1---2name: exploit-development3description: Authorized exploit development and vulnerability research skill for lab environments, CTFs, owned software, crash analysis, memory corruption, exploitability assessment, fuzzing results, proof-of-concept design, and remediation. Use for defensive validation and education; avoid real-world weaponization, stealth, persistence, evasion, or unauthorized targets.4---56# Exploit Development78## Authorization Boundary910- Work only on owned code, lab targets, CTFs, or explicitly authorized research.11- Keep proof of concept minimal: demonstrate the bug and impact without persistence, evasion, automated exploitation at scale, or post-exploitation.12- Prefer root-cause analysis, exploitability classification, mitigations, and regression tests.1314## Workflow15161. Establish target version, build flags, architecture, mitigations, input vector, and crash artifact.172. Reproduce deterministically in an isolated lab with symbols and sanitizer output when possible.183. Triage root cause: bounds, lifetime, type confusion, race, injection, logic flaw, or unsafe parser behavior.194. Assess exploitability at a high level: control of instruction pointer, write primitive, info leak, sandbox, and mitigations.205. Provide a safe PoC or pseudocode only as needed to validate impact, then produce patch guidance and tests.2122## Defensive Outputs2324- Crash summary with environment and reproduction constraints.25- Root-cause explanation tied to source or disassembly.26- Severity rationale and affected versions.27- Patch strategy, hardening recommendations, and regression/fuzz tests.28
Masriyan