amend-skill

Name: amend-skill
Author: ShulkwiSEC

18stars5forks

How to install amend-skill?

shulkwisec/bb-huge/amend-skill

$npx -y skills add ShulkwiSEC/bb-huge --skill amend-skill

Installs into the current project.

Summary

Inspects a skill's SKILL.md and its observations/runs.md log, identifies failure patterns, and proposes a targeted amendment to improve the skill. Trigger on: "improve this skill", "fix this skill", "update this skill", "why does X keep failing", "this skill is wrong", "add this

Files · 1

View on GitHub

SKILL.md

1	# Amend Skill
2
3	## Purpose
4
5	Skills degrade over time as targets change, new bypass techniques emerge, and failure patterns accumulate. This skill closes the feedback loop: it reads execution history, identifies what is systematically failing, and proposes a minimal surgical amendment to the skill.
6
7	## Trigger Conditions
8
9	Activate this skill when:
10
11	- User says "improve this skill", "fix this skill", "update this skill", "amend this skill"
12	- User says "why does X keep failing" where X is a skill name
13	- User says "add this to the skill" after describing a new technique that worked
14	- `observations/<skill-name>/runs.md` contains 3 or more entries with `outcome: fail`
15
16	## Methodology
17
18	1. Identify the target skill — confirm the skill name with the user if ambiguous.
19	2. Read the skill — load `skills/<bucket>/<category>/<skill-name>/SKILL.md` in full.
20	3. Read the observations — load `observations/<skill-name>/runs.md`.
21	4. Analyze failure patterns:
22	- Which steps consistently fail?
23	- Which payloads are blocked or produce wrong output?
24	- Which trigger conditions are missing or too broad?
25	- Are there new bypass techniques that worked but aren't documented?
26	- Is the output format causing downstream confusion?
27	5. Formulate a single targeted amendment — one focused change rather than a full rewrite. The amendment should be one of:
28	- Tighten trigger: remove or refine a trigger condition that causes false activation
29	- Add missing condition: add a step, payload, or bypass that is now needed
30	- Reorder steps: move a high-value step earlier to avoid wasted time
31	- Fix payload: update an outdated payload that no longer works
32	- Change output format: restructure how the skill presents findings
33	6. Output the amendment as a unified diff — show old text and proposed new text side by side.
34	7. Ask for confirmation — do not apply until the user approves.
35	8. Apply and record — edit the SKILL.md, then append to `observations/<skill-name>/runs.md`:
36
37	```
38	---
39	date: YYYY-MM-DD
40	skill: <skill-name>
41	task: Amendment applied via amend-skill
42	outcome: amendment
43	what_worked: \|
44	<describe what the amendment changes and why>
45	what_failed: \|
46	<describe the failure pattern that motivated the amendment>
47	errors: \|
48	N/A
49	notes: \|
50	Amendment type: <tighten-trigger \| add-condition \| reorder-steps \| fix-payload \| change-output>
51	Rationale: <one-sentence reason>
52	---
53	```
54
55	## Example Interaction
56
57	User: "why does sql-injection keep failing on this target?"
58
59	Process:
60	1. Read `skills/owasp-wstg/injection/sql-injection/SKILL.md`
61	2. Read `observations/sql-injection/runs.md` — finds 3 fail entries, all noting WAF blocking `'` and `--`
62	3. Analysis: Bypass section exists but WAF-specific encoding variants not prominent enough in step 2
63	4. Amendment: Move WAF bypass step earlier in Methodology, add a WAF detection pre-step
64
65	Output:
66	```diff
67	-2. Submit `'`, `"`, `;`, `--`, `/* */` individually and observe response differences.
68	-3. Confirm with boolean pair: append `AND 1=1--` (true) vs `AND 1=2--` (false).
69	+2. Check for WAF: submit `'` and observe whether the response is a WAF block page (uniform
70	+ error regardless of input) vs. a database error (input-specific). If WAF present, use
71	+ encoding variants from the Bypass Techniques section before confirming injection.
72	+3. Submit `'`, `"`, `;`, `--`, `/* */` individually. If WAF present, substitute with
73	+ `%27`, `%2D%2D`, and comment fragmentation `UN/**/ION`.
74	+4. Confirm with boolean pair: `AND 1=1--` vs `AND 1=2--`.
75	```
76
77	## Fix Patterns
78
79	This is a meta-skill — it has no fix patterns of its own. Its output is an amendment to another skill's fix patterns.

People who liked this also viewed

6 picks

Type

amend-skill

18stars5forks

View on GitHub

How to install amend-skill?

shulkwisec/bb-huge/amend-skill

$npx -y skills add ShulkwiSEC/bb-huge --skill amend-skill

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Amend Skill
2
3	## Purpose
4
5	Skills degrade over time as targets change, new bypass techniques emerge, and failure patterns accumulate. This skill closes the feedback loop: it reads execution history, identifies what is systematically failing, and proposes a minimal surgical amendment to the skill.
6
7	## Trigger Conditions
8
9	Activate this skill when:
10
11	- User says "improve this skill", "fix this skill", "update this skill", "amend this skill"
12	- User says "why does X keep failing" where X is a skill name
13	- User says "add this to the skill" after describing a new technique that worked
14	- `observations/<skill-name>/runs.md` contains 3 or more entries with `outcome: fail`
15
16	## Methodology
17
18	1. Identify the target skill — confirm the skill name with the user if ambiguous.
19	2. Read the skill — load `skills/<bucket>/<category>/<skill-name>/SKILL.md` in full.
20	3. Read the observations — load `observations/<skill-name>/runs.md`.
21	4. Analyze failure patterns:
22	- Which steps consistently fail?
23	- Which payloads are blocked or produce wrong output?
24	- Which trigger conditions are missing or too broad?
25	- Are there new bypass techniques that worked but aren't documented?
26	- Is the output format causing downstream confusion?
27	5. Formulate a single targeted amendment — one focused change rather than a full rewrite. The amendment should be one of:
28	- Tighten trigger: remove or refine a trigger condition that causes false activation
29	- Add missing condition: add a step, payload, or bypass that is now needed
30	- Reorder steps: move a high-value step earlier to avoid wasted time
31	- Fix payload: update an outdated payload that no longer works
32	- Change output format: restructure how the skill presents findings
33	6. Output the amendment as a unified diff — show old text and proposed new text side by side.
34	7. Ask for confirmation — do not apply until the user approves.
35	8. Apply and record — edit the SKILL.md, then append to `observations/<skill-name>/runs.md`:
36
37	```
38	---
39	date: YYYY-MM-DD
40	skill: <skill-name>
41	task: Amendment applied via amend-skill
42	outcome: amendment
43	what_worked: \|
44	<describe what the amendment changes and why>
45	what_failed: \|
46	<describe the failure pattern that motivated the amendment>
47	errors: \|
48	N/A
49	notes: \|
50	Amendment type: <tighten-trigger \| add-condition \| reorder-steps \| fix-payload \| change-output>
51	Rationale: <one-sentence reason>
52	---
53	```
54
55	## Example Interaction
56
57	User: "why does sql-injection keep failing on this target?"
58
59	Process:
60	1. Read `skills/owasp-wstg/injection/sql-injection/SKILL.md`
61	2. Read `observations/sql-injection/runs.md` — finds 3 fail entries, all noting WAF blocking `'` and `--`
62	3. Analysis: Bypass section exists but WAF-specific encoding variants not prominent enough in step 2
63	4. Amendment: Move WAF bypass step earlier in Methodology, add a WAF detection pre-step
64
65	Output:
66	```diff
67	-2. Submit `'`, `"`, `;`, `--`, `/* */` individually and observe response differences.
68	-3. Confirm with boolean pair: append `AND 1=1--` (true) vs `AND 1=2--` (false).
69	+2. Check for WAF: submit `'` and observe whether the response is a WAF block page (uniform
70	+ error regardless of input) vs. a database error (input-specific). If WAF present, use
71	+ encoding variants from the Bypass Techniques section before confirming injection.
72	+3. Submit `'`, `"`, `;`, `--`, `/* */` individually. If WAF present, substitute with
73	+ `%27`, `%2D%2D`, and comment fragmentation `UN/**/ION`.
74	+4. Confirm with boolean pair: `AND 1=1--` vs `AND 1=2--`.
75	```
76
77	## Fix Patterns
78
79	This is a meta-skill — it has no fix patterns of its own. Its output is an amendment to another skill's fix patterns.

People who liked this also viewed

6 picks

Type