Borrowing it
Nothing to install: this file belongs to zhaji2333/CkSKILLS. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/zhaji2333/CkSKILLS/main/.agents/skills/report/SKILL.mdgit clone --depth 1 https://github.com/zhaji2333/CkSKILLSWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/zhaji2333/ckskills/report)<a href="https://agentmods.dev/skills/zhaji2333/ckskills/report"><img src="https://agentmods.dev/badge/skills/zhaji2333/ckskills/report.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 228 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.07210 |
| Opus 5 | $0.00000 | $0.03605 |
| Sonnet 5 | $0.00000 | $0.01442 |
| Haiku 4.5 | $0.00000 | $0.00721 |
Grade A, and why
report scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- PoC 给可直接复制粘贴的完整 Burp 原始 HTTP 请求块（**不放 curl**），配真实截图，照做就能看到同样结果。 Copies of this mod
1 near-identical copy found in the catalogue:
- report — 89% identical, 59 lines differ
How it starts
The opening of the file, as written. The whole thing — 296 lines — stays where its author put it; the contents beside it link to each section on GitHub.
report — 漏洞报告成稿收口
EN: This skill turns confirmed vulnerabilities into submission-ready DOCX reports. The body is in Chinese because the target platforms (Chinese SRCs, CNVD/CNNVD, EDUSRC) require Chinese reports; the methodology is language-agnostic. See README.md for an English overview.
这是薄编排层，只做一件事：把已确认的漏洞写成可直接提交给审核方的 DOCX 提交稿。 漏洞怎么挖、怎么验证不在本 skill 范围；但"什么漏洞够格写成报告"的分层验证门已内联在本文，自成一体。
何时用 / 何时不用
- ✅ 用：漏洞已确认（硬门过了）、准备成稿交付、扩大危害后更新报告、被驳回后追加申诉。
- ❌ 不用：还在挖 / 还在验证 / 只有单点信号没到终局 → 继续验证，别急着开报告。
- 成稿前若存在
hunts/<目标>/CLUEBOARD.md，证据链以板上「已证实」行为准（见hunt-clueboard），不从聊天重新编出处。
前置铁律：无 PoC = 不存在漏洞；影响没落地到链路终局 = 不写报告。P3 以下不写。
分层验证门（成稿前必过，本 skill 自带完整判据）
分两层：硬门（所有漏洞必过，缺一不报）+ 按类型命门（不同类型的"关键钥匙"）+ 质量项（尽力，不卡报告）。
硬门（所有漏洞必过，缺一不报）
- 先证伪（正常功能排除） — 先假设"这就是正常功能"，主动跑否定实验去推翻它：未授权→用
zzz不存在<时间戳>跑同协议，看是不是 catch-all/公开/样例；越权→用合法 body 重测排除 400 假阳性、POST 排除 SPA 回退；SSRF→确认是不是服务端正常连接功能而非越过边界。证伪不掉，才可能是漏洞；证伪掉了，作废不报。 - PoC 可复现 — 能直接粘贴 Burp 原始请求块，不需要额外解释上下文。
- 真实业务影响（链路终局，危害要实际打出来） — 拿到别人的 ≥3 个敏感字段真实数据 / 操作真实生效改了别人业务状态 / 凭证实际访问到敏感内容。是数据泄露/账户接管/资金损失/服务端 RCE/内网横向的终局结果，不是中间信号（文档/token/拓扑泄露不是终点），不是"理论上有风险"。打不出实际危害 = 信号作废 = 不报。
- 服务端/权限边界确认 — 是服务端或权限边界问题，不是浏览器 JS 假象/调试功能/页面渲染。
- 类型命门 — 命中下方按类型命门表中对应行的硬条件。
- 链式追问到终局 — 已顺根因穷举同类接口 + 纵深追到危害边界（不是问一层就交），或已记录"为什么到此为止"。
按类型命门表（不同类型，关键钥匙不同）
| 漏洞类型 | 命门（硬条件） |
|---|---|
| 数据泄露 | 别人的数据 + ≥3 敏感字段 + 非公开/非样例/非模板；自己测试账号数据 ≠ 漏洞 |
| 越权 / IDOR | A/B 交叉证明：A 拥有的资源，B 的 token 能读/改；只读到自己不报 |
| RCE / 命令执行 | 真实命令执行实证；"别人的数据"对 RCE 天然不适用，能执行命令本身就是危害 |
| SSRF | 服务端发出（回调 UA 证明 Java/Go/Python，非客户端 JS fetch）+ 有官方靶场必须先过靶场（不过不收）；无靶场必须回显内网数据（云元数据/内网服务 banner/内网页面内容）。DNSlog 只是其中一步：出网响了 = 敲门砖，必须继续打到回显/危害终点，仅 dnslog 记录直接交 = 半成品不收 |
| 认证绕过 / ATO | 任意用户可绕过/接管，不只证明自己能登自己号；OAuth/JWT/密码重置逻辑要 A/B 双账号证明 |
| 业务逻辑 / 资金 | 操作真实生效 + 影响的是他人业务状态（金额/订单/状态机跳转），不是自己测试数据 |
| 文件上传 | 造成实际效果才算：webshell 可执行（getshell）或存储型 XSS 触发（HTML/SVG 被服务端解析）；只传上去/能访问但纯存储不解析 = 不成立 |
| 注入 (SQL/NoSQL/SSTI/XXE) | 有确定输出/副作用证明（错误回显、时间差、OOB marker），不是"报错就报"；SQL 注入最低共识 = 注出库名 database()（盲注需时间差 + 库名内容，特殊情况另议） |
What ships with it
6 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago Changed · +1 lines 5472db7f3e54
- 8d ago First seen · 295 lines · 0 tokens per session scan A fa92370affc3
report is a skill published in the GitHub repository zhaji2333/CkSKILLS (76 stars, last pushed 7d ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 7,210 tokens. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
docx
Use this skill whenever the user wants to create, read, edit, or manipulate Word documents (.docx files). Triggers include: any mention of "Word doc", "word document", ".docx", or requests to produce professional documents with formatting like tables of contents, headings, page numbers, or letterheads. Also use when…
docx
A guide for working with Microsoft Word documents in the .docx format. It covers reading, creating, editing, converting, exporting, and handling tracked changes.
morph-ppt
Use this skill when the user wants a .pptx with smooth cross-slide animation — PowerPoint Morph transitions, Keynote-style continuous motion, shapes that grow / move / rotate as the slide advances. Trigger on: 'morph', 'morph transition', 'smooth transition', 'continuous animation across slides', 'Keynote-style…
officecli-academic-paper
Use this skill to build academic-style .docx output: journal / conference / thesis chapters carrying formal citation style (APA, Chicago, IEEE, MLA), numbered equations, figure & table cross-references, footnotes/endnotes, bibliography, or multi-column journal layout. Trigger on: 'research paper', 'journal paper'…
officecli-docx
Use this skill any time a .docx file is involved -- as input, output, or both. This includes: creating Word documents, reports, letters, memos, or proposals; reading, parsing, or extracting text from any .docx file; editing, modifying, or updating existing documents; working with templates, tracked changes, comments…
officecli-financial-model
Use this skill when the user wants to build a financial model — 3-statement model, DCF valuation, LBO, SaaS unit economics, sensitivity / scenario analysis, debt schedule, or fundraising projections — in Excel. Trigger on: 'financial model', '3-statement model', 'P&L + BS + CF', 'DCF', 'WACC', 'NPV', 'terminal value'…