Skill UI

AddressSanitizer accelerates fuzz testing by instrumenting C/C++ and unsafe Rust code to detect buffer overflows, use-after-free, and related memory corruption bugs at runtime, with configurable ASAN_OPTIONS for verbosity, abort behavior, and leak control.

Browser automation expert for debugging flaky tests and running long-lived scrapers using Playwright/Puppeteer, focusing on robust selectors, auto-waits, isolation, and anti-detection practices.

This skill provides a comprehensive, multi-phase guided workflow for professional incident response management. Following modern SRE principles and the Incident Command System (ICS), it guides users from initial detection and triage (P0-P3 classification) through deep investigation (observability, debugging, security checks), culminating in structured resolution and post-mortem analysis. Use this when managing critical system outages or performance degradation.

Runs Semgrep static analysis with auto language detection, parallel Task subagents, Semgrep Pro checks, and configurable “run all” or “important only” modes to audit codebases for vulnerabilities and bug patterns.

Guides writing high-quality YARA-X detection rules for malware hunting, covering naming conventions, string selection, performance tuning, migrations from legacy YARA, and reducing false positives when authoring, reviewing, or debugging signatures.

This skill uses the Thinkst Canary REST API to programmatically deploy and monitor various tripwire mechanisms, including web bugs, DNS tokens, MS Word documents, and AWS API keys. It is designed for early breach detection by simulating attacker activity and generating comprehensive deception coverage reports and alert histories.

This skill enables sophisticated runtime dynamic analysis of Android applications using industry-standard tools like Frida and Objection. It is used to observe application behavior, intercept API calls, monitor network traffic, and bypass client-side security protections (e.g., root detection, anti-debugging). Essential for identifying vulnerabilities and analyzing obfuscated code that static analysis cannot reach.

This skill provides a comprehensive, structured methodology and checklist for identifying Remote Code Execution (RCE) vulnerabilities across various web applications. It covers advanced attack vectors such as OS command injection, Server-Side Template Injection (SSTI), insecure deserialization, file upload flaws, and XXE. Use this guide during web application penetration testing or bug bounty hunting to systematically discover arbitrary code execution paths.

This internal agent skill automates the complex process of determining the most likely owner or team for a bug cluster. It follows a strict 6-level precedence model, starting with cached overrides, and sequentially querying sources like Service Owners, Oncall status, CODEOWNERS, recent assignees, and committers. The process includes staleness detection and confidence scoring, providing highly accurate and auditable routing recommendations for internal development triage.

A comprehensive playbook for defeating anti-debugging mechanisms in protected binaries. Covers advanced techniques across both Linux (ptrace, /proc/self/status, timing checks) and Windows (PEB flags, NtQueryInformationProcess). Provides detailed detection methods and corresponding bypass strategies (e.g., patching, hooking, kernel modules) essential for advanced binary reverse engineering.

This skill is designed to identify subtle and complex logic bugs within a single code file or function. It employs a semi-formal execution tracing methodology, systematically breaking down the suspected bug into five stages: Premises (expected state), Trace (execution path), Divergence (actual deviation), Trigger (reproduction case), and Remedy (fix). It is ideal for scenarios where users suspect code is wrong but cannot specify a concrete failure point.

A comprehensive methodology for deep security testing of both Android (APK) and iOS (IPA) applications. This guide covers the entire workflow, from initial information gathering and static analysis (decompilation, code structure analysis) to advanced dynamic instrumentation, network interception, and bypassing modern security measures like SSL Pinning, Root/Jailbreak detection, and anti-debugging.