Results for “shellcode-analysis”

Builds and queries multi-language source code graphs for security analysis, including blast radius, taint propagation, privilege boundaries, and entry point enumeration.

Refactoring Analyst

Analyze a codebase to produce an interactive knowledge graph for understanding architecture, components, and relationships

Analyzes codebases to understand existing features, tracing entry points, execution paths, architecture layers, patterns, and dependencies before new development.

Imported skill shell from langchain

Diagnoses a reported bug, error, test failure, or unexpected behavior through a 4-phase root-cause analysis before any code changes.

Evaluates code generation models across HumanEval, MBPP, MultiPL-E, and 15+ benchmarks with pass@k metrics. Use when benchmarking code models, comparing coding abilities, testing multi-language support, or measuring code generation quality.

Scans codebases for security vulnerabilities by reasoning about code context, data flow, and component interactions, covering injection flaws, secrets exposure, authentication issues, and weak cryptography across multiple languages.

Runs a Trailmark summary analysis on a codebase to auto-detect languages, count entry points, and list dependencies.

Reviews local branch changes for bugs, security vulnerabilities, and code quality issues using a structured checklist and attack surface mapping.

Conducts systematic security code reviews to identify exploitable vulnerabilities, reporting only high-confidence findings after researching the codebase.

Analyzes malware command-and-control (C2) communication protocols to understand beacon patterns, command structures, data encoding, and infrastructure for detection development and threat intelligence.

Language-specific super-code guidelines for bash.

Detect and analyze heap spray attacks in memory dumps using Volatility3 plugins to identify NOP sled patterns, shellcode landing zones, and suspicious large allocations in process virtual address space.

Performs deep architectural analysis of a specified module, directory, or feature area by examining structural coupling, data flow, concurrency patterns, risk, and SOLID alignment. Use when the user wants to assess, evaluate, or review the architecture, design quality, dependency structure, coupling, cohesion, or technical debt of an existing part of the codebase. Not for investigating specific bugs, runtime errors, or failures — use investigate. Not for test planning — use automated-test-planning. Not for file-level code review — use code-review. Not for researching open-ended options, prior art, or how something works — use research. Not for designing a new interface or contract — use design-an-api. Not for writing documentation or architectural decision records.

Analyze PLC firmware for security vulnerabilities including hardcoded credentials, insecure updates, backdoors, memory corruption, and undocumented debug interfaces using static and dynamic analysis techniques.

Analyze a codebase with specialized agents and propose refactoring tickets.

Systematically deobfuscate multi-layer PowerShell malware using AST analysis, dynamic tracing, and tools like PSDecode and PowerDecode to reveal hidden payloads and C2 infrastructure.

Detect and analyze Linux persistence mechanisms including crontab entries, systemd service units, LD_PRELOAD hijacking, bashrc modifications, and authorized_keys backdoors using auditd and file integrity monitoring.

Scans a codebase for Martin Fowler's catalog of code smells, reporting each with location, severity, and refactoring recommendations, and ranks files to build a prioritized refactoring queue.

Scans a codebase for deepening opportunities, presents them as a visual HTML report, then grills through the chosen one. Use when the user wants to improve codebase architecture or find refactoring opportunities.

Reverse shell generation and listener management. Generates platform-specific reverse shell payloads (bash, python, php, powershell, java, ruby, perl, netcat, socat, msfvenom) and sets up listeners in the Kali container. Supports one-liner generation, encoded payloads for WAF/filter bypass, listener setup with session capture, and shell stabilization. Chains from /pentester, /metasploit, or /post-exploit when command execution is confirmed.

CVE Vulnerability Analysis Workflow

对一个软件项目或源码仓库进行全面调研，输出一份结构化的中文调研报告，让对项目不熟悉的人能够同时理解"它做什么"和"它怎么实现"。当用户说"调研这个项目 / 分析这个代码库 / 给我一份项目分析报告 / 我要全面理解这个项目 / 帮我看看这个仓库 / onboarding 一下 / 这个项目的整体架构是什么 / 给我梳理下这个源码"等等，或者把一个不熟悉的代码目录交给你并希望你给出全局认识时，必须使用本 skill。即使用户没有显式说"调研报告"，只要意图是"帮我搞懂一个完整的代码库 / 项目"，就应当触发。但本 skill 仅针对"全局理解 / 架构调研 / onboarding"场景：若用户只是要做 code review、定位某个 bug、评审某处具体实现、做性能或安全诊断，不要触发本 skill。

Evaluates code generation models across HumanEval, MBPP, MultiPL-E, and 15+ benchmarks with pass@k metrics. Use when benchmarking code models, comparing coding abilities, testing multi-language support, or measuring code generation quality. Industry standard from BigCode Project used by HuggingFace leaderboards.

Analyze Windows Shellbag registry artifacts to reconstruct folder browsing activity, detect access to removable media and network shares, and establish user interaction with directories even after deletion using SBECmd and ShellBags Explorer.

Parse Windows PowerShell Script Block Logs (Event ID 4104) from EVTX files to detect obfuscated commands, encoded payloads, and living-off-the-land techniques.

Performs a white-box source code security review structured around OWASP ASVS 5.0, mapping attack surfaces, tracing data flows, and chaining into downstream penetration testing and threat modeling skills.

Code quality dashboard. Wraps existing project tools (type checker, linter, test runner, dead code detector, shell linter), computes a weighted composite 0-10 score, and tracks trends over time. Use when: "health check", "code quality", "how healthy is the codebase", "run all checks", "quality score". (gstack)

Use this when designing scripts or small tools for automation, maintenance, CI tasks, file manipulation, config generation, or local workflow support across shell, Python, or mixed environments.

当用户想测试或复盘某个 skill 的实际执行效果时使用——如“测一下这个 skill”“看看 agent 是否按 skill 执行”“生成 skill 覆盖率或溯源报告”。在隔离沙箱中发起一次 headless 盲测，逐步骤溯源并产出中文复盘报告。不要用于编写新 skill、调试业务代码、代码审查，或复盘当前会话已经发生的执行。

Convention audit and pre-PR code review for Sage/Acorn projects — checks PHP Blade JS CSS against Sage/Acorn/Tailwind v4 conventions; audits ACF Composer field patterns, Livewire component structure, Eloquent models, Acorn routes, Blade components; verifies design alignment; dispatches sage-reviewer agent; prepares code for PR merge. Invoke for: "review before PR", "run sage-reviewer", "convention audit", "/reviewing", "check my block for issues", "pre-merge review", "review this code". Skip when: you just need to read or understand a file — that is not a review session.

Analyzes malware-generated network traffic from PCAP files to identify C2 protocols, data exfiltration, DNS tunneling, and beaconing patterns using Wireshark, Zeek, Suricata, and Python.

Reviews CUDA, OpenMP, and OpenCL code for parallel correctness, covering data races, memory model violations, synchronization bugs, numerical precision issues, and API-specific pitfalls.

Provides a structured code review checklist covering security, performance, correctness, maintainability, testing, accessibility, and documentation, with a three-pass review process and guidance on severity levels and anti-patterns.