269 skills · sorted by relevance
Trace server-side request forgery, where a server fetches a supplied URL, through internal services and metadata endpoints in a CTF sandbox. Document credential scope and distinguish successful token extraction from access actually accepted by another service.
Reproduce timing and ordering bugs in a CTF sandbox using controlled concurrent requests. Compare normal and racing runs, trace reads and writes, and preserve a minimal sequence that demonstrates duplicate actions or inconsistent state.
Trace mailbox abuse in a CTF sandbox, a controlled security challenge environment. The skill connects OAuth permissions, forwarding rules, delegated access, and message logs to concrete mail effects, documenting the smallest reproducible sequence and supporting evidence.
Analyze running containers in a CTF sandbox by comparing declared configuration with live processes, mounts, and routes. Trace how secrets and helper containers affect behavior, then document the earliest mismatch and a minimal evidence chain.
Analyze WebSocket and SSE realtime connections in CTF sandboxes. Trace connection setup, authentication, subscriptions, and message sequences to explain changes in displayed or stored state and identify the smallest sequence that reproduces them.
Investigate Windows secrets protected by DPAPI, a system for encrypting sensitive data, in a CTF sandbox. Trace the required keys and account context through decryption, then verify which service accepts the recovered secret.
Trace how access to cloud metadata leads to issued credentials and accepted privileges in a CTF sandbox. Organize endpoints, identity details, and API evidence into a minimal, reproducible path showing where trust is granted.
Analyze a custom protocol in a CTF sandbox and reproduce an accepted exchange. Recover message boundaries, checksums, and session state, then build a small replay program that preserves the required message order.
Trace movement between Windows hosts in a CTF sandbox using credentials and Kerberos tickets, which carry authentication information. Connect recovered artifacts to the service that accepted them and document the resulting access or privileges.
Analyze Windows identity and host evidence in CTF sandboxes. Connect authentication tickets, credentials, mailbox rules, and host activity to explain which services accept access and how movement between hosts occurs.
Trace forced authentication and relay chains in a CTF sandbox. Identify what triggers authentication, which service accepts the forwarded identity, and what privilege or artifact results, while distinguishing captured authentication from a successfully accepted relay.
Inspect firmware in a CTF sandbox, map its partitions, and trace startup and update steps. Connect extracted files, credentials, and configuration to device behavior, preserving evidence for a minimal reproducible path.
Investigate Kerberos delegation, which lets services act on another identity, in a CTF sandbox. Trace delegation settings, issued tickets, and service acceptance to document a reproducible trust path and the privileges it actually grants.
Investigate Active Directory Certificate Services in an isolated CTF competition environment. Trace certificate templates and enrollment rights through issuance, identity mapping, and service acceptance to explain resulting privileges and document a minimal reproducible chain.
Investigate AI-agent and cloud infrastructure challenges in a CTF sandbox. Trace untrusted content into tool actions, compare deployment configuration with runtime behavior, and follow software artifacts from source through build and release to their actual consumers.
Analyze Android apps in a CTF sandbox using static inspection and Frida hooks, which observe or alter running code. Trace request signing, local storage, and Java-to-native boundaries to reproduce a request accepted by the server.
Inspect browser storage and caches in a CTF sandbox to explain changes in authentication, page rendering, or requests. Compare clean and modified states, then document the smallest sequence that reproduces the relevant behavior.
Analyze binaries, malware samples, memory dumps, and packet captures in sandboxed security challenges. Trace program behavior, investigate crashes, and verify exploit conditions while preserving original files, decoded artifacts, and observable evidence for reproducible findings.
Investigate prompt injection in sandboxed security challenges by tracing how untrusted text changes an agent’s decisions or tool calls. Build a minimal reproduction and preserve evidence showing where external content crosses into trusted instructions or actions.
Route authorized reverse engineering, security analysis, CTF challenge, and defensive testing requests to specialist skills in a local repository. This Codex adapter selects the relevant workflow and checks the task scope before target actions begin.
Reconstruct frontend behavior from served JavaScript, build manifests, and source maps, which link built code to source. Trace loaded modules, recover route and API references, and identify the smallest asset sequence that explains observed behavior.
Create task-oriented READMEs, API references, architecture documentation, and security reports. Organize information from quick starts to deeper explanations, and turn completed investigations into formal Markdown reports with supporting evidence, reproducible steps, and appropriately masked sensitive information.
Develop exploit code from a known memory corruption flaw, then investigate differences between local and remote execution. Covers stack, heap, and Linux kernel cases, with attention to library versions, debugging, and repeatable results.
Review Windows privilege escalation paths from a standard user session to Administrator or SYSTEM. Examine service permissions, token privileges, library loading, scheduled tasks, and stored credentials, with detection indicators for defensive validation.