badi

Market and demand research procedures. Niche discovery, demand sizing, competitor/gap analysis, opportunity scoring, and pricing/positioning signals BEFORE building. Triggers on: market research, demand, niche, opportunity sizing, competitor analysis, TAM, positioning, pricing, go-to-market, validate idea, is there demand.

Choosing between app.json vs app.config.ts vs app.config.js, environment variables, variants, extra fields, plugin chain, and slug/scheme/bundle/version discipline. Triggers on app.json, app.config.ts, app.config.js, expo config, environment variable, .env, eas secret, variant, extra field, slug, scheme, bundle identifier, package name, version, build number, version code.

Writing Expo config plugins, withInfoPlist, withAndroidManifest, withDangerousMod, mod compose, plugin testing, and registration in app.config.ts. Triggers on config plugin, with-plugin, withInfoPlist, withAndroidManifest, withDangerousMod, withEntitlementsPlist, withGradleProperties, mod, native config, expo plugin, plugin test, app.config plugin.

Custom development builds with expo-dev-client, build profiles, a custom dev menu, runtime-version compatibility, and EAS Update integration. Triggers on expo-dev-client, dev client, custom dev build, development build, dev menu, expo go, runtime version, debug build, dev launcher, scan qr, dev server.

iOS and Android build profiles with EAS Build, credentials management, build cache, secrets, and monorepo support. Triggers on eas build, eas.json, build profile, credentials, provisioning profile, keystore, push certificate, service account, build cache, eas secret, monorepo, development build, preview build, production build.

App Store Connect and Google Play Console upload flow with EAS Submit, metadata, build-artifact selection, review notes, and phased release. Triggers on eas submit, app store connect, google play, asc api key, service account, metadata, screenshot, phased release, review notes, testflight, internal testing, production submit, release management.

Publishing OTA updates with EAS Update, channels, runtime versions, branch management, and rollback strategy. Triggers on eas update, ota, over-the-air, runtime version, channel, branch, rollback, embedded update, asset selection, expo-updates, hot update, partial release, release cohort.

Writing Swift/Kotlin native modules with the Expo Modules API, requireNativeModule, async functions, view modules, and the event-emitter pattern. Triggers on expo modules, native module, swift, kotlin, requireNativeModule, expo-module-scripts, expo.modules.json, view module, event emitter, native function, async function, native code, jsi.

expo-notifications setup, push tokens, FCM + APNs credentials, categories, scheduled notifications, channels, and the permission flow. Triggers on expo-notifications, push notification, fcm, apns, push token, notification permission, notification channel, notification category, action button, scheduled notification, local notification, badge, silent push.

Expo + React Native cross-platform mobile app development orchestrator — workflow selection (managed/bare/dev-client), project setup, eas profile discipline, release strategy. Triggers on expo, react native, eas, mobil, app store, play store, ios, android, app.json, eas.json, prebuild, expo-router, expo-modules.

Managed-to-bare transition with Expo prebuild, the ios/android directories, .easignore, native-upgrade discipline, and custom-mod application order. Triggers on expo prebuild, prebuild, managed to bare, bare workflow, native upgrade, ios android directory, easignore, prebuild cache, eject, sync native, native code generation.

File-based routing with Expo Router, dynamic routes, layout hierarchy, deep linking, and navigation patterns. Triggers on expo-router, file-based routing, app dizini, _layout.tsx, [id].tsx, deep linking, expo-linking, tab navigation, stack navigation, drawer, prefetch, parallel routes, redirects, navigation, useRouter, useLocalSearchParams.

Common Expo errors: Metro cache, version mismatch, expo-doctor, Pod install, Gradle daemon, native module conflicts, EAS Build logs, dependency hoisting. Triggers on expo error, metro cache, version mismatch, expo-doctor, expo install check, pod install error, gradle error, native module not found, build failed, eas build log, dependency conflict, hermes error, hoisting.

Active Directory pentest methodology — BloodHound graph analysis, Kerberos abuse, ACL exploitation, lateral movement path advisory. Triggers on Active Directory, AD pentest, BloodHound, Kerberoasting, AS-REP, DCSync, Golden Ticket, Silver Ticket, NTLM relay, lateral movement, Impacket, NetExec, Certipy.

API security testing — REST/GraphQL/WebSocket, OWASP API Top 10, JWT/OAuth analysis, mass assignment, broken object-level authorization advisory. Triggers on API pentest, OWASP API, REST security, GraphQL test, WebSocket, JWT analysis, OAuth flow, BOLA, BFLA, mass assignment.

Business logic flaw hunting — price manipulation, race condition, workflow bypass, authorization edge case advisory. Triggers on business logic, bizlogic, race condition, price manipulation, workflow bypass, payment flaw, coupon abuse, refund abuse, time-of-check race.

Bug bounty methodology — HackerOne/Bugcrowd/Intigriti, deduplication, report writing, severity scoring, payout maximization advisory. Triggers on bug bounty, HackerOne, Bugcrowd, Intigriti, H1, BB, dedup, severity, CVSS scoring, bug report writing, triage.

CI/CD red team methodology — GitHub Actions, GitLab CI, Jenkins pipeline security analysis, secret leak, workflow injection advisory. Triggers on CI/CD pentest, GitHub Actions security, GitLab CI, Jenkins, pipeline injection, workflow injection, secret leak, OIDC abuse, runner takeover, supply chain.

Cloud security pentest — AWS/Azure/GCP IAM analysis, lateral path, container escape pattern, serverless abuse advisory. Triggers on cloud pentest, AWS, Azure, GCP, IAM, S3 misconfig, EC2 metadata, Azure AD, GCP IAM, Pacu, ScoutSuite, Prowler, CloudGoat.

Credential testing methodology — hash crack selection, wordlist generation, password spray (advisory), default cred audit. Triggers on credential testing, hash crack, Hashcat, John the Ripper, password spray, wordlist generation, cupp, CeWL, Crunch, hashid, default password, credential stuffing.

CTF (Capture the Flag) challenge solving advisory — HackTheBox, TryHackMe, PicoCTF, web/pwn/rev/crypto/forensics. Triggers on CTF, HackTheBox, HTB, TryHackMe, THM, PicoCTF, OverTheWire, pwn, reverse engineering, crypto challenge, forensics challenge, stego.

Detection engineering — Sigma, Splunk SPL, Elastic KQL, Microsoft Sentinel KQL, YARA, Suricata rule writing advisory. Triggers on detection engineering, Sigma rule, Splunk SPL, Elastic KQL, Sentinel KQL, YARA, Suricata, Snort, SIEM rule, EDR rule, hunting query.

Penetration testing engagement planning — scoping, ROE drafting, phased timeline, MITRE ATT&CK mapping, kickoff/closeout documentation. Triggers on engagement plan, ROE, rules of engagement, scoping, pentest plan, phased plan, MITRE mapping, attack matrix, kickoff, closeout.

Multi-step exploit chain analysis — linking low/medium severity findings into a critical chain, stealth+impact scoring advisory. Triggers on exploit chain, attack chain, chain analysis, multi-step attack, kill chain, attack path, stealth scoring, impact analysis.

Digital forensics — evidence acquisition, memory/disk imaging analysis, timeline reconstruction, IOC extraction advisory. Triggers on forensics, DFIR, Volatility, memory analysis, disk image, Autopsy, FTK, timeline, IOC extraction, evidence chain, log analysis.

LLM application red team — OWASP LLM Top 10, prompt injection, RAG poisoning, MCP server abuse, agent tool abuse, jailbreak testing advisory. Triggers on LLM red team, prompt injection, jailbreak, RAG poisoning, OWASP LLM Top 10, MCP abuse, agent tool abuse, AI security testing.

Malware analysis — triage, static analysis, dynamic sandbox, IOC extract, YARA signature writing advisory. Triggers on malware analiz, malware triage, sandbox, Cuckoo, IDA, Ghidra, dynamic analysis, IOC, YARA imza, packer, unpacker, reverse malware.

Mobile application pentest — Android/iOS, MASTG/MASVS, Frida/Objection dynamic analysis, certificate-pinning bypass, IPC test advisory. Triggers on Android pentest, iOS pentest, Frida, Objection, MobSF, MASTG, MASVS, certificate pinning, root detection, jailbreak detection, IPC, deep link.

Operator OPSEC + evidence handling — operator identity hygiene, source IP design, burner infrastructure, evidence chain of custody, log retention advisory. Triggers on OPSEC, operator anonymity, source IP hygiene, burner infrastructure, evidence chain, chain of custody, log retention, attribution, fingerprint hygiene.

Authorized penetration testing engagement orchestrator — scope declaration, OPSEC tagging, evidence-handling discipline. Triggers on pentest, penetration test, red team, engagement, ROE, scope, security assessment, vulnerability assessment, ethical hacking. ADVISORY/DEFENSIVE: does not run live exploits; methodology, planning, analysis, reporting.

Privilege escalation methodology — Linux + Windows + container escape advisory. LinPEAS/WinPEAS analysis, SUID/capability abuse, kernel exploit selection. Triggers on privesc, privilege escalation, LinPEAS, WinPEAS, SUID, capability, sudo abuse, kernel exploit, Windows token, UAC bypass.

Reconnaissance and enumeration advisory — Nmap/Nessus/Nikto/BloodHound output parsing, attack surface prioritization, next-step suggestions. Includes OSINT (domain recon, email harvest, breach data). Triggers on recon, reconnaissance, enumeration, Nmap output, attack surface, target prioritization, subdomain enum, port scan analysis, OSINT, domain recon.

Penetration test report writing — executive summary, technical writeup, CVSS scoring, remediation roadmap advisory. Triggers on pentest report, executive summary, technical writeup, CVSS, remediation roadmap, finding writeup, retest report.

Social engineering pentest methodology — phishing strategy, pretexting, vishing scenario, awareness training advisory. No live phishing operation. Triggers on social engineering, phishing, vishing, pretext, awareness, OSINT-driven pretext, GoPhish, Evilginx, phishing simulation.

DISA STIG (Security Technical Implementation Guide) audit + GPO remediation + keep-open justification advisory. Triggers on STIG, DISA, SCAP, OpenSCAP, Compliance Master, GPO, group policy hardening, keep-open justification, CKL.

Threat modeling — STRIDE, DREAD, attack tree, data flow diagram, MITRE ATT&CK Navigator integration. Triggers on threat model, STRIDE, DREAD, attack tree, DFD, data flow diagram, MITRE ATT&CK, threat matrix, risk scoring.

Web application security testing methodology — OWASP Top 10, SSRF, IDOR, auth bypass, injection-class advisory. Burp/ZAP output analysis. Triggers on web pentest, OWASP, SQL injection, XSS, SSRF, IDOR, auth bypass, Burp output, ZAP, parameter pollution, request smuggling.

Wireless network pentest — WPA/WPA2/WPA3, evil twin, 802.1X enterprise, Bluetooth advisory. Triggers on wireless pentest, WiFi, WPA2, WPA3, PMKID, evil twin, deauth, Aircrack, hcxdumptool, 802.1X, Bluetooth, BLE security.

Master orchestration skill that coordinates the entire 4-phase security scanning pipeline

False positive elimination and confidence scoring for all security findings