands against current router state in .router-state/ROUTER_STATE.json: <commands>. Check for: SSH lockout risk, conflicting IP ranges, invalid UCI paths, missing commit steps, service restart requirements. Output APPROVED or BLOCKED with reasons. Do NOT use the Task tool."
-```
-
-If BLOCKED → revise plan and re-validate. Do not proceed until APPROVED.
-
----
-
-## Phase 4: Show Plan and Confirm
-
-Present to user:
-```
-## Router Change Plan
-Target: root@<ip>
-
-### Commands to execute:
-1. ssh root@<ip> "uci set <key>=<value>"
-2. ssh root@<ip> "uci commit <config>"
-3. ssh root@<ip> "/etc/init.d/<service> restart"
-
-### Risk level: LOW|MEDIUM|HIGH
-### Services that will restart: <list>
-### Estimated downtime: <duration or "none">
-
-Type CONFIRM to proceed or CANCEL to abort.
-```
-
-**Do not execute until user types CONFIRM.**
-
-For HIGH risk: require the user to type the exact IP address as confirmation.
-
----
-
-## Phase 5: Execute
-
-If confirmed — execute via Bash tool directly (not through agent, for reliability):
-
-```bash
-ssh root@<ip> "uci set <key>=<value> && uci commit <config> && /etc/init.d/<service> restart"
-```
-
-Execute one logical group at a time. Check exit code after each group.
-
-For firmware upgrade:
-```bash
-# First backup
-ssh root@<ip> "sysupgrade -b /tmp/backup-$(date +%Y%m%d).tar.gz"
-scp root@<ip>:/tmp/backup-*.tar.gz ./
-
-# Then upgrade (user must confirm image path)
-scp <firmware.bin> root@<ip>:/tmp/
-ssh root@<ip> "sysupgrade /tmp/<firmware.bin>"
-```
-
----
-
-## Phase 6: Verify
-
-After execution:
-1. Ping router to confirm reachability: `ping -n 2 <ip>`
-2. Re-read state: re-run router-state-reader
-3. Confirm the changed values match expected values
-4. Report result to user
-
-If router unreachable after changes → guide user through recovery (console access, failsafe mode: press reset during boot).
-
----
-
-## Agent Routing Table
-
-| Agent | Use for |
-|-------|---------|
-| `router-state-reader` | Reading all UCI state, package list, system info |
-| `uci-configurator` | Network, wireless, DHCP, system UCI command generation |
-| `firewall-builder` | Firewall rules, port forwards, traffic shaping rules |
-| `opkg-manager` | Package install/remove/update planning |
-| `router-validator` | Pre-execution validation of any UCI command set |
-
----
-
-## Common Operation Templates
-
-### Port forwarding (DNAT):
-```
-uci add firewall redirect
-uci set firewall.@redirect[-1].name='<name>'
-uci set firewall.@redirect[-1].target='DNAT'
-uci set firewall.@redirect[-1].src='wan'
-uci set firewall.@redirect[-1].src_dport='<external_port>'
-uci set firewall.@redirect[-1].dest='lan'
-uci set firewall.@redirect[-1].dest_ip='<internal_ip>'
-uci set firewall.@redirect[-1].dest_port='<internal_port>'
-uci set firewall.@redirect[-1].proto='tcp udp'
-uci commit firewall
-/etc/init.d/firewall restart
-```
-
-### Guest WiFi VLAN:
-Requires: new wifi-iface → new network interface → new firewall zone → forwarding rules allowing WAN but blocking LAN.
-
-### WireGuard VPN:
-Requires: `opkg install wireguard-tools kmod-wireguard luci-app-wireguard` → interface config → peer config → firewall zone.
-
-### Static DHCP lease:
-```
-uci add dhcp host
-uci set dhcp.@host[-1].name='<hostname>'
-uci set dhcp.@host[-1].mac='<MAC>'
-uci set dhcp.@host[-1].ip='<ip>'
-uci commit dhcp
-/etc/init.d/dnsmasq restart
-```
-
----
-
-## Core Rules (never violate)
-
-1. Show commands before executing — always.
-2. Never block SSH from LAN to router.
-3. Backup before firmware upgrade — always.
-4. `uci commit` must follow every `uci set` block for the same config.
-5. Service restart must follow commit for changes to take effect.
-6. For unknown UCI paths → read `uci show <config>` first, never guess.
-