Results for “engineering”

Perform code reviews following Sentry engineering practices. Use when reviewing pull requests, examining code changes, or providing feedback on code quality. Covers security, performance, testing, and design review.

Detect business email compromise (BEC) attacks using email gateway rules, behavioral analytics, and financial process controls.

Reverse engineers stripped Go and Rust binaries by recovering runtime metadata, symbols, panic strings, and idiomatic decompilation patterns.

Perform code reviews following Sentry engineering practices. Use when reviewing pull requests, examining code changes, or providing feedback on code quality. Covers security, performance, testing, and design review.

Authorized security testing framework for desktop thick clients covering local storage, IPC, update channels, traffic interception, and client-side trust boundaries.

Reverse engineer Go-compiled malware using Ghidra with specialized scripts for function recovery, string extraction, and type reconstruction in stripped Go binaries.

Analyzes encryption algorithms, key management, and file encryption routines used by ransomware families to assess decryption feasibility, identify implementation weaknesses, and support recovery efforts.

Plan and execute authorized spearphishing simulations for red team engagements, covering pretext development, payload creation, infrastructure setup, campaign execution, and post-campaign analysis.

Analyze suspected malware through static, dynamic, and behavioral techniques, including IOC extraction, YARA or Sigma rules, sandboxing, and anti-analysis behavior detection.

Unified automation entry point covering browser automation with Playwright and Windows desktop app automation with OpenReverse for GUI interaction, network capture, and reverse engineering workflows.

Analyze the structure, boot chain, and update mechanism of a firmware image, then trace the shortest path to the decisive artifact or secret.

Design, implement, test, and maintain SIEM detection rules mapped to MITRE ATT&CK across Splunk, Elastic, and Sentinel platforms.

End-to-end firmware and IoT penetration testing pipeline following OWASP FSTM methodology. Extracts, emulates, and exploits router, camera, and smart-home firmware using binwalk, EMBA, Firmadyne, and AFL++.

Recovers transform chains, hidden media payloads, mobile signing paths, and local trust boundaries in CTF challenges involving crypto, encoding, steganography, APK, IPA, and mobile trust-boundary analysis.

Reduces SOC alert fatigue by tuning detection rules, consolidating duplicate alerts, implementing risk-based alerting, and measuring alert quality metrics to maintain analyst effectiveness.

Designs chaos experiments, creates failure injection frameworks, and facilitates game day exercises for distributed systems — producing runbooks, experiment manifests, rollback procedures, and post-mortem templates.

Recovers malware configuration, decodes C2 and beacon parameters, unpacks staged payloads, and extracts bot or campaign IDs from samples in a CTF sandbox environment.

Extract actionable insights from blog posts, web articles, and practitioner content - assess credibility, run security checks, and either improve existing skills or apply to the current project. Load when the user asks to learn from an article, extract insights from a blog post, apply a practitioner's findings, or process engineering blog content. Also triggers on "learn from this article", "learn from this blog post", "extract insights from this post", "what can we learn from this article", "apply this article", or when the user links to a blog, Medium, Substack, dev.to, or engineering blog post.

Analyzes firmware images for embedded malware, backdoors, and unauthorized modifications targeting routers, IoT devices, UEFI/BIOS, and embedded systems. Covers firmware extraction, filesystem analysis, binary reverse engineering, and bootkit detection.

Perform static analysis of Android APK malware samples using apktool for decompilation, jadx for Java source recovery, and androguard for permission analysis, manifest inspection, and suspicious API call detection.

Analyzes malware command-and-control (C2) communication protocols to understand beacon patterns, command structures, data encoding, and infrastructure for detection development and threat intelligence.

Provides a structured workflow for reverse engineering .NET and C# binaries, including deobfuscation with de4dot, static analysis via dnSpyEx IL view, dynamic debugging, and reliable IL patching for red-team tools and malware.

Reverse-engineers custom JavaScript-based WASM virtual machines and risk-control engines by identifying DSL VM patterns, extracting opcodes, analyzing constant tables, and tracing exported functions through static analysis and runtime injection.

Query MITRE ATT&CK data programmatically, map APT group TTPs to Navigator layers, create multi-layer overlays for gap analysis, and generate actionable intelligence reports for detection engineering teams.

Extracts and analyzes firmware images using binwalk to identify embedded filesystems, compressed archives, bootloaders, kernel images, and cryptographic material. Covers entropy analysis, recursive extraction, filesystem mounting, and string analysis for credential and configuration discovery.

World-class backend engineering - distributed systems, database architecture, API design, and the battle scars from scaling systems that handle millions of requestsUse when "backend, api, database, postgres, mysql, mongodb, redis, graphql, rest, authentication, authorization, caching, queue, background job, webhook, migration, transaction, n+1, rate limit, server, node.js, python, go, backend, api, database, architecture, performance, reliability, security" mentioned.

Develop and implement OT-specific incident response playbooks aligned with SANS PICERL framework, IEC 62443, and NIST SP 800-82 that address unique ICS challenges including safety-critical systems, limited downtime tolerance, and coordination between IT SOC, OT engineering, and plant operations teams.

Reviews animation and motion code against a high craft bar derived from Emil Kowalski's design engineering philosophy (see `emil-design-eng`). Default to flagging; approval is earned. Use when reviewing a diff for motion quality — not for writing features, fixing unrelated bugs, or general (non-motion) code review. For building an animation from scratch, use `animate`; for a whole-codebase audit, use `improve-animations`. Source: github.com/emilkowalski/skills.

Drafts a federally-defensible SOW or PWS the prime issues to a subcontractor / teaming partner — same FAR 37.102(d) / 37.602 / 16.601(c)(2) / 16.306(d) discipline a contracting officer applies, opposite seat. USE WHEN the user asks to "write a SOW for our sub", "draft a PWS for [Partner]", "build the teaming-partner statement of work", "convert this SOO into a sub SOW", "we need a SOW the sub will sign", or any variant of authoring a downstream work statement. Walks the upstream 3-phase tree (acquisition intake → 6 scope blocks → 14-section assembly), pulls scope from the active Theseus KG (requirements, deliverables, work_scope_items, performance_standards), enforces FAR 37.102(d) "no FTEs in body", emits a chat-only staffing handoff for the prime's cost build, writes Markdown for `renderers` → .docx. DO NOT USE FOR prime proposal prose (`proposal-generator`), reverse-engineering an RFP (`rfp-reverse-engineer`), pricing the sub (`price-to-win`), or clause audit (`compliance-auditor`).