advsec-plus

advsec-plus is a Penetration testing & red team skill for AI agents, published by bingook in the bingo repository on GitHub. Skillspace rates advsec-plus D (57/100) and it passed the safety scan; the rating is based on static analysis only.

高级渗透测试补充技能 v1.0.1。覆盖 SecSkills-main 未涵盖的现代安全领域： API安全(JWT/OAuth/WebSocket)、移动端(Android/iOS/Frida)、 云安全(元数据/容器/K8s)、供应链(Git泄露/依赖混淆/CI-CD)、 现代Web漏洞(原型污染/2FA绕过/缓存欺骗)、高级规避(EDR/AMSI/Syscall)。 所有漏洞输出必须附带可复现的验证请求（完整curl命令），用户需在Burp中自行验证。 未核实的漏洞禁止作为正式漏洞输出。硬编码/未授权/敏感信息必须输出完整路径+行号。 Git泄露/密钥泄露必须输出文件路径+行号+泄露值。 当目标涉及API接口、移动App、云环境、JWT/OAuth、容器/K8s时触发。 不触发: 传统Web漏洞(SQLi/XSS/RCE/SSRF等)，这些路由到 SecSkills-main。

Grade
D
Quality
57 / 100
Safety
Passed
GitHub stars
295

Unproven: rated by static analysis only, not yet compared head-to-head.

This rating describes the version of the repository we crawled; it may have changed since, so go by its current files.

View source on GitHubbingook/bingo

Our review

Architecture
76 / 100
Maturity
Structured: ships references or scripts
Security scan
Low-risk patterns
License
Not declared. Check the repository before reusing it.
Adoption
Adopted by 0 other repositories, in 0 collections

What the scanner flagged

  • mentions secrets in text

Not checked yet

  • Not judged on the rubric yet (not a contender in its category)
  • No blind task eval yet
  • Scope (portable / vendor / repo-internal) not assessed; only the top of each category is read for scope
  • Sibling files (scripts, references) not fetched; security scan covers SKILL.md only

Better-rated skills in Penetration testing & red team

Skillspace indexes and rates this skill; it does not host or endorse it. Run third-party skills at your own risk.