Security

abelrguezr Bundle

How to escape Python sandbox restrictions and gain code execution. Use this skill whenever the user mentions Python sandboxes, restricted Python environments, CTF challenges with Python jails, eval/exec restrictions, sandboxed code execution, or any scenario where Python code runs in a limited environment. This includes CTF writeups, security research, penetration testing, or debugging restricted Python environments. Make sure to use this skill even if the user doesn't explicitly say "sandbox" - if they mention restricted Python, eval-only environments, or Python CTF challenges, this skill is relevant.

abelrguezr Bundle

Analyze MediaTek bootloader vulnerabilities, particularly bl2_ext secure-boot bypasses. Use this skill when investigating MediaTek device boot chains, analyzing secure boot verification gaps, triaging boot logs for authentication bypasses, or documenting firmware security issues. Trigger when users mention MediaTek bootloaders, bl2_ext, secure boot bypass, EL3 vulnerabilities, seccfg manipulation, or firmware analysis on MediaTek devices.

abelrguezr Bundle

Analyze macOS app bundles for Dirty NIB attack surface, enumerate nib-driven apps, validate code signatures, and assess defensive posture. Use this skill whenever the user mentions macOS security research, app bundle auditing, privilege escalation analysis, nib file analysis, or macOS hardening. Also trigger for macOS 13+ protection assessments, TCC permission audits, or when investigating potential nib-based injection vectors.

abelrguezr Bundle

Analyze Android firmware for supply-chain backdoors and firmware-level compromises. Use this skill whenever the user needs to audit Android firmware images, detect Zygote-level backdoors, investigate libandroid_runtime.so modifications, analyze firmware artifacts, or perform mobile forensics on compromised devices. Trigger for any request involving Android firmware analysis, backdoor detection, supply-chain security auditing, or mobile device forensics.

abelrguezr Bundle

Generate and test Node.js prototype pollution to RCE payloads. Use this skill whenever the user mentions prototype pollution, Node.js security testing, child_process exploitation, PP2RCE, or needs to convert prototype pollution into remote code execution. This skill provides payloads for fork, spawn, exec, and other child_process functions, plus techniques for forcing spawn when not present.

abelrguezr Bundle

Active Directory ACL/ACE abuse techniques for privilege escalation. Use this skill whenever the user needs to enumerate or exploit misconfigured Active Directory permissions, including GenericAll, GenericWrite, WriteProperty, WriteOwner, ForceChangePassword, GPO delegation abuse, or SYSVOL/NETLOGON poisoning. Trigger when users mention AD ACLs, ACEs, permission abuse, privilege escalation in Active Directory, or need to exploit specific AD object permissions.

abelrguezr Bundle

Analyze macOS System Integrity Protection (SIP) status, identify potential bypass vectors, and assess system security posture. Use this skill whenever the user mentions macOS security, SIP, System Integrity Protection, privilege escalation on macOS, checking system protections, analyzing SIP bypasses, or needs to understand macOS security mechanisms. Trigger for any macOS security assessment, penetration testing, or system hardening tasks.

abelrguezr Bundle

Bypass Android anti-instrumentation, root detection, and SSL pinning using Frida, Objection, and related tools. Use this skill whenever you need to analyze Android apps that detect Frida, check for root, enforce TLS pinning, or block dynamic analysis. Trigger this skill for any Android security testing, mobile pentesting, or app reverse engineering task involving detection bypass, SSL unpinning, or instrumentation stealth.

abelrguezr Bundle

Analyze and understand the Pixel BigWave BIGO timeout race UAF vulnerability (CVE-2025-36934). Use this skill when investigating kernel driver vulnerabilities involving timeout races, use-after-free conditions, or MMIO-based write primitives. Also use when analyzing similar vulnerabilities in hardware accelerator drivers, reviewing kernel driver code for race conditions, or studying the mediacodec sandbox escape attack surface. Make sure to use this skill whenever the user mentions kernel driver vulnerabilities, timeout races, UAF in device drivers, MMIO copy operations, or Pixel/Android security research.

abelrguezr Bundle

macOS process abuse and injection techniques for security research. Use this skill when investigating macOS privilege escalation, analyzing process injection vectors, researching library injection, function hooking, IPC abuse, or application-specific injection methods (Electron, Chromium, Java, .NET, Python, Ruby, Perl). Also use for understanding macOS process/thread internals, credentials/persona system, or when detecting process injection attacks. Make sure to use this skill for any macOS security research involving process manipulation, code injection, or privilege escalation techniques.

abelrguezr Bundle

Analyze PCAP files for forensic investigation, malware detection, and network traffic analysis. Use this skill whenever the user needs to inspect network captures, extract credentials, identify malicious activity, analyze DNS traffic, or investigate suspicious connections. Trigger for any PCAP/PCAPNG file analysis, network forensics tasks, or when examining captured network traffic for security investigations.

abelrguezr Bundle

How to bypass Content Security Policy (CSP) when configured with 'self' and 'unsafe-inline'. Use this skill whenever you're doing web security testing, penetration testing, or analyzing CSP configurations that include 'unsafe-inline'. Trigger this skill for any CSP bypass scenario, iframe exploitation, or when you need to execute JavaScript in restricted environments. Also use when analyzing Content-Security-Policy headers, testing web application security, or when you encounter CSP headers like "default-src 'self' 'unsafe-inline'".

abelrguezr Bundle

How to exploit CVE-2025-21479 on Qualcomm Adreno A7xx GPUs to achieve kernel R/W via GPU SMMU takeover. Use this skill whenever the user mentions Adreno A7xx, GPU SMMU exploitation, SDS privilege bypass, kernel physical memory access, or wants to understand/reproduce the CVE-2025-21479 vulnerability chain. Also use when discussing GPU microcode bugs, IB level masking issues, or dirty pagetable pivots on Android devices with Snapdragon chipsets.

abelrguezr Bundle

macOS kernel and system architecture reference for security research. Use this skill whenever the user asks about XNU kernel internals, Mach/BSD architecture, coprocessors (SEP, SMC, T2, ANE, etc.), kernel extensions, system extensions, cryptexes, RSR updates, or macOS attack surfaces. Trigger for questions about macOS security mechanisms, privilege escalation vectors, firmware security, or when analyzing macOS system internals.

abelrguezr Bundle

Guide for macOS security assessment, privilege escalation, and hardening. Use this skill whenever the user mentions macOS security, privilege escalation, TCC, SIP, file permissions, security auditing, or any macOS security-related task. This skill covers security architecture, attack surface analysis, TCC/SIP bypasses, and traditional privilege escalation techniques.

abelrguezr Bundle

How to discover, debug, and exploit client-side prototype pollution vulnerabilities in JavaScript applications. Use this skill whenever the user mentions prototype pollution, __proto__, constructor.prototype, Object.prototype, or wants to find XSS via prototype pollution in web applications. Also use when debugging JavaScript vulnerabilities, analyzing JS libraries for pollution sinks, or when the user needs to generate prototype pollution payloads for security testing.

abelrguezr Bundle

How to enumerate and assess Windows security controls including AppLocker, credentials storage (SAM, LSASS, LSA), Microsoft Defender, EFS, gMSA, LAPS, PowerShell modes, SSPI, and UAC. Use this skill whenever the user mentions Windows security assessment, penetration testing, AppLocker bypass, credential enumeration, EFS decryption, gMSA password extraction, LAPS, PowerShell constrained mode, execution policy bypass, or any Windows security control evaluation. Trigger for authorized security testing, red teaming, or security assessment tasks involving Windows systems.

abelrguezr Bundle

Windows privilege escalation through autorun mechanisms. Use this skill whenever you need to enumerate or exploit Windows startup persistence mechanisms for privilege escalation. Trigger this when the user mentions Windows privilege escalation, autorun, startup programs, scheduled tasks, registry persistence, Winlogon, Active Setup, BHOs, or any Windows persistence technique. Also use when analyzing Windows systems for privilege escalation vectors, reviewing autorun configurations, or investigating suspicious startup entries.

abelrguezr Bundle

Security analysis skill for Android rooting frameworks (KernelSU, Magisk, APatch, SKRoot). Use this skill when analyzing privilege escalation vulnerabilities in kernel-level rooting solutions, reviewing syscall hook authentication mechanisms, implementing secure manager authentication, or detecting suspicious prctl/syscall patterns on rooted devices. Trigger this skill for any security research, code review, or defensive analysis related to Android kernel modifications, su binaries, or privileged syscall channels.

abelrguezr Bundle

Expert assistance for Session Initiation Protocol (SIP) tasks including message construction, protocol analysis, security assessments, and VoIP pentesting. Use this skill whenever the user needs to understand SIP methods, create SIP messages, analyze SIP traffic, perform SIP security testing, work with SIP digest authentication, or troubleshoot VoIP systems. Trigger for any request involving SIP, VoIP, PBX, Asterisk, SIP headers, SIP response codes, or session initiation protocol.

abelrguezr Bundle

Audit browser extension permissions and host_permissions for security vulnerabilities. Use this skill whenever analyzing Chrome/Firefox extensions, reviewing manifest.json files, investigating extension security, or pentesting browser extensions. Trigger on mentions of extension permissions, host_permissions, manifest analysis, extension security testing, or when examining potentially malicious browser extensions.

abelrguezr Bundle

Security testing methodology for browser extensions (Chrome, Firefox, Chromium). Use this skill whenever you need to audit, analyze, or pentest a browser extension for vulnerabilities. Trigger this skill for extension security reviews, manifest.json analysis, content script vulnerability assessment, native messaging security checks, or when investigating extension-based attacks. Don't forget to use this skill for any browser extension security work, even if the user doesn't explicitly mention "pentesting" or "security audit".

abelrguezr Bundle

How to identify and exploit prototype pollution vulnerabilities in Node.js applications. Use this skill whenever the user mentions prototype pollution, __proto__, Object.prototype, JavaScript prototype attacks, Node.js deserialization vulnerabilities, or wants to test for prototype pollution in web applications. Also trigger when users ask about CVE-2019-11358, CVE-2018-3721, CVE-2019-10744, jQuery extend vulnerabilities, lodash prototype pollution, Handlebars/Pug template injection, or any JavaScript object manipulation attacks.

abelrguezr Bundle

How to enable and analyze core dump files for binary exploitation debugging and crash analysis. Use this skill whenever the user mentions core dumps, crash analysis, GDB debugging, binary exploitation, reverse engineering, or needs to investigate why a program crashed. Make sure to use this skill when working with CTF challenges, security research, or any situation where understanding a program's crash state is important.

abelrguezr Bundle

How to perform Sigreturn-Oriented Programming (SROP) attacks on ARM64 binaries. Use this skill whenever the user mentions SROP, sigreturn exploitation, ARM64 binary exploitation, signal frame manipulation, or needs to exploit buffer overflows on AArch64 systems. This skill covers creating vulnerable test binaries, crafting SigreturnFrame payloads, finding sigreturn gadgets automatically, and chaining SROP with ROP for advanced exploitation.

abelrguezr Bundle

macOS function hooking and method swizzling for security research. Use this skill whenever you need to intercept function calls, hook Objective-C methods, analyze binary behavior, or understand macOS runtime manipulation. Trigger this for any task involving dylib injection, function interposing, method swizzling, or runtime code interception on macOS.

abelrguezr Bundle

How to bypass stack canary protections in binary exploitation. Use this skill whenever the user mentions stack canaries, ASLR bypass, binary exploitation, pwn challenges, forked processes, threaded binaries, or needs to brute-force security tokens. This skill covers brute-forcing canaries on forked network services, threaded processes, and TLS-based canary manipulation. Make sure to use this skill for any CTF pwn challenge, binary analysis, or exploitation task involving stack canaries, even if the user doesn't explicitly mention "canary" or "stack protection."

abelrguezr Bundle

Perform Windows forensic analysis by extracting and analyzing artifacts from Windows systems. Use this skill whenever the user needs to investigate Windows systems, analyze user activity, track file access, examine registry data, parse event logs, or conduct digital forensics on Windows machines. This includes tasks like finding deleted files, tracking USB devices, analyzing email artifacts, examining program execution history, or investigating security events.

abelrguezr Bundle

Bypass Linux filesystem protections (read-only, noexec, file whitelisting, hash whitelisting) by hijacking existing processes through /proc/pid/mem. Use this skill whenever you need to execute code on a restricted Linux system, bypass filesystem restrictions, perform authorized security testing on systems with read-only or noexec mounts, or understand process memory manipulation techniques. Make sure to use this skill when the user mentions bypassing filesystem protections, read-only mounts, noexec restrictions, file-based whitelisting, or executing code in constrained Linux environments.

abelrguezr Bundle

Windows privilege escalation from high integrity to SYSTEM using named pipes. Use this skill whenever the user mentions Windows privilege escalation, gaining SYSTEM access, named pipe exploitation, high integrity to SYSTEM, service-based privilege escalation, or any Windows security testing scenario where you need to escalate privileges. This is especially relevant for penetration testing, red teaming, or security assessments on Windows systems where you already have high integrity but need SYSTEM.

abelrguezr Bundle

Analyze Windows kernel race conditions, TOCTOU vulnerabilities, and Object Manager namespace exploitation techniques. Use this skill whenever the user mentions Windows kernel vulnerabilities, race conditions, privilege escalation, Object Manager, NtOpen* calls, TOCTOU bugs, or security research on Windows kernel timing attacks. This skill helps understand, measure, and defend against race-based kernel exploits.

abelrguezr Bundle

Research and analyze Windows Telephony (TapiSrv) service vulnerabilities, specifically CVE-2026-20931 arbitrary DWORD write to RCE. Use this skill when investigating Windows privilege escalation, analyzing TAPI server configurations, researching MSRPC named pipe vulnerabilities, or hardening Windows systems against telephony service attacks. Trigger for any questions about Windows Telephony service security, TAPI server mode exploitation, mailslot path confusion attacks, or NETWORK SERVICE privilege escalation.

abelrguezr Bundle

How to analyze macOS kernel extensions (Kexts), extract and inspect kernelcaches, enumerate loaded kexts, debug kernel panics, and identify kernel-level security issues. Use this skill whenever the user mentions kernel extensions, kexts, kernelcache, macOS kernel debugging, KDK, kmutil, kextstat, kernel vulnerabilities, SIP bypass, or any macOS kernel-level security analysis. Make sure to use this skill for any macOS security research, kernel extension management, or kernel debugging tasks.

abelrguezr Bundle

Analyze and work with macOS System Extensions including DriverKit, Network Extensions, and Endpoint Security Framework. Use this skill when investigating macOS security, analyzing system extensions, understanding endpoint security bypasses, or working with macOS kernel-level security mechanisms. Make sure to use this skill whenever the user mentions macOS security, system extensions, endpoint security, TCC permissions, or any macOS kernel/user space security architecture.

abelrguezr Bundle

Security testing skill for Chromium browser abuse on macOS. Use this skill when the user needs to test browser-based privilege escalation, session theft, or DevTools Protocol exploitation on macOS systems. Trigger this skill for any request involving Chrome/Edge/Brave security assessments, CDP exploitation, browser extension injection, or macOS browser hardening tests. Make sure to use this skill whenever the user mentions Chromium browsers, Chrome DevTools Protocol, browser security testing, or macOS browser exploitation scenarios.

abelrguezr Bundle

Analyze macOS Gatekeeper security mechanisms, check application signatures and notarization status, examine quarantine attributes, and assess Gatekeeper bypass vulnerabilities. Use this skill whenever the user needs to audit macOS application security, investigate blocked applications, analyze code signatures, check quarantine extended attributes, understand Gatekeeper behavior, or assess macOS security posture. Trigger for any macOS security analysis involving Gatekeeper, spctl, codesign, quarantine attributes, or XProtect.