Skill UI

A specialized deep-dive skill for analyzing container-to-host escape vulnerabilities. This tool is used after a sandbox orchestrator establishes initial assumptions, focusing on mapping isolation boundaries (namespaces, cgroups, seccomp, capabilities). It helps prove boundary crossings, identify minimal exploit primitives, and determine if an exploit can break out of the container context to the host kernel.

A highly specialized, downstream skill for advanced threat analysis. This tool is used to recover hidden configurations, decode C2 (Command and Control) parameters, unpack staged payloads, and extract Indicators of Compromise (IOCs) from complex malware samples. It focuses on identifying the exact decode chains—including compression, encoding, and crypto steps—and linking recovered fields to observed behavioral outcomes within a sandbox environment.

This specialized skill is designed to trace and prove the complete flow of OAuth or OIDC authentication, acting as a downstream specialization after an orchestrator has established sandbox assumptions. It meticulously tracks the entire journey—from initial redirect and parameter handling (state, nonce, PKCE) through token exchange, claim mapping, and ultimately to the point where an identity or privilege is accepted by the backend service. Use this when the critical task is proving the security and mechanics of the authentication chain.

This specialized skill is used to trace complex network requests through multi-layered infrastructure, such as reverse proxies, container boundaries, and various header manipulations. It is essential for determining which specific node, proxy rule, or derived header ultimately serves a live request within a sandboxed environment. Use it when analyzing VHost routing, path rewrites, or X-Forwarded headers to pinpoint the decisive backend.

A specialized, downstream skill designed for forensic analysis within a confined sandbox environment, particularly for CTF challenges. It guides the user to inspect the full stack behavior, including API interactions, server routing, browser state (cookies, local storage), and asynchronous worker processes. Use this skill to trace complex, end-to-end request flows, debug authentication/session leaks, or diagnose discrepancies between frontend UI and backend enforcement.

This is the master workflow and default entrypoint for complex CTF, exploit, and digital forensics challenges. It establishes a 'sandbox model,' treating presented targets as internal and guiding the user through a systematic investigation process. The orchestrator maps the entry surface, proves minimal attack paths, and intelligently routes the investigation to the most relevant specialized domain (e.g., pwn, crypto, cloud, AD) while maintaining a cohesive analysis flow.

Comprehensive workflow for analyzing suspected malware via static, dynamic, and behavioral techniques. Covers IOC extraction, YARA/Sigma rule generation, sandbox automation, and anti-analysis bypassing.

This command inspects the native code execution sandbox environment. It reports on platform compatibility (e.g., bubblewrap, Seatbelt), active security configurations (auto-allow status, filesystem policies, network allowlists), and details recent security violations. Use it to audit the execution environment before running autonomous workflows.

This protocol provides a systematic, multi-step diagnostic approach to determine if a command failure (e.g., permission denied, network issues) is genuinely due to sandbox restrictions or is caused by environmental or measurement errors. It includes eight critical checks—such as verifying shell scope and reading real exit codes—to eliminate false positives before filing a blocker report.

Adds one optional external Codex critique after the council workflow has produced a synthesis draft. Use for ambiguous, high-consequence decisions where a separate model should attempt to break the consensus. Requires explicit user consent before sending a compact review packet to OpenAI, labels cross-provider vs same-provider honestly, sandboxes the external call, and marks the review absent if the adapter is unavailable.

A thin primary skill for orchestrating multi-type CTF/AWD/competition sandboxes. It triggers on keywords like CTF or AWD, delegates to a sidecar orchestrator, and enforces authorization before any external network action. Designed to avoid routing duplication and maintain safety boundaries.

This playbook guides the comprehensive design of complex survival and crafting games. It covers the core gameplay loop: resource gathering, managing survival needs (hunger, thirst, temperature), crafting items, building bases, and surviving escalating threats. Essential for developing deep, persistent sandbox experiences.