Skill UI

A specialized downstream skill for CTF-sandbox workflows. Used to analyze complex security challenges driven by AI agent interactions, prompt injection, or infrastructure vulnerabilities. Focuses on tracing control chains involving untrusted input, tool side effects, deployment drift, container runtime issues, and CI/CD supply chain provenance. Ideal for rigorous vulnerability assessment in modern, distributed systems.

A specialized skill for advanced runtime analysis of Android applications, primarily used in CTF and security research. It covers techniques like hooking specific system boundaries (JNI, WebView), bypassing security measures (SSL pinning, root checks), and recovering sensitive data or request signatures. Ideal for deep inspection of app trust boundaries and complex mobile logic.

This skill specializes in analyzing built frontend artifacts, going beyond static source code. It reconstructs the dynamic JavaScript structure, tracks chunk loading paths, and interprets source maps and build manifests to recover hidden routes, APIs, and runtime behaviors. Essential for deep security analysis and understanding execution flow from deployed bundles.

A specialized skill for analyzing the discrepancy between static Kubernetes/Compose manifests and the actual live operational state of a container runtime. It traces complex dependencies, such as secrets consumption, sidecar/init container modifications, network routing, and mounted volume paths. Use this when the core challenge involves proving how the live execution path differs from the documented intent, forming a minimal, verifiable evidence chain.

A specialized skill for advanced security analysis, particularly in CTF scenarios. This tool guides users through analyzing live iOS runtime behavior, including Objective-C/Swift method tracing, inspecting Keychain data, bypassing SSL pinning, and recovering accepted network requests. It is designed to be used after a primary orchestration tool has established the sandbox environment, focusing on the details of trust boundaries.

This specialized skill is used to trace complex network requests through multi-layered infrastructure, such as reverse proxies, container boundaries, and various header manipulations. It is essential for determining which specific node, proxy rule, or derived header ultimately serves a live request within a sandboxed environment. Use it when analyzing VHost routing, path rewrites, or X-Forwarded headers to pinpoint the decisive backend.

This advanced skill specializes in tracing the complete provenance of software artifacts across the entire development lifecycle. It is designed for deep security analysis of CI/CD pipelines, identifying dependency drift, build tampering, package origin, and determining the final artifact consumed at runtime. Use it when investigating integrity vulnerabilities in complex release flows.

A specialized, downstream skill designed for forensic analysis within a confined sandbox environment, particularly for CTF challenges. It guides the user to inspect the full stack behavior, including API interactions, server routing, browser state (cookies, local storage), and asynchronous worker processes. Use this skill to trace complex, end-to-end request flows, debug authentication/session leaks, or diagnose discrepancies between frontend UI and backend enforcement.

This specialized skill analyzes the complete lifecycle of real-time web communications, including WebSocket and Server-Sent Events (SSE). It is designed to map the initial handshake, decode complex message streams (subscriptions, keepalives, pushes, reconnects), and trace how frame activity leads to persistent or rendered state changes. Use this to isolate the minimal, decisive sequence of events that prove a system's behavior.

This specialized skill provides a deep workflow for reverse engineering stripped Go and Rust binaries. It guides the recovery of lost runtime metadata, including symbols, pclntab data, and panic strings. The process addresses language-specific challenges, such as Go's interface structures and Rust's complex async state machines, serving as a crucial complement to general decompilers like IDA or Ghidra.

Guideline for front-end JavaScript reverse engineering using js-reverse MCP tools and jshookmcp. Covers locating signature and encrypted parameters, tracing request initiators, runtime sampling via hooks, local Node environment reconstruction, and evidence-first output for reproducing signing logic.

This comprehensive guide details the methodology for reverse engineering macOS and Mach-O binaries. It covers analyzing application bundles, deciphering Objective-C/Swift symbols, examining code signing and hardened runtime features, and performing both static (using tools like Ghidra, IDA) and dynamic analysis (using lldb, Frida) to aid in malware analysis and platform security research.