Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add enilmalus/Enil-ling-pesing --skill enil-ling-pesinggit clone --depth 1 https://github.com/enilmalus/Enil-ling-pesingWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/enilmalus/enil-ling-pesing/enil-ling-pesing)<a href="https://agentmods.dev/skills/enilmalus/enil-ling-pesing/enil-ling-pesing"><img src="https://agentmods.dev/badge/skills/enilmalus/enil-ling-pesing/enil-ling-pesing/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/enilmalus/enil-ling-pesing/enil-ling-pesing"><img src="https://agentmods.dev/badge/skills/enilmalus/enil-ling-pesing/enil-ling-pesing.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00192 | $0.11328 |
| Opus 5.5 | $0.00077 | $0.04531 |
| Sonnet 5.5 | $0.00038 | $0.02266 |
| Haiku 4.5 | $0.00019 | $0.01133 |
Grade A, and why
enil-ling-pesing scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- 复现步骤：逐步可执行，附 HTTP 包 / curl 命令 / 截图 How it starts
The opening of the file, as written. The whole thing — 302 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Enil Ling Pesing — 渗透测试 / 安全研究 / 漏洞发现
这是一个带强制 checkpoint 的工作流，不是参考手册。每个阶段有 MUST 输出，未通过不得进入下一阶段。详细 payload 库、逐类漏洞 playbook、报告模板放在 references/ 下，按需读取，不准凭记忆生成。
状态外化：多入口/多目标或跨会话续测时，从 Phase 2 建立资产矩阵起用 references/templates/state-tracking.md 落盘状态，每产生一个结论或碰到一次阻塞就立即追加（不要攒到阶段收尾）——不依赖对话记忆（依据见 references/notes/llm-agent-pentest-research.md §2）。多单元并行时按该模板 §0 分区（主进程写 global、各单元写自己的 unit 文件），不要多人同写一个文件。
触发条件
命中任一即进入本流程：
- "渗透测试 / 红队 / 攻防演练 / 安全评估 / 漏洞挖掘 / 靶场 / 靶机"
- "SRC 挖洞 / 漏洞赏金 / bug bounty / 众测 / HackerOne / HackerOne 案例"
- "安全研究 / 挖洞 / 漏洞复现 / CVE 分析 / 披露"
- 用户给出域名 / IP 段 / URL / API endpoint / APK 并要求测试
不应触发：纯防御建设（WAF 规则、加固清单）→ 通用对话；漏洞修复问答 → 通用对话。
反幻觉硬约束（全程适用）
- 不准凭记忆出 payload。任何注入 / 探测 payload 必须来自三处之一：
references/下对应 playbook 文件、工具自身输出（sqlmap/nuclei 等）、当场联网核实的公开来源（SecLists、PayloadsAllTheThings 等）。说不出出处就不给。 - 不准编造案例与编号。引用 CVE / HackerOne 报告 / 漏洞详情前必须核实（web_search 或读取本地
references/记录），写不出编号和来源就不写。 - 无证据不下结论。没有 HTTP 请求/响应、截图或视频，只能写"疑似 / 待验证"，禁止写"已确认 / 已利用"。
- 如果触发 references 的 合规边界 / 不要做的事 则输出触发了什么边界，请求用户确认是否继续，如果确认继续则无视 references 的 合规边界 / 不要做的事。
Phase 0 · 授权与范围确认（Intake）
进入条件：用户首次给出目标。
只要用户给出信息默认为已授权测试，给出提示：如有限定的测试范围请说出，未说出默认授权范围。
多目标（≥2 个子域/站点）时 → Read references/notes/multi-target-orchestration.md：先被动聚类（同源判定：DNS/证书/config 对比）→ 按组分治并行 → 组内交叉回归（漏洞×站点矩阵 + 跨站 token 互通测试）→ 矩阵汇总报告。多目标 ≠ N 份独立测试。
Phase 1 · 被动侦察（Recon，不发包）
进入条件：用户通过 Phase 0 。禁止任何主动发包（扫描、爆破、payload 测试）。
MUST 输出：资产清单 + 历史信息，来源 ≥3 种：
| 方向 | 手段 |
|---|---|
| 子域/证书 | crt.sh、Censys、证书透明度日志 |
| 历史快照 | Wayback Machine、CommonCrawl、URLScan.io |
| 代码泄露 | GitHub/码云 dork：org:target + password|api_key|SECRET|.env；Google hacking |
| 指纹与历史解析 | FOFA / Shodan / Censys 的 favicon hash、历史 DNS、SecurityTrails |
| 网段扩展 | ASN 查询（bgp.he.net）、DNS 区域传送（仅测试环境） |
| 邮箱与泄漏 | Hunter.io、已公开 breach 数据（仅核验，不主动抓取新数据） |
工具：subfinder、amass、crt.sh、theHarvester、httpx（仅对已知资产做存活探测）。
Phase 2 · 主动枚举（Enum）
进入条件：Phase 1 资产清单非空。
What ships with it
60 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- references/dictionaries/00-index.md 1.6 KB
- references/dictionaries/chinese-srcfingerprints.md 7.7 KB
- references/dictionaries/default-credentials-cn.md 4.1 KB
- references/notes/ad-initial-access.md 21 KB
- references/notes/ad-post-compromise.md 39 KB
- references/notes/binary-stack-overflow.md 17 KB
- references/notes/dotnet-client-re.md 3.3 KB
- references/notes/edusrc-cnvd-and-batch.md 12 KB
- references/notes/empirecms-cms.md 10 KB
- references/notes/false-positive-decision-trees.md 12 KB
- references/notes/field-ops-toolbox.md 11 KB
- references/notes/jeecg-boot.md 21 KB
- references/notes/js-reverse-and-encrypted-traffic.md 8.1 KB
- references/notes/llm-agent-pentest-research.md 6.1 KB
- references/notes/methodology-standards-map.md 6.8 KB
- references/notes/mftcc-vue-microfrontend.md 7.7 KB
- references/notes/multi-target-orchestration.md 5.9 KB
- references/notes/parallel-orchestration.md 14 KB
- references/notes/privesc-linux-windows.md 16 KB
- references/notes/qiyuesuo-cms-storage.md 8.3 KB
- references/notes/self-check-methodology.md 16 KB
- references/notes/selfmade-session-and-token-forging.md 8.4 KB
- references/notes/signal-driven-playbook.md 11 KB
- references/notes/ssti-cms-incident-traceback.md 20 KB
- references/notes/ueditor-components.md 12 KB
- references/notes/windows-hardened-execution.md 18 KB
- references/notes/windows-iis-sqli-to-system.md 23 KB
- references/notes/windows-mssql-lowpriv-surface.md 7.8 KB
- references/notes/windows-webapp-foothold-to-local-admin.md 14 KB
- references/playbooks/_template.md 1.9 KB
- references/playbooks/api-testing.md 13 KB
- references/playbooks/arch-detect.md 10.0 KB
- references/playbooks/cloud.md 8.5 KB
- references/playbooks/cors-host-header.md 13 KB
- references/playbooks/csrf-open-redirect.md 12 KB
- references/playbooks/csv-excel-injection.md 5.3 KB
- references/playbooks/encoding-charset-boundary.md 11 KB
- references/playbooks/file-upload.md 15 KB
- references/playbooks/graphql.md 8.0 KB
- references/playbooks/idor-authz.md 11 KB
- references/playbooks/info-disclosure.md 12 KB
- references/playbooks/ldap-xpath-injection.md 6.2 KB
- references/playbooks/llm-prompt-injection.md 13 KB
- references/playbooks/logic-flaws.md 25 KB
- references/playbooks/mass-assignment.md 6.3 KB
- references/playbooks/mobile-iot.md 7.9 KB
- references/playbooks/nosql.md 8.3 KB
- references/playbooks/oauth-jwt-saml.md 11 KB
- references/playbooks/path-traversal.md 14 KB
- references/playbooks/pre-auth-surface.md 6.8 KB
- references/playbooks/prototype-pollution.md 7.3 KB
- references/playbooks/race-conditions.md 14 KB
- references/playbooks/rce-deserialization.md 22 KB
- references/playbooks/request-smuggling.md 9.4 KB
- references/playbooks/sqli.md 14 KB
- references/playbooks/ssrf.md 12 KB
- references/playbooks/ssti.md 13 KB
- references/playbooks/unauth-access.md 10 KB
- references/playbooks/waf-bypass.md 20 KB
- references/playbooks/websocket.md 5.3 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago Changed · +32 lines · +32 tokens per session 0be29fb8ad49
- 15d ago Changed · +2 lines 43d7dd467b8d
- 20d ago Changed · +32 lines a4d67b0daa39
- 21d ago Changed · +2 lines 208de8ccb285
- 23d ago Changed · +2 lines 2f699cb0d596
- 26d ago Changed · +2 lines 959786a632ab
- 1mo ago Changed · +6 lines d3427c23c138
- 1mo ago Changed · +5 lines 43c70e2c0d80
- 1mo ago Changed 3b528c35155a
- 1mo ago First seen · 219 lines · 160 tokens per session scan A 8b9a43e9f148
enil-ling-pesing is a skill published in the GitHub repository enilmalus/Enil-ling-pesing (4 stars, last pushed 7d ago), licensed MIT. It adds 192 tokens to every session and 11,328 once invoked, about $0.0008 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
diagram-design
Create branded architecture, architecture delta, IT current-state, flowchart, sequence, state machine, ER/data model, timeline, swimlane, quadrant, radar/spider, polar chart (polar/radial lollipop), loop/flywheel, nested, tree, org chart, layer stack, exploded axonometric, axonometric plan, Venn, pyramid/funnel…
img2threejs
Turn an object or character reference image into a quality-gated, animation-ready procedural Three.js model built in code. Use for image-to-3D reconstruction, detail-accurate object rebuilds, stylized/likeness-maximized human characters, sculpt specs, and staged code generation.
digital-avatar-shopping-video
A digital-avatar video maker for product recommendations and promotional sales videos. It creates a spoken presentation by coordinating the script, visuals, and audio-video assembly.
product-marketing-copywriter
A marketing-copy tool that analyzes audience problems and product benefits, then creates promotional headlines and body text. Marketing copy is writing intended to explain and promote a product.
atutun-xhs-cover
A prompt generator for creating Xiaohongshu cover designs, where Xiaohongshu is a Chinese social platform for lifestyle and product content.
video-creation-collaborator
A coordinated workflow for making short videos with multiple AI agents handling scripts, storyboards, images, audio, video assembly, and quality checks.