Skill: gandli/space-query-skill (version 1.0.0)

--- name: space-query-skill description: | Build search queries for network asset discovery platforms (space测绘). Use when users want to find network assets, discover attack surfaces, investigate vulnerabilities (CVE), or search for specific services/servers/websites. Triggers on: 空间测绘, FOFA, 鹰图, ZoomEye, Shodan, CVE, 漏洞, asset discovery, network search, or similar queries. license: MIT --- # Space Query Skill Multi-platform query builder for FOFA, Quake, ZoomEye, and Shodan. ## Quick Start 1. **Detect platform** — Use specified platform or ask user 2. **Analyze intent** — What to find, where, attributes, exclusions 3. **Build query** — Apply correct syntax for the platform 4. **Present result** — Use the output format below ## Platform Selection | Platform | Best For | Syntax Style | |----------|----------|--------------| | FOFA | Global coverage, protocol details | `field="value"` | | Quake (鹰图) | China data, threat intel | `field:value` | | ZoomEye | Service fingerprints | `field:value` | | Shodan | IoT,漏洞关联 | `field:value` | ## Core Patterns ### Pattern 1: Exposed Service ``` FOFA: product="Redis" && port="6379" && country="CN" Quake: app:Redis AND port:6379 AND country:China Shodan: product:Redis port:6379 country:CN ``` ### Pattern 2: Login Page ``` FOFA: (title="登录" || title="admin" || title="后台") && country="CN" Quake: (keyword:登录 OR keyword:admin) AND country:China Shodan: title:"login" country:CN ``` ### Pattern 3: File Upload ``` FOFA: (body="plupload" || body="webuploader" || title="上传") && country="CN" Shodan: http.html:"type=\"file\"" country:CN ``` ### Pattern 4: SSL Certificate Issue ``` FOFA: cert.is_expired=true && country="CN" Shodan: ssl.cert.expired:true country:CN ``` ### Pattern 5: CVE/Vulnerability Search **Critical**: Always extract features from CVE info and use platform-specific product identifiers. #### CVE Query Workflow ``` ┌─────────────────────────────────────────────────────────────┐ │ Step 1: WebSearch for official queries │ │ Search: "[Platform] CVE-XXXX-XXXX" or "[CVE] + FOFA" │ └─────────────────────────┬───────────────────────────────────┘ ▼ ┌─────────────────────────────────────────────────────────────┐ │ Step 2: Find official source │ │ - Platform blog (en.fofa.info, quake.360.net/blog) │ │ - Security sites (securityonline.info, nvd.nist.gov) │ │ - GitHub PoC repos often contain platform queries │ └─────────────────────────┬───────────────────────────────────┘ ▼ ┌─────────────────────────────────────────────────────────────┐ │ Step 3: Extract platform-specific product ID │ │ - FOFA uses app="product-name" │ │ - Quake uses app:product-name │ │ - Shodan uses product:product-name │ └─────────────────────────┬───────────────────────────────────┘ ▼ ┌─────────────────────────────────────────────────────────────┐ │ Step 4: Build query │ └─────────────────────────────────────────────────────────────┘ ``` #### How to Find Official Sources **When given a CVE, ALWAYS use WebSearch first:** ```bash # Search for platform-specific queries web_search: "CVE-2024-38819 FOFA query" web_search: "CVE-2024-38819 fofa.info" web_search: "CVE-2024-38819 Quake 360" web_search: "CVE-2024-38819 PoC github" # Search for official platform announcements web_search: "site:en.fofa.info CVE-2024-38819" web_search: "site:quake.360.net CVE" ``` **Official Sources to Check:** | Source | URL | What to Find | |--------|-----|--------------| | FOFA Blog | en.fofa.info | Official queries with exact app IDs | | Quake Blog | quake.360.net/blog | Threat intel announcements | | NVD | nvd.nist.gov | CVE details, affected products | | SecurityOnline | securityonline.info | PoC with platform queries | | GitHub | github.com | PoC exploits often include FOFA/Quake queries | #### Example - CVE-2024-38819 **Step 1: WebSearch** ``` Search: "CVE-2024-38819 FOFA" Result: en.fofa.info shows "app="vmware-Spring-Framework"" ``` **Step 2: Official Query Found** ``` FOFA: app="vmware-Spring-Framework" (25k+ results) ``` **Step 3: Cross-platform translation** ``` FOFA: app="vmware-Spring-Framework" Shodan: product:"Spring Framework" Quake: app:Spring ZoomEye: app:spring ``` #### Wrong vs Correct Approach **Wrong (lazy):** ``` body="CVE-2024-38819" ❌ CVE ID in body, no results product="Spring" ❌ Wrong product ID for most platforms ``` **Correct (official product ID):** ``` app="vmware-Spring-Framework" ✅ FOFA official query ``` #### Verified CVE Query Table | CVE | Affects | FOFA | Shodan | Quake | |-----|---------|------|--------|-------| | CVE-2024-38819 | Spring Framework | `app="vmware-Spring-Framework"` | `product:"Spring Framework"` | `app:Spring` | | CVE-2021-44228 | Apache Log4j | `app="Apache-log4j2"` | `product:log4j` | `app:log4j` | | CVE-2019-0708 | Windows RDP | `app="Microsoft-RDP"` | `vuln:CVE-2019-0708` | `app:RDP` | | CVE-2022-22965 | Spring4Shell | `app="vmware-Spring-Framework"` | `product:Spring` | `app:Spring` | **Rule**: When you find an official query from a trusted source (platform blog, security site, verified PoC), use that exact query. ## Operator Precedence ``` () > == > = > != > && > || ``` **Rule**: Always wrap multiple OR conditions with `()`. ## Output Format Present queries using this structure: ```markdown ## Query **Platform:** [Platform] ``` [Query Here] ``` ### Explanation - **Target:** What this finds - **Fields:** Main fields used - **Logic:** AND/OR relationship ### Suggestions - Additional filters to consider - Known limitations - Alternative approaches ``` ## Field Reference See `resources/fields.md` for complete field lists per platform. ## Important Notes 1. **Parentheses** — `(A || B) && C` not `A || B && C` 2. **Platform syntax differs** — FOFA uses `="` while others use `:` 3. **Chinese chars** — `country="中国"` works in FOFA, prefer English elsewhere 4. **Time filtering** — `after`/`before` in FOFA/Quake ## Troubleshooting | Issue | Solution | |-------|----------| | No results | Add `status_code="200"` or remove strict filters | | Too many results | Add country, time, or product filters | | Wrong syntax | Check platform in reference files |

path: AGENTS.md
content: # AGENTS.md

This file provides guidance to AI coding agents (Claude Code, Cursor, Copilot, etc.) when working with code in this repository.

## Repository Overview

A collection of skills for building network asset discovery (空间测绘) queries. Supports FOFA, Quake (鹰图), ZoomEye, and Shodan platforms.

## Creating or Updating Skills

### Directory Structure

```
{skill-name}/           # kebab-case directory name
  SKILL.md              # Required: skill definition
  scripts/              # Helper scripts (optional)
    {script-name}.sh    # Bash scripts
  resources/            # Supporting documentation (optional)
    {file}.md          # Reference files
```

### Naming Conventions

- **Skill directory**: `kebab-case` (e.g., `space-query-skill`)
- **SKILL.md**: Always uppercase, always this exact filename
- **Scripts**: `kebab-case.sh`
- **Resources**: `kebab-case.md` or `kebab-case/`

### SKILL.md Format

```markdown
---
name: {skill-name}
description: {One sentence describing when to use this skill. Include trigger phrases.}
---

# {Skill Title}

{Brief description of what the skill does.}

## How It Works

{Numbered list explaining the skill's workflow}

## Usage

{How to use the skill}
```

### Best Practices for Context Efficiency

Skills are loaded on-demand — only the skill name and description are loaded at startup. The full `SKILL.md` loads into context only when the agent decides the skill is relevant. To minimize context usage:

- **Keep SKILL.md under 500 lines** — put detailed reference material in separate files
- **Write specific descriptions** — helps the agent know exactly when to activate the skill
- **Use progressive disclosure** — reference supporting files that get read only when needed
- **Prefer scripts over inline code** — script execution doesn't consume context (only output does)
- **File references work one level deep** — link directly from SKILL.md to supporting files

## Skill Structure

Each skill contains:
- `SKILL.md` - Instructions for the agent
- `scripts/` - Helper scripts for automation (optional)
- `resources/` - Supporting documentation (optional)

## Distribution

Skills are packaged as zip files for distribution. Include all necessary files in the skill directory.


path: CLAUDE.md
content: # CLAUDE.md

This file provides context for AI coding agents working with this repository.

## Repository Purpose

Space Query Skill - Multi-platform query builder for network asset discovery (空间测绘) platforms.

## Supported Platforms

- **FOFA** (fofa.info) - Global coverage, protocol details
- **Quake** (quake.360.net) - China-focused, threat intelligence
- **ZoomEye** (zoomeye.org) - Detailed service fingerprints
- **Shodan** (shodan.io) - International IoT, vulnerability correlation

## Key Features

- CVE/vulnerability search with correct methodology
- Platform-specific query syntax
- Progressive disclosure (SKILL.md → resources/)
- Multi-platform query translation

## Important Conventions

1. **CVE Queries**: Always extract platform-specific product IDs, never search CVE ID directly in body/content
2. **Operator Precedence**: `() > == > = > != > && > ||`
3. **Progressive Disclosure**: Keep SKILL.md under 500 lines, detailed fields in resources/

## File Structure

```
SKILL.md           # Main skill file (loaded on trigger)
resources/         # Detailed field references
  fields.md       # Platform-specific field mappings
scripts/          # Helper scripts (future)
```

## Working with CVEs

When given a CVE:
1. WebSearch for official platform queries first
2. Check platform blogs, security sites, GitHub PoCs
3. Extract platform-specific product IDs
4. Build queries using official product identifiers

See `SKILL.md` for detailed workflow.


path: README.md
content: # Space Query Skill

Build search queries for network asset discovery (空间测绘) platforms.

## Supported Platforms

| Platform | Best For | Website |
|----------|---------|--------|
| FOFA | Global coverage, detailed protocol data | [fofa.info](https://fofa.info) |
| Quake (鹰图) | China-focused, threat intelligence | [quake.360.net](https://quake.360.net) |
| ZoomEye | Detailed service fingerprints | [zoomeye.org](https://zoomeye.org) |
| Shodan | International IoT devices, vulnerability correlation | [shodan.io](https://shodan.io) |

## Installation

### Claude Code
```bash
# Clone the repository
git clone https://github.com/gandli/space-query-skill.git ~/.claude/skills/space-query-skill
```

### Claude Code Plugin
```bash
/plugin marketplace add gandli/space-query-skill
/plugin install space-query-skill@gandli
```

### Other
```bash
# Using skills CLI (recommended)
npx skills add gandli/space-query-skill
```

## Usage

Describe what you want to find:

```
Find all Redis servers exposed in China
Search for Apache Log4j vulnerabilities
Look for login pages on government websites
Find expired SSL certificates on banks
Search for CVE-2021-44228 affected hosts
```

The skill will generate queries for the appropriate platform(s).

## Features

- Multi-platform query syntax support
- CVE/vulnerability search queries
- Platform-specific field mappings
- Query pattern templates
- Operator precedence handling

## Examples

### Exposed Database
```
FOFA:   port="6379" && product="Redis" && country="CN"
Quake:  port:6379 AND app:Redis AND country:China
Shodan: port:6379 product:Redis country:CN
```

### Login Pages
```
FOFA:   (title="登录" || title="admin") && country="CN"
Shodan: title:"login page" country:CN
```

### CVE/Vulnerability
```
Shodan: product:Apache vuln:CVE-2021-44228
FOFA:   product="Apache" && body="log4j"
Quake:  app:Apache AND tag:CVE-2021-44228
```

## License

MIT


path: evals/evals.json
content: {
  "skill_name": "fofa-query-builder",
  "evals": [
    {
      "id": 1,
      "prompt": "查找中国境内的 Nginx 服务器，要求状态码为 200",
      "expected_output": "应该生成包含 product=\"Nginx\"、country=\"CN\" 和 status_code=\"200\" 的查询语句",
      "files": []
    },
    {
      "id": 2,
      "prompt": "我想找找有哪些 Redis 数据库暴露在公网上，端口是 6379",
      "expected_output": "应该生成包含 port=\"6379\" 和 product=\"Redis\" 的查询语句",
      "files": []
    },
    {
      "id": 3,
      "prompt": "搜集目标 example.com 下的所有子域名网站资产",
      "expected_output": "应该生成包含 domain=\"example.com\" 和 type=\"subdomain\" 的查询语句",
      "files": []
    },
    {
      "id": 4,
      "prompt": "排查一下我们公司的 SSL 证书有没有过期的，使用的是 Apache 服务器",
      "expected_output": "应该生成包含 server=\"Apache\"、cert.is_expired=true 的查询语句",
      "files": []
    },
    {
      "id": 5,
      "prompt": "查找标题包含「登录」或「后台」的 phpmyadmin 页面，限制在最近半年有更新的",
      "expected_output": "应该生成包含 body=\"phpmyadmin\"、title 相关条件、以及 after 时间限制的查询语句",
      "files": []
    }
  ]
}


path: metadata.json
content: {
  "version": "1.0.0",
  "organization": "space-query-skill",
  "date": "April 2026",
  "abstract": "Multi-platform query builder for network asset discovery (空间测绘). Supports FOFA, Quake (鹰图), ZoomEye, and Shodan with correct CVE/vulnerability search methodology. Contains platform-specific field mappings, query patterns, and verified CVE queries.",
  "references": [
    "https://fofa.info",
    "https://quake.360.net",
    "https://zoomeye.org",
    "https://shodan.io",
    "https://en.fofa.info/blog",
    "https://quake.360.net/blog"
  ]
}


path: resources/fields.md
content: # Field Reference

Detailed field mappings for each platform.

## FOFA (fofa.info)

### Basic Fields
| Field | Description | Example |
|-------|-------------|---------|
| ip | IPv4 address | `ip="1.1.1.1"` |
| ip="220.181.111.1/24" | IPv4 C段 | |
| port | Port number | `port="6379"` |
| domain | Root domain | `domain="qq.com"` |
| host | Hostname | `host=".fofa.info"` |
| server | Server type | `server="Microsoft-IIS/10"` |
| asn | ASN number | `asn="19551"` |
| org | Organization | `org="LLC Baxet"` |

### Website Fields (type="subdomain")
| Field | Description | Example |
|-------|-------------|---------|
| title | Website title | `title="beijing"` |
| header | HTTP header | `header="elastic"` |
| body | HTML body | `body="网络空间测绘"` |
| js_name | JS filename | `js_name="js/jquery.js"` |
| js_md5 | JS hash | `js_md5="82a..."` |
| status_code | HTTP status | `status_code="200"` |
| icon_hash | Icon hash | `icon_hash="-247388890"` |

### Product/Component
| Field | Description | Example |
|-------|-------------|---------|
| product | Product name | `product="NGINX"` |
| product.version | Version | `product.version="1.6.10"` |
| app | FOFA rule | `app="Microsoft-Exchange"` |
| category | Category | `category="服务"` |

### Certificate
| Field | Description | Example |
|-------|-------------|---------|
| cert | Certificate | `cert="baidu"` |
| cert.domain | Cert domain | `cert.domain="huawei.com"` |
| cert.subject | Subject | `cert.subject="Oracle Corporation"` |
| cert.issuer | Issuer | `cert.issuer="DigiCert"` |
| cert.is_valid | Valid cert | `cert.is_valid=true` |
| cert.is_expired | Expired cert | `cert.is_expired=true` |
| cert.is_match | Cert matches domain | `cert.is_match=true` |

### Location
| Field | Description | Example |
|-------|-------------|---------|
| country | Country | `country="CN"` or `country="中国"` |
| region | Region/state | `region="Zhejiang"` |
| city | City | `city="Hangzhou"` |

### Time
| Field | Description | Example |
|-------|-------------|---------|
| after | Updated after | `after="2023-01-01"` |
| before | Updated before | `before="2023-12-01"` |

### Operators
- `=` exact match, `= ""` for empty
- `==` perfect match, `== ""` for exists-but-empty
- `!=` not equal, `!= ""` for not-empty
- `*=` fuzzy match
- `&&` AND, `||` OR

---

## Quake (quake.360.net)

### Basic Fields
| Field | Description | Example |
|-------|-------------|---------|
| ip | IP address | `ip:1.2.3.4` |
| port | Port | `port:80` |
| domain | Domain | `domain:example.com` |
| country | Country | `country:China` |
| city | City | `city:Beijing` |
| protocol | Protocol | `protocol:http` |

### Special Fields
| Field | Description | Example |
|-------|-------------|---------|
| app | Application | `app:Apache` |
| tag | Tag | `tag:weblogic` |
| device | Device type | `device:Router` |
| os | OS | `os:Windows` |
| header | HTTP header | `header:Server` |
| keyword | Full-text | `keyword:login` |

### Operators
- `AND` / `&&` - AND
- `OR` / `||` - OR
- `NOT` / `!` - NOT
- `*` wildcard (multi), `?` single
- `()` grouping

---

## ZoomEye (zoomeye.org)

ZoomEye uses a "dork" based search system.

### Basic Fields
| Field | Description | Example |
|-------|-------------|---------|
| ip | IP address | `ip:1.2.3.4` |
| port | Port | `port:80` |
| country | Country code | `country:cn` |
| city | City | `city:beijing` |
| app | Application | `app:apache` |
| service | Service type | `service:http` |
| os | Operating system | `os:windows` |
| device | Device type | `device:router` |
| component | Component | `component:jquery` |
| version | Version | `version:1.18.0` |

### CLI/SDK Usage
```bash
# ZoomEye CLI
zoomeye search "telnet"
zoomeye search "country=cn" -facets product -pagesize 10

# ZoomEye SDK (Python)
from zoomeye.sdk import ZoomEye
zm = ZoomEye([REDACTED_SECRET]")
zm.search('app:apache')
```

### Important Notes
- Uses API key authentication (free tier available)
- Supports facets for aggregated statistics
- Website data requires different search mode
- Reference: [github.com/knownsec/ZoomEye-python](https://github.com/knownsec/ZoomEye-python)

---

## Shodan (shodan.io)

### Filters
| Filter | Description | Example |
|--------|-------------|---------|
| country | Country code | `country:CN` |
| city | City | `city:Beijing` |
| geo | Coordinates | `geo:39.9,116.4,50km` |
| org | Organization | `org:"China Telecom"` |
| isp | ISP | `isp:"China Unicom"` |
| asn | ASN | `asn:45090` |
| hostname | Hostname | `hostname:.edu.cn` |
| net | Network | `net:192.168.0.0/24` |
| port | Port | `port:22` |

### Product/Service
| Filter | Description | Example |
|--------|-------------|---------|
| product | Product | `product:nginx` |
| version | Version | `version:1.18.0` |
| os | OS | `os:"Windows 7"` |
| device | Device | `device:webcam` |
| vuln | Vulnerability | `vuln:CVE-2021-44228` |

### Operators
- `AND` / `OR` / `NOT` (or `!`)
- `"phrase"` exact phrase
- `()` grouping

---

## Common Use Cases

### Find Databases
| Platform | Query |
|----------|-------|
| FOFA | `port="6379" && product="Redis" && country="CN"` |
| Quake | `port:6379 AND app:Redis AND country:China` |
| ZoomEye | `port:6379 AND app:redis` |
| Shodan | `port:6379 product:Redis` |

### Find Login Pages
| Platform | Query |
|----------|-------|
| FOFA | `(title="登录" \|\| title="admin") && country="CN"` |
| Quake | `(keyword:登录 OR keyword:admin) AND country:China` |
| ZoomEye | `title:登录 OR title:admin` |
| Shodan | `title:"login" country:CN` |

### Find Webcams
| Platform | Query |
|----------|-------|
| FOFA | `product="海康威视" && country="CN"` |
| Quake | `app:海康威视 AND country:China` |
| Shodan | `device:webcam country:CN` |

### Find Vulnerable Services
| Platform | Query |
|----------|-------|
| FOFA | `product="Apache" && product.version="2.4.49"` |
| Quake | `app:Apache AND ver:2.4.49` |
| Shodan | `product:Apache version:2.4.49 vuln:CVE-2021-44228` |

---

## CVE Vulnerability Search

### Platform Support

| Platform | CVE Support | Example |
|----------|------------|---------|
| Shodan | Full CVE tags | `vuln:CVE-2021-44228` |
| Quake | Tag-based | `tag:CVE-2021-44228` |
| FOFA | Body/content search | `body="log4j"` |
| ZoomEye | Partial | `vuln:CVE-2021-44228` |

### Common CVE Queries

| CVE | Affected | FOFA | Shodan | Quake |
|-----|---------|------|--------|-------|
| CVE-2026-33032 | Nginx UI | `app="nginx-ui"` | `product:"Nginx UI"` | `app:nginx-ui` |
| CVE-2024-38819 | Spring Framework | `app="vmware-Spring-Framework"` | `product:"Spring Framework"` | `app:Spring` |
| CVE-2021-44228 | Apache Log4j | `app="Apache-log4j2"` | `vuln:CVE-2021-44228` | `app:log4j` |
| CVE-2019-0708 | Windows RDP | `app="Microsoft-RDP"` | `vuln:CVE-2019-0708` | `app:RDP` |
| CVE-2022-22965 | Spring4Shell | `app="vmware-Spring-Framework"` | `product:Spring` | `app:Spring` |
| CVE-2021-26855 | MS Exchange | `app="Microsoft-Exchange"` | `vuln:CVE-2021-26855` | `app:Exchange` |

### Vulnerability Search Tips

1. **Shodan** has the best CVE support - use `vuln:CVE-YYYY-NNNNN`
2. **FOFA** often requires searching for vulnerability signatures in body/header
3. **Quake** uses tags for known CVEs
4. **ZoomEye** supports some CVE searches
5. Always combine with product/service filters for accuracy


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)