ctf-reversing-basics

Use when testing a web application for SQL injection on an authorized engagement.

7 skills

Use when planning or running nmap scans during authorized engagements: host discovery options, TCP SYN, connect, UDP, NULL, FIN, Xmas, and ACK scan types, service and OS detection, timing templates T0 to T5, evasion techniques (fragmentation, decoys, idle scans, source port tricks, data length padding), NSE script selection by category, and output formats for evidence.

6 skills

Use when you hold a low-privilege Linux shell on an authorized engagement, lab, or CTF and need a reliable path to root.

6 skills

Use when testing a web application for cross-site scripting on an authorized engagement.

6 skills

Use when mapping an authorized Active Directory environment during an internal assessment or assumed breach exercise.

5 skills

Use when testing REST, GraphQL, or internal APIs on an authorized engagement.

5 skills

Statically analyze a local JS/Electron app you're authorized to study, with file+line evidence, and build an original reimplementation of what you find. Experimental. Phase 1: JS/Electron static analysis. Phase 2: native ELF/PE/Mach-O container inspection. Phase 3: .NET assembly metadata. Phase 4: EVM bytecode inventory. Phase 5: CUDA fatbin, cubin and PTX inventory. Parses, never executes. Dynamic analysis is a future phase, not yet implemented.

1 skill · 1 command · 1 agent

Binary reverse engineering, malware analysis, firmware security, and software protection research for authorized security research, CTF competitions, and defensive security

4 skills · 3 agents

Reverse-engineer any codebase into a complete PRD. Frontend (React, Vue, Angular, Next.js), backend (NestJS, Django, Express, FastAPI), and fullstack. 2 Python scripts (codebase_analyzer, prd_scaffolder), 2 reference guides, /code-to-prd slash command.

1 skill

Looks up curated web security learning resources (XSS, SQLi, CSRF, SSRF, OAuth/JWT, recon, evasion, tools, CTF). Filters by topic, difficulty, language, and resource type. Returns top references with archive fallbacks. Defensive use only; refuses unauthorized targeting.

1 skill

Mod almost any game you own with an AI agent: engine recon, reverse engineering, fal-generated art/3D/audio, in-game testing, showcase videos, and a shared knowledge base of how games were modded.

13 skills · 3 agents · 1 MCP server · hooks

Decompile Android APK/JAR/AAR with jadx, trace call flows through libraries, and document extracted APIs.

1 skill · 1 command