Profile My skills Saved Collections Edit profile Submit a skill

← all publishers

hypnguyen1209

@hypnguyen1209 source repo

31 published skills

  1. ▌
    Plan · hypnguyen1209
    Use when work needs a written plan before code, when a request spans more than one file or subsystem, or the user says plan, design the approach, or how should we do this. Produces an evidence-backed implementation plan with testable acceptance criteria. Part of codex-goat.
    0
    installs
  2. ▌
    Team · hypnguyen1209
    Use when a task has 2 or more genuinely independent workstreams, or the user says in parallel, split this up, or run these at the same time. Splits work into independent lanes, runs them concurrently, and merges the results with per-lane evidence. Part of codex-goat.
    0
    installs
  3. ▌
    Clarify · hypnguyen1209
    Use when a request is vague, could mean several different things, or the user says help me think this through or I am not sure what I want yet. Resolves an ambiguous request into frozen, execution-ready requirements by asking only the questions the codebase cannot answer. Part of codex-goat.
    0
    installs
  4. ▌
    Ultraqa · hypnguyen1209
    Use when behavior must be proven by execution rather than reading, before a release, or the user says test this properly, QA it, or make sure it actually works. Adversarial end-to-end QA that runs the real thing against hostile scenarios, then fixes what breaks and cleans up. Part of codex-goat.
    0
    installs
  5. ▌
    Ultragoal · hypnguyen1209
    Use for multi-step implementation work, when a task must be finished across several turns, or the user says execute this, ship it, finish the plan, or work until done. Executes an objective to completion as durable goals with checkpointed evidence, surviving compaction and session restarts. Part of codex-goat.
    0
    installs
  6. ▌
    Goat Roles · hypnguyen1209
    Use when a task needs one specific expert lens rather than a full workflow stage. Specialist role cards (planner, executor, verifier, reviewer, security-reviewer, test-engineer, architect, critic, researcher) to adopt for focused sub-tasks. Part of codex-goat.
    0
    installs
  7. ▌
    Code Review · hypnguyen1209
    Use when the user says review this, check my changes, look at this PR or diff, or before merging. Reviews a concrete change across correctness, security, performance, and test coverage, then adversarially verifies each finding before reporting it. Part of codex-goat.
    0
    installs
  8. ▌
    Goat Workflow · hypnguyen1209
    Use when unsure whether to plan, execute, review, or QA, or the user asks what should we do next. Chooses which codex-goat stage fits the current request and checks whether it can start right now. Part of codex-goat.
    0
    installs
  9. ▌
    Network Attack · hypnguyen1209 bundle
    Use when attacking a network or moving laterally — L2/L3 poisoning (LLMNR/mDNS, ARP/DHCP, mitm6), coercion + NTLM relay (CVE-2025-33073), TUN pivoting (Ligolo-ng/Chisel), MitM, network-service RCE (CVE-2024-38077), WPA2/WPA3 wireless
    1
    install
  10. ▌
    Threat Hunting · hypnguyen1209 bundle
    Use when hunting threats or engineering detections — ATT&CK Detection-Strategies, Sigma + correlation with Detection-as-Code CI, Windows endpoint hunting (Sysmon/ETW/LSASS/LOLBins), network C2 hunting (JA4+, beaconing, DNS tunneling), cloud-identity hunting, Atomic Red Team purple-team validation
    1
    install
  11. ▌
    Crypto Analysis · hypnguyen1209 bundle
    Use when assessing cryptography — TLS/PKI auditing, RSA/ECC key attacks, ECDSA nonce lattice recovery, symmetric/AEAD misuse, JWT/JOSE forgery, hash cracking, post-quantum migration review
    1
    install
  12. ▌
    Privesc Windows · hypnguyen1209 bundle
    Use when escalating privileges on a Windows host — SeImpersonate Potato chains (GodPotato/PrintNotifyPotato), service & DLL hijacking, UAC bypass (fodhelper/ICMLuaUtil), kernel EoP + BYOVD (CVE-2025-29824), token-rights abuse, LSASS/SAM/DPAPI credential harvesting
    1
    install
  13. ▌
    Malware Analysis · hypnguyen1209 bundle
    Use when reverse-engineering or detecting malware — static triage + capa/YARA-X, emulation/DBI/.NET unpacking, dynamic/fileless/Volatility 3 memory analysis, C2 config extraction (Cobalt Strike/CAPE), C2 traffic detection (JA4+, beaconing)
    1
    install
  14. ▌
    Incident Response · hypnguyen1209 bundle
    Use when responding to or forensically investigating an incident — triage acquisition (Velociraptor/KAPE), Volatility 3 memory forensics, Chainsaw/Hayabusa EVTX timelining, anti-forensics detection, cloud IR, ransomware/ESXi response
    1
    install
  15. ▌
    Finding Discipline · hypnguyen1209
    Use when about to record, claim, rate the severity of, or report any security finding — before marking anything [CONFIRMED] or writing it into the report
    1
    install
  16. ▌
    Windows Boundaries · hypnguyen1209 bundle
    Use when crossing a Windows security boundary or escaping a sandbox — kernel/user crossing (win32k/dxgkrnl UAF CVE-2025-24983), BYOVD kernel R/W, UAC/COM elevation, AppContainer/LPAC & Chromium-Mojo sandbox escape (CVE-2025-2783), PPL bypass, RPC/ALPC & named-pipe impersonation
    1
    install
  17. ▌
    Exploit Development · hypnguyen1209 bundle
    Use when turning a memory-corruption bug into a working PoC — stack/ROP, glibc heap & FSOP, format strings, browser/JIT type confusion & UAF, Linux/Windows kernel LPE against ASLR/DEP/CFG/CET/V8-Sandbox
    1
    install
  18. ▌
    Reverse Engineering · hypnguyen1209 bundle
    Use when reverse-engineering a binary or firmware — static triage + decompilation (Ghidra/IDA/Binary Ninja), dynamic instrumentation (GDB/Frida 17/angr), anti-reversing & packer bypass, OLLVM/VM deobfuscation, UEFI/BIOS RE & Secure Boot research, patch-diffing for n-days
    1
    install
  19. ▌
    Windows Mitigations Bypass · hypnguyen1209 bundle
    Use when bypassing a Windows exploit/platform mitigation — ASLR/DEP/CFG/XFG/CET, ACG/CIG, WDAC/App Control, ASR/AMSI/ETW, PPL/LSA Protection, BYOVD/VBS/HVCI
    1
    install
  20. ▌
    Browser Exploitation · hypnguyen1209 bundle
    Use when building a client-side browser exploit — V8/JSC JIT type confusion to renderer R/W, V8 heap-sandbox escape, renderer-to-browser sandbox escape (Mojo IPC, GPU/Dawn/ANGLE), Electron/webview IPC abuse, 1-click RCE chains
    1
    install
  21. ▌
    Using Offensive Claude · hypnguyen1209
    Use when starting any offensive-security engagement or task — establishes how to find and invoke the right skill before any action (including clarifying questions, recon, exploitation, or reporting)
    1
    install
  22. ▌
    Vulnerability Analysis · hypnguyen1209 bundle
    Use when auditing source code for vulnerabilities — drive CodeQL/Semgrep/Joern to taint untrusted data source-to-sink across injection, memory safety, deserialization/prototype-pollution, secrets/crypto/authz/race, and supply-chain risks
    1
    install
  23. ▌
    Active Directory Attack · hypnguyen1209 bundle
    Use when attacking a Windows Active Directory domain — Kerberos roasting/delegation, coercion + NTLM/Kerberos relay (CVE-2025-33073), ADCS ESC1-16 (EKUwu), ticket forgery & DCSync, dMSA BadSuccessor (CVE-2025-53779), BloodHound attack-path enumeration, domain dominance
    1
    install
  24. ▌
    Edr Evasion · hypnguyen1209
    Use when bypassing EDR/AV to run a payload — hook unhooking, direct/indirect syscalls, PPID spoofing, process injection, AMSI bypass, ETW patching, memory/sleep encryption, behavioral evasion
    1
    install
  25. ▌
    Recon Osint · hypnguyen1209 bundle
    Use when mapping a target's external attack surface or gathering OSINT — subdomain enumeration, attack-surface mapping (httpx/katana/JS secrets), subdomain takeover, multi-cloud/Azure tenant recon, GitHub secret dorking, breach/infostealer credential intel, CVE prioritization (EPSS/KEV)
    1
    install
  26. ▌
    Red Team Ops · hypnguyen1209
    Use when running a full red-team engagement end-to-end — initial access, persistence, privilege escalation, defense evasion, C2 infrastructure, EDR bypass, living-off-the-land
    1
    install
  27. ▌
    Shellcode Dev · hypnguyen1209
    Use when writing position-independent shellcode or a loader — PEB walking, API hashing, null-byte avoidance, encoders, loaders, PE-to-shellcode conversion, cross-platform shellcode
    1
    install
  28. ▌
    Cloud Security · hypnguyen1209 bundle
    Use when attacking AWS/Azure/GCP cloud — IAM/identity privilege escalation, IMDS/metadata SSRF, Entra device-code & PRT theft, GCP impersonation chains, Kubernetes/container escape, IaC/CI-CD federation abuse
    1
    install
  29. ▌
    Coding Mastery · hypnguyen1209 bundle
    Use when writing security tooling, exploits, scanners, or C2 in Python/C/Go/Rust/ASM — systems & network programming, automation, cryptography implementation
    1
    install
  30. ▌
    Initial Access · hypnguyen1209
    Use when gaining initial access to a target — phishing, payload delivery, HTML smuggling, ISO/IMG/MOTW bypass, supply-chain, credential stuffing, exposed-service exploitation
    1
    install
  31. ▌
    Mobile Pentest · hypnguyen1209 bundle
    Use when pentesting an Android/iOS app — Frida 17 instrumentation, SSL-pinning & root/jailbreak bypass, Android 14/15 CA injection, exported-component/content-provider abuse, deep-link/WebView chains, biometric bypass, Flutter/React-Native RE
    1
    install