Security

hybridlabor-api Skill

Design the MixerSceneIntent, approval state, JSON schema, CLI examples, audit entries, and tests for AI-Controlled Party mixer/Soundcraft Ui24R scene arming. Use whenever a task mentions mixer scenes, Ui24R snapshots/cues, operator-approved mixer control, show-director contract updates, schema updates, dry-run CLI shape, or follow-ups that revise this contract.

fluxonlab Skill

Use when you need to audit global and project installation paths, backups, packages, and reinstall readiness.

fluxonlab Skill

Use when you need to write or audit a CHANGELOG and human-facing release notes — applying Keep a Changelog structure, deriving entries from conventional commits, choosing the correct semver bump, and writing clear breaking-change and migration notes.

fluxonlab Skill

Use when you need to write or audit incident runbooks and on-call operational docs — symptom-first triage, validated diagnostic and recovery commands, escalation paths and severity levels, rollback steps, and verification that service is restored.

dnyoussef Bundle

When Auditing Code Style Use Style Audit

dnyoussef Bundle

When Auditing Security Use Security Analyzer

dnyoussef Bundle

When Validating Code Works Use Functionality Audit

dnyoussef Bundle

When Setting Network Security Use Network Security Setup

dnyoussef Bundle

When Configuring Sandbox Security Use Sandbox Configurator

kyrie66nb Skill

Run a comprehensive security review on code

maxrave-dev Skill

Delete a feature that duplicates a newer one — two effects on one output multiply — after auditing what else uses the handle the removed feature appeared to own, deleting the no-op stubs on the other platforms, and force-stopping before judging whether the removal worked, because an already-attached external effect outlives the change. Use when replacing a delegating integration with an in-app one, or when a removed feature still seems to be running.

maxrave-dev Skill

A design rule with legitimate exceptions survives only if every exception carries its reason at the call site and the rule itself is greppable — otherwise nothing distinguishes an exception from a violation and the rule silently rots. Covers where the rule statement goes, where the reasons go, scoping the audit to the code the rule actually governs, and the limits of a comment-based check. Use when a stated convention is drifting, when reviewers cannot tell deliberate from careless, or before writing a rule into a file header and assuming it will hold.

netvar1337 Skill

从逆向走到可用利用 (Working Exploit) 的全链路工程化方法。 适用场景：拿到了二进制 + 漏洞点 + 目标环境，需要写出一个能稳定打通的 exploit（不是只能本地复现一下、远程一打就崩的脚本）。 覆盖三大方向：栈溢出 / 堆利用 / 内核 pwn。强调'CTF 本地通 → 真实远程稳定打通'的工程差距：libc 版本错配、堆喷射时序、SMEP/SMAP/KASLR、栈对齐、远程缓冲。 核心工具链：pwntools + GEF/pwndbg + ROPgadget/Ropper + one_gadget + libc-database + qemu-system 内核调试。 触发关键词：pwn、栈溢出、堆溢出、ROP、ret2libc、ret2csu、one_gadget、libc-database、堆利用、tcache、fastbin、unsorted bin、kernel pwn、kROP、SMEP、SMAP、KASLR、modprobe_path、pwntools、GEF、pwndbg。

netvar1337 Skill

Usermode↔kernel driver communication: IOCTL design, shared sections, events, security descriptors, stealth IOCTL.

netvar1337 Skill

Use for authorized wireless security assessment including Wi-Fi capture, WPA handshake analysis, rogue AP detection research, and lab-only deauth testing.

netvar1337 Skill

Use when auditing C/C++/Rust secret handling for missing or optimized-away zeroization.

netvar1337 Skill

Creates task-oriented technical documentation with progressive disclosure. Use when writing READMEs, API docs, architecture docs, or markdown documentation. Also use this skill at the END of any completed reverse engineering, penetration testing, CTF, or security analysis task to generate a formal report in the user's project directory. Trigger keywords: 写报告, 写文档, 出报告, writeup, 技术文档, report, documentation.

netvar1337 Skill

固件 / IoT 渗透链。从拿到一坨 .bin / .img 开始，闭环走完逆向 → 提取 → 模拟 → 利用。 方法论遵循 OWASP FSTM 九阶段；工具链以 binwalk v3、unblob、EMBA、Firmadyne、AFL++ 为主。 适用场景：路由器/摄像头/智能家居固件审计、固件升级包逆向、IoT CVE 复现、嵌入式 0day 挖掘。 触发关键词：固件、firmware、IoT、binwalk、unblob、UART、JTAG、squashfs、UBI、JFFS2、Firmadyne、QEMU 全系统仿真、EMBA、固件渗透、路由器固件、嵌入式漏洞利用、bootloader、NVRAM、FAT、firmware analysis toolkit。

netvar1337 Skill

N-day 补丁差分到利用。从厂商发布的补丁里反推漏洞点、写 PoC、做成可用的攻击模块。 适用场景：已知 CVE 编号但只有补丁没有 PoC、SRC/红队需要打击未及时更新的资产、N-day 武器化、Patch Tuesday 跟进。 核心方法：拿 before/after 二进制 → 对齐符号 → 二进制 diff → 看新增的安全检查反推 bug class → 写 PoC 触发漏洞。 触发关键词：N-day、Nday、补丁差分、patch diff、patch tuesday、1day、binary diff 漏洞、bindiff 利用、ghidriff、Diaphora、补丁分析、CVE 复现、漏洞还原、补丁反推、N-day 武器化。

netvar1337 Skill

Use when setting up unattended secret access (service accounts, vault scoping, non-echoing tokens).

netvar1337 Skill

Use for security-focused review of PRs/commits/diffs with blast-radius analysis.

netvar1337 Skill

Use to harden a repo end-to-end: inventory, baselines, issues/PRs, security, merge-ready pub.

netvar1337 Skill

Routes reverse engineering, exploitation, penetration testing, malware, mobile, firmware, browser automation, documentation, and security tasks to the appropriate specialist skill. Use when a task spans modules or the correct reverse-skill entrypoint is unclear.

netvar1337 Skill

Use when hunting new Windows privilege-escalation or security-boundary vulnerabilities in first-party services, scheduled tasks, recovery flows, security products, profile handling, or other privileged workflows. Drives evidence-first attack-surface mapping, state-machine analysis, controlled experiments, exploit-chain construction, variant hunting, and reproducibility testing.

netvar1337 Skill

Stack buffer overflow exploit development: smash framing, saved RIP/SEH control, canaries, overlap, ROP setup, Windows/Linux differences.

netvar1337 Skill

Use for line-by-line architectural context building before vuln/bug hunting.

netvar1337 Skill

Use when reviewing crypto code for timing side channels / secret-dependent behavior.

netvar1337 Skill

Use for pre-commit review: security scan, quality gates, auto-fix.

netvar1337 Skill

Use when hunting new vulnerabilities in the latest stable Chromium, Firefox, WebKit/Safari, or embedded browser stack, including renderer RCE, IPC/broker flaws, sandbox escapes, site-isolation violations, JIT/compiler bugs, DOM/media/font/image parsers, GPU processes, extensions, and browser-to-OS exploit chains.

netvar1337 Skill

Use when assessing dependency exploit/takeover risk and supply-chain attack surface.

netvar1337 Skill

Use to design/test/recover security workflows with durable state and side effects.

netvar1337 Skill

Use when hunting new escapes from a latest-stable application sandbox or restricted process, including document readers, office suites, messaging clients, media processors, plugin hosts, renderers, security sandboxes, AppContainer, macOS Seatbelt/XPC, Linux seccomp/namespaces/portals, and brokered desktop applications. Builds a capability map, compromised-child harness, broker/IPC audit, and pr...

acaprino Bundle

Rulebook of MUST/DO/DON'T rules backed by real-world incident references. TRIGGER WHEN: building or reviewing SPA, PWA, mobile (iOS/Android), or desktop (Electron/Tauri) apps for security posture, architecture decisions, performance, or compliance with OWASP, Core Web Vitals, and OAuth 2.1.

acaprino Skill

Verify every claim, path, count, and badge against the codebase before changing anything. TRIGGER WHEN: the user asks to audit, update, or improve an existing README.md: fix stale stats/links, reorganize sections, or apply readme-craft best practices. DO NOT TRIGGER WHEN: creating a new README (use the docs:readme-craft skill), or non-README docs (use /codebase-mapper:docs-maintain).

acaprino Skill

Checks manifest, install criteria, offline behavior, security headers and performance, locally or against a live URL, citing file and line. TRIGGER WHEN: auditing a PWA, or verifying one is installable and production-ready.

acaprino Bundle

Knowledge base for structural entropy: the cost of change when one concept lives in many places. TRIGGER WHEN: the user asks "should I extract this", "who owns this rule", "is this DRY enough", "is this the wrong abstraction"; centralizing, inlining or removing a layer; auditing for duplicated domain knowledge, competing sources of truth, redundant models or derivable state stored anyway; loaded under /abstraction-architect:audit or the /senior-review:team-review abstraction dimension. DO NOT TRIGGER WHEN: the concern is formatting (use clean-code:clean-code), Python refactoring (use python-development:python-refactor), dead-code removal (use /senior-review:code-review --fix), security (use senior-review:security-auditor), contract drift (use senior-review:api-contract-auditor), or cycles, cohesion and single-file patterns (use senior-review:code-auditor and senior-review:chicken-egg-detector).