← 返回扫描报告总表 · ← dshlib 图书馆

扫描报告 · @dhicoc/dsh-reverse-skill

认证等级L1
DIDdid:cha2a:package:@dhicoc/dsh-reverse-skill
身份锚点dhicoc/dsh-reverse-skill · npm 官方声明
来源npm
插件版本—
安装dsh plugin add @dhicoc/dsh-reverse-skill
扫描日期2026-08-17（3 天前）
扫描层级静态扫描（自研规则 + GuardDog 复核 + OSV 依赖）
扫描器版本dshlib-scan v0.1 · GuardDog 3.2.0 · OSV.dev

自研扫描：⚠️ 待审 · GuardDog 复核：✅ 通过 · OSV 依赖：未扫描

语义：扫描是提示信号，非安全审查。✅ 通过=无命中；⚠️ 待审=有命中需人工判断；❌ 失败=无法扫描。人工确认恶意→下架。本页全部内容由 dshlib 数据库派生（验证报告 可核对证据）。认证等级与依赖漏洞正交：L4 认证覆盖插件包内容/来源/生态，不覆盖依赖安全（见收录与验证标准）。结论有有效期：插件或运行时更新后，本页结论可能过期（>30 天将标注待复核）。本库能力与边界：披露页。

1. 自研扫描（dshlib-scan）

数据外传（47 处）

文件行命中
package/skills/pentest-tools/src-hunter/references/payloader/raw/tools.json1011password -dc-ip dc_ip -request
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json23128process.env,\n cwd: process.cwd(),\n hostname: require('os').hostname()\n});\n
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json23291readFileSync(`${buildDir}/${f}`, 'utf8');\n code += '\\n;fetch
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json24965process.env or os.environ\n\n# 自动化检测脚本\ncurl
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json14938token}\"}\nresponse = request
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json15057token = \"YOUR_TOKEN\"\nfor i in range(1, 100):\n r = request
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json15228api_keys = [\"key1\", \"key2\", \"key3\", \"key4\"]\nfor i, key in enumerate(api
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json18547password=wrong\" \"http://target.com/login\"\n\ncurl
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json18637password=test\" \"http://target.com/login\"\n\n# 参数重复(某些后端取最后一个值):\ncurl
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json18637password=test\" \"http://target.com/login\"\n\n# JSON格式切换(如果支持):\ncurl
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json18637password\":\"test\"}' \"http://target.com/login\"\n\n# 大小写混淆:\ncurl
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json18637password=test\" \"http://target.com/login\"\n\n# 额外参数注入:\ncurl
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json18637password=test&captcha=&token=\" \"http://target.com/login\"\n\n# 不同编码:\ncurl
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json18857tokens = []\nfor i in range(10):\n r = request
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json18875password-reset\"\n\n# 2. IDOR - 直接使用他人的重置Token/UID:\ncurl
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json18875password=hacked123\" \"http://target.com/api/password-reset/confirm\"\n\n# 3.
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json18875password=test12345\" \"http://target.com/api/password-reset/set-password\"\n\n
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json18875password=newpass123\" \"http://target.com/api/password-reset/confirm\"\n\n# 5.
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json19001token=xxx\n# 使用Referer泄露:\n# 如果callback页面有外链，Token会通过Referer泄露\n\n# 2. Scope越权 -
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json19001token_here\"\ncurl -H \"Authorization: Bearer ${TOKEN}\" \"http://target.com/api
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json19001token窃取后无限续期:\ncurl
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json19395secret)):\n# 注册新账号 → 分析Cookie → 推导secret → 伪造admin Cookie\n\n# 5. 测试:\ncurl
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json19421token=$(curl
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json20887password\"\ncurl
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json22495passwords:\n captcha = solve_captcha(\"{TARGET}\")\n r = request
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json22885secret,\n algorithm=\"HS256\"\n)\nprint(f\"Forged JWT: {forged}\")\n\n# 验证\nc
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json23225token {GITHUB_TOKEN}\" | jq '.[].name'\n\n# 分析工作流中的密钥使用\ncurl
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json23247secrets.DEPLOY_KEY }} | base64 -w0\n curl
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json23311secrets\n\n# 环境变量泄露——避免直接echo\n- run: |\n python3 -c \"import os,urllib.reque
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json23767password\": {\"$ne\": \"\"}}'\n\n# $regex匹配\ncurl
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json23767password\": {\"$regex\": \".*\"}}'\n\n# $gt永真条件\ncurl
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json23811password\": {\"$regex\": f\"^{password}{re.escape(c)}\"}\n }\n r =
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json23911credentials/\"\n\n# 获取临时凭据\ncurl
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json23911credentials/{ROLE_NAME}\"\n\n# 获取用户数据(可能包含启动脚本中的密钥)\ncurl
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json23938token\" -H \"Metadata-Flavor: Google\"\n\n# GCP获取项目信息\ncurl -s \"https://{TARGET
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json24403secrets/kubernetes.io/serviceaccount/ca.crt\nK8S=https://$KUBERNETES_SERVICE_HOS
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json25096password is\",\n \"The API key is sk-\",\n \"BEGIN RSA PRIVATE KEY\",\n]\n
package/CTF-Sandbox-Orchestrator/competition-identity-windows/references/identity-windows.md11secrets, browser stores, PowerShell history, ETW, Sysmon, prefetch
package/skills/pentest-tools/src-hunter/references/playbooks/intranet-postexp.md135password -dc-ip dc_ip -request
package/skills/pentest-tools/src-hunter/references/playbooks/oauth-saml-jwt.md1497token=$(curl
package/CTF-Sandbox-Orchestrator/competition-ios-runtime/SKILL.md38token, device identifier, request
package/CTF-Sandbox-Orchestrator/competition-prompt-injection/SKILL.md18secret request
package/CTF-Sandbox-Orchestrator/competition-ssrf-metadata-pivot/SKILL.md3tokens, service-account credentials, or explain how a server-side fetch
package/CTF-Sandbox-Orchestrator/competition-web-runtime/SKILL.md47token extraction through server-side fetch
package/skills/pentest-tools/src-hunter/references/payloader/tools/内网渗透.md136password -dc-ip dc_ip -request
package/skills/pentest-tools/src-hunter/references/payloader/by-category/intranet/凭证窃取.md163password -dc-ip dc_ip -request
package/skills/pentest-tools/src-hunter/references/payloader/by-category/web/认证漏洞.md1410token=$(curl

越权能力（228 处）

文件行命中
package/skills/pentest-tools/src-hunter/references/payloader/raw/tools.json5068exec(
package/skills/pentest-tools/src-hunter/references/payloader/raw/tools.json5091exec(
package/skills/pentest-tools/src-hunter/references/payloader/raw/tools.json5112exec(
package/skills/pentest-tools/src-hunter/references/payloader/raw/tools.json5140exec(
package/skills/pentest-tools/src-hunter/references/payloader/raw/tools.json5155exec(
package/skills/pentest-tools/src-hunter/references/payloader/raw/tools.json5225exec(
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json1055exec(
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json4404exec(
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json4807exec(
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json4851exec(
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json4864exec(
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json4950exec(
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json4965exec(
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json5017exec(
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json5030exec(
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json5046exec(
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json5085exec(
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json5103exec(
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json5103exec(
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json5118exec(
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json5149exec(
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json5175exec(
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json5211exec(
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json5308exec(
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json5313exec(
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json5925exec(
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json5987exec(
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json5988exec(
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json6059exec(
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json6059exec(
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json6082execSync(
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json6082execSync(
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json6100exec(
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json6116execSync(
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json6123execSync(
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json6141execSync(
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json6356exec(
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json7072exec(
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json7072exec(
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json7082exec(
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json7087exec(
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json7102exec(
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json9081exec(
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json9081exec(
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json11909exec(
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json11909exec(
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json11919exec(
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json11924exec(
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json12518exec(
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json15728exec(
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json15728exec(
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json15728exec(
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json15743exec(
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json15751exec(
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json15751exec(
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json15790exec(
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json15808exec(
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json15834exec(
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json15858exec(
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json15876exec(
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json15992exec(
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json15992exec(
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json16182exec(
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json16247exec(
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json16915exec(
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json17000exec(
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json17041exec(
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json18407exec(
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json23175exec(
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json23175exec(
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json23515execSync(
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json23515execSync(
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json23534execSync(
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json23542execSync(
package/skills/apk-reverse/references/android-advanced.md226exec(
package/skills/field-journal/CONTRIBUTE-BACK.md45exec(
package/skills/pentest-tools/src-hunter/references/playbooks/file-upload.md108exec(
package/skills/pentest-tools/src-hunter/references/playbooks/file-upload.md218exec(
package/skills/pentest-tools/src-hunter/references/playbooks/file-upload.md268exec(
package/skills/apk-reverse/references/frida-bypass-kit.md15exec(
package/skills/apk-reverse/references/frida-cookbook.md277exec(
package/skills/pentest-tools/src-hunter/references/playbooks/intranet-postexp.md245exec(
package/skills/pentest-tools/src-hunter/references/payloader/by-category/web/lfi-rfi文件包含.md153exec(
package/skills/pentest-tools/src-hunter/references/payloader/by-category/web/lfi-rfi文件包含.md730exec(
package/skills/pentest-tools/src-hunter/references/payloader/by-category/web/lfi-rfi文件包含.md733exec(
package/skills/pentest-tools/src-hunter/references/payloader/by-category/web/lfi-rfi文件包含.md737exec(
package/skills/pentest-tools/src-hunter/references/payloader/by-category/web/lfi-rfi文件包含.md738exec(
package/skills/pentest-tools/src-hunter/references/payloader/by-category/web/lfi-rfi文件包含.md760exec(
package/skills/pentest-tools/src-hunter/references/playbooks/mobile.md140exec(
package/skills/pentest-tools/src-hunter/references/playbooks/mobile.md143exec(
package/skills/pentest-tools/src-hunter/references/playbooks/mobile.md145exec(
package/skills/pentest-tools/src-hunter/references/playbooks/path-traversal.md509exec(
package/skills/pentest-tools/src-hunter/references/playbooks/path-traversal.md882exec(
package/skills/pentest-tools/src-hunter/references/playbooks/path-traversal.md885exec(
package/skills/pentest-tools/src-hunter/references/playbooks/path-traversal.md907exec(
package/skills/field-journal/precedent-pentest.md471exec(
package/skills/field-journal/precedent-pentest.md473exec(
package/skills/pentest-tools/src-hunter/references/playbooks/rce.md104exec(
package/skills/pentest-tools/src-hunter/references/playbooks/rce.md241exec(
package/skills/pentest-tools/src-hunter/references/playbooks/rce.md244exec(
package/skills/pentest-tools/src-hunter/references/playbooks/rce.md388exec(
package/skills/pentest-tools/src-hunter/references/playbooks/rce.md657exec(
package/skills/pentest-tools/src-hunter/references/playbooks/rce.md657exec(
package/skills/pentest-tools/src-hunter/references/playbooks/rce.md792exec(
package/skills/pentest-tools/src-hunter/references/playbooks/rce.md793exec(
package/skills/pentest-tools/src-hunter/references/playbooks/rce.md800exec(
package/skills/pentest-tools/src-hunter/references/playbooks/rce.md807exec(
package/skills/pentest-tools/src-hunter/references/playbooks/rce.md810exec(
package/skills/pentest-tools/src-hunter/references/playbooks/rce.md832exec(
package/skills/pentest-tools/src-hunter/references/playbooks/rce.md843exec(
package/skills/pentest-tools/src-hunter/references/playbooks/rce.md870exec(
package/skills/pentest-tools/src-hunter/references/playbooks/rce.md889exec(
package/skills/pentest-tools/src-hunter/references/playbooks/rce.md967exec(
package/skills/pentest-tools/src-hunter/references/playbooks/rce.md970exec(
package/skills/pentest-tools/src-hunter/references/playbooks/rce.md1180exec(
package/skills/pentest-tools/src-hunter/references/playbooks/rce.md1700exec(
package/skills/pentest-tools/src-hunter/references/playbooks/rce.md1766exec(
package/skills/pentest-tools/src-hunter/references/playbooks/rce.md1806exec(
package/skills/pentest-tools/src-hunter/references/playbooks/rce.md2106exec(
package/skills/pentest-tools/src-hunter/references/playbooks/rce.md2283exec(
package/skills/pentest-tools/src-hunter/references/playbooks/rce.md2284exec(
package/skills/pentest-tools/src-hunter/references/playbooks/rce.md3085exec(
package/skills/pentest-tools/src-hunter/references/playbooks/rce.md3101exec(
package/skills/pentest-tools/src-hunter/references/playbooks/rce.md3108exec(
package/skills/pentest-tools/src-hunter/references/playbooks/rce.md3143exec(
package/skills/pentest-tools/src-hunter/references/playbooks/rce.md3176exec(
package/skills/pentest-tools/src-hunter/references/playbooks/rce.md3184exec(
package/skills/pentest-tools/src-hunter/references/playbooks/rce.md3211exec(
package/skills/pentest-tools/src-hunter/references/playbooks/rce.md3218exec(
package/skills/pentest-tools/src-hunter/references/playbooks/rce.md3219exec(
package/skills/pentest-tools/src-hunter/references/playbooks/rce.md3234exec(
package/skills/pentest-tools/src-hunter/references/playbooks/rce.md3242exec(
package/skills/pentest-tools/src-hunter/references/playbooks/rce.md3255exec(
package/skills/pentest-tools/src-hunter/references/playbooks/rce.md3305exec(
package/skills/pentest-tools/src-hunter/references/playbooks/rce.md3606exec(
package/skills/pentest-tools/src-hunter/references/playbooks/rce.md3666exec(
package/skills/pentest-tools/src-hunter/references/playbooks/rce.md3667exec(
package/skills/pentest-tools/src-hunter/references/playbooks/rce.md3674execSync(
package/skills/pentest-tools/src-hunter/references/playbooks/rce.md3675execSync(
package/skills/pentest-tools/src-hunter/references/playbooks/rce.md3681exec(
package/skills/pentest-tools/src-hunter/references/playbooks/rce.md3690execSync(
package/skills/pentest-tools/src-hunter/references/playbooks/rce.md3698execSync(
package/skills/pentest-tools/src-hunter/references/playbooks/rce.md3705execSync(
package/skills/pentest-tools/src-hunter/references/playbooks/rce.md4309exec(
package/skills/pentest-tools/src-hunter/references/playbooks/rce.md4314exec(
package/skills/pentest-tools/src-hunter/references/playbooks/rce.md4554execSync(
package/skills/pentest-tools/src-hunter/references/playbooks/rce.md4562execSync(
package/skills/pentest-tools/src-hunter/references/playbooks/rce.md4571execSync(
package/skills/pentest-tools/src-hunter/references/payloader/by-category/web/rce远程代码执行.md134exec(
package/skills/pentest-tools/src-hunter/references/payloader/by-category/web/rce远程代码执行.md182exec(
package/skills/pentest-tools/src-hunter/references/payloader/by-category/web/rce远程代码执行.md183exec(
package/skills/pentest-tools/src-hunter/references/payloader/by-category/web/rce远程代码执行.md191exec(
package/skills/pentest-tools/src-hunter/references/payloader/by-category/web/rce远程代码执行.md192exec(
package/skills/pentest-tools/src-hunter/references/payloader/by-category/web/rce远程代码执行.md664exec(
package/skills/field-journal/seed-013_kerberoasting-spn.md38exec (
package/skills/attack-chain/SKILL.md341exec(
package/skills/pentest-tools/src-hunter/references/payloader/by-category/web/sql-nosql注入.md679exec(
package/skills/pentest-tools/src-hunter/references/playbooks/sqli.md862exec(
package/skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md158exec(
package/skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md182exec(
package/skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md191exec(
package/skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md255exec(
package/skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md265exec(
package/skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md303exec(
package/skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md315exec(
package/skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md323exec(
package/skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md366exec(
package/skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md376exec(
package/skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md377exec(
package/skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md383exec(
package/skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md401exec(
package/skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md413exec(
package/skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md432exec(
package/skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md512exec(
package/skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md516exec(
package/skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md979exec(
package/skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md1019exec(
package/skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md1021exec(
package/skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md1077exec(
package/skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md1078exec(
package/skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md1089execSync(
package/skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md1090execSync(
package/skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md1100exec(
package/skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md1111execSync(
package/skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md1119execSync(
package/skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md1129execSync(
package/skills/pentest-tools/src-hunter/references/playbooks/unauth-access.md238exec(
package/skills/pentest-tools/src-hunter/references/payloader/waf-bypass.md158exec(
package/skills/pentest-tools/src-hunter/references/payloader/waf-bypass.md172exec(
package/skills/pentest-tools/src-hunter/references/payloader/waf-bypass.md3106exec(
package/skills/pentest-tools/src-hunter/references/payloader/waf-bypass.md3115exec(
package/skills/pentest-tools/src-hunter/references/payloader/waf-bypass.md3133exec(
package/skills/pentest-tools/src-hunter/references/payloader/waf-bypass.md3145exec(
package/skills/pentest-tools/src-hunter/references/payloader/waf-bypass.md3160exec(
package/skills/pentest-tools/src-hunter/references/payloader/waf-bypass.md3179exec(
package/skills/pentest-tools/src-hunter/references/payloader/waf-bypass.md3373execSync(
package/skills/pentest-tools/src-hunter/references/payloader/waf-bypass.md3381execSync(
package/skills/pentest-tools/src-hunter/references/payloader/waf-bypass.md3391execSync(
package/skills/pentest-tools/src-hunter/references/payloader/waf-bypass.md5835exec(
package/skills/pentest-tools/src-hunter/references/payloader/waf-bypass.md5840exec(
package/skills/pentest-tools/src-hunter/references/payloader/by-category/web/供应链攻击.md114exec(
package/skills/pentest-tools/src-hunter/references/payloader/by-category/web/供应链攻击.md119exec(
package/skills/pentest-tools/src-hunter/references/payloader/by-category/intranet/凭证窃取.md326exec(
package/skills/pentest-tools/src-hunter/references/payloader/by-category/web/原型链污染.md43execSync(
package/skills/pentest-tools/src-hunter/references/payloader/by-category/web/原型链污染.md51execSync(
package/skills/pentest-tools/src-hunter/references/payloader/by-category/web/原型链污染.md57execSync(
package/skills/pentest-tools/src-hunter/references/payloader/by-category/web/原型链污染.md65execSync(
package/skills/pentest-tools/src-hunter/references/payloader/by-category/web/框架漏洞.md153exec(
package/skills/pentest-tools/src-hunter/references/payloader/by-category/web/框架漏洞.md153exec(
package/skills/pentest-tools/src-hunter/references/payloader/by-category/web/框架漏洞.md359exec(
package/skills/pentest-tools/src-hunter/references/payloader/by-category/web/框架漏洞.md360exec(
package/skills/pentest-tools/src-hunter/references/payloader/by-category/web/框架漏洞.md367exec(
package/skills/pentest-tools/src-hunter/references/payloader/by-category/web/框架漏洞.md372exec(
package/skills/pentest-tools/src-hunter/references/payloader/by-category/web/框架漏洞.md378exec(
package/skills/pentest-tools/src-hunter/references/payloader/by-category/web/框架漏洞.md381exec(
package/skills/pentest-tools/src-hunter/references/payloader/by-category/web/框架漏洞.md409exec(
package/skills/pentest-tools/src-hunter/references/payloader/by-category/web/框架漏洞.md423exec(
package/skills/pentest-tools/src-hunter/references/payloader/by-category/web/框架漏洞.md433exec(
package/skills/pentest-tools/src-hunter/references/payloader/by-category/web/框架漏洞.md473exec(
package/skills/pentest-tools/src-hunter/references/payloader/by-category/web/框架漏洞.md495exec(
package/skills/pentest-tools/src-hunter/references/payloader/by-category/web/框架漏洞.md609exec(
package/skills/pentest-tools/src-hunter/references/payloader/by-category/web/框架漏洞.md612exec(
package/skills/pentest-tools/src-hunter/references/payloader/by-category/web/框架漏洞.md816exec(
package/skills/pentest-tools/src-hunter/references/payloader/by-category/web/框架漏洞.md911exec(
package/skills/pentest-tools/src-hunter/references/payloader/by-category/web/框架漏洞.md1656exec(
package/skills/pentest-tools/src-hunter/references/payloader/by-category/web/框架漏洞.md1754exec(
package/skills/pentest-tools/src-hunter/references/payloader/by-category/web/框架漏洞.md1802exec(
package/skills/pentest-tools/src-hunter/references/payloader/by-category/web/框架漏洞.md2216exec(

危险命令（10 处）

文件行命中
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json2803TRUNCATE
package/skills/pentest-tools/src-hunter/references/payloader/raw/web.json24974TRUNCATE
package/skills/llm-security/references/agent-security-testing.md93DROP TABLE
package/skills/pentest-tools/src-hunter/references/payloader/by-category/web/ai安全.md111TRUNCATE
package/skills/firmware-pentest/references/extraction-methodology.md115dd if=rootfs.jffs2 of=/dev
package/skills/pentest-tools/src-hunter/references/playbooks/intranet-postexp.md4265reboot
package/skills/pwn-chain/references/kernel-pwn.md53reboot
package/skills/pentest-tools/src-hunter/references/payloader/by-category/web/sql-nosql注入.md1742TRUNCATE
package/skills/pentest-tools/src-hunter/references/playbooks/sqli.md1510TRUNCATE
package/skills/pentest-tools/src-hunter/references/payloader/by-category/intranet/权限维持.md353reboot

硬编码密钥（21 处）

文件行命中
package/skills/field-journal/anonymization.md92token = "{admin_session_token}"
package/skills/field-journal/anonymization.md148secret = "Bearer eyJhbGciOiJIUzI1NiJ9..."
package/skills/field-journal/anonymization.md152secret = "Bearer {hardcoded_jwt}"
package/skills/pentest-tools/src-hunter/references/playbooks/api-rest.md730password: "password1"
package/skills/pentest-tools/src-hunter/references/playbooks/api-rest.md731password: "password2"
package/skills/pentest-tools/src-hunter/references/playbooks/api-rest.md732password: "password3"
package/skills/pentest-tools/src-hunter/references/playbooks/api-rest.md733password: "password4"
package/skills/pentest-tools/src-hunter/references/playbooks/api-rest.md734password: "password5"
package/skills/pentest-tools/src-hunter/references/playbooks/api-rest.md1133token = "YOUR_TOKEN"
package/skills/pentest-tools/src-hunter/references/payloader/by-category/web/api安全.md601password: "password1"
package/skills/pentest-tools/src-hunter/references/payloader/by-category/web/api安全.md602password: "password2"
package/skills/pentest-tools/src-hunter/references/payloader/by-category/web/api安全.md603password: "password3"
package/skills/pentest-tools/src-hunter/references/payloader/by-category/web/api安全.md604password: "password4"
package/skills/pentest-tools/src-hunter/references/payloader/by-category/web/api安全.md605password: "password5"
package/skills/pentest-tools/src-hunter/references/payloader/by-category/web/api安全.md1175token = "YOUR_TOKEN"
package/CTF-Sandbox-Orchestrator/competition-web-runtime/references/cookie-hmac-key-reuse-auth-bypass.md54token = "从URL提取的token"
package/CTF-Sandbox-Orchestrator/competition-web-runtime/references/cookie-hmac-key-reuse-auth-bypass.md100token = "已知的token"
package/skills/reverse-engineering/field-notes.md393token = "<token from /access/<token>>"
package/skills/pentest-tools/src-hunter/references/payloader/by-category/web/jwt安全.md310secret = "cracked_secret_key"
package/skills/pentest-tools/src-hunter/references/playbooks/oauth-saml-jwt.md1998secret = "cracked_secret_key"
package/skills/scripts/update-star-history.ps127password=' }) -replace '

2. 第三方复核（GuardDog 3.2.0）

No risks found in @dhicoc/dsh-reverse-skill


────────────────────────────────────────
Assessment:  No risks detected  (0.0/10)
0 risks detected

3. 依赖漏洞（OSV.dev）

未查询。