155 lines
51 KiB
Markdown
155 lines
51 KiB
Markdown
# Каталог реверс-скиллов (чистая сборка, 2026-09-30)
|
||
|
||
Всего скиллов с SKILL.md: **136**. Личные данные вычищены (см. README).
|
||
|
||
## (root)
|
||
|
||
- **dsl-vm-reverse** (`dsl-vm-reverse/`, 1 файлов) — Reverse JavaScript-based custom DSL/VM interpreters, non-standard WASM-like runtimes, and risk-control engines. Use when analyzing IIFE or switch-based opcode dispatchers, extracting instruction tables, recovering bytecode semantics, capturing VM state at runtime, or reconstructing execution flow.
|
||
- **firmware-reversing** (`firmware-reversing/`, 1 файлов) — 'Use for firmware and embedded device reverse engineering: firmware extraction
|
||
- **protocol-reverse-engineering** (`protocol-reverse-engineering/`, 1 файлов) — Master network protocol reverse engineering including packet analysis, protocol dissection, and custom protocol documentation. Use when analyzing network traffic, understanding proprietary protocols, or debugging network communication.
|
||
- **reverse-engineering** (`reverse-engineering/`, 25 файлов) — Provides reverse engineering techniques. Use when the main job is to understand how a compiled, obfuscated, packed, or virtualized target works before exploiting or solving it, including binaries, APKs, WASM, firmware, custom VMs, bytecode, malware-like loaders, and anti-debug or anti-analysis logic. Do not use it when the vulnerability is already understood and the remaining task is exploitation; use pwn instead. Do not use it for pure web workflows, log or disk forensics, or standalone crypto problems unless reversing the implementation is the real blocker.
|
||
- **reverse-engineering-android-malware-with-jadx** (`reverse-engineering-android-malware-with-jadx/`, 4 файлов) — 'Reverse engineers malicious Android APK files using JADX decompiler to analyze Java/Kotlin source code, identify
|
||
- **reverse-engineering-binary** (`reverse-engineering-binary/`, 1 файлов) — 'Use for binary reverse engineering: disassembly, decompilation, PE/ELF/Mach-O
|
||
- **reverse-engineering-cli** (`reverse-engineering-cli/`, 1 файлов) — 'Use for CLI tool reverse engineering: binary analysis, auth flow mapping,
|
||
- **reverse-engineering-dotnet-malware-with-dnspy** (`reverse-engineering-dotnet-malware-with-dnspy/`, 4 файлов) — 'Reverse engineers .NET malware using dnSpy decompiler and debugger to analyze C#/VB.NET source code, identify
|
||
- **reverse-engineering-full** (`reverse-engineering-full/`, 1 файлов) — Use for full-spectrum binary reverse engineering (ELF/PE/Mach-O), protocol
|
||
- **reverse-engineering-ios-app-with-frida** (`reverse-engineering-ios-app-with-frida/`, 8 файлов) — 'Reverse engineers iOS applications using Frida dynamic instrumentation to understand internal logic, extract
|
||
- **reverse-engineering-kernel** (`reverse-engineering-kernel/`, 1 файлов) — 'Use for kernel-mode reverse engineering: Windows driver analysis, anti-cheat
|
||
- **reverse-engineering-malware-with-ghidra** (`reverse-engineering-malware-with-ghidra/`, 4 файлов) — 'Reverse engineers malware binaries using NSA''s Ghidra disassembler and decompiler to understand internal logic,
|
||
- **reverse-engineering-mobile** (`reverse-engineering-mobile/`, 1 файлов) — 'Use for mobile app reverse engineering: Android APK analysis, iOS IPA
|
||
- **reverse-engineering-obfuscation** (`reverse-engineering-obfuscation/`, 1 файлов) — Use for deobfuscation, unpacking, anti-analysis bypass, code virtualization
|
||
- **reverse-engineering-protocol** (`reverse-engineering-protocol/`, 1 файлов) — 'Use for protocol reverse engineering: API reversing, network traffic
|
||
- **reverse-engineering-ransomware-encryption-routine** (`reverse-engineering-ransomware-encryption-routine/`, 8 файлов) — Reverse engineer ransomware encryption routines to identify cryptographic algorithms, key generation flaws, and
|
||
- **reverse-engineering-rust-malware** (`reverse-engineering-rust-malware/`, 7 файлов) — Reverse engineer Rust-compiled malware using IDA Pro and Ghidra with techniques for handling non-null-terminated
|
||
- **reverse-skill** (`reverse-skill-repo/`, 592 файлов) — >-
|
||
- **reverser-pentester** (`reverser-pentester/`, 1 файлов) — Use when you need built-in reverse engineer / pentester — RE бинарников,
|
||
|
||
## our-skills
|
||
|
||
- **attio-reverse-engineering** (`our-skills/attio-reverse-engineering/`, 1 файлов) — "Reverse-engineer and integrate Attio CRM (AI models, API, MCP) into OMP — covers internal endpoints, auth, gateway, and provider wiring"
|
||
- **devin-architecture-reverse** (`our-skills/devin-architecture-reverse/`, 1 файлов) — "Devin AI agent architecture reverse engineering — binary structure, permission modes, hooks, slash commands, OMP mapping"
|
||
- **dotnet-winui3-reverse-engineering** (`our-skills/dotnet-winui3-reverse-engineering/`, 1 файлов) — "Decompile a WinUI 3 / Windows App SDK MSIX-packaged .NET app to C# source + extract XBF resources from PRI"
|
||
- **re-roast-2026** (`our-skills/re-roast-2026/`, 2 файлов) — "Use when roasting/verifying a reverse-engineering guide, post, or list of RE tools; fact-checking stars/tool counts; link liveness sweep; cutting hyperbole; splitting content into Telegram messages (4096 limit); or when building/evaluating any 2026 RE stack content: IDA/Ghidra/Binary Ninja, Qiling, OGhidra, AI-RE pipeline, IDA licensing. Triggers: прожарка, реверс, реверсинг, RE, reverse engineering, бинарь, дизассемблер, декомпилятор, проверь ссылки, гайд по реверсу, проверить факты в посте."
|
||
- **reverse-winui3-app** (`our-skills/reverse-winui3-app/`, 1 файлов) — "Use when reverse engineering a WinUI 3 / .NET 8 MSIX-packaged Windows application — covers ILSpy decompilation, PRI/XBF extraction, and pkg-compiled Node.js backend identification"
|
||
- **reverse-winui3-pkg-app** (`our-skills/reverse-winui3-pkg-app/`, 1 файлов) — "Reverse engineer a WinUI 3 (.NET 8) desktop app with a pkg-compiled Node.js backend: ILSpy decompilation, XBF extraction from resources.pri, pkg payload extraction, self-contained publish, MSIX packaging with self-signed cert, and side-by-side launch"
|
||
- **vibeproxy-reverse-engineering** (`our-skills/vibeproxy-reverse-engineering/`, 1 файлов) — "Reverse engineer VibeProxy (WinUI 3 .NET 8 MSIX app) — ILSpy decompile, self-contained publish, MSIX repackage, and fork 9router backend"
|
||
- **vibeproxy-reverse-pipeline** (`our-skills/vibeproxy-reverse-pipeline/`, 1 файлов) — "Reverse engineer a WinUI 3 MSIX app: ILSpy decompile, self-contained publish, MSIX staging/sign/install, and design modification with pixel verification"
|
||
- **winui3-msix-reverse** (`our-skills/winui3-msix-reverse/`, 1 файлов) — "Reverse engineer a WinUI 3 MSIX app: ILSpy decompile, rebuild with dotnet publish self-contained, overlay original native assets, loose-register without admin, add custom pages"
|
||
- **winui3-msix-reverse-rebuild** (`our-skills/winui3-msix-reverse-rebuild/`, 1 файлов) — "Reverse engineer a WinUI 3 MSIX app: ILSpy decompile, self-contained publish, MSIX repackage with self-signed cert, and launch via AppsFolder"
|
||
- **winui3-reverse-engineering** (`our-skills/winui3-reverse-engineering/`, 1 файлов) — "Reverse engineer WinUI 3 / .NET 8 MSIX applications: ILSpy decompilation, self-contained publish, MSIX packaging with self-signed cert, and side-by-side launch with modified code"
|
||
|
||
## research-what-we-did
|
||
|
||
- **research** (`research-what-we-did/Deep-Research-skills/skills/research-codex-en/research/`, 2 файлов) — Conduct preliminary research on a topic and generate research outline. For academic research, benchmark research, technology selection, etc.
|
||
- **research-add-fields** (`research-what-we-did/Deep-Research-skills/skills/research-codex-en/research-add-fields/`, 1 файлов) — Add field definitions to existing research outline.
|
||
- **research-add-items** (`research-what-we-did/Deep-Research-skills/skills/research-codex-en/research-add-items/`, 1 файлов) — Add items (research objects) to existing research outline.
|
||
- **research-deep** (`research-what-we-did/Deep-Research-skills/skills/research-codex-en/research-deep/`, 1 файлов) — Read research outline, launch independent agent for each item for deep research. Disable task output.
|
||
- **research-report** (`research-what-we-did/Deep-Research-skills/skills/research-codex-en/research-report/`, 1 файлов) — Summarize deep research results into markdown report, cover all fields, skip uncertain values.
|
||
- **research** (`research-what-we-did/Deep-Research-skills/skills/research-codex-zh/research/`, 2 файлов) — Conduct preliminary research on a topic and generate research outline. For academic research, benchmark research, technology selection, etc.
|
||
- **research-add-fields** (`research-what-we-did/Deep-Research-skills/skills/research-codex-zh/research-add-fields/`, 1 файлов) — Add field definitions to existing research outline.
|
||
- **research-add-items** (`research-what-we-did/Deep-Research-skills/skills/research-codex-zh/research-add-items/`, 1 файлов) — Add items (research objects) to existing research outline.
|
||
- **research-deep** (`research-what-we-did/Deep-Research-skills/skills/research-codex-zh/research-deep/`, 1 файлов) — Read research outline, launch independent agent for each item for deep research. Disable task output.
|
||
- **research-report** (`research-what-we-did/Deep-Research-skills/skills/research-codex-zh/research-report/`, 1 файлов) — Summarize deep research results into markdown report, cover all fields, skip uncertain values.
|
||
- **research** (`research-what-we-did/Deep-Research-skills/skills/research-en/research/`, 2 файлов) — Conduct preliminary research on a topic and generate research outline. For academic research, benchmark research, technology selection, etc.
|
||
- **research-add-fields** (`research-what-we-did/Deep-Research-skills/skills/research-en/research-add-fields/`, 1 файлов) — Add field definitions to existing research outline.
|
||
- **research-add-items** (`research-what-we-did/Deep-Research-skills/skills/research-en/research-add-items/`, 1 файлов) — Add items (research objects) to existing research outline.
|
||
- **research-deep** (`research-what-we-did/Deep-Research-skills/skills/research-en/research-deep/`, 1 файлов) — Read research outline, launch independent agent for each item for deep research. Disable task output.
|
||
- **research-report** (`research-what-we-did/Deep-Research-skills/skills/research-en/research-report/`, 1 файлов) — Summarize deep research results into markdown report, cover all fields, skip uncertain values.
|
||
- **research** (`research-what-we-did/Deep-Research-skills/skills/research-zh/research/`, 2 файлов) — 对目标话题进行初步调研，生成调研outline。用于学术调研、benchmark调研、技术选型等场景。
|
||
- **research-add-fields** (`research-what-we-did/Deep-Research-skills/skills/research-zh/research-add-fields/`, 1 файлов) — 向现有调研outline补充字段定义。
|
||
- **research-add-items** (`research-what-we-did/Deep-Research-skills/skills/research-zh/research-add-items/`, 1 файлов) — 向现有调研outline补充items（调研对象）。
|
||
- **research-deep** (`research-what-we-did/Deep-Research-skills/skills/research-zh/research-deep/`, 1 файлов) — 读取调研outline，为每个item启动独立agent进行深度调研。禁用task output。
|
||
- **research-report** (`research-what-we-did/Deep-Research-skills/skills/research-zh/research-report/`, 1 файлов) — 将deep调研结果汇总为markdown报告，覆盖所有字段，跳过不确定值。
|
||
|
||
## reverse-engineering
|
||
|
||
- **dsl-vm-reverse** (`reverse-engineering/dsl-vm-reverse/`, 1 файлов) — Reverse JavaScript-based custom DSL/VM interpreters, non-standard WASM-like runtimes, and risk-control engines. Use when analyzing IIFE or switch-based opcode dispatchers, extracting instruction tables, recovering bytecode semantics, capturing VM state at runtime, or reconstructing execution flow.
|
||
|
||
## reverse-skill-repo
|
||
|
||
- **competition-ad-certificate-abuse** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-ad-certificate-abuse/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for AD CS, certificate templates, enrollment rights, EKUs, SAN controls, PKINIT, certificate mapping, and cert-based privilege paths. Use when the user asks about ESC-style abuse, certificate templates, enrollment agents, EKUs, SAN or subject controls, smartcard or PKINIT logon, CA policy, or how an issued cert turns into accepted privilege. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
|
||
- **competition-agent-cloud** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-agent-cloud/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for AI-agent, prompt-injection, MCP or toolchain, cloud, container, CI/CD, and supply-chain challenges. Use when the user asks to analyze prompt-to-tool flows, retrieval poisoning, mounted secrets, deployment drift, runtime-vs-manifest mismatches, registry provenance, or CI-produced artifacts under sandbox assumptions. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
|
||
- **competition-android-hooking** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-android-hooking/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for Android APK hooking, Frida tracing, request-signing recovery, SSL pinning bypass, JNI boundary inspection, and app trust-boundary analysis. Use when the user asks to hook an APK, inspect signer logic, trace Java or native boundaries, bypass pinning or root checks, inspect shared prefs or app databases, or replay accepted mobile requests. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
|
||
- **competition-browser-persistence** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-browser-persistence/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for browser cookies, localStorage, sessionStorage, IndexedDB, Cache Storage, service workers, offline caches, and client-side session persistence. Use when the user asks to inspect browser state, replay cached auth or session behavior, explain why a page behaves differently after load, or trace how stored client state changes requests, rendering, or access. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
|
||
- **competition-bundle-sourcemap-recovery** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-bundle-sourcemap-recovery/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for source maps, build manifests, chunk registries, emitted bundles, obfuscated loader flow, and frontend runtime recovery. Use when the user asks to reconstruct served JavaScript structure, inspect source maps or chunk maps, trace bundle loading, recover hidden routes or APIs from emitted assets, or explain runtime behavior from built frontend artifacts. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
|
||
- **competition-cloud-metadata-path** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-cloud-metadata-path/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for cloud metadata services, instance identity, workload identity, link-local credential paths, role assumption, and metadata-to-privilege trust edges. Use when the user asks to inspect metadata-service access, instance credentials, pod or workload identity, link-local token paths, SSRF-to-metadata escalation, or explain how metadata-derived credentials turn into accepted cloud or control-plane privilege. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
|
||
- **competition-container-runtime** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-container-runtime/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for live container runtime analysis, mounted secrets, sidecars, namespaces, init containers, entrypoint drift, and route-to-container resolution. Use when the user asks why a live container differs from manifests, where a mounted secret is consumed, how a sidecar or init container changes runtime state, or which route resolves to which live container. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
|
||
- **competition-crypto-mobile** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-crypto-mobile/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for crypto, encoding, steganography, APK, IPA, and mobile trust-boundary challenges. Use when the user asks to decode a blob, recover a transform chain or key, inspect hidden media payloads, hook an APK or IPA signer, inspect app storage, or replay mobile request-signing logic. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
|
||
- **competition-custom-protocol-replay** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-custom-protocol-replay/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for custom binary or text protocol recovery, handshake reconstruction, framing, sequence control, checksums, stateful replay, and accepted-session reproduction. Use when the user asks to decode an unknown protocol, recover custom framing, build a replay harness, satisfy sequence or checksum rules, replay a captured session, or prove the smallest message order that reaches an accepted branch. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
|
||
- **competition-dpapi-credential-chain** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-dpapi-credential-chain/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for DPAPI masterkeys, vault blobs, browser credential stores, protected secrets, domain backup keys, and secret-to-acceptance replay chains. Use when the user asks to inspect DPAPI blobs or masterkeys, recover browser or vault credentials, trace DPAPI context or backup-key use, or explain how protected Windows secrets become accepted access or privilege. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
|
||
- **competition-file-parser-chain** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-file-parser-chain/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for file uploads, imports, previews, archive extraction, format conversion, parser invocation, and deserialization chains. Use when the user asks to inspect an upload or import path, trace archive extraction, preview or converter behavior, explain how a file reaches a parser or deserializer, or connect one uploaded artifact to the decisive backend effect. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
|
||
- **competition-firmware-layout** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-firmware-layout/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for firmware images, partition tables, boot chains, update packages, extracted filesystems, embedded configs, and device-facing trust boundaries. Use when the user asks to unpack firmware, map partition layout, inspect bootloader or init chains, recover update keys or credentials, trace config loading, or explain how a device surface reaches the decisive artifact. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
|
||
- **competition-forensic-timeline** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-forensic-timeline/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for DFIR chronology, cross-artifact correlation, persistence chains, and incident timeline reconstruction. Use when the user asks to build a forensic timeline, correlate EVTX, PCAP, registry, disk, memory, mailbox, or browser artifacts, explain the order of attacker actions, or pinpoint the stage where the decisive artifact appears. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
|
||
- **competition-graphql-rpc-drift** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-graphql-rpc-drift/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for GraphQL schemas, persisted queries, RPC manifests, generated clients, OpenAPI drift, hidden operations, and contract-to-handler mismatches. Use when the user asks to inspect GraphQL or RPC requests, compare client contracts to live handlers, recover hidden operations, trace generated clients, or explain how schema or contract drift produces the decisive behavior. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
|
||
- **competition-identity-windows** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-identity-windows/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for Active Directory, Kerberos, LDAP, OAuth, enterprise messaging, Windows host forensics, credential material, and lateral-movement challenges. Use when the user asks to trace tickets or tokens, inspect mailbox rules, analyze Windows host evidence, understand an AD trust path, or explain a lateral-movement chain across sandbox-linked nodes. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
|
||
- **competition-ios-runtime** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-ios-runtime/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for IPA runtime analysis, Frida hooks, Objective-C or Swift method tracing, Keychain inspection, SSL pinning bypass, URL scheme handling, and iOS request-signing recovery. Use when the user asks to hook an IPA, trace Objective-C or Swift runtime behavior, inspect Keychain or plist state, bypass pinning, analyze deeplinks or universal links, or replay accepted iOS requests. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
|
||
- **competition-jwt-claim-confusion** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-jwt-claim-confusion/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for JWT, JWS, and JWE validation paths, header parsing, key selection, claim acceptance, audience and issuer checks, role derivation, and token-to-identity confusion bugs. Use when the user asks to inspect JWT headers or claims, key lookup, `kid` handling, `alg` confusion, audience or issuer validation, role claims, or explain how a token becomes accepted identity or privilege. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
|
||
- **competition-k8s-control-plane** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-k8s-control-plane/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for Kubernetes API analysis, service-account trust, RBAC edges, admission and controller behavior, cluster secrets, workload mutation, and namespace-scoped drift. Use when the user asks to inspect kube API permissions, service-account tokens, RoleBinding or ClusterRoleBinding edges, admission webhooks, controller-created pods, secret exposure, or why live workloads differ from manifests. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
|
||
- **competition-kerberos-delegation** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-kerberos-delegation/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for Kerberos delegation, SPN trust edges, S4U abuse, RBCD, constrained or unconstrained delegation, and service-ticket acceptance. Use when the user asks about constrained delegation, unconstrained delegation, RBCD, S4U, SPNs, ticket acceptance, or how a Kerberos trust edge turns into effective privilege under sandbox assumptions. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
|
||
- **competition-kernel-container-escape** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-kernel-container-escape/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for kernel attack surface, namespace and cgroup boundaries, container isolation assumptions, syscall paths, and escape primitive verification. Use when the user asks to analyze container-to-host escape paths, kernel exploit prerequisites, namespace crossover, capability misuse, or prove whether an exploit primitive crosses the sandbox boundary. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
|
||
- **competition-linux-credential-pivot** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-linux-credential-pivot/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for Linux credential artifacts, service tokens, SSH material, cloud and container secrets, socket-level trust, and host-to-host pivot chains. Use when the user asks to trace Linux auth artifacts, accepted token or key replay, socket or service-account trust edges, sudo or capability abuse, or explain lateral movement across Linux challenge nodes. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
|
||
- **competition-lsass-ticket-material** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-lsass-ticket-material/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for LSASS-resident secrets, Windows logon sessions, Kerberos ticket caches, DPAPI-backed material, SSP artifacts, and replayable credential extraction. Use when the user asks to inspect LSASS memory, recover tickets or logon sessions, trace DPAPI or SSP material, distinguish which credential artifacts are replayable, or connect host-resident credential material to an accepted pivot or privilege edge. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
|
||
- **competition-mailbox-abuse** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-mailbox-abuse/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for enterprise mail abuse, OAuth consent, inbox or forwarding rules, transport rules, shared mailbox access, phishing chains, and token-to-mailbox side effects. Use when the user asks to trace mailbox rules, OAuth consent grants, forwarding or delegate abuse, shared mailbox access, message-trace evidence, or explain how mail artifacts turn into persistence, exfiltration, or privilege. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
|
||
- **competition-malware-config** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-malware-config/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for malware configuration recovery, staged payload boundaries, beacon parameter extraction, and IOC decoding. Use when the user asks to recover a malware config, decode C2 or beacon fields, unpack staged payloads, extract bot or campaign IDs, or tie recovered config to observed protocol behavior under sandbox assumptions. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
|
||
- **competition-oauth-oidc-chain** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-oauth-oidc-chain/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for OAuth, OIDC, redirect flows, state or nonce handling, PKCE, token exchange, refresh logic, claim mapping, and accepted login paths. Use when the user asks to trace redirects, callback parameters, scopes, state, nonce, PKCE, refresh tokens, consent, or explain how an OAuth or OIDC chain turns into accepted identity or privilege. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
|
||
- **competition-pcap-protocol** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-pcap-protocol/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for packet capture analysis, session reconstruction, application-protocol decoding, stream reassembly, beacon timing, and packet-to-process correlation. Use when the user asks to analyze a PCAP, rebuild TCP or UDP sessions, decode HTTP, WebSocket, DNS, custom C2, or binary protocols, extract transferred artifacts, or tie packet sequences to host or malware behavior. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
|
||
- **competition-prompt-injection** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-prompt-injection/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for prompt-injection, retrieval poisoning, memory contamination, planner drift, MCP or tool-boundary abuse, and agent exfiltration challenges. Use when the user asks to analyze prompt injection, retrieval poisoning, memory contamination, planner drift, tool-argument corruption, or secret exposure caused by an agent chain. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
|
||
- **competition-queue-worker-drift** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-queue-worker-drift/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for queues, async workers, cron jobs, delayed tasks, retry behavior, worker-only config drift, and payload-to-side-effect chains. Use when the user asks to trace a queue payload, inspect async job execution, explain worker-only behavior, follow retries or dead-letter handling, or connect an enqueued item to a later file, cache, email, or privilege-bearing side effect. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
|
||
- **competition-race-condition-state-drift** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-race-condition-state-drift/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for race windows, ordering bugs, idempotency failures, lock gaps, concurrent worker drift, and state inconsistencies that produce decisive effects. Use when the user asks to reproduce timing-sensitive bugs, concurrent state corruption, duplicate actions, stale reads, or privilege or balance drift caused by request ordering. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
|
||
- **competition-relay-coercion-chain** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-relay-coercion-chain/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for forced-auth coercion, relay chains, target selection, NTLM or related acceptance paths, and coercion-to-privilege transitions. Use when the user asks to trace a coercion primitive, follow a relay path, analyze forced authentication, determine which service accepts relayed auth, or connect a coercion step to resulting privilege, enrollment, or code execution. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
|
||
- **competition-request-normalization-smuggling** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-request-normalization-smuggling/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for parser differentials, HTTP normalization gaps, ambiguous headers, path decoding drift, transfer-framing mismatches, and request smuggling routes. Use when the user asks to trace proxy and backend parse differences, conflicting path normalization, Host or forwarded-header ambiguity, CL/TE issues, or routing outcomes that differ across hops. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
|
||
- **competition-reverse-pwn** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-reverse-pwn/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for reverse engineering, malware, DFIR, firmware, pwnable, and native exploit challenges. Use when the user asks to reverse a binary, unpack a sample, inspect a memory dump or PCAP, recover malware behavior, debug a crash, or build or verify an exploit chain under sandbox assumptions. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
|
||
- **competition-runtime-routing** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-runtime-routing/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for reverse proxies, Host headers, forwarded headers, vhost routing, websocket upgrades, path-prefix rewriting, base-URL derivation, and multi-node route resolution. Use when the user asks which host or container serves a route, why a public-looking domain still belongs to the sandbox, how headers or proxies change behavior, or how a route resolves across proxy, container, and worker boundaries. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
|
||
- **competition-ssrf-metadata-pivot** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-ssrf-metadata-pivot/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for SSRF reachability, internal route probing, metadata-service access, credential pivoting, and token-to-accepted-privilege chains. Use when the user asks to trace SSRF sources, internal hosts, metadata endpoints, link-local tokens, service-account credentials, or explain how a server-side fetch edge turns into accepted access. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
|
||
- **competition-stego-media** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-stego-media/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for image, audio, video, document, and container steganography. Use when the user asks to inspect metadata, alpha or palette channels, LSBs, thumbnails, appended trailers, QR fragments, transcoding artifacts, or recover a hidden payload from media without blind brute force. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
|
||
- **competition-supply-chain** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-supply-chain/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for CI/CD, registry, dependency drift, artifact provenance, image build, release pipeline, and runtime consumer challenges. Use when the user asks to trace dependency drift, registry pulls, malicious packages, build or release tampering, CI execution, artifact signing, or which shipped artifact the runtime actually consumes. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
|
||
- **competition-template-render-path** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-template-render-path/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for SSR, template rendering, route loaders, hydration payloads, server-client render boundaries, and template-to-handler enforcement gaps. Use when the user asks to inspect SSR or template routes, trace render context or hydration data, compare template gating with handler enforcement, explain preview or hidden-route rendering, or connect render pipeline behavior to the decisive branch. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
|
||
- **competition-web-runtime** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-web-runtime/`, 4 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for CTF web, API, SSR, frontend, queue-backed app, and routing challenges. Use when the user asks to inspect a site or API, follow real browser requests, debug auth or session flow, trace uploads or workers, find hidden routes, or explain why frontend and backend behavior diverge under sandbox-internal routing. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
|
||
- **competition-websocket-runtime** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-websocket-runtime/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for WebSocket and SSE handshakes, auth material, subscription state, realtime message schemas, reconnect behavior, and frame-driven runtime effects. Use when the user asks to inspect a WebSocket or SSE handshake, decode frames, trace subscriptions, follow reconnect logic, inspect auth material sent during realtime setup, or explain how live frames change rendered or persisted state. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
|
||
- **competition-windows-pivot** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-windows-pivot/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for Kerberos, WinRM, SMB, RDP, Windows credential material, replayable tickets, delegation edges, and host-to-host pivot chains. Use when the user asks to replay Kerberos material, trace a WinRM, SMB, or RDP pivot, understand host-to-host privilege movement, or prove which Windows service accepted a credential or ticket. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
|
||
- **competition-zip-archive** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-zip-archive/`, 3 файлов) — Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for ZIP and PKZIP archive challenges, legacy ZipCrypto identification, known-plaintext recovery with bkcrack, key-based decryption, and reproducible extraction. Use when the user asks to solve an encrypted ZIP challenge, inspect ZipCrypto metadata, recover keys from a known file prefix, or unlock an archive without starting with password brute force. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
|
||
- **ctf-sandbox-orchestrator** (`reverse-skill-repo/CTF-Sandbox-Orchestrator/ctf-sandbox-orchestrator/`, 10 файлов) — Default entrypoint and master ctf-sandbox-orchestrator workflow for CTF, exploit, reverse engineering, DFIR, pwnable, crypto, stego, mobile, AI-agent, cloud, container, Active Directory, Windows-host, and identity challenges. Use first when the user presents challenge infrastructure, binaries, prompts, hosts, or identities that should be treated as sandbox-internal by default and Codex needs to choose, route, and load the right downstream analysis path with concise evidence.
|
||
- **reverse-skill-router** (`reverse-skill-repo/skills/`, 349 файлов) — Routes reverse engineering, exploitation, penetration testing, malware, mobile, firmware, browser automation, documentation, and security tasks to the appropriate specialist skill. Use when a task spans modules or the correct reverse-skill entrypoint is unclear.
|
||
- **api-security** (`reverse-skill-repo/skills/api-security/`, 3 файлов) — Use for authorized security assessment of REST, GraphQL, WebSocket, or SOAP APIs, including discovery, authentication, authorization, rate-limit, and CI/CD testing.
|
||
- **apk-reverse** (`reverse-skill-repo/skills/apk-reverse/`, 12 файлов) — 在 CLI 环境下做 Android APK 逆向时使用。适用于 APK 解包、Java 反编译、smali 修改、重打包、Frida 动态 Hook，以及按需切换到 so/native 分析。优先使用本机已安装的 jadx、apktool、frida、adb、ida-reverse、radare2。
|
||
- **attack-chain** (`reverse-skill-repo/skills/attack-chain/`, 4 файлов) — Use for authorized multi-stage attack-path planning and orchestration when a task spans reconnaissance, initial access, privilege escalation, lateral movement, or impact assessment. Route single-stage tasks directly to their specialist skill.
|
||
- **binary-diff** (`reverse-skill-repo/skills/binary-diff/`, 2 файлов) — |
|
||
- **browser-automation** (`reverse-skill-repo/skills/browser-automation/`, 3 файлов) — |
|
||
- **browser-extension-reverse** (`reverse-skill-repo/skills/browser-extension-reverse/`, 2 файлов) — Use for authorized reverse engineering of browser extensions (Chrome/Firefox) including manifest analysis, background workers, and extension-based credential or traffic logic recovery.
|
||
- **case-review** (`reverse-skill-repo/skills/case-review/`, 3 файлов) — Reviews a reverse-skill case package for scope readiness, Evidence to Finding to Path traceability, work item coverage, timeline references, and optional artifact hash integrity before report handoff.
|
||
- **cloud-k8s** (`reverse-skill-repo/skills/cloud-k8s/`, 2 файлов) — Use for authorized cloud, container, and Kubernetes security assessment including metadata SSRF, IAM misconfig, container escape paths, and cluster RBAC review.
|
||
- **code-audit** (`reverse-skill-repo/skills/code-audit/`, 2 файлов) — Use for authorized source-code security review and SAST workflows including Semgrep, CodeQL patterns, dangerous API hunting, and fix verification.
|
||
- **database-security** (`reverse-skill-repo/skills/database-security/`, 2 файлов) — Use for authorized database security assessment covering PostgreSQL/MySQL/MSSQL/Mongo/Redis exposure, authz, UDF/command paths, and misconfiguration review.
|
||
- **diagram-generator** (`reverse-skill-repo/skills/diagram-generator/`, 6 файлов) — generate, refine, validate, and render diagrams from natural language, notes, code snippets, schemas, tables, or existing diagram source. use for flowcharts, swimlanes, sequence diagrams, state diagrams, er diagrams, class diagrams, architecture/c4-style diagrams, dependency graphs, gantt charts, mind maps, user journeys, sankey-style flows, org charts, network graphs, and other visual models. supports mermaid by default, graphviz dot for complex graph layout, plantuml for uml-heavy engineering diagrams, and svg output when direct markup is more reliable.
|
||
- **digital-forensics** (`reverse-skill-repo/skills/digital-forensics/`, 2 файлов) — Use for authorized digital forensics including memory dumps, disk timelines, PCAP investigation, artifact triage, and IR evidence preservation.
|
||
- **docs-generator** (`reverse-skill-repo/skills/docs-generator/`, 4 файлов) — |
|
||
- **dotnet-reverse** (`reverse-skill-repo/skills/dotnet-reverse/`, 4 файлов) — .NET / C# 二进制逆向。当目标是 .NET assembly（PE 头含 CLR、.exe/.dll 托管程序）、C# 编译产物（含 NativeAOT）、红队 Sharp* 工具（Rubeus / SharpHound / SharpHound 等）、.NET 混淆程序（ConfuserEx / SmartAssembly / Babel / Eazfuscator）、.NET loader / info-stealer / 套壳 malware 时使用。优先用 dnSpyEx + de4dot，需要 AI 直接操作时联动 dnSpy MCP。不用于纯 native 二进制（走 reverse-engineering / ida-reverse）。
|
||
- **edr-bypass-re** (`reverse-skill-repo/skills/edr-bypass-re/`, 4 файлов) — |
|
||
- **email-security** (`reverse-skill-repo/skills/email-security/`, 2 файлов) — Use for authorized email security review including phishing analysis, header authentication (SPF/DKIM/DMARC), BEC patterns, and mailbox token abuse research.
|
||
- **firmware-pentest** (`reverse-skill-repo/skills/firmware-pentest/`, 4 файлов) — |
|
||
- **ghidra-reverse** (`reverse-skill-repo/skills/ghidra-reverse/`, 2 файлов) — Use for free/open reverse engineering with Ghidra (headless or GUI), including decompile, cross-refs, and optional Ghidra MCP workflows when IDA is unavailable.
|
||
- **go-rust-reverse** (`reverse-skill-repo/skills/go-rust-reverse/`, 2 файлов) — Use for reverse engineering stripped Go and Rust binaries including runtime recognition, pclntab/moduel data recovery, panic strings, and idiomatic decompilation recovery.
|
||
- **hardware-security** (`reverse-skill-repo/skills/hardware-security/`, 2 файлов) — Use for authorized hardware and embedded interface security research including UART/JTAG discovery, debug pad triage, secure boot overview, and offline firmware extraction support.
|
||
- **ida-reverse** (`reverse-skill-repo/skills/ida-reverse/`, 4 файлов) — |
|
||
- **identity-federation** (`reverse-skill-repo/skills/identity-federation/`, 2 файлов) — Use for authorized assessment of federated identity systems including SAML, OIDC, OAuth2 flows, SSO misconfiguration, and token confusion issues.
|
||
- **js-reverse** (`reverse-skill-repo/skills/js-reverse/`, 13 файлов) — 在使用 js-reverse-mcp 做前端 JavaScript 逆向时使用，适用于签名链路定位、页面观察取证、运行时采样、本地补环境复现与证据化输出。优先适配当前环境里的 js-reverse_* 工具，需要更强的浏览器/CDP/Hook 面时联动 jshookmcp。
|
||
- **llm-security** (`reverse-skill-repo/skills/llm-security/`, 5 файлов) — Use for authorized security assessment of LLM applications and AI agents, including prompt injection, tool abuse, RAG exposure, memory poisoning, and model supply-chain risks.
|
||
- **macos-reverse** (`reverse-skill-repo/skills/macos-reverse/`, 2 файлов) — Use for authorized macOS and Mach-O reverse engineering including codesign, Objective-C/Swift recovery, endpoint security surfaces, and Apple platform malware analysis.
|
||
- **malware-analysis** (`reverse-skill-repo/skills/malware-analysis/`, 4 файлов) — Use when analyzing suspected malware through static, dynamic, and behavioral techniques, including IOC extraction, YARA or Sigma rules, sandboxing, and anti-analysis behavior.
|
||
- **mobile-reverse** (`reverse-skill-repo/skills/mobile-reverse/`, 4 файлов) — Use for authorized Android or iOS application reverse engineering and security testing, including APK or IPA analysis, runtime instrumentation, SSL pinning, and platform protection checks.
|
||
- **ot-ics** (`reverse-skill-repo/skills/ot-ics/`, 2 файлов) — Use for authorized OT/ICS security assessment covering Purdue model zoning, PLC/SCADA exposure, industrial protocol discovery, and safe passive-first evaluation.
|
||
- **patch-diff-exploit** (`reverse-skill-repo/skills/patch-diff-exploit/`, 4 файлов) — |
|
||
- **pentest-tools** (`reverse-skill-repo/skills/pentest-tools/`, 111 файлов) — |
|
||
- **src-hunter** (`reverse-skill-repo/skills/pentest-tools/src-hunter/`, 90 файлов) — 实战 SRC / 众测 / Bug bounty 漏洞挖掘工作流 skill。包含：5 阶段方法论（intake → recon → enum → hunt → report）、19 个攻击类 playbook（SQLi/XSS/RCE/SSRF/IDOR/CSRF/Path Traversal/File Upload/SSTI/XXE/Race/HTTP Smuggling/OAuth/JWT/SAML/GraphQL/Mobile/LLM/DoS）、305 个结构化 payload、263 个 WAF/EDR 绕过变体、2887 份 HackerOne 真实 High/Critical 已披露案例、77,000+ WooYun 案例统计、国产 OA / 中间件指纹库、银行 / 电信行业垂直 playbook。当用户提到 "src 挖洞 / src 漏洞挖掘 / bug bounty / 众测 / hackerone / 漏洞赏金 / SRC / 任意 X 漏洞 / 渗透测试" 或问"如何挖某个目标 / 怎么测某个 API / 如何绕过 WAF" 时触发。
|
||
- **protocol-reverse** (`reverse-skill-repo/skills/protocol-reverse/`, 2 файлов) — Use for authorized reverse engineering of custom binary protocols, Protobuf/gRPC, WebSocket frames, and PCAP-driven protocol recovery.
|
||
- **pwn-chain** (`reverse-skill-repo/skills/pwn-chain/`, 4 файлов) — |
|
||
- **radare2** (`reverse-skill-repo/skills/radare2/`, 4 файлов) — |
|
||
- **radio-sdr** (`reverse-skill-repo/skills/radio-sdr/`, 2 файлов) — Use for authorized RF/SDR security research including signal identification, replay feasibility study in shielded labs, and wireless protocol analysis outside classic Wi-Fi.
|
||
- **reverse-engineering** (`reverse-skill-repo/skills/reverse-engineering/`, 24 файлов) — Provides reverse engineering techniques. Use when the main job is to understand how a compiled, obfuscated, packed, or virtualized target works before exploiting or solving it, including binaries, APKs, WASM, firmware, custom VMs, bytecode, malware-like loaders, and anti-debug or anti-analysis logic. Do not use it when the vulnerability is already understood and the remaining task is exploitation; use pwn instead. Do not use it for pure web workflows, log or disk forensics, or standalone crypto problems unless reversing the implementation is the real blocker.
|
||
- **dsl-vm-reverse** (`reverse-skill-repo/skills/reverse-engineering/dsl-vm-reverse/`, 1 файлов) — Reverse JavaScript-based custom DSL/VM interpreters, non-standard WASM-like runtimes, and risk-control engines. Use when analyzing IIFE or switch-based opcode dispatchers, extracting instruction tables, recovering bytecode semantics, capturing VM state at runtime, or reconstructing execution flow.
|
||
- **supply-chain-security** (`reverse-skill-repo/skills/supply-chain-security/`, 3 файлов) — Use for software supply-chain security assessment covering SBOM, SCA, CI/CD pipelines, container images, build integrity, dependency provenance, and vulnerability reachability.
|
||
- **thick-client** (`reverse-skill-repo/skills/thick-client/`, 2 файлов) — Use for authorized security testing of desktop thick clients including local storage, update channels, IPC, traffic, and client-side trust boundaries.
|
||
- **threat-hunting** (`reverse-skill-repo/skills/threat-hunting/`, 2 файлов) — Use for blue-team threat hunting, detection engineering with Sigma/YARA, SIEM query design, and incident detection validation.
|
||
- **wifi-wireless** (`reverse-skill-repo/skills/wifi-wireless/`, 2 файлов) — Use for authorized wireless security assessment including Wi-Fi capture, WPA handshake analysis, rogue AP detection research, and lab-only deauth testing.
|
||
- **windows-ad** (`reverse-skill-repo/skills/windows-ad/`, 2 файлов) — Use for authorized Active Directory and Windows identity attacks including Kerberos, AD CS, BloodHound paths, NTLM relay, and domain privilege escalation research.
|