203 skills · sorted by relevance
Trace forced authentication and relay chains in a CTF sandbox. Identify what triggers authentication, which service accepts the forwarded identity, and what privilege or artifact results, while distinguishing captured authentication from a successfully accepted relay.
Investigate NTLM relay, an attack that forwards authentication messages to another service, by comparing Windows login events with host inventories. Use the supplied queries and audits to identify suspicious sources, weaker authentication, and gaps in signing enforcement.
Use when authoring a Relayflows flow (@relayflows/surface / @relayflows/sdk, the journal-based v2 engine — the CLI is `flows`, package versions 2.0.x) in TypeScript or YAML/JSON. Covers the three-rung ladder (run/llm/agent), the resident verbs (human/dispatch/done), verification gates, TypeScript vs YAML authoring, per-step cli/model selection and its resolution order, flows.json, and `flows check`/`run`/`resume` with their real refusal shapes and exit codes. Not for the older, unrelated `@relayflows/core` WorkflowBuilder engine (`.pattern('dag')`/.agent()/.step() chains) that `writing-agent-relay-workflows` and `migrating-persona-to-relayflow` cover — that's a different product despite the similar name.
The English summary is being prepared. Showing the original description.
Assess forced authentication and NTLM relay, the forwarding of authentication to another service, in authorized Windows environments. Use Coercer and PetitPotam to document exposed methods and check detection coverage, signing requirements, and Extended Protection for Authentication safeguards.
Use this skill when the operator is driving the DOCA Socket Relay to bridge a socket-oriented host application onto a BlueField DPU peer without rewriting it — picking the deployment shape (in-process, sidecar, or BlueField service container), configuring the host-side socket and the DPU-side forwarding endpoint, walking the bind → connect → round-trip → admit-fleet smoke, or diagnosing a stuck/silent relay. Trigger even when the user does not explicitly mention "DOCA Socket Relay" — typical implicit phrasings include "move my socket app onto the BlueField without rewriting it", "host app gets ECONNREFUSED on the relay", "relay accepts the connection but bytes never arrive on the DPU side", "first round-trip works, the rest hang", "bridge an AF_UNIX (UDS) socket to a DPU peer over Comch", or "I want a sidecar that forwards my socket to the BlueField". Refuse and route elsewhere for the comch programming API, line-rate raw packet I/O via doca-eth, and DOCA install/bring-up — those belong to other skills.
The English summary is being prepared. Showing the original description.
Prepare and manage durable MEX team handoffs in git-native project memory. Use when the user asks to hand work to a person or team, prepare an end-of-session handoff, save what the next engineer needs, create a MEX Relay, take or close a Relay, or invokes /mex-relay or $mex-relay. Keywords: mex, project memory, relay, handoff, team memory, Claude Code, Codex. Treat Relay as a memory baton, not chat, notifications, task assignment, issue tracking, or a Jira replacement; do not activate for ordinary status messages that are not durable handoffs.
The English summary is being prepared. Showing the original description.
Set up, check, stop, or delete a retalk relay server (retalk-server). Use when the user needs their OWN relay rather than an existing URL. Invoke as `relay setup`, `relay ping`, `relay stop`, or `relay delete`. Uses AskUserQuestion to pick the host (Local / Local+Cloudflare / Hugging Face / GCP) and gather settings.
The English summary is being prepared. Showing the original description.
Prepare and manage durable MEX team handoffs. Use when the user asks to hand work to a person or team, prepare an end-of-session handoff, save what the next engineer needs, create a MEX Relay, take or close a Relay, or explicitly invokes /mex-relay or $mex-relay. Treat Relay as a memory and context baton, not chat, notifications, task assignment, issue tracking, or a Jira replacement; do not activate for ordinary status messages that are not durable handoffs.
The English summary is being prepared. Showing the original description.
Use when an agent or human needs to set up relayfile end-to-end so agents can read and write provider files through a local mount. Covers `relayfile setup`, dynamic integration discovery with `relayfile integration available/search`, Nango and Composio backend selection, Atlassian site selection and metadata, cloud login, OAuth/connect flows, mount verification, `RELAYFILE_LOCAL_DIR` handoff, writeback status and retry commands, and key May 2026 cloud-mount gotchas.
The English summary is being prepared. Showing the original description.
Use when you are a registered relay agent (a spawned worker, or a lead that called register_agent) coordinating with peers in real time over current Agent Relay MCP tools - messaging, channels, threads, reactions, search, inbox, actions, and worker spawn/release. For role selection and orchestrator startup instructions, use https://agentrelay.com/skill and the orchestrating-agent-relay skill.
The English summary is being prepared. Showing the original description.
Fix "blocked: event rejected by relay policy" errors when publishing Kind 34236 (video) events to divine relays. Use when: (1) Kind 0 profile events succeed but Kind 34236 fails, (2) Generic policy rejection with no specific reason, (3) Video events work on other relays but fail on divine relays. The divine relay requires thumbnails for all video events - stricter than NIP-71 spec.
The English summary is being prepared. Showing the original description.
Assess Windows and Active Directory identity security within an authorized scope. Map accounts and permissions, investigate authentication and certificate weaknesses, and document paths that could allow an attacker to gain greater access.
Expert knowledge for Azure Relay development including troubleshooting, security, configuration, and integrations & coding patterns. Use when configuring Hybrid Connections, WCF relays, Entra ID/SAS auth, Private Link, or .NET/Node.js Relay clients, and other Azure Relay related development tasks. Not for Azure Service Bus (use azure-service-bus), Azure Event Hubs (use azure-event-hubs), Azure Web PubSub (use azure-web-pubsub), Azure Application Gateway (use azure-application-gateway).
The English summary is being prepared. Showing the original description.
Expert knowledge for Azure Fluid Relay development including troubleshooting, best practices, limits & quotas, security, configuration, integrations & coding patterns, and deployment. Use when using AzureClient, audience APIs, JWT auth tokens, container recovery, or Static Web Apps hosting, and other Azure Fluid Relay related development tasks. Not for Azure Web PubSub (use azure-web-pubsub), Azure SignalR Service (use azure-signalr-service), Azure Relay (use azure-relay), Azure Service Bus (use azure-service-bus).
The English summary is being prepared. Showing the original description.
Authentication coercion (PetitPotam MS-EFSR, PrinterBug MS-RPRN, DFSCoerce MS-DFSNM) chained into NTLM relay (impacket ntlmrelayx) toward LDAP, AD CS web enrollment (ESC8), or SMB. Use when SMB signing is not enforced or LDAP channel binding is missing, and you want to force a privileged machine account to authenticate to your relay and turn that into RBCD, a DCSync-capable ACL grant, or a certificate. Includes the exact Coercer/ntlmrelayx commands, requirements, detection, and remediation.
The English summary is being prepared. Showing the original description.
Execute advanced Man-in-the-Middle (MITM) NTLM Relay attacks specifically targeting environments where SMB Signing is purportedly enabled but improperly configured (e.g., exclusively required on Domain Controllers but NOT enforced universally on standard Workstations or File Servers). Utilize powerful tools like Responder and Impacket's NTLMRelayX to coercively capture NTLMv2 authentications (via LLMNR, WPAD, or Coercion methods like PetitPotam) and seamlessly relay them across the network identically yielding immediate Local Administrator command execution.
The English summary is being prepared. Showing the original description.
Build and review ViewModels, objects that manage screen state and actions, with CommunityToolkit.Mvvm. Use attributes to generate change notifications and commands, add input validation, and handle asynchronous operations, cancellation, and command availability.
[omh] Buzz community agent setup or relay trouble: connect and operate Hermes as a native Buzz community agent, deliver local media with verified relay receipts, or diagnose a self-hosted Buzz relay without inventing transport evidence. Aliases: omh-buzz. Use when the user says: connect Hermes to Buzz, Buzz community agent, Buzz gateway setup, Buzz media attachment, Buzz relay self-hosting, Buzz connection diagnostics, 버즈 커뮤니티 연결, Buzz 메시지 첨부.
The English summary is being prepared. Showing the original description.
NTLM relay and authentication coercion playbook. Use when capturing and relaying NTLM authentication to escalate privileges via SMB, LDAP, HTTP, or MSSQL relay targets, combined with PetitPotam, PrinterBug, and other coercion methods.
The English summary is being prepared. Showing the original description.
Use when deploying changes to staging across relay, relay-dashboard, and relay-cloud repos - coordinates multi-repo branch syncing using git worktrees, automatically triggers staging deployments via GitHub Actions
The English summary is being prepared. Showing the original description.
The canonical way to run agent-relay - self-bootstrap the local broker and autonomously spawn, monitor, and coordinate a team of worker agents without human intervention. Covers infrastructure startup, agent spawning, lifecycle monitoring, message-based reading via the relay MCP, and team coordination.
The English summary is being prepared. Showing the original description.
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for forced-auth coercion, relay chains, target selection, NTLM or related acceptance paths, and coercion-to-privilege transitions. Use when the user asks to trace a coercion primitive, follow a relay path, analyze forced authentication, determine which service accepts relayed auth, or connect a coercion step to resulting privilege, enrollment, or code execution. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
The English summary is being prepared. Showing the original description.
NTLM relay and authentication coercion playbook. Use when capturing and relaying NTLM authentication to escalate privileges via SMB, LDAP, HTTP, or MSSQL relay targets, combined with PetitPotam, PrinterBug, and other coercion methods.
The English summary is being prepared. Showing the original description.
文献接力（ScholarRelay）：人机协作法学／中文学术论文写作工作流。解决的核心问题是——机构订阅文献库（知网等）需经校园 webvpn 的 IP 授权才能下载，Agent 无法自行走通这条链路，而让非专业用户自建浏览器自动化又门槛过高；本工作流把链路切在授权边界上：人做检索/导出题录/下载 PDF，AI 做解析/分级/精读/写作/校验/排版。并把流程固化为十阶段协议（立项定锚→题录获取→解析分级→精读笔记→分章写作→修订体检→编号校验→投稿排版→模拟审稿→选刊投递），用脚本强制保证正文引用编号与文末参考文献一一对应、不从零编造文献页码、用版本健康度监控防止补丁式迭代把论文改烂、用机械扫描清除 AI 写作痕迹与标点问题。 Trigger when user asks for 文献接力, scholarrelay, 论文合作流程, 人机协作写论文, 文献分级, 文献精读笔记, 写作启动包, 参考文献编号校验, 编号错位, 投稿排版, 模拟审稿, 征文投稿, 知网题录解析, 期刊体例 Word, 论文修订, 车轱辘话, 越改越烂, 版本对比, 文字冗余, 摘要写作, 关键词, 去AI腔, AI写作痕迹, 选刊, 投稿策略, 投稿检查清单, 法学引注手册, CSSCI期刊.
The English summary is being prepared. Showing the original description.