43 skills · sorted by relevance
Debug and emulate specific code fragments or functions using the Unicorn engine. Activate when the user wants to emulate a function with Unicorn, trace binary execution without running the full program, decrypt or decode data by emulating the algorithm, or bypass environment dependencies (JNI, syscalls, libc) during emulation.
The English summary is being prepared. Showing the original description.
Full build workflow for adding new syscall descriptions to syzkaller
The English summary is being prepared. Showing the original description.
Syzkaller syzlang syntax basics for describing ioctl syscalls
The English summary is being prepared. Showing the original description.
Use eBPF for deep kernel-level observability — trace syscalls, network flows, and application behavior without code changes using Cilium, Tetragon, and bpftrace.
The English summary is being prepared. Showing the original description.
Use when bypassing EDR/AV to run a payload — hook unhooking, direct/indirect syscalls, PPID spoofing, process injection, AMSI bypass, ETW patching, memory/sleep encryption, behavioral evasion
The English summary is being prepared. Showing the original description.
Generate and interpret security-research diffs between Windows versions or patch levels using this repo's WinDiff CLI and databases. Use when comparing Windows builds or binaries such as ntoskrnl.exe, ntdll.dll, win32k*.sys, ci.dll, or cng.sys to find changed syscalls, symbols, types, mitigation flags, callbacks, ETW/EtwTi telemetry, code-integrity behavior, drivers, or attack surface. Explain likely intent and security relevance with Windows-internals knowledge, and frame findings for anti-malware/EDR, anti-cheat, and vulnerability-research audiences rather than returning an uninterpreted symbol list.
The English summary is being prepared. Showing the original description.
Think and work like an expert Embedded Systems Engineer. Use when a task calls for Embedded Systems Engineer judgment. Reasons from hardware timing, interrupt latency, memory maps, and deterministic WCET resource bounds through DWT CYCCNT and Saleae logic-analyzer timing proofs, SWD/JTAG (J-Link/OpenOCD) with CFSR/HFSR/BFAR fault decode, FreeRTOS/Zephyr respecting configMAX_SYSCALL_INTERRUPT_PRIORITY, MISRA C:2012 and ISO 26262 ASIL discipline, Nordic PPK2 power profiling, and MCUboot signed OTA while treating priority inversion, Cortex-M7 uncached-DMA D-cache incoherence, CAN bus-off, I2C NACK storms, and brownout-during-flash-write NVS corruption as first-class failure modes.
The English summary is being prepared. Showing the original description.
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for kernel attack surface, namespace and cgroup boundaries, container isolation assumptions, syscall paths, and escape primitive verification. Use when the user asks to analyze container-to-host escape paths, kernel exploit prerequisites, namespace crossover, capability misuse, or prove whether an exploit primitive crosses the sandbox boundary. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
The English summary is being prepared. Showing the original description.
Use when writing KUnit tests, adding kselftest cases, fuzzing syscalls with syzkaller and kcov, running LTP, or wiring CI for a kernel patch.
The English summary is being prepared. Showing the original description.
Bypass antivirus and Endpoint Detection & Response solutions during red team operations using payload obfuscation, process injection, AMSI bypass, ETW patching, and custom loaders. Use this skill when AV/EDR is blocking your payloads, tooling, or post-exploitation activities. Covers shellcode encryption, syscall-based injection, unhooking techniques, and living-off-the-land approaches for opsec-safe red team operations.
The English summary is being prepared. Showing the original description.
Review Yuzu C++ source changes for resource ownership, RAII, borrowed lifetimes, C ABI contexts, casts, process/syscall boundaries, callbacks, threads, and sanitizer coverage. Use for any governance Gate 3 review when C++ files change, paired with cpp-expert.
The English summary is being prepared. Showing the original description.
Detect and prevent privilege escalation in Kubernetes pods by monitoring security contexts, capabilities, and syscall patterns with Falco and OPA policies.
The English summary is being prepared. Showing the original description.
Uses Falco YAML rules for runtime threat Tespit in containers and Kubernetes, monitoring syscalls for shell spawns, file tampering, network anomalies, and privilege escalation. Manages Falco rules via the Falco gRPC API and parses Falco alert output. Use building yaparken container runtime security or investigating k8s cluster compromises.
The English summary is being prepared. Showing the original description.
tespit etmeand prevent privilege escalation in Kubernetes pods by monitoring security contexts, capabilities, and syscall patterns with Falco and OPA policies.
The English summary is being prepared. Showing the original description.
Detect and prevent privilege escalation in Kubernetes pods by monitoring security contexts, capabilities, and syscall patterns with Falco and OPA policies.
The English summary is being prepared. Showing the original description.
Detect and prevent privilege escalation in Kubernetes pods by monitoring security contexts, capabilities, and syscall patterns with Falco and OPA policies.
The English summary is being prepared. Showing the original description.
EDR evasion offensive checklist: hook unhooking (user/kernel), direct syscalls, PPID spoofing, process injection variants, AMSI bypass, ETW patching, memory encryption, and behavior-based evasion. Use when planning EDR bypass during red team engagements or researching AV/EDR evasion techniques.
The English summary is being prepared. Showing the original description.
Command and Control framework deployment, configuration, and operational tradecraft for red team engagements. Covers Cobalt Strike (malleable C2 profiles, Beacon types HTTP/HTTPS/DNS/SMB, Beacon Object Files for in-memory execution, sleep and jitter tuning, named pipe pivoting), Sliver (implant generation across mTLS/WireGuard/DNS transport, operator multiplayer mode, armory extensions), Mythic (agent ecosystem with Apollo/Poseidon/Medusa, C2 profile configuration, translation containers), Havoc (Demon agent with sleep obfuscation via Ekko/Zilean, indirect syscalls, dotnet inline execution), Metasploit (msfvenom payload generation, multi/handler staging, Meterpreter post-exploitation modules), redirector architecture using Apache mod_rewrite and Nginx, domain fronting through CDN providers, DNS-based C2 for restrictive network egress, and TLS certificate management for infrastructure OPSEC. Tools: Cobalt Strike, Sliver, Mythic, Havoc, Metasploit Framework. Aligns to MITRE ATT&CK T1071 (Application Layer P...
The English summary is being prepared. Showing the original description.
Comprehensive red team operations methodology covering full engagement lifecycle from planning through reporting. Addresses engagement scoping and rules of engagement negotiation, multi-tier C2 infrastructure design with redirectors and domain fronting, malleable traffic profiles and beacon tradecraft, OPSEC discipline including attribution avoidance and indicator management, EDR and AMSI evasion techniques using direct syscalls and unhooking, data collection with chain-of-custody controls, and structured reporting with purple team debrief workflows. Covers assumed-breach, external-to-internal, insider threat, and hybrid physical-cyber engagement scenarios with MITRE ATT&CK mapping throughout. Targets operators planning or executing adversary simulation engagements against mature defenders.
The English summary is being prepared. Showing the original description.