Explore the full catalog
Explore skills, repositories and creators
Search the catalog or browse with filters. Checks are automated signals, not a safety guarantee.
Page 91 · 50 results shown
Skill
radio-sdr
zhaoxuya520/reverse-skill · skills/radio-sdr
Use for authorized RF/SDR security research including signal identification, replay feasibility study in shielded labs, and wireless protocol analysis outside classic Wi-Fi.
Repository stars: 44,280 · Incomplete scan
Skill
wifi-wireless
zhaoxuya520/reverse-skill · skills/wifi-wireless
Use for authorized wireless security assessment including Wi-Fi capture, WPA handshake analysis, rogue AP detection research, and lab-only deauth testing.
Repository stars: 44,280 · Incomplete scan
Skill
competition-windows-pivot
zhaoxuya520/reverse-skill · CTF-Sandbox-Orchestrator/competition-windows-pivot
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for Kerberos, WinRM, SMB, RDP, Windows credential material, replayable tickets, delegation edges, and host-to-host pivot chains. Use when the user asks to replay Kerberos material, trace a WinRM, SMB, or RDP pivot, understand host-to-host privilege movement, or prove which Windows service accepted a credential or ticket. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
Repository stars: 44,280 · Incomplete scan
Skill
browser-extension-reverse
zhaoxuya520/reverse-skill · skills/browser-extension-reverse
Use for authorized reverse engineering of browser extensions (Chrome/Firefox) including manifest analysis, background workers, and extension-based credential or traffic logic recovery.
Repository stars: 44,280 · Incomplete scan
Skill
windows-ad
zhaoxuya520/reverse-skill · skills/windows-ad
Use for authorized Active Directory and Windows identity attacks including Kerberos, AD CS, BloodHound paths, NTLM relay, and domain privilege escalation research.
Repository stars: 44,280 · Incomplete scan
Skill
llm-security
zhaoxuya520/reverse-skill · skills/llm-security
Use for authorized security assessment of LLM applications and AI agents, including prompt injection, tool abuse, RAG exposure, memory poisoning, and model supply-chain risks.
Repository stars: 44,280 · Incomplete scan
Skill
competition-identity-windows
zhaoxuya520/reverse-skill · CTF-Sandbox-Orchestrator/competition-identity-windows
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for Active Directory, Kerberos, LDAP, OAuth, enterprise messaging, Windows host forensics, credential material, and lateral-movement challenges. Use when the user asks to trace tickets or tokens, inspect mailbox rules, analyze Windows host evidence, understand an AD trust path, or explain a lateral-movement chain across sandbox-linked nodes. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
Repository stars: 44,280 · Incomplete scan
Skill
dsl-vm-reverse
zhaoxuya520/reverse-skill · skills/reverse-engineering/dsl-vm-reverse
Reverse JavaScript-based custom DSL/VM interpreters, non-standard WASM-like runtimes, and risk-control engines. Use when analyzing IIFE or switch-based opcode dispatchers, extracting instruction tables, recovering bytecode semantics, capturing VM state at runtime, or reconstructing execution flow.
Repository stars: 44,280 · Incomplete scan
Skill
email-security
zhaoxuya520/reverse-skill · skills/email-security
Use for authorized email security review including phishing analysis, header authentication (SPF/DKIM/DMARC), BEC patterns, and mailbox token abuse research.
Repository stars: 44,280 · Incomplete scan
Skill
ida-reverse
zhaoxuya520/reverse-skill · skills/ida-reverse
IDA Pro 逆向分析辅助技能。当用户提到逆向、反编译、分析二进制/PE/ELF/APK/DLL/SO、破解、找密码、漏洞分析、病毒分析、firmware 固件分析，或需要分析 exe/dll/so/elf/macho/sys 等文件时，务必使用此技能。 Ensure to use this skill when the user wants to analyze any binary file, regardless of whether they explicitly mention "IDA" or "reverse engineering". This includes requests like "看看这个exe", "分析这个dll", "帮我破解", "找一下密码", "这个软件怎么注册", etc. Use the bundled scripts (scripts/start.ps1, scripts/open.ps1) for deterministic server management and file opening — do NOT write ad-hoc PowerShell commands for these operations.
Repository stars: 44,280 · Incomplete scan
Skill
supply-chain-security
zhaoxuya520/reverse-skill · skills/supply-chain-security
Use for software supply-chain security assessment covering SBOM, SCA, CI/CD pipelines, container images, build integrity, dependency provenance, and vulnerability reachability.
Repository stars: 44,280 · Incomplete scan
Skill
malware-analysis
zhaoxuya520/reverse-skill · skills/malware-analysis
Use when analyzing suspected malware through static, dynamic, and behavioral techniques, including IOC extraction, YARA or Sigma rules, sandboxing, and anti-analysis behavior.
Repository stars: 44,280 · Incomplete scan
Skill
competition-oauth-oidc-chain
zhaoxuya520/reverse-skill · CTF-Sandbox-Orchestrator/competition-oauth-oidc-chain
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for OAuth, OIDC, redirect flows, state or nonce handling, PKCE, token exchange, refresh logic, claim mapping, and accepted login paths. Use when the user asks to trace redirects, callback parameters, scopes, state, nonce, PKCE, refresh tokens, consent, or explain how an OAuth or OIDC chain turns into accepted identity or privilege. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
Repository stars: 44,280 · Incomplete scan
Skill
dotnet-reverse
zhaoxuya520/reverse-skill · skills/dotnet-reverse
.NET / C# 二进制逆向。当目标是 .NET assembly（PE 头含 CLR、.exe/.dll 托管程序）、C# 编译产物（含 NativeAOT）、红队 Sharp* 工具（Rubeus / SharpHound / SharpHound 等）、.NET 混淆程序（ConfuserEx / SmartAssembly / Babel / Eazfuscator）、.NET loader / info-stealer / 套壳 malware 时使用。优先用 dnSpyEx + de4dot，需要 AI 直接操作时联动 dnSpy MCP。不用于纯 native 二进制（走 reverse-engineering / ida-reverse）。
Repository stars: 44,280 · Incomplete scan
Skill
thick-client
zhaoxuya520/reverse-skill · skills/thick-client
Use for authorized security testing of desktop thick clients including local storage, update channels, IPC, traffic, and client-side trust boundaries.
Repository stars: 44,280 · Incomplete scan
Skill
competition-race-condition-state-drift
zhaoxuya520/reverse-skill · CTF-Sandbox-Orchestrator/competition-race-condition-state-drift
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for race windows, ordering bugs, idempotency failures, lock gaps, concurrent worker drift, and state inconsistencies that produce decisive effects. Use when the user asks to reproduce timing-sensitive bugs, concurrent state corruption, duplicate actions, stale reads, or privilege or balance drift caused by request ordering. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
Repository stars: 44,280 · Incomplete scan
Skill
attack-chain
zhaoxuya520/reverse-skill · skills/attack-chain
Use for authorized multi-stage attack-path planning and orchestration when a task spans reconnaissance, initial access, privilege escalation, lateral movement, or impact assessment. Route single-stage tasks directly to their specialist skill.
Repository stars: 44,280 · Incomplete scan
Skill
ghidra-reverse
zhaoxuya520/reverse-skill · skills/ghidra-reverse
Use for free/open reverse engineering with Ghidra (headless or GUI), including decompile, cross-refs, and optional Ghidra MCP workflows when IDA is unavailable.
Repository stars: 44,280 · Incomplete scan
Skill
competition-request-normalization-smuggling
zhaoxuya520/reverse-skill · CTF-Sandbox-Orchestrator/competition-request-normalization-smuggling
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for parser differentials, HTTP normalization gaps, ambiguous headers, path decoding drift, transfer-framing mismatches, and request smuggling routes. Use when the user asks to trace proxy and backend parse differences, conflicting path normalization, Host or forwarded-header ambiguity, CL/TE issues, or routing outcomes that differ across hops. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
Repository stars: 44,280 · Incomplete scan
Skill
reverse-skill-router
zhaoxuya520/reverse-skill · skills
Routes reverse engineering, exploitation, penetration testing, malware, mobile, firmware, browser automation, documentation, and security tasks to the appropriate specialist skill. Use when a task spans modules or the correct reverse-skill entrypoint is unclear.
Repository stars: 44,280 · Incomplete scan
Skill
cloud-k8s
zhaoxuya520/reverse-skill · skills/cloud-k8s
Use for authorized cloud, container, and Kubernetes security assessment including metadata SSRF, IAM misconfig, container escape paths, and cluster RBAC review.
Repository stars: 44,280 · Incomplete scan
Skill
reverse-skill-router
zhaoxuya520/reverse-skill · plugins/reverse-skill/skills/reverse-skill-router
Use the reverse-skill repository from Codex for authorized reverse engineering, security analysis, CTF, and defensive testing tasks. Requires the reverse-skill repository to be available as the current workspace or an explicitly supplied local path.
Repository stars: 44,280 · Incomplete scan
Skill
competition-template-render-path
zhaoxuya520/reverse-skill · CTF-Sandbox-Orchestrator/competition-template-render-path
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for SSR, template rendering, route loaders, hydration payloads, server-client render boundaries, and template-to-handler enforcement gaps. Use when the user asks to inspect SSR or template routes, trace render context or hydration data, compare template gating with handler enforcement, explain preview or hidden-route rendering, or connect render pipeline behavior to the decisive branch. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
Repository stars: 44,280 · Incomplete scan
Skill
pwn-chain
zhaoxuya520/reverse-skill · skills/pwn-chain
从逆向走到可用利用 (Working Exploit) 的全链路工程化方法。 适用场景：拿到了二进制 + 漏洞点 + 目标环境，需要写出一个能稳定打通的 exploit（不是只能本地复现一下、远程一打就崩的脚本）。 覆盖三大方向：栈溢出 / 堆利用 / 内核 pwn。强调"CTF 本地通 → 真实远程稳定打通"的工程差距：libc 版本错配、堆喷射时序、SMEP/SMAP/KASLR、栈对齐、远程缓冲。 核心工具链：pwntools + GEF/pwndbg + ROPgadget/Ropper + one_gadget + libc-database + qemu-system 内核调试。 触发关键词：pwn、栈溢出、堆溢出、ROP、ret2libc、ret2csu、one_gadget、libc-database、堆利用、tcache、fastbin、unsorted bin、kernel pwn、kROP、SMEP、SMAP、KASLR、modprobe_path、pwntools、GEF、pwndbg。
Repository stars: 44,280 · Incomplete scan
Skill
competition-relay-coercion-chain
zhaoxuya520/reverse-skill · CTF-Sandbox-Orchestrator/competition-relay-coercion-chain
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for forced-auth coercion, relay chains, target selection, NTLM or related acceptance paths, and coercion-to-privilege transitions. Use when the user asks to trace a coercion primitive, follow a relay path, analyze forced authentication, determine which service accepts relayed auth, or connect a coercion step to resulting privilege, enrollment, or code execution. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
Repository stars: 44,280 · Incomplete scan
Skill
code-audit
zhaoxuya520/reverse-skill · skills/code-audit
Use for authorized source-code security review and SAST workflows including Semgrep, CodeQL patterns, dangerous API hunting, and fix verification.
Repository stars: 44,280 · Incomplete scan
Skill
competition-dpapi-credential-chain
zhaoxuya520/reverse-skill · CTF-Sandbox-Orchestrator/competition-dpapi-credential-chain
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for DPAPI masterkeys, vault blobs, browser credential stores, protected secrets, domain backup keys, and secret-to-acceptance replay chains. Use when the user asks to inspect DPAPI blobs or masterkeys, recover browser or vault credentials, trace DPAPI context or backup-key use, or explain how protected Windows secrets become accepted access or privilege. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
Repository stars: 44,280 · Incomplete scan
Skill
competition-agent-cloud
zhaoxuya520/reverse-skill · CTF-Sandbox-Orchestrator/competition-agent-cloud
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for AI-agent, prompt-injection, MCP or toolchain, cloud, container, CI/CD, and supply-chain challenges. Use when the user asks to analyze prompt-to-tool flows, retrieval poisoning, mounted secrets, deployment drift, runtime-vs-manifest mismatches, registry provenance, or CI-produced artifacts under sandbox assumptions. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
Repository stars: 44,280 · Incomplete scan
Skill
docs-generator
zhaoxuya520/reverse-skill · skills/docs-generator
Creates task-oriented technical documentation with progressive disclosure. Use when writing READMEs, API docs, architecture docs, or markdown documentation. Also use this skill at the END of any completed reverse engineering, penetration testing, CTF, or security analysis task to generate a formal report in the user's project directory. Trigger keywords: 写报告, 写文档, 出报告, writeup, 技术文档, report, documentation.
Repository stars: 44,280 · Incomplete scan
Skill
competition-ssrf-metadata-pivot
zhaoxuya520/reverse-skill · CTF-Sandbox-Orchestrator/competition-ssrf-metadata-pivot
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for SSRF reachability, internal route probing, metadata-service access, credential pivoting, and token-to-accepted-privilege chains. Use when the user asks to trace SSRF sources, internal hosts, metadata endpoints, link-local tokens, service-account credentials, or explain how a server-side fetch edge turns into accepted access. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
Repository stars: 44,280 · Incomplete scan
Skill
case-review
zhaoxuya520/reverse-skill · skills/case-review
Reviews a reverse-skill case package for scope readiness, Evidence to Finding to Path traceability, work item coverage, timeline references, and optional artifact hash integrity before report handoff.
Repository stars: 44,280 · Incomplete scan
Skill
competition-firmware-layout
zhaoxuya520/reverse-skill · CTF-Sandbox-Orchestrator/competition-firmware-layout
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for firmware images, partition tables, boot chains, update packages, extracted filesystems, embedded configs, and device-facing trust boundaries. Use when the user asks to unpack firmware, map partition layout, inspect bootloader or init chains, recover update keys or credentials, trace config loading, or explain how a device surface reaches the decisive artifact. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
Repository stars: 44,280 · Incomplete scan
Skill
competition-custom-protocol-replay
zhaoxuya520/reverse-skill · CTF-Sandbox-Orchestrator/competition-custom-protocol-replay
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for custom binary or text protocol recovery, handshake reconstruction, framing, sequence control, checksums, stateful replay, and accepted-session reproduction. Use when the user asks to decode an unknown protocol, recover custom framing, build a replay harness, satisfy sequence or checksum rules, replay a captured session, or prove the smallest message order that reaches an accepted branch. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
Repository stars: 44,280 · Incomplete scan
Skill
competition-container-runtime
zhaoxuya520/reverse-skill · CTF-Sandbox-Orchestrator/competition-container-runtime
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for live container runtime analysis, mounted secrets, sidecars, namespaces, init containers, entrypoint drift, and route-to-container resolution. Use when the user asks why a live container differs from manifests, where a mounted secret is consumed, how a sidecar or init container changes runtime state, or which route resolves to which live container. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
Repository stars: 44,280 · Incomplete scan
Skill
competition-browser-persistence
zhaoxuya520/reverse-skill · CTF-Sandbox-Orchestrator/competition-browser-persistence
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for browser cookies, localStorage, sessionStorage, IndexedDB, Cache Storage, service workers, offline caches, and client-side session persistence. Use when the user asks to inspect browser state, replay cached auth or session behavior, explain why a page behaves differently after load, or trace how stored client state changes requests, rendering, or access. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
Repository stars: 44,280 · Incomplete scan
Skill
competition-graphql-rpc-drift
zhaoxuya520/reverse-skill · CTF-Sandbox-Orchestrator/competition-graphql-rpc-drift
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for GraphQL schemas, persisted queries, RPC manifests, generated clients, OpenAPI drift, hidden operations, and contract-to-handler mismatches. Use when the user asks to inspect GraphQL or RPC requests, compare client contracts to live handlers, recover hidden operations, trace generated clients, or explain how schema or contract drift produces the decisive behavior. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
Repository stars: 44,280 · Incomplete scan
Skill
competition-reverse-pwn
zhaoxuya520/reverse-skill · CTF-Sandbox-Orchestrator/competition-reverse-pwn
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for reverse engineering, malware, DFIR, firmware, pwnable, and native exploit challenges. Use when the user asks to reverse a binary, unpack a sample, inspect a memory dump or PCAP, recover malware behavior, debug a crash, or build or verify an exploit chain under sandbox assumptions. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
Repository stars: 44,280 · Incomplete scan
Skill
js-reverse
zhaoxuya520/reverse-skill · skills/js-reverse
在使用 js-reverse-mcp 做前端 JavaScript 逆向时使用，适用于签名链路定位、页面观察取证、运行时采样、本地补环境复现与证据化输出。优先适配当前环境里的 js-reverse_* 工具，需要更强的浏览器/CDP/Hook 面时联动 jshookmcp。
Repository stars: 44,280 · Incomplete scan
Skill
src-hunter
zhaoxuya520/reverse-skill · skills/pentest-tools/src-hunter
实战 SRC / 众测 / Bug bounty 漏洞挖掘工作流 skill。包含：5 阶段方法论（intake → recon → enum → hunt → report）、19 个攻击类 playbook（SQLi/XSS/RCE/SSRF/IDOR/CSRF/Path Traversal/File Upload/SSTI/XXE/Race/HTTP Smuggling/OAuth/JWT/SAML/GraphQL/Mobile/LLM/DoS）、305 个结构化 payload、263 个 WAF/EDR 绕过变体、2887 份 HackerOne 真实 High/Critical 已披露案例、77,000+ WooYun 案例统计、国产 OA / 中间件指纹库、银行 / 电信行业垂直 playbook。当用户提到 "src 挖洞 / src 漏洞挖掘 / bug bounty / 众测 / hackerone / 漏洞赏金 / SRC / 任意 X 漏洞 / 渗透测试" 或问"如何挖某个目标 / 怎么测某个 API / 如何绕过 WAF" 时触发。
Repository stars: 44,280 · Incomplete scan
Skill
competition-malware-config
zhaoxuya520/reverse-skill · CTF-Sandbox-Orchestrator/competition-malware-config
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for malware configuration recovery, staged payload boundaries, beacon parameter extraction, and IOC decoding. Use when the user asks to recover a malware config, decode C2 or beacon fields, unpack staged payloads, extract bot or campaign IDs, or tie recovered config to observed protocol behavior under sandbox assumptions. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
Repository stars: 44,280 · Incomplete scan
Skill
binary-ninja-reverse
zhaoxuya520/reverse-skill · skills/binary-ninja-reverse
Use for authorized binary analysis in Binary Ninja, including HLIL/MLIL/LLIL inspection, strings/imports/exports, cross-references, types, patch review, Python API automation, and optional Binary Ninja MCP or localhost HTTP integration.
Repository stars: 44,280 · Incomplete scan
Skill
mobile-reverse
zhaoxuya520/reverse-skill · skills/mobile-reverse
Use for authorized Android or iOS application reverse engineering and security testing, including APK or IPA analysis, runtime instrumentation, SSL pinning, and platform protection checks.
Repository stars: 44,280 · Incomplete scan
Skill
threat-intelligence
zhaoxuya520/reverse-skill · skills/threat-intelligence
Use for authorized OSINT and cyber threat intelligence that enriches IOCs, campaigns, impersonation, scams, or threat actors from public sources. Includes bounded X/Twitter search through Xquik, source preservation, corroboration, and evidence handoff.
Repository stars: 44,280 · Incomplete scan
Skill
competition-ios-runtime
zhaoxuya520/reverse-skill · CTF-Sandbox-Orchestrator/competition-ios-runtime
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for IPA runtime analysis, Frida hooks, Objective-C or Swift method tracing, Keychain inspection, SSL pinning bypass, URL scheme handling, and iOS request-signing recovery. Use when the user asks to hook an IPA, trace Objective-C or Swift runtime behavior, inspect Keychain or plist state, bypass pinning, analyze deeplinks or universal links, or replay accepted iOS requests. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
Repository stars: 44,280 · Incomplete scan
Skill
patch-diff-exploit
zhaoxuya520/reverse-skill · skills/patch-diff-exploit
N-day 补丁差分到利用。从厂商发布的补丁里反推漏洞点、写 PoC、做成可用的攻击模块。 适用场景：已知 CVE 编号但只有补丁没有 PoC、SRC/红队需要打击未及时更新的资产、N-day 武器化、Patch Tuesday 跟进。 核心方法：拿 before/after 二进制 → 对齐符号 → 二进制 diff → 看新增的安全检查反推 bug class → 写 PoC 触发漏洞。 触发关键词：N-day、Nday、补丁差分、patch diff、patch tuesday、1day、binary diff 漏洞、bindiff 利用、ghidriff、Diaphora、补丁分析、CVE 复现、漏洞还原、补丁反推、N-day 武器化。
Repository stars: 44,280 · Incomplete scan
Skill
competition-pcap-protocol
zhaoxuya520/reverse-skill · CTF-Sandbox-Orchestrator/competition-pcap-protocol
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for packet capture analysis, session reconstruction, application-protocol decoding, stream reassembly, beacon timing, and packet-to-process correlation. Use when the user asks to analyze a PCAP, rebuild TCP or UDP sessions, decode HTTP, WebSocket, DNS, custom C2, or binary protocols, extract transferred artifacts, or tie packet sequences to host or malware behavior. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
Repository stars: 44,280 · Incomplete scan
Skill
radare2
zhaoxuya520/reverse-skill · skills/radare2
Use this skill whenever the user wants to analyze binaries with radare2/r2 from the command line, including reverse engineering, disassembly, function analysis, strings/import inspection, patching, binary diffing, hex inspection, or r2 scripting. Also use it when the user mentions PE/ELF/Mach-O/DEX/WASM files together with CLI analysis, `rabin2`, `rasm2`, `radiff2`, `r2pipe`, or asks for radare2 command help on Windows/Linux/macOS.
Repository stars: 44,280 · Incomplete scan
Skill
competition-k8s-control-plane
zhaoxuya520/reverse-skill · CTF-Sandbox-Orchestrator/competition-k8s-control-plane
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for Kubernetes API analysis, service-account trust, RBAC edges, admission and controller behavior, cluster secrets, workload mutation, and namespace-scoped drift. Use when the user asks to inspect kube API permissions, service-account tokens, RoleBinding or ClusterRoleBinding edges, admission webhooks, controller-created pods, secret exposure, or why live workloads differ from manifests. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
Repository stars: 44,280 · Incomplete scan
Skill
threat-hunting
zhaoxuya520/reverse-skill · skills/threat-hunting
Use for blue-team threat hunting, detection engineering with Sigma/YARA, SIEM query design, and incident detection validation.
Repository stars: 44,280 · Incomplete scan
Skill
competition-ad-certificate-abuse
zhaoxuya520/reverse-skill · CTF-Sandbox-Orchestrator/competition-ad-certificate-abuse
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for AD CS, certificate templates, enrollment rights, EKUs, SAN controls, PKINIT, certificate mapping, and cert-based privilege paths. Use when the user asks about ESC-style abuse, certificate templates, enrollment agents, EKUs, SAN or subject controls, smartcard or PKINIT logon, CA policy, or how an issued cert turns into accepted privilege. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
Repository stars: 44,280 · Incomplete scan
Automated signals, not a guarantee. How the checks work.
