给中文用户和新手用的 Strix Lite 统一入口:先判断该用哪一个 strix-* 工具或漏洞测试 skill,再给最小化起手步骤;适合在 Web 安全测试、工具链使用、漏洞验证时不知道先用哪个 Strix skill 的场景;触发名:strix-beginner-hub
npx skills add https://github.com/asdfgh1445/ctf-super-hub --skill Strix•新手入口
这是给 不会选 Strix skill 的人 用的轻量入口。
它不是为了替代 ctf-super-hub,而是作为你现有 CTF 主包的 增强层:
ctf-super-hub出现下面情况时优先考虑这个入口:
httpx / ffuf / katana / nuclei / sqlmap 哪个strix-httpx:先探测站点、标题、状态码、技术指纹strix-katana:爬路径、JS、路由strix-ffuf:目录、文件、参数模糊测试strix-nuclei:快速模板扫描strix-sqlmap:SQL 注入自动验证与枚举strix-sql-injectionstrix-xssstrix-ssrfstrix-rcestrix-authentication-jwtstrix-idorstrix-information-disclosurestrix-insecure-file-uploadsstrix-open-redirectstrix-csrfstrix-business-logicstrix-broken-function-level-authorizationstrix-path-traversal-lfi-rfistrix-quick:先打高价值、快确认strix-standard:更平衡地覆盖测试面如果用户没有指定:
strix-httpx / strix-katana / strix-ffufstrix-quickstrix-standardreferences/router-cheatsheet.mdreferences/examples.mdThis skill should be used when the user asks to "set up a web server", "configure HTTP or HTTPS", "perform SNMP enumeration", "configure SMB shares", "test network services", or needs guidance on configuring and testing network services for penetration testing labs.
This skill should be used when the user asks to "run pentest commands", "scan with nmap", "use metasploit exploits", "crack passwords with hydra or john", "scan web vulnerabilities with nikto", "enumerate networks", or needs essential penetration testing command references.
Configure Static Application Security Testing (SAST) tools for automated vulnerability detection in application code. Use when setting up security scanning, implementing DevSecOps practices, or automating code vulnerability detection.
Configure Static Application Security Testing (SAST) tools for automated vulnerability detection in application code. Use when setting up security scanning, implementing DevSecOps practices, or automating code vulnerability detection.
This skill should be used when the user asks to "perform SMTP penetration testing", "enumerate email users", "test for open mail relays", "grab SMTP banners", "brute force email credentials", or "assess mail server security". It provides comprehensive techniques for testing SMTP server security.
This skill should be used when the user asks to "test for SQL injection vulnerabilities", "perform SQLi attacks", "bypass authentication using SQL injection", "extract database information through injection", "detect SQL injection flaws", or "exploit database query vulnerabilities". It provides comprehensive techniques for identifying, exploiting, and understanding SQL injection attack vectors across different database systems.
This skill should be used when the user asks to "pentest SSH services", "enumerate SSH configurations", "brute force SSH credentials", "exploit SSH vulnerabilities", "perform SSH tunneling", or "audit SSH security". It provides comprehensive SSH penetration testing methodologies and techniques.
This skill should be used when the user asks to "pentest WordPress sites", "scan WordPress for vulnerabilities", "enumerate WordPress users, themes, or plugins", "exploit WordPress vulnerabilities", or "use WPScan". It provides comprehensive WordPress security assessment methodologies.
Take asdfgh1445/strix•新手入口 from the repository into ~/.claude/skills for personal
use, or into .claude/skills inside a project.
The agent identifies a skill by the name field in its header. Two skills with the
same name cannot sit side by side — one of them will be ignored.