Analyze how EDR, software that monitors endpoint threats, and antivirus products detect activity. Support authorized exercises by examining monitoring mechanisms, assessing evasion approaches, and checking detection results in an isolated test environment.
Analyze compiled .NET and C# programs by identifying managed files, removing obfuscation, inspecting intermediate instructions, and debugging runtime behavior. Save extracted configuration and code changes as evidence for further review.
Assess database security within an authorized scope by reviewing network exposure, authentication, access permissions, risky features, audit logs, and backup access. Distinguish configuration weaknesses from issues that can be demonstrated through safe validation.
Assess security in authorized cloud, container, and Kubernetes environments. Review excessive permissions, exposed resources, container isolation, and cluster access controls, then document findings with reproduction details and their impact.
Support authorized hardware security research by locating debug interfaces, recording pin assignments and voltage levels, and collecting boot logs. Assess interface locks and firmware extraction options, then hand extracted images to firmware analysis tools.
Understand compiled Go and Rust programs even when function names have been removed. Use runtime clues, recovered metadata, and error strings to identify important functions and trace application logic with language-specific reverse engineering methods.
Analyze captured network traffic and binary messages to recover custom protocol structures. The skill organizes message types, fields, and connection states, then produces reproducible decoding steps with supporting evidence for authorized investigations.
Turn notes, prose, code, schemas, or tables into editable diagrams, including flowcharts, architecture diagrams, and schedules. Choose Mermaid, Graphviz DOT, PlantUML, or SVG to suit the content, with image or PDF rendering when needed.
Route reverse engineering and security tasks to a specialist skill based on the target, purpose, and available tools. Establish the case scope and authorization status, then prepare supported tools before handing off the work.
Analyze authorized macOS applications and Mach-O binaries, the executable format used on macOS. Examine signatures, dependencies, Objective-C and Swift symbols, and runtime behavior to produce findings tied to specific addresses or symbols.
Inspect Android APKs from the command line to understand app logic, permissions, and components. Supports Java decompilation, low-level code edits, rebuilding and signing, plus Frida observation of running methods and routing to native code analysis.
Coordinate authorized penetration testing with tools for port discovery, vulnerability scanning, web testing, and password hash recovery. Use MCP servers to connect agents to security tools, record reproducible evidence, and support reporting within the approved scope.
Inspect executable files from the command line with radare2, starting with file details, strings, and imported functions. Trace code through disassembly, compare binaries, automate inspections, or apply explicitly requested patches with verification.
Investigate how compiled or obfuscated programs work, including binaries, APKs, WASM, and firmware. Combine file inspection, decompilation, and observed execution to understand control flow, validation logic, and mechanisms that hinder analysis.
Investigate memory dumps, disk records, and captured network traffic while preserving evidence. The skill guides timeline reconstruction and examination of system traces to identify suspicious activity and produce findings that others can review.
Review an existing security case package before report handoff. Check links between evidence, findings, investigation paths, tasks, and timeline entries, optionally verify file hashes to detect changes, and produce a Markdown or JSON review.
Trace how a web page generates request signatures and encrypted parameters by inspecting network requests and JavaScript execution. Collect runtime evidence, then use it to reproduce the behavior locally in Node.js.
Provides reverse engineering techniques. Use when the main job is to understand how a compiled, obfuscated, packed, or virtualized target works before exploiting or solving it, including binaries, APKs, WASM, firmware, custom VMs, bytecode, game clients, malware-like loaders, and anti-debug or anti-analysis logic. Do not use it when the vulnerability is already understood and the remaining task is exploitation; use pwn instead. Do not use it for pure web workflows, log or disk forensics, or standalone crypto problems unless reversing the implementation is the real blocker.
The English summary is being prepared. Showing the original description.
主动渗透测试工具链。覆盖信息收集、端口扫描、漏洞扫描、Web 渗透、SQL 注入、目录爆破、密码破解等场景。 通过 MCP server（pentestMCP / mcp-security-hub）将 20+ 安全工具暴露给 AI agent。 触发关键词：渗透测试、端口扫描、Nmap、漏洞扫描、Nuclei、SQL 注入、SQLMap、目录爆破、FFUF、密码破解、Hashcat、信息收集、子域名、Web 渗透、ZAP、Burp。
The English summary is being prepared. Showing the original description.
在使用 js-reverse-mcp 做前端 JavaScript 逆向时使用，适用于签名链路定位、页面观察取证、运行时采样、本地补环境复现与证据化输出。优先适配当前环境里的 js-reverse_* 工具，需要更强的浏览器/CDP/Hook 面时联动 jshookmcp。
The English summary is being prepared. Showing the original description.
Use this skill whenever the user wants to analyze binaries with radare2/r2 from the command line, including reverse engineering, disassembly, function analysis, strings/import inspection, patching, binary diffing, hex inspection, or r2 scripting. Also use it when the user mentions PE/ELF/Mach-O/DEX/WASM files together with CLI analysis, `rabin2`, `rasm2`, `radiff2`, `r2pipe`, or asks for radare2 command help on Windows/Linux/macOS.
The English summary is being prepared. Showing the original description.
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for reverse engineering, malware, DFIR, firmware, pwnable, and native exploit challenges. Use when the user asks to reverse a binary, unpack a sample, inspect a memory dump or PCAP, recover malware behavior, debug a crash, or build or verify an exploit chain under sandbox assumptions. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
The English summary is being prepared. Showing the original description.
统一自动化入口。覆盖浏览器自动化（Playwright）和 Windows 桌面应用自动化（OpenReverse）。 浏览器场景：打开网页、点击、填表、爬取、截图、自动化登录、渗透页面交互。 桌面场景：操作 IDA/x64dbg/Cheat Engine 等 GUI 工具、Windows UI Automation、视觉驱动交互、桌面应用网络抓包。 触发关键词：浏览器自动化、桌面自动化、打开网页、填表、爬取、截图、自动化登录、Playwright、agent-browser、headless、OpenReverse、UIA、CUA、桌面操作、Windows 自动化。
The English summary is being prepared. Showing the original description.
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for CI/CD, registry, dependency drift, artifact provenance, image build, release pipeline, and runtime consumer challenges. Use when the user asks to trace dependency drift, registry pulls, malicious packages, build or release tampering, CI execution, artifact signing, or which shipped artifact the runtime actually consumes. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
The English summary is being prepared. Showing the original description.
Is this your account? Link GitHub to bring it onto your creator page (Japanese)