Zhao

Investigate Active Directory Certificate Services in an isolated CTF competition environment. Trace certificate templates and enrollment rights through issuance, identity mapping, and service acceptance to explain resulting privileges and document a minimal reproducible chain.

中文简介正在准备中。当前显示英语简介。

• Inspect certificate templates and enrollment rights
• Trace certificate issuance to accepted authentication
• Identify configuration weaknesses behind granted privileges

Understand compiled Go and Rust programs even when function names have been removed. Use runtime clues, recovered metadata, and error strings to identify important functions and trace application logic with language-specific reverse engineering methods.

中文简介正在准备中。当前显示英语简介。

• Analyzing Go binaries with function names removed
• Investigating Rust releases through panic strings
• Recovering Go function names from metadata

Turn notes, prose, code, schemas, or tables into editable diagrams, including flowcharts, architecture diagrams, and schedules. Choose Mermaid, Graphviz DOT, PlantUML, or SVG to suit the content, with image or PDF rendering when needed.

中文简介正在准备中。当前显示英语简介。

• Turn business procedures into flowcharts
• Diagram system architecture and dependencies
• Visualize database relationships and interactions

Assess security in authorized cloud, container, and Kubernetes environments. Review excessive permissions, exposed resources, container isolation, and cluster access controls, then document findings with reproduction details and their impact.

中文简介正在准备中。当前显示英语简介。

• Reviewing cloud permissions and public storage settings
• Assessing container isolation and escape paths
• Checking Kubernetes permissions and Secrets handling

Compare software binaries before and after a security patch to identify the underlying flaw. Guide creation of a proof of concept, a small vulnerability demonstration, and compare its behavior across patched and unpatched versions.

中文简介正在准备中。当前显示英语简介。

• Investigating a known CVE without a public proof of concept
• Analyzing Windows Patch Tuesday changes
• Checking Linux LTS branches for missing fixes

Create task-oriented READMEs, API references, architecture documentation, and security reports. Organize information from quick starts to deeper explanations, and turn completed investigations into formal Markdown reports with supporting evidence, reproducible steps, and appropriately masked sensitive information.

中文简介正在准备中。当前显示英语简介。

• Writing a README with a clear quick start
• Organizing API and architecture documentation
• Reporting reverse engineering or penetration test findings

Assess Windows and Active Directory identity security within an authorized scope. Map accounts and permissions, investigate authentication and certificate weaknesses, and document paths that could allow an attacker to gain greater access.

中文简介正在准备中。当前显示英语简介。

• Mapping Active Directory privilege escalation paths
• Reviewing Kerberos authentication weaknesses
• Testing AD CS certificate configuration weaknesses

Analyze binaries with Ghidra to locate important functions, follow references, and inspect decompiled code, a readable approximation of the original program. Support both interactive investigation and automated batch analysis without a graphical interface.

中文简介正在准备中。当前显示英语简介。

• Analyzing binaries when an IDA license is unavailable
• Locating important functions through strings and imported APIs
• Running batch decompilation or analysis in CI

Inspect Android APKs from the command line to understand app logic, permissions, and components. Supports Java decompilation, low-level code edits, rebuilding and signing, plus Frida observation of running methods and routing to native code analysis.

中文简介正在准备中。当前显示英语简介。

• Inspecting APK entry points, components, and permissions
• Locating login, signing, and certificate checks
• Editing smali code and rebuilding an APK

Analyze custom virtual machines written in JavaScript by extracting instruction tables, examining constants, and capturing runtime state. Use the findings to reconstruct how obfuscated code executes, including custom runtimes used in risk-control engines.

中文简介正在准备中。当前显示英语简介。

• Identify a custom virtual machine in obfuscated JavaScript
• Extract and classify virtual machine instructions
• Trace exported functions and their execution flow

Investigate AI-agent and cloud infrastructure challenges in a CTF sandbox. Trace untrusted content into tool actions, compare deployment configuration with runtime behavior, and follow software artifacts from source through build and release to their actual consumers.

中文简介正在准备中。当前显示英语简介。

• Tracing untrusted content into agent tool actions
• Comparing deployment configuration with live behavior
• Following dependencies and artifacts through CI/CD

Assess authorized single sign-on systems using SAML, OIDC, and OAuth2. Map the login flow, check signatures, redirects, and token validation, then document reproducible findings and their impact, including identity or tenant confusion.

中文简介正在准备中。当前显示英语简介。

• Review redirect and token checks in a single sign-on flow
• Assess SAML signatures and assertion handling
• Investigate tenant confusion and logout failures

Inspect executable files from the command line with radare2, starting with file details, strings, and imported functions. Trace code through disassembly, compare binaries, automate inspections, or apply explicitly requested patches with verification.

中文简介正在准备中。当前显示英语简介。

• Inspecting an unfamiliar executable file
• Finding the function that uses an error message
• Comparing two versions of a binary

Review an existing security case package before report handoff. Check links between evidence, findings, investigation paths, tasks, and timeline entries, optionally verify file hashes to detect changes, and produce a Markdown or JSON review.

中文简介正在准备中。当前显示英语简介。

• Reviewing investigation records before report handoff
• Checking links between evidence, findings, and paths
• Verifying case artifact integrity with SHA-256

Investigate how compiled or obfuscated programs work, including binaries, APKs, WASM, and firmware. Combine file inspection, decompilation, and observed execution to understand control flow, validation logic, and mechanisms that hinder analysis.

中文简介正在准备中。当前显示英语简介。

• Understanding unfamiliar compiled programs
• Investigating obfuscation and anti-debugging logic
• Solving CTF validation challenges

Inspect browser storage and caches in a CTF sandbox to explain changes in authentication, page rendering, or requests. Compare clean and modified states, then document the smallest sequence that reproduces the relevant behavior.

中文简介正在准备中。当前显示英语简介。

• Investigating login behavior affected by stored browser state
• Explaining page differences caused by caches
• Reproducing behavior with clean and modified storage

Investigate suspicious domains, scams, impersonation, and malicious activity using public sources. Preserve source details, check leads against independent evidence, and prepare a threat intelligence handoff that records confidence, verification status, and remaining gaps.

中文简介正在准备中。当前显示英语简介。

• Check public phishing reports for a suspicious domain
• Investigate scam or impersonation leads from public posts
• Prepare verified evidence for a security investigation

主动渗透测试工具链。覆盖信息收集、端口扫描、漏洞扫描、Web 渗透、SQL 注入、目录爆破、密码破解等场景。 通过 MCP server（pentestMCP / mcp-security-hub）将 20+ 安全工具暴露给 AI agent。 触发关键词：渗透测试、端口扫描、Nmap、漏洞扫描、Nuclei、SQL 注入、SQLMap、目录爆破、FFUF、密码破解、Hashcat、信息收集、子域名、Web 渗透、ZAP、Burp。

中文简介正在准备中。当前显示原文说明。

Provides reverse engineering techniques. Use when the main job is to understand how a compiled, obfuscated, packed, or virtualized target works before exploiting or solving it, including binaries, APKs, WASM, firmware, custom VMs, bytecode, game clients, malware-like loaders, and anti-debug or anti-analysis logic. Do not use it when the vulnerability is already understood and the remaining task is exploitation; use pwn instead. Do not use it for pure web workflows, log or disk forensics, or standalone crypto problems unless reversing the implementation is the real blocker.

中文简介正在准备中。当前显示原文说明。

在使用 js-reverse-mcp 做前端 JavaScript 逆向时使用，适用于签名链路定位、页面观察取证、运行时采样、本地补环境复现与证据化输出。优先适配当前环境里的 js-reverse_* 工具，需要更强的浏览器/CDP/Hook 面时联动 jshookmcp。

中文简介正在准备中。当前显示原文说明。

Use this skill whenever the user wants to analyze binaries with radare2/r2 from the command line, including reverse engineering, disassembly, function analysis, strings/import inspection, patching, binary diffing, hex inspection, or r2 scripting. Also use it when the user mentions PE/ELF/Mach-O/DEX/WASM files together with CLI analysis, `rabin2`, `rasm2`, `radiff2`, `r2pipe`, or asks for radare2 command help on Windows/Linux/macOS.

中文简介正在准备中。当前显示原文说明。

Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for CI/CD, registry, dependency drift, artifact provenance, image build, release pipeline, and runtime consumer challenges. Use when the user asks to trace dependency drift, registry pulls, malicious packages, build or release tampering, CI execution, artifact signing, or which shipped artifact the runtime actually consumes. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.

中文简介正在准备中。当前显示原文说明。

generate, refine, validate, and render diagrams from natural language, notes, code snippets, schemas, tables, or existing diagram source. use for flowcharts, swimlanes, sequence diagrams, state diagrams, er diagrams, class diagrams, architecture/c4-style diagrams, dependency graphs, gantt charts, mind maps, user journeys, sankey-style flows, org charts, network graphs, and other visual models. supports mermaid by default, graphviz dot for complex graph layout, plantuml for uml-heavy engineering diagrams, and svg output when direct markup is more reliable.

中文简介正在准备中。当前显示原文说明。

Default entrypoint and master ctf-sandbox-orchestrator workflow for CTF, exploit, reverse engineering, DFIR, pwnable, crypto, stego, mobile, AI-agent, cloud, container, Active Directory, Windows-host, and identity challenges. Use first when the user presents challenge infrastructure, binaries, prompts, hosts, or identities that should be treated as sandbox-internal by default and Codex needs to choose, route, and load the right downstream analysis path with concise evidence.

中文简介正在准备中。当前显示原文说明。