114 skills · sorted by relevance
Inspect suspicious Android APK files without running them. Analyze permissions, app components, suspicious code patterns, and network indicators, then produce a JSON risk report to support malware triage and detection rule development.
Investigate how transformer language models produce predictions with TransformerLens. This skill guides inspection of intermediate values and attention patterns, plus experiments that replace internal values to test their effects and identify components involved in model behavior.
Investigate how transformer language models produce predictions with TransformerLens. This skill guides inspection of intermediate values and attention patterns, plus experiments that replace internal values to test their effects and identify components involved in model behavior.
Read existing code to reconstruct system specifications, including architecture, data flows, APIs, and business rules. Produces documentation tied to code locations, separating observed behavior from inferences and questions that need clarification.
Search shared game modding notes and turn session findings into reusable documentation. Record exact versions, engine behavior, verification limits, and fixes for common problems, then validate the note and prepare a public contribution for human approval.
Inspect game code, data files, live memory, and graphics captures to understand the internals needed for a mod. Choose tools for the game’s technology, document findings, and validate unknown file formats by decoding and re-encoding them.
Make every team AI native — TeamAI syncs a team's AI skills, rules, docs and env across AI coding tools. Use when the task operates on team-shared AI configuration or team knowledge: setting up a team repo, joining one, managing members, syncing with pull or push, or checking team status. Also use to build or query a codebase knowledge base for a large multi-repo project (architecture analysis, architecture reverse-engineering, code-to-knowledge, team-wiki-codebase, architecture wiki), and to share what a session taught you back to the team (share session learnings, contribute a learning, share what I learned with my team), including after a friction reminder. Triggers include "set up teamai", "join the team repo", "sync team skills", "team wiki", "share what I learned", and running /teamai. Talking about a team needs no skill; operating on what the team shares does.
The English summary is being prepared. Showing the original description.
Provides guidance for mechanistic interpretability research using TransformerLens to inspect and manipulate transformer internals via HookPoints and activation caching. Use when reverse-engineering model algorithms, studying attention patterns, or performing activation patching experiments.
The English summary is being prepared. Showing the original description.
Master network protocol reverse engineering including packet analysis, protocol dissection, and custom protocol documentation. Use when analyzing network traffic, understanding proprietary protocols, or debugging network communication.
The English summary is being prepared. Showing the original description.
Episode and season structure for TV series (剧集单集与季的结构) — teasers and cold opens, broadcast four/five/six-act grids with page anchors, three tests for finding the invisible acts in streaming scripts, act-out and cliffhanger taxonomies, Oberg's four information tools, A/B/C/runner weaving and scene-count ratios, the Calvisi pilot beat sheet, five-part scene structure, and season shape (tentpoles, bottle and container episodes, two-parters, finales). Merged from Calvisi, Douglas, Oberg, Landau, Goldberg & Rabkin, Miller, Rabkin and Blum, plus act lengths measured from published West Wing, Succession, Sopranos, Downton and Fleabag scripts. Use when breaking an episode into acts, deciding how many acts a script needs, placing act outs and cliffhangers, designing a teaser, weaving A/B/C stories and runners, beating out a one-hour pilot, auditing an episode that has no shape, reverse-engineering a show's structure, or planning a season's episode order (分幕、出幕、悬念结局、季弧、瓶子集).
The English summary is being prepared. Showing the original description.
Analyze a website's SEO visibility, keyword rankings, traffic estimates, and competitive positioning. Uses web search probes, SimilarWeb (free tier via web), and site: queries to build an SEO profile without requiring paid tool subscriptions. Useful for competitive intel, gap analysis, and reverse-engineering a company's organic acquisition strategy.
The English summary is being prepared. Showing the original description.
.NET / C# 二进制逆向。当目标是 .NET assembly（PE 头含 CLR、.exe/.dll 托管程序）、C# 编译产物（含 NativeAOT）、红队 Sharp* 工具（Rubeus / SharpHound / SharpHound 等）、.NET 混淆程序（ConfuserEx / SmartAssembly / Babel / Eazfuscator）、.NET loader / info-stealer / 套壳 malware 时使用。优先用 dnSpyEx + de4dot，需要 AI 直接操作时联动 dnSpy MCP。不用于纯 native 二进制（走 reverse-engineering / ida-reverse）。
The English summary is being prepared. Showing the original description.
Provides reverse engineering techniques. Use when the main job is to understand how a compiled, obfuscated, packed, or virtualized target works before exploiting or solving it, including binaries, APKs, WASM, firmware, custom VMs, bytecode, malware-like loaders, and anti-debug or anti-analysis logic. Do not use it when the vulnerability is already understood and the remaining task is exploitation; use pwn instead. Do not use it for pure web workflows, log or disk forensics, or standalone crypto problems unless reversing the implementation is the real blocker.
The English summary is being prepared. Showing the original description.
Android and iOS application security testing — static and dynamic analysis, APK/IPA inspection, OWASP MASVS/MASTG verification, secure-storage and transport review, and mobile malware triage for authorized assessments
The English summary is being prepared. Showing the original description.
Audit iOS and Android mobile applications against OWASP MASVS / MASTG — insecure storage, weak crypto, certificate pinning, deeplinks, IPC, jailbreak/root detection, reverse-engineering resistance. Use when the user mentions 'mobile security,' 'iOS security,' 'Android security,' 'mobile audit,' 'mobile pentest,' 'MASVS,' 'MASTG,' 'certificate pinning,' 'jailbreak detection,' 'root detection,' 'deeplink,' 'URL scheme,' 'app transport security,' 'keychain,' 'keystore,' 'mobile reverse engineering,' or has a mobile app to review.
The English summary is being prepared. Showing the original description.
Use when reverse-engineering or detecting malware — static triage + capa/YARA-X, emulation/DBI/.NET unpacking, dynamic/fileless/Volatility 3 memory analysis, C2 config extraction (Cobalt Strike/CAPE), C2 traffic detection (JA4+, beaconing)
The English summary is being prepared. Showing the original description.
Competitive Ad Intelligence. Analyzes competitor advertising strategies including platform identification, landing page analysis, targeting reverse-engineering, positioning gaps, creative approach evaluation, and builds a "beat the competition" strategy with a competitor ad swipe file template.
The English summary is being prepared. Showing the original description.
.NET / C# 二进制逆向。当目标是 .NET assembly（PE 头含 CLR、.exe/.dll 托管程序）、C# 编译产物（含 NativeAOT）、红队 Sharp* 工具（Rubeus / SharpHound / SharpHound 等）、.NET 混淆程序（ConfuserEx / SmartAssembly / Babel / Eazfuscator）、.NET loader / info-stealer / 套壳 malware 时使用。优先用 dnSpyEx + de4dot，需要 AI 直接操作时联动 dnSpy MCP。不用于纯 native 二进制（走 reverse-engineering / ida-reverse）。
The English summary is being prepared. Showing the original description.
Provides reverse engineering techniques. Use when the main job is to understand how a compiled, obfuscated, packed, or virtualized target works before exploiting or solving it, including binaries, APKs, WASM, firmware, custom VMs, bytecode, malware-like loaders, and anti-debug or anti-analysis logic. Do not use it when the vulnerability is already understood and the remaining task is exploitation; use pwn instead. Do not use it for pure web workflows, log or disk forensics, or standalone crypto problems unless reversing the implementation is the real blocker.
The English summary is being prepared. Showing the original description.
Suede-owned marketing video planning and production discipline. Use when choosing a format, scripting, storyboarding, generating, editing, reverse-engineering pacing, building a repeatable video pipeline, or repurposing one source into multiple cuts. NOT FOR: deciding the social calendar (use suede-social), paid ad concepts (use suede-ad-creative), image-only assets (use suede-image), or publishing unapproved media.
The English summary is being prepared. Showing the original description.
Expert guide for reverse-engineering UI/UX interactions from screen-recordings and spatial video, extracting animation spring curves, and generating pixel-perfect Tailwind CSS v4 and Framer Motion code / Panduan ahli rekayasa balik interaksi UI/UX dari rekaman layar dan video spasial, ekstraksi kurva pegas animasi, dan pembuatan kode presisi Tailwind CSS v4 serta Framer Motion.
The English summary is being prepared. Showing the original description.
This skill integrates **Boxxy sandbox boundary testing** with the complete Trail of Bits firmware extraction methodology. Use this for extracting and analyzing firmware in heavily obfuscated, containerized, or restricted environments.
The English summary is being prepared. Showing the original description.
Provides reverse engineering techniques. Use when the main job is to understand how a compiled, obfuscated, packed, or virtualized target works before exploiting or solving it, including binaries, APKs, WASM, firmware, custom VMs, bytecode, game clients, malware-like loaders, and anti-debug or anti-analysis logic. Do not use it when the vulnerability is already understood and the remaining task is exploitation; use pwn instead. Do not use it for pure web workflows, log or disk forensics, or standalone crypto problems unless reversing the implementation is the real blocker.
The English summary is being prepared. Showing the original description.
Redact reverse-engineering findings for public disclosure while preserving methodology, generalizable patterns, and teaching value. Covers the private-vs-public repo split, deny-list pattern maintenance, orphan-commit publish pattern that prevents `git log` leaks, category-based redaction calibration (methodology/pattern/version-finding/internal), and the `check-redaction.sh`-style CI gate that blocks merges when a deny-listed pattern appears. Use when publishing findings about a CLI harness you don't own, when preparing upstream proposals to an unrelated project, or when archiving a private research repo for public reference.
The English summary is being prepared. Showing the original description.