cyberstrike-eino-demo

CyberStrike × Eino Fully Provisioned Skill Demo

This package is consistent with Agent Skills :SKILL.md is the manifest + main description(no separate SKILL.yaml). The same directory may contain scripts/、references/、assets/ and any other subdirectories (as long as paths are safe and the package depth/file count limits are not exceeded), read by ListPackageFiles / resource_path and Eino local tools. See FORMS.md、REFERENCE.md。

Overview

For one-time validation:

• HTTP GET /api/skills list (script_count、file_count、progressive etc. are derivation/scan results)
• GET /api/skills/cyberstrike-eino-demo?depth=summary|full
• section= corresponds to SKILL.md in ## headingor the short id of an ASCII heading (e.g. ## Payload 样例 often corresponds to section=payload）
• ADK within multi-agent skill tools (and optional local file tools) read in-package relative path resources
• Eino FilesystemSkillsRetriever retrieval of package summaries,## chunks, script entries

Hard requirements: any testing must obtain written authorization and be limited to the agreed scope and time window.

Authorized testing workflow

1. Scope confirmation: domains / IPs, interface list, prohibited actions (DoS, data exfiltration, etc.).
2. Baseline records: perform read-only probing of the agreed assets, save timestamps and raw request/response summaries.
3. Categorized testing: split tasks by vulnerability type; re-confirm the authorization boundary before high-risk operations.
4. Evidence and reporting: each finding comes with reproduction steps, impact, remediation recommendations; sensitive data is redacted.
5. Wrap-up: delete temporary accounts, clean up test data, hand over the report.

Payload examples

The following are teaching placeholders, actual testing requires replacing with the target context and must not be used against unauthorized systems:

• SQLi probing (error-based):"'(observe whether database error message leakage is triggered)
• Reflected XSS (harmless):<script>alert(1)</script> → should be encoded or blocked by CSP in the range
• Path traversal (read-only validation):....//....//etc/passwd(only in authorized file read scenarios)

See scripts/payloads.txt。

references/ and assets/

Used to verify whether subdirectories other than scripts/ are treated equally:

Path	Purpose
references/citations.md	References and HTTP resource_path test description
assets/README.txt	Placeholder resources (can be replaced with real binaries for file read limit testing)

Recommended toolchain

Phase	Tool examples
Proxy and replay	Burp Suite、mitmproxy
Scanning and directories	ffuf, nuclei (lower concurrency to comply with authorization)
Vulnerability validation	self-written PoCs, official CLIs (sqlmap, etc.) only within the authorized scope
Records	Markdown + JSON snippet templates (see scripts/report-snippet.json）

Manifest and validation

• written authorization and testing window have been saved
• scripts/ files under it are consistent with references in the body text
• Web or GET /api/skills?... can verify the index; within a multi-agent session use skill Tools are loaded by package to save tokens
• When details are needed, use skill to pull the full text, or HTTP depth=full、section=<标题或短 id>
• When the original script is needed, use the local file tool or HTTP resource_path=scripts/check-env.sh
• resource_path=references/citations.md and resource_path=assets/README.txt can be read