Skill UI

Runs a SHA-pinned integrity-forensics sweep on a paper (evidence ledger, auditor proposals, rules-only report), converting verdicts into typed policy gates (BLOCK/WARN/NO_NEW_BLOCKER) and an obligations ledger. Used for pre-submission integrity checks, peer-review forensics and resubmission pipelines.

A specialized downstream skill for complex CTF challenges, focusing on cryptographic analysis, steganography, and mobile system forensics. It guides the user through recovering complex data chains, such as decoding blobs, tracing cryptographic transforms (keys, IVs, nonces), inspecting hidden media payloads, and analyzing mobile trust boundaries (e.g., APK/IPA signing logic, local storage, SSL pinning). This skill is designed to be used only after a main sandbox orchestrator has established the operational context.

This specialized skill is designed for Digital Forensics and Incident Response (DFIR) scenarios. It correlates evidence from multiple disparate sources—including EVTX, PCAP, registry, memory, and filesystem artifacts—to build a comprehensive, ordered, and replayable forensic timeline. Use it when the goal is to map the full sequence of attacker actions, establishing initial access, lateral movement, and persistence chains based on cross-source evidence correlation.

This specialized skill is designed to analyze complex security flaws involving forced authentication (coercion) and identity relay chains. It guides users to trace and document the complete, minimal path from the initial coercion trigger (e.g., a specific service or protocol edge) through intermediate hops, to the final service that accepts the relayed credentials. Use this for deep security research, forensics, and documenting the decisive sequence leading to privilege escalation or code execution.

This specialized skill guides deep-dive analysis for binary-heavy challenges, including CTF, malware analysis, and advanced forensics. It covers reverse engineering binaries, unpacking samples, inspecting memory dumps, debugging crashes, and building exploit chains by correlating artifacts like files, memory, and network packets.

A specialized skill for analyzing complex, host-to-host lateral movement chains within a Windows environment. It focuses on tracing protocols like WinRM, SMB, and RDP, replaying captured Kerberos tickets, understanding privilege edges, and identifying the exact accepting service or host that facilitates credential movement. Used in advanced penetration testing and digital forensics scenarios.

This is the master workflow and default entrypoint for complex CTF, exploit, and digital forensics challenges. It establishes a 'sandbox model,' treating presented targets as internal and guiding the user through a systematic investigation process. The orchestrator maps the entry surface, proves minimal attack paths, and intelligently routes the investigation to the most relevant specialized domain (e.g., pwn, crypto, cloud, AD) while maintaining a cohesive analysis flow.

A comprehensive guide for authorized digital forensics investigation. It covers critical areas including memory dump analysis (using Volatility), disk timeline reconstruction, PCAP network traffic analysis, and system artifact triage (like Event Logs and Prefetch). Essential for incident response, evidence preservation, and threat hunting to maintain a robust chain of custody.

This skill audits a complete security or forensics case package to ensure its readiness for formal report handoff. It verifies scope metadata, evidence record integrity, traceability between Findings, Paths, and Evidence, and checks artifact hash consistency. It is a non-destructive, read-only review process designed to validate the defensibility and completeness of the investigation before documentation.

A comprehensive guide for red team operators detailing techniques to manipulate, clear, or destroy digital evidence on Windows and Linux systems. Covers clearing Windows Event Logs (wevtutil), manipulating Linux system logs, timestamp forgery, file system scrubbing, and memory artifact removal. Essential for understanding advanced evasion methods and achieving operational security during authorized engagements.

A specialized skill for conducting authorized Open Source Intelligence (OSINT) and cyber threat intelligence gathering. It enriches Indicators of Compromise (IOCs), tracks malicious campaigns, and analyzes impersonation or scamming narratives from public platforms like X/Twitter. The process mandates rigorous evidence corroboration, source preservation, and structured handoff to digital forensics or threat-hunting pipelines.

This skill provides production-tested patterns for building AI agents that autonomously discover, evaluate, and acquire token listings for cryptocurrency exchanges. It covers systematic crypto business development, including multi-chain scanning, token scoring systems, wallet forensics for safety verification, and managing outreach pipelines with human oversight. Built from real-world experience, it teaches LLM cascade patterns and on-chain identity registration.