93 skills · sorted by relevance
Mobile (Android) app recon and analysis — decompile APK, extract secrets, find hardcoded endpoints, exposed Firebase / AWS / API keys, deeplink abuse, intent vulnerabilities, exported components, WebView XSS, MobSF static analysis. Use when target's scope includes Android apps (.apk).
The English summary is being prepared. Showing the original description.
End-to-end Android APK red-team pipeline
The English summary is being prepared. Showing the original description.
Implement, review, or improve maps and location features in iOS/macOS apps using MapKit and CoreLocation. Use when working with Map views, annotations, markers, polylines, user location tracking, geocoding, reverse geocoding, search/autocomplete, directions and routes, geofencing, region monitoring, CLLocationUpdate async streams, or location authorization flows. Also use when working with maps, coordinates, addresses, places, directions, distance calculations, or location-based features in Swift apps.
The English summary is being prepared. Showing the original description.
Trace how a web page generates request signatures and encrypted parameters by inspecting network requests and JavaScript execution. Collect runtime evidence, then use it to reproduce the behavior locally in Node.js.
Analyze executable files and libraries with IDA Pro. Inspect pseudocode, strings, function calls, and data flow, then add meaningful names and comments and produce a Markdown report documenting findings and analysis steps.
Assess iOS and Android app security using OWASP MASTG, a mobile security testing guide. Examine app files, runtime behavior, stored data, authentication, and API traffic, then document vulnerabilities, their impact, and suggested fixes.
Support authorized external security reconnaissance, the discovery of exposed systems and information. The skill provides search queries, probe references, secret detection patterns, and scoring guidance to help identify assets and organize findings with evidence and confidence levels.
Assess iOS apps from IPA acquisition through file inspection and runtime testing. The skill helps uncover embedded credentials, insecure network settings, and app link handling issues using tools such as Frida, objection, and binary analysis utilities.
Assess what discovered cloud credentials allow across AWS, Azure, GCP, and Kubernetes. The skill guides identity checks, permission review, and paths to higher privileges, then helps document impact, activity, and cleanup within the engagement's agreed scope.
Investigate security flaws in OAuth login flows, including weak redirect checks, leaked access tokens, and skipped authentication steps. The skill guides testing of web and mobile integrations and helps document demonstrated impact and reproducible findings.
Create scientific diagrams from written descriptions using Nano Banana Pro. Gemini 3 Pro reviews accuracy, labels, and layout, triggering regeneration when scores fall below the chosen document threshold, up to the iteration limit.
Provides reverse engineering techniques for CTF challenges. Use when the main job is to understand how a compiled, obfuscated, packed, or virtualized target works before exploiting or solving it, including binaries, APKs, WASM, firmware, custom VMs, bytecode, game clients, malware-like loaders, and anti-debug or anti-analysis logic. Do not use it when the vulnerability is already understood and the remaining task is exploitation; use pwn instead. Do not use it for pure web workflows, log or disk forensics, or standalone crypto problems unless reversing the implementation is the real blocker.
The English summary is being prepared. Showing the original description.
Dump DEX files from a running Android app for unpacking/deobfuscation. Activate when the user wants to unpack an Android APK, dump DEX from memory, extract decrypted DEX files, or defeat class-loading packing.
The English summary is being prepared. Showing the original description.
通用 Web API 数据采集、Node.js/Python 协议调用与前端签名分析。 使用 Camoufox MCP 捕获请求、调试 Hook、分析混淆/JSVMP/WASM， 交付可验证的采集程序，支持分页、断点续采和接口改版回归。 用于自有或已授权接口；微信小程序 wxapkg 解包使用对应小程序技能。
The English summary is being prepared. Showing the original description.
Increase widget visibility on Apple Watch using RelevanceKit. Use when providing contextual relevance signals for watchOS widgets, declaring time-based or location-based relevance, combining multiple relevance providers, helping the system surface the right widget at the right time on watchOS 26, or routing mixed RelevanceKit/WidgetKit/HealthKit/MapKit Smart Stack scope.
The English summary is being prepared. Showing the original description.
Use when a Godot game stutters, drops frames, hitches when entering new areas, overheats a phone, or must ship: profiling and Performance monitors, CPU or GPU bound, draw calls, MultiMesh, occlusion culling, LOD, shader compilation hitches, export to macOS, Windows, Linux, Steam, Android (APK, AAB, keystore), iOS (Xcode), web (itch.io, COOP/COEP headers, SharedArrayBuffer, JavaScript interop), build size budgets, demo and DLC builds, signing and notarization.
The English summary is being prepared. Showing the original description.
Provides reverse engineering techniques. Use when the main job is to understand how a compiled, obfuscated, packed, or virtualized target works before exploiting or solving it, including binaries, APKs, WASM, firmware, custom VMs, bytecode, malware-like loaders, and anti-debug or anti-analysis logic. Do not use it when the vulnerability is already understood and the remaining task is exploitation; use pwn instead. Do not use it for pure web workflows, log or disk forensics, or standalone crypto problems unless reversing the implementation is the real blocker.
The English summary is being prepared. Showing the original description.
Use for authorized Android or iOS application reverse engineering and security testing, including APK or IPA analysis, runtime instrumentation, SSL pinning, and platform protection checks.
The English summary is being prepared. Showing the original description.
用于二进制、APK、WASM、固件、自定义虚拟机、字节码、游戏客户端、类恶意加载器以及反调试/反分析逻辑等逆向类 CTF 题;触发名:ctf-reverse
The English summary is being prepared. Showing the original description.
GeoToolbox PlaceDescriptor patterns with MapKit integration for location representation, geocoding, and multi-service place identifiers. Use when working with place descriptors, geocoding, or cross-service location data.
The English summary is being prepared. Showing the original description.
Deep Mobile Security Red Team persona. Executes OWASP MASTG procedures including APK/IPA decompilation, Frida dynamic hooking, biometric bypasses, and local database decryption.
The English summary is being prepared. Showing the original description.
Prepare the local environment for the Maestro smoke-test suite — verify tooling, select a device, collect the APK if needed, validate the .env file by variable name only, then hand the user the exact lab-store CLI command to run or run it on request.
The English summary is being prepared. Showing the original description.
Provides reverse engineering techniques. Use when the main job is to understand how a compiled, obfuscated, packed, or virtualized target works before exploiting or solving it, including binaries, APKs, WASM, firmware, custom VMs, bytecode, malware-like loaders, and anti-debug or anti-analysis logic. Do not use it when the vulnerability is already understood and the remaining task is exploitation; use pwn instead. Do not use it for pure web workflows, log or disk forensics, or standalone crypto problems unless reversing the implementation is the real blocker.
The English summary is being prepared. Showing the original description.
Think and work like an expert Cell Signaling Biologist. Use when a task calls for Cell Signaling Biologist judgment. Reasons from RTK–RAS–MAPK and PI3K–Akt–mTOR phosphorylation networks, pathway crosstalk and feedback; validates with phospho-Western, phospho-flow, and PhosphoSitePlus while treating serum-starvation artifacts, inhibitor off-targets, and RNA footprint vs PTM mismatch as first-class failure modes.
The English summary is being prepared. Showing the original description.