Security

abelrguezr Bundle

Inspect, debug, and analyze macOS/iOS objects in memory using LLDB and Frida. Use this skill whenever the user needs to examine Objective-C or Swift objects at runtime, understand memory layouts, decode type encodings, work with arm64e/PAC pointers, enumerate classes and methods, or perform runtime inspection on macOS applications. Trigger for any task involving memory forensics, reverse engineering, debugging native code, or analyzing object structures in macOS/iOS processes.

abelrguezr Bundle

Analyze macOS dynamic linker (dyld) internals, debug library loading, examine Mach-O binary structure, and identify potential security implications. Use this skill whenever the user needs to understand how macOS loads executables, debug dyld behavior, analyze library injection vectors, examine stub sections, or investigate privilege escalation through the dynamic linker. Trigger for any questions about dyld environment variables, Mach-O segments, lazy vs non-lazy binding, or macOS binary internals.

abelrguezr Bundle

macOS AMFI (AppleMobileFileIntegrity) security reference. Use this skill whenever the user asks about macOS kernel security, code signing enforcement, AMFI boot arguments, MACF policies, amfid daemon, provisioning profiles, or macOS privilege escalation related to file integrity. Trigger for any macOS security research, jailbreak analysis, or code signing questions.

abelrguezr Bundle

Reference and templates for x64 assembly programming and macOS shellcode development. Use this skill whenever the user needs to understand x64 registers, calling conventions, write assembly code, create shellcode for macOS, work with syscalls, or needs quick reference for assembly instructions. Trigger for any x64/x86-64 assembly questions, macOS syscall work, shellcode creation, or reverse engineering tasks involving x64 architecture.

abelrguezr Bundle

macOS security analysis for launch constraints, trust caches, and binary execution restrictions. Use this skill whenever the user asks about macOS security mechanisms, launch constraints, trust cache enumeration, AMFI (Apple Mobile File Integrity), binary execution policies, environment constraints on apps, or analyzing which binaries are constrained vs unconstrained. Also trigger for questions about macOS privilege escalation, system binary security, XPC service protection, or when investigating why a binary won't execute on macOS.

abelrguezr Bundle

ARM64 assembly language reference for macOS security and reverse engineering. Use this skill whenever the user asks about ARM64 assembly, registers, instructions, exception levels, calling conventions, shellcode, or macOS system calls. This includes questions about writing assembly code, understanding disassembly, creating shellcode, or working with ARM64 architecture concepts. Make sure to use this skill when users mention ARM64, aarch64, assembly, shellcode, syscalls, registers like x0-x30, or macOS binary exploitation.

abelrguezr Bundle

macOS file system, permissions, binaries, and security reference. Use this skill whenever the user asks about macOS file structures, directory layouts, file permissions, plist files, bundles, dyld shared cache, file flags, ACLs, extended attributes, resource forks, or any macOS security concepts. This includes questions about where to find configuration files, how to read plist files, understanding file permissions and flags, analyzing binaries, or investigating macOS security mechanisms. Make sure to use this skill for any macOS security research, pentesting, or system administration tasks involving files, permissions, or binaries.

abelrguezr Bundle

How to exploit Electron apps with disabled contextIsolation to achieve RCE. Use this skill whenever you're pentesting Electron desktop applications, analyzing Electron security, investigating context isolation bypasses, or need to demonstrate prototype pollution attacks in Electron. Trigger this for any Electron app security assessment, especially when you see renderer process access to Node.js APIs, or when investigating RCE vulnerabilities in Electron-based software.

abelrguezr Bundle

Sigreturn-Oriented Programming (SROP) exploitation for binary security challenges. Use this skill whenever the user mentions SROP, sigreturn, signal handlers, register manipulation, syscall exploitation, or needs to craft exploits that control CPU registers through stack manipulation. Also trigger for CTF challenges involving signal-based vulnerabilities, ret2syscall with register control, or when a binary calls sigreturn and allows stack writes.

abelrguezr Bundle

macOS library injection and dylib hijacking analysis. Use this skill whenever the user needs to analyze macOS binaries for library injection vulnerabilities, check DYLD_INSERT_LIBRARIES restrictions, find weak linked libraries, examine rpath configurations, or test for privilege escalation via library loading. Trigger on any request about macOS dyld, library injection, dylib hijacking, dlopen hijacking, or binary security analysis.

abelrguezr Bundle

Create and debug sandboxed macOS applications for security research and testing. Use this skill whenever the user mentions macOS sandboxing, app entitlements, codesigning, creating sandboxed apps, testing macOS security protections, privilege escalation research, or needs to build a macOS app bundle with specific sandbox permissions. This is for legitimate security research, penetration testing, and understanding macOS security mechanisms.

abelrguezr Bundle

Analyze macOS Mach-O binaries, universal binaries, and extract security-relevant information. Use this skill whenever the user asks about macOS binary analysis, Mach-O format, universal binaries, reverse engineering macOS executables, extracting binary metadata, analyzing load commands, segments, sections, or any macOS binary forensics task. Make sure to use this skill for any macOS binary-related questions, even if the user doesn't explicitly mention "Mach-O" or "binary analysis".

abelrguezr Bundle

Analyze, debug, and deobfuscate VBS/VBScript files for forensic investigation. Use this skill whenever the user mentions VBS files, VBScript analysis, malware investigation, script obfuscation, or needs to understand what a VBS file does. This is essential for security researchers, incident responders, and anyone investigating suspicious scripts.

abelrguezr Bundle

macOS extended attributes (xattr) and Access Control Lists (ACLs) for file security. Use this skill whenever working with macOS file permissions, security hardening, privilege escalation research, or when you need to understand/modify ACLs and extended attributes beyond standard chmod. Trigger for any macOS file permission tasks, security analysis, or when dealing with com.apple.* attributes.

abelrguezr Bundle

macOS TCC (Transparency, Consent, and Control) bypass research and analysis. Use this skill when investigating macOS security mechanisms, performing authorized penetration testing, analyzing TCC vulnerabilities, or researching macOS privilege escalation techniques. Trigger this skill for any macOS security research involving TCC database manipulation, process injection attacks, or bypassing macOS privacy protections.

abelrguezr Bundle

Analyze and understand AppleScript files on macOS, including decompiling, disassembling, and security assessment. Use this skill whenever the user needs to examine .scpt files, understand AppleScript automation, investigate potential malware, or audit AppleScript usage on macOS systems. Make sure to use this skill when the user mentions AppleScript, .scpt files, macOS automation, process interaction scripts, or any macOS security investigation involving scripting.

abelrguezr Bundle

Extract entitlements from Mach-O binaries and index Apple IPSW firmwares for forensic analysis. Use this skill whenever you need to analyze iOS/macOS binaries for security entitlements, enumerate privileged capabilities across firmware versions, or perform attack surface mapping on Apple platforms. Trigger this skill for any request involving Mach-O parsing, code signature analysis, entitlement extraction, IPSW mounting, or Apple platform forensics—even if the user doesn't explicitly mention "entitlements" or "Mach-O".

abelrguezr Bundle

Use this skill whenever analyzing suspicious files for 0-click exploit detection, forensic investigation of mobile malware, or validating file format structural integrity. Trigger on any request about PDF exploits, WebP vulnerabilities, font bytecode analysis, DNG/TIFF forensics, HEIF/AVIF parsing issues, or general file format exploit detection. This skill helps detect exploit chains by validating structural invariants rather than relying on byte signatures.

abelrguezr Bundle

Bypass Linux filesystem protections (read-only, no-exec, distroless containers) for authorized security testing. Use this skill whenever you need to execute code on restricted Linux systems, containers with readOnlyRootFilesystem, distroless containers, or when facing no-exec mount restrictions. Make sure to use this skill when you encounter read-only filesystems, no-exec protections, or minimal containers where standard binary execution fails.

abelrguezr Bundle

Security assessment skill for identifying and testing CVE-2023-33733 (ReportLab/xhtml2pdf RCE vulnerability) in authorized environments. Use this skill when you need to assess PDF generation systems for this specific sandbox escape vulnerability, verify patch status, or validate remediation. Only use on systems you own or have explicit authorization to test.

abelrguezr Bundle

Use this skill whenever analyzing macOS binaries, debugging applications, performing security research on macOS apps, or fuzzing macOS software. Trigger for any macOS binary analysis, reverse engineering, crash investigation, security assessment, or when the user mentions inspecting, debugging, or testing macOS applications. Also use when investigating suspicious macOS binaries, analyzing crash reports, or performing malware analysis on macOS.

abelrguezr Bundle

macOS XPC Authorization Analysis and Exploitation. Use this skill whenever investigating macOS privilege escalation, analyzing XPC helper tools, enumerating authorization rights in /var/db/auth.db, or developing exploits for vulnerable XPC services. Trigger this when the user mentions XPC, HelperTool, authorization rights, privilege escalation on macOS, or any macOS security assessment involving inter-process communication.

abelrguezr Bundle

Analyze Mach Interface Generator (MIG) IPC on macOS. Use this skill whenever the user mentions MIG, Mach IPC, macOS inter-process communication, binary analysis of Mach-O files with IPC, extracting dispatch tables from macOS binaries, or reverse engineering macOS system services. Trigger for any task involving .defs files, mach_port, bootstrap_look_up, jtool2 MIG analysis, or identifying RPC functions in macOS binaries.

abelrguezr Bundle

macOS thread injection and IPC exploitation reference. Use this skill whenever the user asks about macOS security research, privilege escalation, task ports, thread hijacking, Mach IPC, process injection, EndpointSecurity detection, or Apple Silicon (arm64e) exploitation. Trigger for macOS security audits, EDR development, or understanding macOS process isolation bypasses.

abelrguezr Bundle

Bypass PHP disable_functions restrictions using mod_cgi CGI handler. Use this skill when testing PHP applications for command execution vulnerabilities, when PHP functions like system/exec are disabled but you have write access and mod_cgi is enabled, or when you need to execute arbitrary commands in restricted PHP environments. Make sure to use this skill whenever you're doing authorized security testing on PHP applications with disabled functions, or when you encounter PHP restrictions during penetration testing.

abelrguezr Bundle

Bypass PHP disable_functions restriction using /proc/self/mem manipulation. Use this skill whenever the user needs to execute disabled PHP functions (like system(), exec(), shell_exec()) in a restricted environment, mentions PHP function restrictions, or is performing authorized security testing on PHP applications. This technique works on Linux x64 with PHP-CGI/FPM and kernel >= 2.68.

abelrguezr Bundle

Analyze macOS Mach IPC communications, port rights, task ports, and inter-process communication mechanisms. Use this skill whenever the user needs to understand Mach ports, debug IPC messages, analyze port permissions, work with task/thread ports, investigate code injection via task ports, or understand macOS IPC internals for security research, debugging, or privilege escalation analysis. Trigger on any mention of Mach ports, IPC, task_for_pid, bootstrap server, port rights, or macOS inter-process communication.

abelrguezr Bundle

Audit PHP configurations for security vulnerabilities and hardening opportunities. Use this skill whenever you need to review PHP security settings, check for dangerous enabled functions, assess disable_functions configuration, verify extension_dir security, or harden PHP installations. Trigger this skill for any PHP security assessment, penetration testing (authorized), configuration review, or compliance audit.

abelrguezr Bundle

Security testing skill for macOS Microsoft Office sandbox escape techniques. Use this skill when performing authorized security assessments, penetration testing, or vulnerability research on macOS Office applications. Trigger when users mention Office sandbox testing, macOS security auditing, privilege escalation research, or need to understand Office sandbox bypass methods for defensive purposes.

abelrguezr Bundle

How to bypass PHP disable_functions and open_basedir restrictions using PHP-FPM FastCGI protocol vulnerabilities. Use this skill whenever the user mentions PHP-FPM, FastCGI, disable_functions bypass, open_basedir bypass, PHP configuration injection, or needs to test PHP security configurations. Make sure to use this skill for any PHP security assessment involving FastCGI protocol exploitation, PHP_VALUE/PHP_ADMIN_VALUE injection, or CVE-2019-11043 testing.

abelrguezr Bundle

How to debug, analyze, and bypass macOS sandbox restrictions. Use this skill whenever the user mentions macOS sandbox, app-sandbox entitlement, sandbox escape, privilege escalation on macOS, debugging sandboxed processes, Mach services, XPC, quarantine attributes, or any macOS security bypass technique. This skill covers sandbox loading mechanisms, interposition techniques, lldb debugging workflows, Mach service abuse, and various bypass methods including quarantine attribute manipulation, LaunchAgent abuse, and static compilation bypasses.

abelrguezr Bundle

Use this skill when pentesting PHP applications to bypass disabled_functions restrictions using the Shellshock vulnerability (CVE-2014-6271). Trigger when the user mentions PHP security testing, disabled_functions bypass, Shellshock exploitation, mail() function abuse, or needs to execute commands in restricted PHP environments. Always use for authorized security assessments only.

abelrguezr Bundle

Use this skill when analyzing PHP applications for security vulnerabilities, specifically when investigating ionCube extension misconfigurations that may allow bypassing disable_functions and safe_mode restrictions. Trigger this skill when users mention PHP security testing, ionCube vulnerabilities, disable_functions bypass, safe_mode bypass, or PHP extension exploitation during authorized penetration testing. Always verify authorization before using these techniques.

abelrguezr Bundle

Audit macOS XPC services for PID reuse vulnerabilities. Use this skill whenever you need to analyze XPC connection code, review process authentication patterns, identify race condition risks in macOS IPC, or harden XPC services against PID-based authentication attacks. Trigger this skill for any macOS security audit involving XPC, process verification, or inter-process communication security.

abelrguezr Bundle

Use this skill whenever you need to bypass PHP security restrictions, execute commands through PHP, or work with disable_functions/open_basedir limitations during web application security testing. Trigger this skill for any PHP-related pentesting tasks including command execution, function bypass techniques, FastCGI exploitation, or when analyzing PHP vulnerabilities in web applications.

abelrguezr Bundle

Bypass disabled_functions in PHP 4 >= 4.2.0 and PHP 5 using pcntl_exec. Use this skill when testing PHP applications for command execution vulnerabilities, analyzing disabled_functions configurations, or when you need to execute system commands through PHP when standard functions are blocked. Trigger this skill for any PHP security testing involving function restrictions, WAF bypass, or privilege escalation scenarios.