Zhao

Route reverse engineering and security tasks to a specialist skill based on the target, purpose, and available tools. Establish the case scope and authorization status, then prepare supported tools before handing off the work.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Choose a specialist skill for an unfamiliar analysis task
• Route work spanning several security disciplines
• Record case scope and authorization before analysis

Assess authorized APIs through a ten-stage workflow covering endpoint discovery, authentication, access permissions, input handling, and request limits. Collect reproducible evidence and turn findings into regression checks that can run in a development pipeline.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Review API authentication and access permissions
• Assess GraphQL and WebSocket security
• Check request limits and unintended data exposure

Analyze captured network traffic and binary messages to recover custom protocol structures. The skill organizes message types, fields, and connection states, then produces reproducible decoding steps with supporting evidence for authorized investigations.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Recover message fields from captured network traffic
• Investigate unknown Protobuf message structures
• Map handshakes, heartbeats, and connection states

Assess database security within an authorized scope by reviewing network exposure, authentication, access permissions, risky features, audit logs, and backup access. Distinguish configuration weaknesses from issues that can be demonstrated through safe validation.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing database exposure and TLS settings
• Checking account privileges and sensitive table access
• Assessing dangerous features and configuration weaknesses

Inspect Android APKs from the command line to understand app logic, permissions, and components. Supports Java decompilation, low-level code edits, rebuilding and signing, plus Frida observation of running methods and routing to native code analysis.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Inspecting APK entry points, components, and permissions
• Locating login, signing, and certificate checks
• Editing smali code and rebuilding an APK

Compare software binaries before and after a security patch to identify the underlying flaw. Guide creation of a proof of concept, a small vulnerability demonstration, and compare its behavior across patched and unpatched versions.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating a known CVE without a public proof of concept
• Analyzing Windows Patch Tuesday changes
• Checking Linux LTS branches for missing fixes

Create task-oriented READMEs, API references, architecture documentation, and security reports. Organize information from quick starts to deeper explanations, and turn completed investigations into formal Markdown reports with supporting evidence, reproducible steps, and appropriately masked sensitive information.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Writing a README with a clear quick start
• Organizing API and architecture documentation
• Reporting reverse engineering or penetration test findings

Inspect compiled programs in Binary Ninja using strings, function references, and intermediate representations—views of program logic at different levels. Trace data flow and report findings with addresses, supporting evidence, confidence, and reproduction steps.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Tracing function calls and data flow in Binary Ninja
• Cross-checking findings from other disassemblers
• Automating binary analysis with the Python API

Automate website navigation, form filling, content collection, and Windows desktop interactions. The skill selects browser or desktop tools for the task and guides screenshot capture and desktop network traffic observation when needed.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Automating website login and form entry
• Collecting page content and screenshots
• Operating Windows desktop applications

Investigate AI-agent and cloud infrastructure challenges in a CTF sandbox. Trace untrusted content into tool actions, compare deployment configuration with runtime behavior, and follow software artifacts from source through build and release to their actual consumers.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Tracing untrusted content into agent tool actions
• Comparing deployment configuration with live behavior
• Following dependencies and artifacts through CI/CD

Inspect browser storage and caches in a CTF sandbox to explain changes in authentication, page rendering, or requests. Compare clean and modified states, then document the smallest sequence that reproduces the relevant behavior.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating login behavior affected by stored browser state
• Explaining page differences caused by caches
• Reproducing behavior with clean and modified storage

Analyze Android and iOS apps through package inspection, code analysis, runtime observation, and network traffic review. Support authorized security testing of embedded secrets, certificate checks, device protection checks, and cryptographic behavior.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Inspecting APK or IPA permissions and configuration
• Checking code for embedded keys and tokens
• Observing app behavior with Frida or Objection

Assess Windows and Active Directory identity security within an authorized scope. Map accounts and permissions, investigate authentication and certificate weaknesses, and document paths that could allow an attacker to gain greater access.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Mapping Active Directory privilege escalation paths
• Reviewing Kerberos authentication weaknesses
• Testing AD CS certificate configuration weaknesses

Inspect executable files from the command line with radare2, starting with file details, strings, and imported functions. Trace code through disassembly, compare binaries, automate inspections, or apply explicitly requested patches with verification.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Inspecting an unfamiliar executable file
• Finding the function that uses an error message
• Comparing two versions of a binary

Analyze binaries with Ghidra to locate important functions, follow references, and inspect decompiled code, a readable approximation of the original program. Support both interactive investigation and automated batch analysis without a graphical interface.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Analyzing binaries when an IDA license is unavailable
• Locating important functions through strings and imported APIs
• Running batch decompilation or analysis in CI

Review authorized source code or pull request changes for security flaws. Combine automated static analysis, which checks code without running it, with manual validation to document affected locations, data flows, reproduction examples, and suggested fixes.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing pull request changes for security issues
• Checking scanner findings for false positives
• Investigating authorization and injection flaws

Analyze suspected malware through code inspection and behavior observed in an isolated environment. Extract indicators of compromise, such as suspicious domains and file paths, and create YARA file-matching rules or Sigma behavior-detection rules from the findings.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspicious executables, scripts, and macros
• Extracting malicious domains, file paths, and other indicators
• Creating YARA and Sigma detection rules

Default entrypoint and master ctf-sandbox-orchestrator workflow for CTF, exploit, reverse engineering, DFIR, pwnable, crypto, stego, mobile, AI-agent, cloud, container, Active Directory, Windows-host, and identity challenges. Use first when the user presents challenge infrastructure, binaries, prompts, hosts, or identities that should be treated as sandbox-internal by default and Codex needs to choose, route, and load the right downstream analysis path with concise evidence.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Provides reverse engineering techniques. Use when the main job is to understand how a compiled, obfuscated, packed, or virtualized target works before exploiting or solving it, including binaries, APKs, WASM, firmware, custom VMs, bytecode, game clients, malware-like loaders, and anti-debug or anti-analysis logic. Do not use it when the vulnerability is already understood and the remaining task is exploitation; use pwn instead. Do not use it for pure web workflows, log or disk forensics, or standalone crypto problems unless reversing the implementation is the real blocker.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

游戏安全逆向专项。当任务涉及游戏反作弊分析、Unity/UE 逆向、内存扫描、DBI 框架、IL2CPP 分析、 游戏保护壳（VMProtect/Themida）脱壳、Cheat Engine、游戏 Mod 开发时使用本 skill。 触发关键词：游戏逆向、反作弊、Cheat Engine、Unity、IL2CPP、Unreal Engine、x64dbg、游戏安全、 game hacking、anti-cheat、EAC、BattlEye、Vanguard。

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for reverse engineering, malware, DFIR, firmware, pwnable, and native exploit challenges. Use when the user asks to reverse a binary, unpack a sample, inspect a memory dump or PCAP, recover malware behavior, debug a crash, or build or verify an exploit chain under sandbox assumptions. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for queues, async workers, cron jobs, delayed tasks, retry behavior, worker-only config drift, and payload-to-side-effect chains. Use when the user asks to trace a queue payload, inspect async job execution, explain worker-only behavior, follow retries or dead-letter handling, or connect an enqueued item to a later file, cache, email, or privilege-bearing side effect. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

主动渗透测试工具链。覆盖信息收集、端口扫描、漏洞扫描、Web 渗透、SQL 注入、目录爆破、密码破解等场景。 通过 MCP server（pentestMCP / mcp-security-hub）将 20+ 安全工具暴露给 AI agent。 触发关键词：渗透测试、端口扫描、Nmap、漏洞扫描、Nuclei、SQL 注入、SQLMap、目录爆破、FFUF、密码破解、Hashcat、信息收集、子域名、Web 渗透、ZAP、Burp。

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for CI/CD, registry, dependency drift, artifact provenance, image build, release pipeline, and runtime consumer challenges. Use when the user asks to trace dependency drift, registry pulls, malicious packages, build or release tampering, CI execution, artifact signing, or which shipped artifact the runtime actually consumes. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.