NUSGreyhats/ctf-agent-workstation
Skill Claude CodeCodex
Use when a single file falls into one of three trip-up cases the model reliably gets wrong without a recipe: (1) Corrupted-header repair where magic bytes / IHDR / SOI / EOI / CRC / central-directory fields have been clobbered and need precise byte-level reconstruction (PNG height-restore, JPEG marker repair, ZIP EOCD…
NUSGreyhats/ctf-agent-workstation
Skill Claude CodeCodex
Use for packet captures where the answer needs tool-specific extraction recipes the model doesn't keep straight: USB HID keystroke decoding from usb.capdata (the keycode→character map is fiddly), TLS keylog reconstruction via SSLKEYLOGFILE, file carving from HTTP/SMB/FTP streams via Wireshark export-objects or…
NUSGreyhats/ctf-agent-workstation
Skill Claude CodeCodex
Use ONLY when the disk image is in a forensic format that needs specialized mounting (.E01/EWF via ewfmount, .qcow2/.vmdk/.vhd via qemu-img convert, .AFF via affuse) OR when the task explicitly requires Sleuth Kit-style filesystem inspection: deleted-file recovery via inode (icat / tskrecover), MFT parsing…
NUSGreyhats/ctf-agent-workstation
Skill Claude CodeCodex
Use ONLY for full-system memory dumps (.lime, .raw, .mem, .vmem, full Windows crashdump) where the analysis requires Volatility 3 plugin syntax — the namespacing the model habitually gets wrong (windows.pslist.PsList, linux.pslist.PsList, windows.malfind.Malfind, etc.) — or Linux symbol generation via dwarf2json for…
NUSGreyhats/ctf-agent-workstation
Skill Claude CodeCodex
Use when solving CTF challenges, debugging exploits, reviewing vulnerabilities, or making technical claims that should be verified with evidence. This skill forces hypotheses to be grounded through local reproduction, instrumentation, emulation, controlled probes, or other direct observations before relying on…
NUSGreyhats/ctf-agent-workstation
Skill Claude CodeCodex
Automatically find gadgets and assemble ROP chains for pwn challenges with angrop (angr's ROP engine). Use ONLY when you actually need to BUILD a ROP chain — e.g. set registers for a syscall, ret2syscall/execve, ret2libc-style funccall, write "/bin/sh" to memory, stack pivot, or mprotect+shellcode. Trigger on…
NUSGreyhats/ctf-agent-workstation
Skill Claude CodeCodex
Use for Android APK reverse engineering where the workflow specifically requires apktool (manifest, smali, resources, repackaging), jadx (DEX → Java/Kotlin decompilation with deobfuscation), or IDA Pro on bundled native .so libraries. The trip-ups this skill closes: deciding when JNI native libs hold the real logic…
NUSGreyhats/ctf-agent-workstation
Skill Claude CodeCodex
Analyze binaries using IDA Pro's Python Domain API (ida-domain) in headless mode (idalib). Use when examining program structure, functions, disassembly, cross-references, or strings without the GUI.
NUSGreyhats/ctf-agent-workstation
Skill Claude CodeCodex
Debug Linux kernels using bata24/GEF (GDB Enhanced Features) via the GDB MCP. Use when doing kernel debugging, exploit development, slab/heap inspection, task/cred analysis, memory layout investigation, ROP gadget search, or any qemu-system kernel GDB session. Trigger on kernel debugging, GEF commands, slab analysis…