All authors
Claude Skills by NetVar1337
github.com/NetVar1337861 skills0 installs44 views
- ConnectUse when starting IDA analysis sessions or routing to other IDA skills (CLI/HTTP/MCP setup).Votes: 0GitHub stars: 2
- Constant Time AnalysisUse when reviewing crypto code for timing side channels / secret-dependent behavior.Votes: 0GitHub stars: 2
- Context CanaryInstall a per-turn canary signal (e.g. starting every reply with the user's name and a turn counter) so silent context degradation becomes visible the moment it happens, and run a recovery protocol when the canary trips. Use when the user mentions a "canary", "context canary", or "canary check", asks to detect context rot / compaction / drift, says "you stopped using my name" or "did you lose context", asks "how degraded is your context", or wants an early-warning system for long agent sessions.Votes: 0GitHub stars: 2
- Ctf CryptoProvides cryptography attack techniques for CTF challenges. Use when attacking encryption, hashing, signatures, ZKP, PRNG, or mathematical crypto problems involving RSA, AES, ECC, lattices, LWE, CVP, number theory, Coppersmith, Pollard, Wiener, padding oracle, GCM, key derivation, or stream/block cipher weaknesses.Votes: 0GitHub stars: 2
- Ctf ForensicsProvides digital forensics and signal analysis techniques for CTF challenges. Use when analyzing disk images, memory dumps, event logs, network captures, cryptocurrency transactions, steganography, PDF analysis, Windows registry, Volatility, PCAP, Docker images, coredumps, side-channel power traces, DTMF audio spectrograms, packet timing analysis, CD audio disc images, or recovering deleted files and credentials.Votes: 0GitHub stars: 2
- Ctf MalwareProvides malware analysis and network traffic techniques for CTF challenges. Use when analyzing obfuscated scripts, malicious packages, custom crypto protocols, C2 traffic, PE/.NET binaries, RC4/AES encrypted communications, YARA rules, shellcode analysis, memory forensics for malware (Volatility malfind, process injection detection), anti-analysis techniques (VM/sandbox detection, timing evasion, API hashing, process injection, environment checks), or extracting malware configurations and in...Votes: 0GitHub stars: 2
- Ctf MiscProvides miscellaneous CTF challenge techniques for problems that do not cleanly fit the main categories. Use for encoding puzzles, pyjails, bash jails, RF/SDR, DNS oddities, unicode tricks, esoteric languages, QR or audio puzzles, constraint solving, game theory, unusual sandbox escapes, and hybrid logic puzzles. Prefer a more specific skill first when the challenge is mainly web, pwn, reverse, forensics, malware, OSINT, or crypto. Treat this as the fallback skill for genuine cross-category ...Votes: 0GitHub stars: 2
- Ctf PwnProvides binary exploitation techniques for CTF challenges. Use when you already have a vulnerable native target or service and need to turn memory corruption or low-level primitives into code execution or privilege escalation, such as buffer overflows, format strings, heap bugs, ROP, ret2libc, shellcode, kernel exploitation, seccomp bypass, sandbox escape, or Windows/Linux exploit chains. Do not use it when the main blocker is understanding what the binary does; use reverse engineering first...Votes: 0GitHub stars: 2
- Ctf ReverseProvides reverse engineering techniques for CTF challenges. Use when the main job is to understand how a compiled, obfuscated, packed, or virtualized target works before exploiting or solving it, including binaries, APKs, WASM, firmware, custom VMs, bytecode, game clients, malware-like loaders, and anti-debug or anti-analysis logic. Do not use it when the vulnerability is already understood and the remaining task is exploitation; use pwn instead. Do not use it for pure web workflows, log or d...Votes: 0GitHub stars: 2
- Ctf Sandbox OrchestratorSidecar orchestrator for CTF / AWD / cyber range / sandbox multi-surface engagements. Takes over after the ctf-sandbox PRIMARY routes in: sets up the lab network profile, initializes the case with auth.status=granted, and dispatches each challenge to its specialist (pwn-chain, apk-reverse, ida-reverse/r2mcp-basic, api-security/pentest-tools) without inventing new workflows. Use when a CTF/cyber range task needs multi-challenge orchestration, case init, network profile scoping, or downstream r...Votes: 0GitHub stars: 2
- Ctf SandboxThin PRIMARY for CTF / AWD / range multi-type orchestration. Hands off to the sidecar CTF-Sandbox-Orchestrator. Use when the user says CTF, AWD, range, or competition task and no more specific pwn/APK/IDA route already won.Votes: 0GitHub stars: 2
- Ctf WebProvides web exploitation techniques for CTF challenges. Use when the target is primarily an HTTP application, API, browser client, template engine, identity flow, or smart-contract frontend/backend surface, including XSS, SQLi, SSTI, SSRF, XXE, JWT, auth bypass, file upload, request smuggling, OAuth/OIDC, SAML, prototype pollution, and similar web bugs. Do not use it for native binary memory corruption, reverse engineering of standalone executables, disk or memory forensics, or pure cryptana...Votes: 0GitHub stars: 2
- Cua DriverDrive a native GUI app (macOS, Windows, Linux) via the cua-driver CLI (default) or MCP server; snapshot its accessibility tree, act through snapshot-bound element tokens, native menu paths, exact window geometry, or pixel coordinates, and verify from fresh state. Use when the user asks you to operate, drive, automate, or perform a GUI task in a real application on the host.Votes: 0GitHub stars: 2
- DataUse to query IDA strings/bytes/binary content and rebuild string tables.Votes: 0GitHub stars: 2
- Database SecurityUse for authorized database security assessment covering PostgreSQL/MySQL/MSSQL/Mongo/Redis exposure, authz, UDF/command paths, and misconfiguration review.Votes: 0GitHub stars: 2
- DebuggerUse for IDA debugger ops: breakpoints, patches, conditions, patch inventory.Votes: 0GitHub stars: 2
- DecompilerUse for IDA pseudocode, ctree AST, locals, labels, decompiler-driven cleanup.Votes: 0GitHub stars: 2
- DeepenUse when improving module design without changing behavior ('deepen this', /ck:deepen).Votes: 0GitHub stars: 2
- Desktop Ei069kk AccessUse when connecting to, administering, or transferring files to and from DESKTOP-EI069KK via the `work` SSH/RDP aliases, or when diagnosing that remote-access path from either C3PO or DESKTOP-EI069KK.Votes: 0GitHub stars: 2
- DeslopifyDe-slop pass for any text. Scans for the statistical fingerprints of AI writing (negative parallelism / 'not X but Y', em-dash density, rule-of-three, false ranges, puffery vocabulary, uniform cadence, hedged both-sidesing), rewrites by meaning, then re-scans until the text is clean and sits in the right register for its genre: academic article, tweet, reddit post, email, blog, docs, marketing....Votes: 0GitHub stars: 2
- Development Toolchain CurationUse when auditing or pruning agent skills, MCPs, hooks, and language/RE toolchains.Votes: 0GitHub stars: 2
- Diagram Generatorgenerate, refine, validate, and render diagrams from natural language, notes, code snippets, schemas, tables, or existing diagram source. use for flowcharts, swimlanes, sequence diagrams, state diagrams, er diagrams, class diagrams, architecture/c4-style diagrams, dependency graphs, gantt charts, mind maps, user journeys, sankey-style flows, org charts, network graphs, and other visual models. supports mermaid by default, graphviz dot for complex graph layout, plantuml for uml-heavy engineeri...Votes: 0GitHub stars: 2
- Differential ReviewUse for security-focused review of PRs/commits/diffs with blast-radius analysis.Votes: 0GitHub stars: 2
- Digital ForensicsUse for authorized digital forensics including memory dumps, disk timelines, PCAP investigation, artifact triage, and IR evidence preservation.Votes: 0GitHub stars: 2
- DisassemblyUse for IDA disassembly queries: functions, segments, instructions, blocks, operands, CFG.Votes: 0GitHub stars: 2
- Docs GeneratorCreates task-oriented technical documentation with progressive disclosure. Use when writing READMEs, API docs, architecture docs, or markdown documentation. Also use this skill at the END of any completed reverse engineering, penetration testing, CTF, or security analysis task to generate a formal report in the user's project directory. Trigger keywords: 写报告, 写文档, 出报告, writeup, 技术文档, report, documentation.Votes: 0GitHub stars: 2
- Dotnet Reverse.NET / C# 二进制逆向。当目标是 .NET assembly（PE 头含 CLR、.exe/.dll 托管程序）、C# 编译产物（含 NativeAOT）、红队 Sharp* 工具（Rubeus / SharpHound / SharpHound 等）、.NET 混淆程序（ConfuserEx / SmartAssembly / Babel / Eazfuscator）、.NET loader / info-stealer / 套壳 malware 时使用。优先用 dnSpyEx + de4dot，需要 AI 直接操作时联动 dnSpy MCP。不用于纯 native 二进制（走 reverse-engineering / ida-reverse）。Votes: 0GitHub stars: 2
- Driver CommUsermode↔kernel driver communication: IOCTL design, shared sections, events, security descriptors, stealth IOCTL.Votes: 0GitHub stars: 2
- Dsl Vm ReverseReverse JavaScript-based custom DSL/VM interpreters, non-standard WASM-like runtimes, and risk-control engines. Use when analyzing IIFE or switch-based opcode dispatchers, extracting instruction tables, recovering bytecode semantics, capturing VM state at runtime, or reconstructing execution flow.Votes: 0GitHub stars: 2
- Dwarf ExpertUse when analyzing DWARF debug info or code that parses DWARF.Votes: 0GitHub stars: 2
- Eac Ban StackEAC/EasyAntiCheat ban-stack research: HWID serials, server-side trust, usermode telemetry, kernel driver signals, FN-class ban discussions.Votes: 0GitHub stars: 2
- Eac Kernel Driver ReEasyAntiCheat.sys-class kernel driver reverse engineering: callbacks, device interfaces, integrity, communication, Rust/C++ RE notes.Votes: 0GitHub stars: 2
- Eac Usermode Telemetry ReEasyAntiCheat_EOS.exe / usermode telemetry RE: modules, IPC to driver, heartbeats, report formats, packing.Votes: 0GitHub stars: 2
- Ebpf OffensiveUse when auditing or exploiting Linux eBPF verifier and JIT behavior, building CO-RE/libbpf research probes, exercising maps and ring buffers, attaching kprobe, fentry, LSM, cgroup, tc, or XDP programs, evaluating unprivileged BPF exposure, or enumerating and removing hidden BPF state.Votes: 0GitHub stars: 2
- Edr Bypass Re逆向防御方实现 → 红队针对性绕过。把 EDR / Defender / AV 的 hook 表、ETW provider、AMSI 实现先逆向出来， 再写针对性的 unhook / 间接 syscall / ETW patch / call stack spoof。对照 MITRE ATT&CK T1562 防御规避。 触发关键词：EDR 绕过、AV bypass、免杀、unhook、direct syscall、indirect syscall、Hell's Gate、Halo's Gate、 Tartarus Gate、ETW patch、AMSI patch、call stack spoofing、hardware breakpoint Blindside、MITRE T1562、 ntdll unhook、kernel callback、CrowdStrike 绕过、Defender 绕过、Sentinel One 绕过、Elastic Defend、 Sysmon 规避、PPID spoof、Sleep mask、Process Hollowing、Reflectiv...Votes: 0GitHub stars: 2
- Email SecurityUse for authorized email security review including phishing analysis, header authentication (SPF/DKIM/DMARC), BEC patterns, and mailbox token abuse research.Votes: 0GitHub stars: 2
- Enma LangEnma language and embedding SDK reference: syntax, types, functions, pointers, classes, inheritance, templates, exceptions, modules, compiler semantics, native type/function registration, safety, and standard addons. Use when writing Enma code or embedding/extending the Enma engine; use perception-api for Perception-specific host functions.Votes: 0GitHub stars: 2
- Enterprise Server Rce ResearchUse when hunting new remote code execution vulnerabilities in the latest stable enterprise server, appliance, middleware, management-plane, gateway, identity, backup, monitoring, messaging, database, or file-processing product. Maps unauthenticated and low-privilege network paths, builds protocol-aware harnesses, traces attacker data to native or interpreter sinks, and validates practical serve...Votes: 0GitHub stars: 2
- Ept Hook DetectionUse when detecting or scoring Intel EPT (or AMD NPT) split-view hooks from the guest: write-reflect fail, RDTSC exit-cost, two-thread race clock. Complements hypervisor-detection (HV present?) and stealth-hypervisor (hide the hook).Votes: 0GitHub stars: 2
- Exploit DevUse when converting a known crash, UAF, overflow, type confusion, race, or logic flaw into a measured exploit primitive, leak, heap strategy, mitigation-aware PoC, ROP/JOP or shellcode chain, local privilege escalation, and deterministic reliability harness. Routes allocator- and platform-specific work without conflating Windows user mode, Windows kernel, glibc, or Linux kernel; do not use for driver authoring, BYOVD, or multi-host orchestration.Votes: 0GitHub stars: 2
- ExploitationSearch for ROP/JOP/COP gadgets in a binary via r2xsql's rop_gadgets and rop_gadget_instructions tables, and look up syscall names/numbers via the syscalls reference table. Use when building an exploit chain, hunting for stack-pivot/syscall/write-what-where primitives, resolving a target's syscall table, or answering 'what gadgets are available here'.Votes: 0GitHub stars: 2
- External EspUse when building or validating an external game telemetry overlay (ESP): read a separate process, recover build-pinned entity/camera data, transform world coordinates through a verified view-projection matrix, and render the result in an external HWND. Routes offset recovery and overlay implementation to their specialist skills.Votes: 0GitHub stars: 2
- Find SkillsUse when the user wants to discover/install skills or asks 'is there a skill for X'. Also checks ~/.agents/skills-archive/.Votes: 0GitHub stars: 2
- Firmware Hdl ReviewUse when reviewing firmware/HDL changes across registers, SystemVerilog, DMA, sim, CI.Votes: 0GitHub stars: 2
- Firmware Pentest固件 / IoT 渗透链。从拿到一坨 .bin / .img 开始，闭环走完逆向 → 提取 → 模拟 → 利用。 方法论遵循 OWASP FSTM 九阶段；工具链以 binwalk v3、unblob、EMBA、Firmadyne、AFL++ 为主。 适用场景：路由器/摄像头/智能家居固件审计、固件升级包逆向、IoT CVE 复现、嵌入式 0day 挖掘。 触发关键词：固件、firmware、IoT、binwalk、unblob、UART、JTAG、squashfs、UBI、JFFS2、Firmadyne、QEMU 全系统仿真、EMBA、固件渗透、路由器固件、嵌入式漏洞利用、bootloader、NVRAM、FAT、firmware analysis toolkit。Votes: 0GitHub stars: 2
- Format String BugFormat-string vulnerabilities: read/write primitives via %n/%s, GOT overwrite, modern compiler constraints.Votes: 0GitHub stars: 2
- Frida 17Frida 17 JavaScript API compatibility checker and fixer. Use when writing, reviewing, or fixing Frida scripts, especially when migrating from older Frida versions. Detects deprecated APIs removed in Frida 17 (May 2025) and provides correct replacements. Covers Module, Memory, Process APIs and common naming conflicts.Votes: 0GitHub stars: 2
- Frida DbiFrida dynamic binary instrumentation for RE and security research: spawn/attach, Interceptor hooks, NativeFunction, Memory scanning, Stalker tracing, gadget modes, anti-anti-debug bypass patterns, il2cpp/mono bridges for games, OPSEC of frida-server, and reliability discipline for long sessions. Local stack: frida 17.17.0 + frida-tools 14.10.4 via pip.Votes: 0GitHub stars: 2
- Frida InstrumentationUse when dynamically instrumenting native or managed code on Windows, Linux, macOS, Android, or iOS — Frida Interceptor hooks, Stalker tracing, frida-trace CLI, Java.perform and ObjC bridges, gadget embedding, script RPC, spawn-vs-attach gating, and defeating anti-Frida detection (port 27042 scans, frida-agent artifacts, ptrace checks). Covers hook design, call reconstruction, and runtime data capture for RE, mobile app testing, game clients, and anti-cheat research.Votes: 0GitHub stars: 2
- FunctionsUse as the idasql SQL function reference catalog (signatures, params, examples).Votes: 0GitHub stars: 2