netvar1337
- 736 skills
- 0 followers
- 1 day ago last updated
- ▌ Router Reverse Skill Router Browser Extension Reverse · netvar1337 bundleUse for authorized reverse engineering of browser extensions (Chrome/Firefox) including manifest analysis, background workers, and extension-based credential or traffic logic recovery.
- ▌ Claude Red Fuzzing Offensive Bug Identification · netvar1337 bundleSystematic bug identification methodology: source code review patterns, black-box testing strategies, taint analysis, dangerous function hunting, data flow tracing, and automated scanning setup. Use for code audits, bug bounty triage, or building vulnerability identification pipelines.
- ▌ Claude Red Infrastructure Offensive Edr Evasion · netvar1337 bundleEDR evasion offensive checklist: hook unhooking (user/kernel), direct syscalls, PPID spoofing, process injection variants, AMSI bypass, ETW patching, memory encryption, and behavior-based evasion. Use when planning EDR bypass during red team engagements or researching AV/EDR evasion techniques.
- ▌ Specialized File Analyzer · netvar1337Analyze specialized file types beyond standard PE executables - .NET assemblies, Office macros, PDFs, PowerShell scripts, JavaScript, archives, HTA files, disk images (ISO/IMG/VHD/VHDX), and Linux ELF binaries. Use when you encounter documents, scripts, disk images, or non-Windows executables that require format-specific analysis tools and techniques.
- ▌ Masriyan 02 Vulnerability Scanner · netvar1337 bundleDependency auditing, CVE detection, configuration security review, CVSS scoring, and prioritized vulnerability reporting
- ▌ Claude Red Infrastructure Offensive Initial Access · netvar1337 bundleInitial access techniques checklist: phishing (spear/smishing), credential stuffing, exposed service exploitation, supply chain attacks, watering hole, VPN/RDP brute force, public-facing application exploitation. Maps to MITRE ATT&CK TA0001. Use when planning initial access phases of red team engagements.
- ▌ Claude Red Infrastructure Offensive Keylogger Arch · netvar1337 bundleLow-level keylogger architecture design: kernel driver hooks (WH_KEYBOARD_LL, SetWindowsHookEx), ETW-based input capture, user-mode vs kernel-mode approaches, stealth techniques, and data exfiltration. Use for understanding input capture mechanisms, EDR evasion research, or malware architecture analysis.
- ▌ Claude Red Exploit Dev Offensive Exploit Dev Course · netvar1337 bundleFull exploit development course roadmap and syllabus: weekly topics, recommended reading, lab setup, and learning path from vulnerability classes through advanced exploitation. Use to structure exploit dev training or onboard new researchers.
- ▌ Claude Red Exploit Dev Offensive Exploit Development · netvar1337 bundleExploit development operational guide: environment setup, debugging workflow, PoC development lifecycle, writing reliable exploits, using pwntools/pwndbg, heap exploitation techniques, and weaponization considerations. Use when actively developing exploits or setting up an exploit dev environment.
- ▌ Claude Red Infrastructure Offensive Advanced Redteam · netvar1337 bundlePractical advanced red team operations guide: OPSEC discipline, C2 infrastructure design, living-off-the-land techniques, lateral movement, persistence, data exfiltration, and evading modern defenses. Use for planning advanced red team engagements or understanding APT TTPs.
- ▌ Waf Bypass Methodology · netvar1337 bundleWAF 绕过统一方法论。当漏洞利用 payload 被 WAF 拦截返回 403/406 时使用。覆盖编码绕过、分块传输、HTTP 方法切换、参数污染、Payload 变形等通用绕过技术
- ▌ Enma Lang · netvar1337 bundleEnma language and embedding SDK reference: syntax, types, functions, pointers, classes, inheritance, templates, exceptions, modules, compiler semantics, native type/function registration, safety, and standard addons. Use when writing Enma code or embedding/extending the Enma engine; use perception-api for Perception-specific host functions.
- ▌ Frida Dbi · netvar1337 bundleFrida dynamic binary instrumentation for RE and security research: spawn/attach, Interceptor hooks, NativeFunction, Memory scanning, Stalker tracing, gadget modes, anti-anti-debug bypass patterns, il2cpp/mono bridges for games, OPSEC of frida-server, and reliability discipline for long sessions. Local stack: frida 17.17.0 + frida-tools 14.10.4 via pip.
- ▌ Radio Sdr · netvar1337 bundleUse for authorized RF/SDR security research including signal identification, replay feasibility study in shielded labs, and wireless protocol analysis outside classic Wi-Fi.
- ▌ Re Source · netvar1337 bundleRecursive bottom-up annotation of a radare2 binary via r2xsql — walk from strings/imports up through callers, naming and commenting each layer until the binary reads like source. Use for reverse engineering campaigns that span multiple sessions.
- ▌ Wayfinder · netvar1337 bundlePlan a huge chunk of work (more than one agent session can hold) as a shared map of decision tickets on your issue tracker, and resolve them one at a time until the way to the destination is clear.
- ▌ Agent Eval · netvar1337 bundleUse when grading an agent session, transcript, skill, or workflow for execution quality. Score routing, tool use, verification, and report honesty, then propose the smallest instruction change that would have prevented each miss.
- ▌ Aifollowup · netvar1337When planning tasks or reviewing code is important to extend the reasoning of the unstaged changes, commits in the current non-master branch and todo roadmap of the ongoing work.
- ▌ Code Audit · netvar1337 bundleUse for authorized source-code security review and SAST workflows including Semgrep, CodeQL patterns, dangerous API hunting, and fix verification.
- ▌ Kernel Dev · netvar1337Use when designing, writing, reviewing, debugging, or hardening Windows WDM/KMDF drivers, IRP and IOCTL paths, PnP/power lifecycles, queues, cancellation, kernel memory, callbacks, or version-pinned ring-0 research. Covers WDK, HVCI, Driver Verifier, KD triage, manual mapping, APC/VAD/DKOM research, and safe teardown; route BYOVD to byovd and user-mode exploitation to exploit-dev.
- ▌ Skill Sync · netvar1337 bundleUse when installing, copying, or checking local skills across agent harnesses. Treat ~/.agents/skills as the source of truth, sync selected skill directories to the target loader, and verify SKILL.md is discoverable.
- ▌ Src Hunter · netvar1337 bundlePractical SRC / crowdsource testing / bug bounty vulnerability hunting workflow skill. Includes: 5-phase methodology (intake → recon → enum → hunt → report), 19 attack-class playbooks (SQLi/XSS/RCE/SSRF/IDOR/CSRF/Path Traversal/File Upload/SSTI/XXE/Race/HTTP Smuggling/OAuth/JWT/SAML/GraphQL/Mobile/LLM/DoS), 305 structured payloads, 263 WAF/EDR bypass variants, 2,887 real disclosed High/Critical HackerOne cases, 77,000+ WooYun case statistics, a Chinese-domestic OA / middleware fingerprint library, and banking / telecom industry-vertical playbooks. Triggers when the user mentions 'SRC hunting / SRC vulnerability hunting / bug bounty / crowdsource testing / hackerone / bug bounty / SRC / arbitrary X vulnerability / penetration testing' or asks 'how to hunt a target / how to test an API / how to bypass a WAF'.
- ▌ To Tickets · netvar1337 bundleBreak a plan, spec, or the current conversation into a set of tracer-bullet tickets, each declaring its blocking edges, published to the configured tracker (edges as text in one file per ticket locally, or native blocking links on a real tracker).
- ▌ Vuln Intel · netvar1337 bundleVulnerability intelligence & 0day-adjacent research workflow: CVE tracking, N-day analysis, patch-tuesday triage, exploit-publication monitoring (GitHub / NVD / vendor advisories / ZDI bulletins), and variant-hunting from public disclosures. Use when the operator asks to track or research a CVE, evaluate a fresh disclosure, scan a new patch for exploitability, or monitor for emerging 0day/N-day leads.
- ▌ Windbg Ttd · netvar1337 bundleWinDbg workflows for RE and driver research: KDNET kernel debugging setup, symbol discipline, crash-dump triage (!analyze, bugcheck semantics incl. PatchGuard 0x109), driver debugging (breakpoints on load, IRP/device trees), live kernel inspection, TTD (Time Travel Debugging) when WinDbgX is available, and cdb automation. Local: classic suite at Windows Kits\10\Debuggers\x64 (windbg/cdb/kd/ntsd).
- ▌ Case Review · netvar1337 bundleReviews a reverse-skill case package for scope readiness, Evidence to Finding to Path traceability, work item coverage, timeline references, and optional artifact hash integrity before report handoff.
- ▌ Ctf Sandbox · netvar1337 bundleThin PRIMARY for CTF / AWD / range multi-type orchestration. Hands off to the sidecar CTF-Sandbox-Orchestrator. Use when the user says CTF, AWD, range, or competition task and no more specific pwn/APK/IDA route already won.
- ▌ Exploit Dev · netvar1337Use when converting a known crash, UAF, overflow, type confusion, race, or logic flaw into a measured exploit primitive, leak, heap strategy, mitigation-aware PoC, ROP/JOP or shellcode chain, local privilege escalation, and deterministic reliability harness. Routes allocator- and platform-specific work without conflating Windows user mode, Windows kernel, glibc, or Linux kernel; do not use for driver authoring, BYOVD, or multi-host orchestration.
- ▌ Find Skills · netvar1337Use when the user wants to discover/install skills or asks 'is there a skill for X'. Also checks ~/.agents/skills-archive/.
- ▌ Plouton Smm · netvar1337 bundleUse when building or extending a Plouton-class SMM (ring -2) game or memory framework: EDK2 SMM module, XHCI SMI on USB, Windows physical memory walk, SPI firmware implant, or PiSmmCpuDxeSmm page-table patch.
- ▌ R2mcp Basic · netvar1337 bundleUse the bundled r2mcp MCP server for binary analysis, disassembly, and reverse-engineering tasks.
- ▌ R2xsql Data · netvar1337 bundleQuery radare2 data and memory — bytes, defined data, byte patterns, assembling/demangling a mnemonic or symbol name, strings, imports, entry points, relocations, linked libraries, and binary metadata — via r2xsql.
- ▌ R2xsql Grep · netvar1337 bundleSearch radare2 named entities by pattern via r2xsql. Use to find functions, flags, imports, exports, sections, or comments matching a name pattern across all kinds in a single query, or via the `entities` view (r2xsql's own kind vocabulary, not a family-ratified one) for a filter-only, non-pattern lookup.
- ▌ Ags Overview · netvar1337 bundleGuide for understanding and contributing to the awesome-game-security curated resource list. Use this skill when adding new resources, organizing categories, mapping topics across anti-cheat, Windows kernel, DMA, reverse engineering, and game-engine research, or maintaining README.md format consistency.
- ▌ Exploitation · netvar1337 bundleSearch for ROP/JOP/COP gadgets in a binary via r2xsql's rop_gadgets and rop_gadget_instructions tables, and look up syscall names/numbers via the syscalls reference table. Use when building an exploit chain, hunting for stack-pivot/syscall/write-what-where primitives, resolving a target's syscall table, or answering 'what gadgets are available here'.
- ▌ External Esp · netvar1337Use when building or validating an external game telemetry overlay (ESP): read a separate process, recover build-pinned entity/camera data, transform world coordinates through a verified view-projection matrix, and render the result in an external HWND. Routes offset recovery and overlay implementation to their specialist skills.
- ▌ Game Hacking · netvar1337Use for authorized game security research involving Unreal, Unity, Source, or custom-engine reverse engineering, build-pinned offsets, external/internal instrumentation, overlays, speed/time virtualization, client-server protocol and logic exploits, reconciliation or rollback trust, cheat telemetry, and anti-cheat experiments. Routes offset dumping, protocol RE, exploit development, and detection validation to the correct specialist.
- ▌ Prompt Forge · netvar1337 bundleUse when writing, rewriting, or stress-testing prompts, work orders, or skill trigger text. Convert vague requests into a tight objective-target-constraints-proof prompt and keep only variants that change agent behavior.
- ▌ R2xsql Xrefs · netvar1337 bundleAnalyze radare2 cross-references via r2xsql — callers, callees, data references, jump targets. Use when asked who calls a function, what a function calls, or what code touches a string/import.
- ▌ Reva Ctf Pwn · netvar1337 bundleSolve CTF binary exploitation challenges by discovering and exploiting memory corruption vulnerabilities to read flags. Use for buffer overflows, format strings, heap exploits, ROP challenges, or any pwn/exploitation task.
- ▌ Reva Ctf Rev · netvar1337 bundleSolve CTF reverse engineering challenges using systematic analysis to find flags, keys, or passwords. Use for crackmes, binary bombs, key validators, obfuscated code, algorithm recovery, or any challenge requiring program comprehension to extract hidden information.
- ▌ Tailnet Mesh · netvar1337 bundleUse when connecting over SSH or RDP to any node on the NetVar1337 tailnet (laptop, desktop, work, vps, macbook, phone), or when diagnosing that mesh.
- ▌ Thick Client · netvar1337 bundleUse for authorized security testing of desktop thick clients including local storage, update channels, IPC, traffic, and client-side trust boundaries.
- ▌ C2 Tradecraft · netvar1337 bundleC2 / command-and-control tradecraft for authorized red-team and adversary-simulation work: implant-beacon architectures, C2 protocol design, listener/redirector setup, OPSEC-aware egress, and evasion vs EDR/network detection. Use when the operator asks to stand up or extend C2 infrastructure, deploy or debug beacons/implants, design C2 channels (DNS/HTTPS/websocket/ICMP), or tune detection evasion for C2 traffic.
- ▌ Eac Ban Stack · netvar1337 bundleEAC/EasyAntiCheat ban-stack research: HWID serials, server-side trust, usermode telemetry, kernel driver signals, FN-class ban discussions.
- ▌ Ida Re Triage · netvar1337 bundleUse when triaging an authorized binary/driver/firmware/dump/IDB for RE or vuln research.
- ▌ Macos Reverse · netvar1337 bundleUse for authorized macOS and Mach-O reverse engineering including codesign, Objective-C/Swift recovery, endpoint security surfaces, and Apple platform malware analysis.
- ▌ Pcx Scripting · netvar1337 bundlePCX (Perception.cx) scripting with Enma and AngelScript for game interaction, memory manipulation, rendering, GUI, and automation. Full API reference for Enma proc/render/input/GUI/net/unicorn/zydis/win/sound APIs. Invoke with /pcx-scripting or when the task involves Perception.cx scripting.
- ▌ Skill Curator · netvar1337 bundleUse when adding, improving, consolidating, or evaluating agent skills and their Markdown references. Find real workflow gaps, avoid duplicate skills, write trigger-precise SKILL.md files, and validate each skill as an executable instruction surface.
- ▌ Vuln Research · netvar1337 bundle0-day vulnerability discovery workflow. Covers fuzzing strategies, variant analysis, static analysis for bug classes, attack surface mapping, PoC development, and responsible triage. Invoke with /vuln-research or when the task involves finding new vulnerabilities.
- ▌ Web3 Security · netvar1337Audit smart contracts, analyze Web3 protocols, reproduce security flaws on local forks, investigate transaction behavior, and develop proof-of-concept exploit paths. Use for Solidity, EVM, DeFi, bridge, wallet, signing, MEV, and on-chain security tasks.
- ▌ Writing Beats · netvar1337 bundleWriting, exploit; assemble raw material into a journey of beats, grounding each term before a beat leans on it.
- ▌ Writing Shape · netvar1337 bundleWriting, exploit: shape raw material into an article, paragraph by paragraph.
- ▌ Ags Anti Cheat · netvar1337 bundleGuide for modern game anti-cheat architecture, Windows kernel monitoring, and detection tradeoffs. Use this skill when analyzing EAC, BattlEye, Vanguard, FACEIT AC, kernel callbacks, handle protection, manual-map detection, boot-start drivers, BYOVD, DMA threats, or behavioral telemetry in game security research.
- ▌ Ags Dma Attack · netvar1337 bundleGuide for PCIe DMA threat modeling, FPGA-based memory access, and defensive implications in game security. Use this skill when researching pcileech, BAR and TLP behavior, page-table walking, IOMMU or VT-d, device impersonation, firmware mimicry, or DMA detection and mitigation in game security research.
- ▌ Claude Handoff · netvar1337 bundleHand the current conversation off to a fresh background agent that picks up the work immediately.
- ▌ Dsl Vm Reverse · netvar1337 bundleReverse JavaScript-based custom DSL/VM interpreters, non-standard WASM-like runtimes, and risk-control engines. Use when analyzing IIFE or switch-based opcode dispatchers, extracting instruction tables, recovering bytecode semantics, capturing VM state at runtime, or reconstructing execution flow.
- ▌ Ebpf Offensive · netvar1337 bundleUse when auditing or exploiting Linux eBPF verifier and JIT behavior, building CO-RE/libbpf research probes, exercising maps and ring buffers, attaching kprobe, fentry, LSM, cgroup, tc, or XDP programs, evaluating unprivileged BPF exposure, or enumerating and removing hidden BPF state.
- ▌ Email Security · netvar1337 bundleUse for authorized email security review including phishing analysis, header authentication (SPF/DKIM/DMARC), BEC patterns, and mailbox token abuse research.
- ▌ Game Internals · netvar1337Game internals RE: engines (UE/Unity/Source), entity systems, networking ticks, prediction, rendering data, asset formats.
- ▌ Ghidra Reverse · netvar1337 bundleUse for free/open reverse engineering with Ghidra (headless or GUI), including decompile, cross-refs, and optional Ghidra MCP workflows when IDA is unavailable.
- ▌ Hypervisor Dev · netvar1337 bundleHypervisor development workflow for Intel VT-x/AMD-V hypervisors with EPT hooks, VMCS manipulation, VMEXIT filtering, and stealth. Invoke with /hypervisor-dev or when the task involves hypervisor or EPT development.
- ▌ Mobile Reverse · netvar1337 bundleUse for authorized Android or iOS application reverse engineering and security testing, including APK or IPA analysis, runtime instrumentation, SSL pinning, and platform protection checks.
- ▌ Perception API · netvar1337 bundlePerception.cx's Enma host API for script lifecycle, process memory, rendering, GUI, input, networking, sound, Windows automation, Unicorn, Zydis, CPU helpers, and MCP. Use when writing, reviewing, or debugging scripts that call APIs registered by Perception; not for Enma language syntax itself.
- ▌ Ponytail Audit · netvar1337 bundleUse for whole-repo over-engineering audit ('audit for over-engineering', /ponytail-audit). Report only.
- ▌ R2xsql Connect · netvar1337 bundleConnect to radare2 sessions via r2xsql and bootstrap analysis. Use when starting a new SQL session, routing to other skills, or setting up CLI/HTTP/MCP connections.
- ▌ Ring 1 Bootkit · netvar1337 bundleUse when reversing or detecting a Ring-1.io-class bootkit cheat: bootmgfw implant, Hyper-V SLAT/MTF hooks, cloned game page tables, EPT-hidden inject, or the Aftermath Labs ring-1.io corpus and 2026 writeup.
- ▌ Core Threat Hunting · netvar1337 bundleUse for blue-team threat hunting, detection engineering with Sigma/YARA, SIEM query design, and incident detection validation.
- ▌ Ags Game Engine · netvar1337 bundleGuide for game-engine internals, source trees, plugins, and engine-specific security research. Use this skill when researching Unreal, Unity, Source, Godot, custom engines, engine detectors, engine explorers, or engine protection patterns relevant to modding, reverse engineering, and anti-cheat.
- ▌ Go Rust Reverse · netvar1337 bundleUse for reverse engineering stripped Go and Rust binaries including runtime recognition, pclntab/moduel data recovery, panic strings, and idiomatic decompilation recovery.
- ▌ R2xsql Analysis · netvar1337 bundleTriage and audit radare2 binaries via r2xsql — find suspicious behavior, surface crypto/network/persistence APIs, hunt high-complexity functions, and run multi-table queries that combine code, data, and xrefs.
- ▌ Reva Ctf Crypto · netvar1337 bundleSolve CTF cryptography challenges by identifying, analyzing, and exploiting weak crypto implementations in binaries to extract keys or decrypt data. Use for custom ciphers, weak crypto, key extraction, or algorithm identification.
- ▌ Vps Ssh Control · netvar1337 bundleConnect to and administer the user's VPS at root@153.92.1.5 over SSH. Use for running commands, inspecting services, managing files, or troubleshooting this specific Linux server.
- ▌ Ags Game Hacking · netvar1337 bundleGuide for game-hacking technique taxonomy and threat modeling relevant to game security. Use this skill when researching memory access, code injection, overlays, input simulation, engine-specific attack surfaces, or how modern anti-cheat systems constrain user-mode, kernel-mode, hypervisor, and DMA-based cheat implementations.
- ▌ Ags Graphics API · netvar1337 bundleGuide for graphics API interception, overlay rendering, and render-pipeline analysis across DirectX, OpenGL, and Vulkan. Use this skill when working with Present or SwapBuffers hooks, DXGI swap chains, shader or draw-call interception, screenshot-sensitive overlays, or graphics debugging in game security research.
- ▌ Memory Forensics · netvar1337 bundleMemory-forensics ops for authorized IR/vuln work: volatile memory acquisition, Volatility 2/3 profile and plugin triage, process/network/hook extraction, and tying findings back to root cause. Use when analyzing a RAM dump, .mem/.dmp/.lime file, hibernation file, pagefile, or Volatility question, or when digital-forensics routes memory-dump triage here.
- ▌ Protocol Reverse · netvar1337 bundleUse for authorized reverse engineering of custom binary protocols, Protobuf/gRPC, WebSocket frames, and PCAP-driven protocol recovery.
- ▌ R2xsql Functions · netvar1337 bundleReference for the SQL helper functions and SQLite built-ins available in r2xsql queries — string utilities, hex/int coercion, regex. Use when looking up how to format addresses, search by pattern, or coerce between numeric/text columns.
- ▌ To Questionnaire · netvar1337 bundleTurn a decision you can't fully answer into a questionnaire for someone else to fill in.
- ▌ Aimbot Triggerbot · netvar1337 bundleAimbot + triggerbot logic: target selection, visibility, fire timing, recoil control hooks, config architecture.
- ▌ Bluepill Type2 Hv · netvar1337 bundleUse when building or debugging a Xeroxz/CR3Swapper Bluepill-class type-2 Intel hypervisor: host-owned GDT/TSS/IDT, self-referencing PML4 PTE map, VMX-root SEH, VDM physical R/W, or VMCS invalid-guest-state / control-error #7 bring-up.
- ▌ Database Security · netvar1337 bundleUse for authorized database security assessment covering PostgreSQL/MySQL/MSSQL/Mongo/Redis exposure, authz, UDF/command paths, and misconfiguration review.
- ▌ Diagram Generator · netvar1337 bundlegenerate, refine, validate, and render diagrams from natural language, notes, code snippets, schemas, tables, or existing diagram source. use for flowcharts, swimlanes, sequence diagrams, state diagrams, er diagrams, class diagrams, architecture/c4-style diagrams, dependency graphs, gantt charts, mind maps, user journeys, sankey-style flows, org charts, network graphs, and other visual models. supports mermaid by default, graphviz dot for complex graph layout, plantuml for uml-heavy engineering diagrams, and svg output when direct markup is more reliable.
- ▌ Digital Forensics · netvar1337 bundleUse for authorized digital forensics including memory dumps, disk timelines, PCAP investigation, artifact triage, and IR evidence preservation.
- ▌ Hardware Security · netvar1337 bundleUse for authorized hardware and embedded interface security research including UART/JTAG discovery, debug pad triage, secure boot overview, and offline firmware extraction support.
- ▌ Core Heap Exploitation · netvar1337 bundleHeap exploitation playbook: freelist poisoning, tcache/safe-linking, UAF, double-free, house-of-*, Windows segment heap primitives.
- ▌ Hyper V Offensive · netvar1337 bundleUse when auditing, reverse engineering, fuzzing, or triaging Hyper-V partitions, hypercalls, synthetic MSRs, SynIC, VMBus channels, VSP/VSC devices, vmwp.exe, vmcompute.exe, Host Compute Service, saved state, enlightened I/O, nested virtualization, root-partition boundaries, or Hyper-V escape research.
- ▌ Microsoft Foundry · netvar1337 bundleBuild, deploy, evaluate, optimize, fine-tune, and manage Microsoft Foundry agents, models, and resources end to end with azd. USE FOR: azd ai agent, azd provision/deploy, hosted agent scaffold/develop/run/deploy, prompt agent create, create agent, update agent, add tool to agent, invoke agent, agent.yaml, evaluate agent, batch eval, continuous eval, continuous monitoring, agent CI/CD, optimize prompt, improve prompt, prompt optimizer, optimize agent instructions, Agent Optimizer scaffold, dataset curation from traces, deploy model, model fine-tuning (SFT/DPO/RFT), Foundry project, RBAC, role assignment, permissions, quota, capacity, region, troubleshoot agent, deployment failure, AI Services, create Foundry resource, knowledge index, customize deployment, onboard, availability, training-data, grader, distillation, fine-tuned model, large file upload. DO NOT USE FOR: Azure Functions, App Service, general Azure deploy (use azure-deploy), general Azure prep (use azure-prepare).
- ▌ R2xsql Decompiler · netvar1337 bundleGet pseudocode for radare2 functions via r2xsql. Use when asked for a higher-level view of a function than raw disassembly. Runtime-gated by an installed decompiler plugin (r2ghidra / r2dec / built-in pdc).
- ▌ Session Bootstrap · netvar1337 bundleUse at session start, after context loss, or when the agent seems lost in the environment. Map cwd, repo state, relevant skills, and constraints, then take the first action on the operator's actual request.
- ▌ Stealth Injectors · netvar1337Stealthy usermode/kernel injection: manual map, thread hijack, APC, module stomping, hollow, mapper design, artifact hygiene.
- ▌ Vbs Hvci Research · netvar1337 bundleVirtualization-Based Security research surface: VTL0/VTL1 split, Secure Kernel and Ium syscalls, HVCI kernel code-integrity enforcement, Credential Guard/LSAIso, what each stealth technique survives (DKOM vs code patches), VTL0→VTL1 attack surfaces (hypercalls, VMBus/VMWP, secure-kernel parsers), lab toggling and detection. Use when a target runs VBS/HVCI/Credential Guard or a technique must survive it.
- ▌
- ▌ Zdi Portal Submit · netvar1337 bundleOperate the Zero Day Initiative authenticated portal in a fully headless browser to review bulletins, populate one prepared vulnerability case, upload PoC files, obtain final approval, submit exactly once, and preserve the resulting case ID. Use only for ZDI portal work after a report has been prepared or when checking authenticated ZDI case/bulletin pages.
- ▌ Ags Research Rigor · netvar1337 bundleGuide for evidence-grounded game-security research, citation verification, uncertainty, reproducible analysis, and detector evaluation. Use when validating technical claims, synthesizing README or wiki resources, comparing security techniques, assessing telemetry or models, or deciding whether evidence supports an anti-cheat conclusion.
- ▌ Ags Windows Kernel · netvar1337 bundleGuide for Windows kernel internals and security mechanisms used in game protection and low-level research. Use this skill when working with drivers, IRQL-sensitive callbacks, EPROCESS, ETHREAD, MMVAD internals, IOCTL paths, DSE, PatchGuard, HVCI, PiDDBCache, MmUnloadedDrivers, or kernel memory inspection.
- ▌ Completion Receipt · netvar1337 bundleUse when finishing a task, writing a status report, or handing work back. Emit a short receipt with paths, commands actually run, results, and any leftover blocker. Do not claim done from narrative.
- ▌ Ept Hook Detection · netvar1337 bundleUse when detecting or scoring Intel EPT (or AMD NPT) split-view hooks from the guest: write-reflect fail, RDTSC exit-cost, two-thread race clock. Complements hypervisor-detection (HV present?) and stealth-hypervisor (hide the hook).
- ▌ Google Bug Hunters · netvar1337 bundleUse when researching, validating, or reporting a security finding to the Google Bug Hunters Program. Requires current official scope/rules verification before testing or report preparation.
- ▌ Grayswan Arena Ipi · netvar1337 bundleCompete in the Gray Swan Arena Indirect Prompt Injection challenge (app.grayswan.ai/arena, e.g. ipi-aug-2026). Covers authenticated recon of behaviors/models/criteria, injection-payload engineering for computer-use, tool-use, and coding-agent targets, energy economics, and manual submission workflow. Use when the user mentions Gray Swan, Arena, IPI challenge, indirect prompt injection competition, or wants to draft/iterate injection payloads for Arena behaviors.