Use when performing cybersecurity operations - offensive or defensive - including threat detection and hunting, SOC operations, incident response, digital forensics and DFIR, malware analysis and reverse engineering, threat intelligence, cloud/container/network/application/API security, identity-access and zero-trust, OT/ICS and endpoint security, vulnerability and supply-chain management, DevSecOps, cryptography, AI security, compliance and governance, and red-team or penetration testing under signed rules of engagement; routes to one of 800+ technique playbooks mapped to MITRE ATT&CK, D3FEND, and NIST CSF.
中文简介正在准备中。当前显示原文说明。
查看安装方法安装前可以查看交给 AI 代理的指令内容。
This skill covers dual-use offensive and defensive techniques. Offensive playbooks (red-team, penetration testing, credential access, C2, social-engineering simulation) are for engagements you own or have explicit written authorization to test. Before any offensive technique, confirm scope, a signed rules-of-engagement, and authority (tasks/engagement-intake.md), and document every action for the engagement record. Defensive, detection, forensic, and compliance playbooks assume you operate on systems you are responsible for.
Route, do not improvise. This skill does not contain techniques inline - it dispatches to one self-contained playbook under playbooks/. Every recommendation names the objective, the strategy basis, the technique's ATT&CK/D3FEND/NIST mapping, and the verification or detection path.
detection-hunting - detection engineering, threat hunting, SIEM analytics.soc-incident-response - SOC operations, triage, incident response, containment.dfir-forensics - disk/memory/network forensics, evidence acquisition, custody.malware-analysis - static/dynamic analysis, reverse engineering, deobfuscation.threat-intelligence - CTI, TTP mapping, actor tracking, IOC work.cloud-container-security - cloud posture, Kubernetes/container, cloud IR.network-wireless-security - network defense, traffic analysis, wireless.application-api-security - web/app/API testing and hardening, OWASP.identity-access-zerotrust - IAM, AD/Entra, zero-trust, credential protection.ot-ics-security - OT/ICS/SCADA, historian, industrial protocols.endpoint-mobile-security - endpoint hardening, EDR, mobile.vuln-supplychain-devsecops - vulnerability management, supply chain, CI/CD security.offensive-security - red-team, penetration testing, C2, social-engineering simulation.crypto-ai-emerging - cryptography, AI security, blockchain, deception.compliance-governance - CMMC/NIST/ISO, risk, privacy, audit.offensive-security task, confirm first
(tasks/engagement-intake.md). No scope, no action.references/INDEX.md lists the 15 categories and their per-category index files. Each references/index/<category>.md is a table of that category's playbooks (name, ATT&CK, tags, description). Both are generated by scripts/build_index.py - regenerate after adding or moving playbooks; never hand-edit them.
Playbooks carry MITRE ATT&CK technique IDs, MITRE D3FEND countermeasures, and NIST CSF functions in their frontmatter. Use these to pair an offensive technique with its detection, and to map defensive work to a control framework.
还没有评价。欢迎分享你的使用感受。
无需登录即可发表。欢迎分享使用感受、提问，或说明在哪些环境下无法运行。
还没有评论。来写第一条吧。
Use when evaluating, designing, drafting, revising, stress-testing, or preparing academic articles, empirical research reports, literature reviews, systematic reviews, meta-analyses, journal submissions, reviewer responses, research methods, sampling, measurement, analysis, publication readiness, or citation/source audits.
中文简介正在准备中。当前显示原文说明。
Android device offensive security, forensic extraction, and mobile app exploitation. Use this whenever the user needs to: break into or bypass the lock screen of an Android phone, extract data from a seized Android device for evidence, analyze or reverse-engineer an APK to find vulnerabilities, intercept communications on an Android device, exploit Android apps via deeplinks, steal crypto wallets or app data, set up rogue WiFi to target a phone, or plan any mobile device investigation or penetration test. Also trigger when the user mentions Android forensics, mobile pentesting, law enforcement phone extraction, device exploitation, WhatsApp or Telegram extraction from a phone, Android app reversing, CVE research for Android, or needing a chain of custody for mobile evidence. Even if the user describes the scenario casually or in another language, if they need to gain access to or pull data from an Android phone, use this skill.
中文简介正在准备中。当前显示原文说明。
Use when designing, reviewing, modifying, migrating, optimizing, securing, operating, troubleshooting, or decommissioning data architectures across data model exploration, SQL, ISO SQL conformance, NoSQL, vector, graph, document, time-series, NewSQL, search, in-memory, SQLite, CDC/Debezium, DBMS storage/query/recovery internals, database incident prevention, hardware acceleration, cache, big-data, lakehouse, and warehouse systems.
中文简介正在准备中。当前显示原文说明。
Use when developing, reviewing, debugging, porting, or engineering Linux kernel device drivers, kernel modules, device tree bindings, bus clients, subsystem drivers, DMA/IRQ/memory paths, userspace interfaces, or hardware bring-up plans.
中文简介正在准备中。当前显示原文说明。
Use when designing, implementing, reviewing, debugging, testing, profiling, or porting concurrent, parallel, distributed, high-performance, network dataplane, kernel-bypass, or real-time software, including locks, semaphores, monitors, MPI, CSP rendezvous, DPDK, VPP, eBPF, XDP, AF_XDP, SR-IOV, RSS, RoCEv2/RDMA, RMS/EDF, priority inversion, and environment selection from silicon to edge.
中文简介正在准备中。当前显示原文说明。
Use when designing, evaluating, documenting, modernizing, reviewing, refactoring, or implementing software architecture and code-level structure, including requirements, context, architecture style selection, microservices patterns, WebAssembly/WASI/Component Model, UMA portable capabilities, runtime contracts, capability graphs, governed MCP/agent orchestration, clean code, code smells, Rust crate/library API architecture, Cargo feature/MSRV/SemVer policy, unsafe/FFI/no_std/library testing, modularity, views, NFR tactics, IAM/auth, security patterns, cost estimation, architecture-as-code fitness functions, ADR/RFC work, and engineering execution plans.
中文简介正在准备中。当前显示原文说明。