Use when performing cybersecurity operations - offensive or defensive - including threat detection and hunting, SOC operations, incident response, digital forensics and DFIR, malware analysis and reverse engineering, threat intelligence, cloud/container/network/application/API security, identity-access and zero-trust, OT/ICS and endpoint security, vulnerability and supply-chain management, DevSecOps, cryptography, AI security, compliance and governance, and red-team or penetration testing under signed rules of engagement; routes to one of 800+ technique playbooks mapped to MITRE ATT&CK, D3FEND, and NIST CSF.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
설치 방법 보기설치하기 전에 에이전트에게 전달되는 지시 내용을 확인할 수 있습니다.
This skill covers dual-use offensive and defensive techniques. Offensive playbooks (red-team, penetration testing, credential access, C2, social-engineering simulation) are for engagements you own or have explicit written authorization to test. Before any offensive technique, confirm scope, a signed rules-of-engagement, and authority (tasks/engagement-intake.md), and document every action for the engagement record. Defensive, detection, forensic, and compliance playbooks assume you operate on systems you are responsible for.
Route, do not improvise. This skill does not contain techniques inline - it dispatches to one self-contained playbook under playbooks/. Every recommendation names the objective, the strategy basis, the technique's ATT&CK/D3FEND/NIST mapping, and the verification or detection path.
detection-hunting - detection engineering, threat hunting, SIEM analytics.soc-incident-response - SOC operations, triage, incident response, containment.dfir-forensics - disk/memory/network forensics, evidence acquisition, custody.malware-analysis - static/dynamic analysis, reverse engineering, deobfuscation.threat-intelligence - CTI, TTP mapping, actor tracking, IOC work.cloud-container-security - cloud posture, Kubernetes/container, cloud IR.network-wireless-security - network defense, traffic analysis, wireless.application-api-security - web/app/API testing and hardening, OWASP.identity-access-zerotrust - IAM, AD/Entra, zero-trust, credential protection.ot-ics-security - OT/ICS/SCADA, historian, industrial protocols.endpoint-mobile-security - endpoint hardening, EDR, mobile.vuln-supplychain-devsecops - vulnerability management, supply chain, CI/CD security.offensive-security - red-team, penetration testing, C2, social-engineering simulation.crypto-ai-emerging - cryptography, AI security, blockchain, deception.compliance-governance - CMMC/NIST/ISO, risk, privacy, audit.offensive-security task, confirm first
(tasks/engagement-intake.md). No scope, no action.references/INDEX.md lists the 15 categories and their per-category index files. Each references/index/<category>.md is a table of that category's playbooks (name, ATT&CK, tags, description). Both are generated by scripts/build_index.py - regenerate after adding or moving playbooks; never hand-edit them.
Playbooks carry MITRE ATT&CK technique IDs, MITRE D3FEND countermeasures, and NIST CSF functions in their frontmatter. Use these to pair an offensive technique with its detection, and to map defensive work to a control framework.
아직 리뷰가 없습니다. 사용해 본 소감을 남겨 주세요.
로그인 없이 쓸 수 있습니다. 사용 후기, 질문, 작동하지 않은 환경 등을 편하게 남겨 주세요.
아직 댓글이 없습니다. 첫 댓글을 남겨 보세요.
Use when evaluating, designing, drafting, revising, stress-testing, or preparing academic articles, empirical research reports, literature reviews, systematic reviews, meta-analyses, journal submissions, reviewer responses, research methods, sampling, measurement, analysis, publication readiness, or citation/source audits.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Android device offensive security, forensic extraction, and mobile app exploitation. Use this whenever the user needs to: break into or bypass the lock screen of an Android phone, extract data from a seized Android device for evidence, analyze or reverse-engineer an APK to find vulnerabilities, intercept communications on an Android device, exploit Android apps via deeplinks, steal crypto wallets or app data, set up rogue WiFi to target a phone, or plan any mobile device investigation or penetration test. Also trigger when the user mentions Android forensics, mobile pentesting, law enforcement phone extraction, device exploitation, WhatsApp or Telegram extraction from a phone, Android app reversing, CVE research for Android, or needing a chain of custody for mobile evidence. Even if the user describes the scenario casually or in another language, if they need to gain access to or pull data from an Android phone, use this skill.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when designing, reviewing, modifying, migrating, optimizing, securing, operating, troubleshooting, or decommissioning data architectures across data model exploration, SQL, ISO SQL conformance, NoSQL, vector, graph, document, time-series, NewSQL, search, in-memory, SQLite, CDC/Debezium, DBMS storage/query/recovery internals, database incident prevention, hardware acceleration, cache, big-data, lakehouse, and warehouse systems.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when developing, reviewing, debugging, porting, or engineering Linux kernel device drivers, kernel modules, device tree bindings, bus clients, subsystem drivers, DMA/IRQ/memory paths, userspace interfaces, or hardware bring-up plans.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when designing, implementing, reviewing, debugging, testing, profiling, or porting concurrent, parallel, distributed, high-performance, network dataplane, kernel-bypass, or real-time software, including locks, semaphores, monitors, MPI, CSP rendezvous, DPDK, VPP, eBPF, XDP, AF_XDP, SR-IOV, RSS, RoCEv2/RDMA, RMS/EDF, priority inversion, and environment selection from silicon to edge.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when designing, evaluating, documenting, modernizing, reviewing, refactoring, or implementing software architecture and code-level structure, including requirements, context, architecture style selection, microservices patterns, WebAssembly/WASI/Component Model, UMA portable capabilities, runtime contracts, capability graphs, governed MCP/agent orchestration, clean code, code smells, Rust crate/library API architecture, Cargo feature/MSRV/SemVer policy, unsafe/FFI/no_std/library testing, modularity, views, NFR tactics, IAM/auth, security patterns, cost estimation, architecture-as-code fitness functions, ADR/RFC work, and engineering execution plans.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.