Results for “process-hollowing”

Execute advanced evasion by injecting malicious code into the memory space of a legitimate, suspended process (Process Hollowing). This skill details techniques to bypass static and dynamic analysis by masking malicious activity behind trusted processes like svchost.exe or explorer.exe.

Detect process injection techniques (T1055) including classic DLL injection, process hollowing, and APC injection by analyzing Sysmon events for cross-process memory operations, remote thread creation, and anomalous DLL loading patterns.

Proceed through ordinary ambiguity by making reasonable assumptions, keeping momentum, validating as you go, and ending with a clear recap of decisions, changes, verification, and residual risk.

Brain Dump Journaling

Use when building cursor-following spotlight reveals that expose a second aligned image through a soft radial mask—hover-to-color, before-and-after, x-ray, material, texture, product-detail, or illustrated heroes where a desaturated or embossed base stays visible while another treatment follows an eased pointer.

Completely delete and rewrite a file or module from scratch when structural rot makes patching impossible, with enforced preservation of interfaces and blast radius verification.

> 强化高能动性和高压闭环执行的行为技能。适用于连续失败、原地打转、空口完成、 把问题甩给用户、没搜就猜、修完就停等场景，也支持手动通过 /pua 进入核心模式。

Debugging is the scientific method under time pressure.

Harness Pulse

当需要进入高效学习、创作或问题解决的心流状态时，调用此模型作为环境与心理准备框架

当需要进入并维持高效、专注的心流状态，以提升学习、工作或技能获取效率时

heath-no-fluff

Handoff

Meta-skill codifying the no-wakeup-polling pattern. Describes the ScheduleWakeup anti-pattern, the fix (--auto merge + detached watcher), and when to still use wakeups. Reduces handoff spam by 80%.

Monitor SLURM/PBS jobs and their logs. Use when the user asks to monitor, check, or watch a submitted job. Automatically detects running/pending jobs, tails logs, and reports errors.

Use for PUA/try-harder productivity coaching when the user expresses frustration, repeated failure, quality complaint, passive behavior, says retry/change approach/don't give up, asks for evidence/completion check/test before done, or wants Ding-style workplace reminders. Triggers include: try harder, stop giving up, figure it out, again??, why still failing, change approach, no evidence, run tests, done without proof, 换个方法, 再试试, 别摆烂, 别偷懒, 为什么还不行, 又错了, 证据呢, 没跑测试别说完成, 验收, 闭环, 自嗨, 置身钉外, 无招, 老板体感. Do not use for calm first-attempt requests.

跨 TypeScript、Python、Go 的健壮错误处理模式——涵盖类型化错误、错误边界、重试策略及优雅降级

Build serverless background jobs, event-driven workflows, and durable execution with Inngest, without managing queues or workers.

PUA Loop — guided iterative development with recurring checks, completion evidence, and pause/abort markers. Use only when the user explicitly asks for loop/自动迭代 mode.

Build clean async pipelines with fp-ts TaskEither, replacing nested try/catch with composable error handling and real API examples.

Use this when the system needs queue-backed processing design, message handling rules, delivery semantics, dead-letter strategy, or throughput planning. Trigger on requests about queues, brokers, message processing, and consumer coordination.

当遭遇挫折、失败或结果不如预期时，用于将负面经验转化为成长燃料

PUA Loop — guided iterative development with recurring checks, completion evidence, and pause/abort markers. Use only when the user explicitly asks for loop/自动迭代 mode.

Monitor system resources with htop and related tools. Use when a user asks to check CPU/memory usage, find resource-hungry processes, monitor server performance, or diagnose system bottlenecks.

A runbook written in a wiki decays silently: the dashboard is renamed, the

Put the user in the hot seat — one question at a time until their plan, decision, or idea actually holds up. Use whenever the user says "hot seat me", "grill me", "stress-test this", "poke holes in this", "am I missing anything", or drops a plan and wants it challenged before anyone acts on it — even if they never say the words. Also used as a sub-procedure by the whiteboard and connotation-cop skills.

Detects fileless malware and in-memory attacks that execute entirely in RAM without writing persistent files to disk, evading traditional antivirus. Provides detection rules for PowerShell-based attacks, reflective DLL injection, WMI persistence, and registry-resident malware.