Gadi Evron

Coordinate specialist agents to investigate suspicious activity in public GitHub repositories. Collect evidence from multiple sources, develop and test hypotheses, verify original records, and produce a report covering timelines, actors, and impact.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspicious activity in a public repository
• Recovering evidence of deleted content and commits
• Checking a vendor report against original records

Check whether specific source lines ran during tests using gcov coverage data, which records code execution. Inspect one or several lines and report execution counts, with exit codes distinguishing uncovered lines from errors.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Checking whether a specific line ran during tests
• Inspecting execution counts for several lines
• Identifying lines left unexecuted by tests

Retrieve code, diffs, patches, and author details from GitHub commits using their SHA identifiers. Useful for investigating changes removed by force pushes when the commit content remains accessible on GitHub.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Inspecting commits removed by a force push
• Saving patches for a list of commit SHAs
• Checking author, committer, and signature details

Collect GitHub activity and local git history as evidence for investigations, then save, filter, and share it as JSON. The skill also supports recovering deleted content from archives and checking stored evidence against its original sources.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Preserving GitHub commits, issues, and pull requests as evidence
• Examining local commits no longer linked to branches or tags
• Recovering deleted GitHub content from archives

Search Wayback Machine archives for deleted GitHub files, issues, pull requests, and wiki pages. Recover available text and repository details from saved web pages to investigate a project's past state.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Recovering a deleted README or documentation
• Checking deleted issue and pull request discussions
• Reviewing a repository's past state

Understand how unfamiliar code works from a security perspective. The skill maps architecture, follows untrusted input through the code, and searches for similar vulnerability patterns, with file and line references to support static analysis and finding validation.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Mapping unfamiliar code before security scanning
• Tracing untrusted input to dangerous operations
• Searching for variants of a known vulnerability

Review code that has not yet been checked by forming security hypotheses and testing them with analysis tools. The skill records evidence, checks whether affected code is reachable, searches for related patterns, and preserves review progress across sessions.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing code that has not yet received security checks
• Testing suspected vulnerabilities with analysis tools
• Searching the codebase for patterns behind confirmed findings

Validate vulnerability findings by checking code, reachable attack paths, observable test results, and realistic prerequisites. The workflow produces evidence-backed reports and assesses binary constraints for memory corruption issues before exploit development proceeds.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Verify vulnerability scanner findings
• Identify unreachable code and unrealistic prerequisites
• Assess exploitation constraints for memory corruption

Observe running apps and binaries with Frida, a tool for inspecting programs during execution. Capture API calls, function activity, and script events in organized run folders across local, USB-connected, or remote targets.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Confirming whether a flagged dangerous function runs
• Tracing API calls in an unfamiliar app
• Investigating mobile traffic blocked by SSL pinning

Record function entry and exit in C/C++ programs, with separate logs for each thread. Convert those logs into a Perfetto timeline to inspect call depth, execution order, and activity across threads.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Following function execution order
• Inspecting call depth in logs
• Viewing multiple threads on one timeline

Add gcov coverage measurement to C/C++ projects and see which lines, branches, and functions tests execute. The skill covers Makefile and CMake settings, test execution, and text or HTML reports that help identify untested code.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Adding coverage measurement to a C/C++ project
• Finding lines and branches tests do not execute
• Adding optional coverage settings to Makefile or CMake

Record and replay a program with rr to investigate crashes and AddressSanitizer memory errors. Step backward through execution, inspect variables and memory, and extract the sequence of operations leading to a failure.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Tracing execution backward from a crash
• Investigating AddressSanitizer memory errors
• Inspecting earlier variable and memory states

Investigate GitHub security incidents by querying archived public activity with BigQuery. Recover recorded details of deleted issues and pull requests, identify the accounts involved, and reconstruct timelines to check claims about repository activity.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reconstructing a security incident timeline
• Recovering recorded text from deleted issues or pull requests
• Checking claims about repository activity