allsmog

Interprocedural, hypothesis-driven hunt — finds the multi-file source→sink bugs that pattern-gating and same-file taint miss. Ranks trace anchors (entry points + dangerous sinks), then the deep-hunter agent walks each flow ACROSS files (forward/backward call-graph CLIs) over multiple rounds, confirming propagation and defeating guards, and promotes confirmed cross-file flows into findings.json with the path stored as evidenceGraph. Token-expensive, budget-bounded. Part of the HUNT phase (run via /sweep --deep, or ask for it); leads flow to /verify (panel).

Whole-file deep reader — finds bugs by READING risk-ranked files in full and reasoning from first principles, not by grepping for known patterns. Catches the long tail (project-specific wrappers, business logic, cross-function flaws) that pattern-gated producers structurally miss. Token-expensive; budget-bounded and risk-ranked. Promotes leads into .kuzushi/findings.json (source "deep-scan").

IRIS-style source→sink taint hunt. Ranks a typed CWE catalog for the repo, then drives subagents to label dangerous sinks, label sources of user input, run Joern/CodeQL dataflow queries (or same-file linking) to connect them, and triage each flow as finding/candidate/rejected. Promotes verdicts into .kuzushi/findings.json. Benefits from a prebuilt CodeQL DB / Joern CPG but degrades gracefully.

Adversarial per-threat review (Carlini doctrine). For each threat in .kuzushi/threat-model.json, state attacker capabilities, walk source→sink, attempt to bypass every guard, and assign a verdict with evidence. Promotes findings into .kuzushi/findings.json. Requires /threat-model first.

Split the attack surface into parallel-discovery partitions so fan-out hunters explore different subsystems instead of converging on the same shallow bug. Deterministic grouping of /x-ray entry points by component → .kuzushi/partitions.json, which a hunt coordinator hands to one subagent per partition. Run /x-ray first.

Empirical proof-of-concept for the PoC-ready findings. For each finding /verify marked confirmed-exploitable or inconclusive, synthesize a minimal harness that triggers the bug; a host script then runs it in a sandbox (Docker --network none when present, else a gated local run) and classifies the crash into a proof verdict. Attaches a poc block onto each finding. Requires /verify first.

Measure recall / precision / false-proof rate of the pipeline against a ground-truth manifest. Scores either the bundled planted-vulnerability corpus (regression) or a live run's findings.json against a manifest you supply. Deterministic — no agent, no network. Use to prove a change to the producers helps rather than hurts.

Adversarial business-logic and invariant-violation hunt. For each intended-behavior invariant (from /deep-context) and logic-bug code shape, the logic-hunter agent tries to construct an operation sequence that violates the property — broken atomicity, out-of-order state transitions, authorization-by-omission, replay, business-rule abuse — then assigns a verdict from a closed set with file:line evidence. Promotes violations into findings.json. Strongest after /deep-context.

Use this skill when the user is auditing a decompiled Android application — directory structure includes `jadx_out/` / `apktool_out/`, files end in `.smali` / are jadx-renamed to `defpackage/*.java`, or the conversation mentions an APK / xAPK / `com.example.*` package. Covers the high-signal vulnerability classes vuln-scout detects in decompiled APKs and the conventions for running the unified mobile-audit workflow.

Use this skill when the user is auditing an iOS application — directory contains `.ipa`, `Info.plist`, `*.swift`, `*.m`, `*.mm`, or an `xcodeproj`. Also activates when the conversation mentions WKWebView, NSURLSession, Keychain, App Transport Security, or any `com.apple.*` / `bundleidentifier`-style iOS package name.

Use this skill when reviewing mobile code that handles card data, payment tokenization, or third-party payment SDK integrations (Braintree, Stripe, Adyen, Google Pay, Apple Pay, FirstData-style iframe encryptors). The skill catalogues the high-signal attack patterns vuln-scout detects in mobile payment flows — server-controlled tokenization URLs, JavaScript-injection-into-WebView card-data exfiltration, JS-bridge token construction, and payment scope mismatches — and maps each to the detector that fires.

This skill should be used when the user asks about "business logic", "workflow vulnerability", "trust boundary", "state machine", "authorization bypass", "multi-step process", "workflow bypass", "application logic flaw", or needs to identify business logic vulnerabilities during whitebox security review.

This skill should be used when the user asks about "cache poisoning", "web cache deception", "CDN cache", "proxy cache", "nginx cache", "varnish", "cache key manipulation", "response caching", or needs to find cache-related vulnerabilities during whitebox security review.

This skill should be used when the user asks about "cloud security", "AWS security", "GCP security", "Azure security", "Kubernetes security", "IMDS", "instance metadata", "S3 bucket policy", "IAM", "serverless security", "Lambda security", "container security", "cloud misconfiguration", "SSRF to cloud metadata", or needs to identify cloud-native security issues during whitebox security review.

This skill should be used when the user asks about "cryptographic failures", "weak encryption", "hardcoded secrets", "insecure random", "MD5", "SHA1", "weak hashing", or needs to find crypto-related vulnerabilities during whitebox security review.

This skill should be used when the user asks about "dangerous functions", "security sinks", "what functions are dangerous in PHP/Java/Python", "find vulnerable functions", "code execution functions", "command injection sinks", "SQL injection functions", or needs to identify security-sensitive functions in source code during whitebox security review.

This skill should be used when the user asks about "Active Directory", "Kerberoasting", "AS-REP roasting", "LDAP enumeration", "BloodHound", "DCSync", "Pass-the-Hash", "Golden Ticket", or needs guidance on attacking Windows domain environments.

This skill covers Cacti network monitoring tool exploitation including authenticated RCE via graph templates (CVE-2025-24367), unauthenticated command injection (CVE-2022-46169), and authentication bypass techniques.

This skill should be used when the user asks about "searchsploit", "CVE exploits", "exploit database", "common vulnerabilities", "reverse shells", "webshells", or needs guidance on exploiting common vulnerabilities and services.

This skill covers container escape techniques for Docker, LXC/LXD, and Kubernetes environments. Includes Docker socket escape, Docker Desktop API escape (192.168.65.7:2375), privileged container breakout, and capability-based escapes.

This skill should be used when the user asks about "password cracking", "brute force", "hydra", "hashcat", "john", "credential stuffing", "password spraying", or needs guidance on credential-based attacks.

This skill should be used when stuck on a CTF challenge or when the user asks to look up a writeup. Use EARLY when brute forcing or guessing seems like the only option - writeups often reveal the intended path. Trigger on: "look up writeup", "how do others solve", "stuck", "what's the intended path", machine names like "Soulmate", "Headless".

This skill should be used when the user asks about "dump database", "extract credentials", "sqlite", "mysql credentials", "database passwords", or needs to extract user data from common database systems.

This skill should be used when Erlang/OTP services are detected: - Port 4369 (EPMD - Erlang Port Mapper Daemon) - Erlang SSH (usually port 2222) - RabbitMQ, CouchDB, or other Erlang-based services Covers CVE-2025-32433 pre-auth RCE and other Erlang attack vectors.

Preserve web, social, image, video, and document evidence in an OSINT investigation. Use when URLs, posts, pages, media, or search results need archiving, hashing, screenshots, Wayback/archive.today/Hunchly/Auto Archiver handling, or an audit trail.

Review conflicting OSINT claims, separate evidence from inference, identify source circularity, compare support and contradiction rows, and produce confidence judgments with caveats.

Geolocate or assess geolocation readiness for images, videos, facilities, routes, conflict footage, proof-of-life scenes, transport sightings, or environmental observations using maps, OSM, Search Grid, satellite imagery, shadows, and visual clues.

Start or continue a target-agnostic OSINT investigation by defining claims, source tiers, evidence requirements, archive needs, and collection priorities. Use when the user asks to investigate a person, organization, event, conflict, location, company, network, or disputed claim using open sources.

Assess whether a person is alive, dead, hidden, incapacitated, or represented only by an office or intermediary. Use for proof-of-life investigations involving recent public appearances, dated audio/video, official statements, rumors, succession language, or biometric/visual evidence.

Map companies, sanctions records, beneficial ownership leads, aliases, financial nodes, procurement networks, politically exposed persons, crypto addresses, and linked entities in an OSINT investigation.

Trace social-media and messaging-platform rumors, first appearances, repost networks, account provenance, and source cascades. Use for Telegram, X, YouTube, TikTok, Instagram, Facebook, or other social claims in OSINT work.

Verify OSINT images or videos for recency, reuse, manipulation, source provenance, metadata, keyframes, and geolocation readiness. Use for alleged proof-of-life media, conflict footage, official meeting images, incident videos, or disputed screenshots.

This skill should be used when the user asks to "debug binary", "find offset", "calculate padding", "use gdb", "attach debugger", "crash analysis", "cyclic pattern", "test exploit", "bad characters", "find bad chars", or needs to perform runtime analysis of a binary. Provides methodology for dynamic debugging with GDB/pwndbg including bad character detection.

This skill should be used when the user asks to "setup pwn environment", "install pwntools", "check pwn tools", "verify exploitation tools", "create exploit workspace", "initialize pwn project", or needs to verify binary exploitation tool availability. Provides guidance for detecting, installing, and configuring pwn tools.

This skill should be used when the user asks to "write exploit", "build payload", "create rop chain", "exploit binary", "pwn challenge", "get shell", "ret2libc", "bypass protection", or needs guidance on constructing exploitation payloads. Provides protection-aware exploitation techniques and payload construction.

This skill should be used when the user asks to "exploit heap", "heap overflow", "tcache poison", "fastbin attack", "double free", "use after free", "UAF exploit", "house of force", "heap feng shui", "malloc exploit", "free hook", or needs guidance on heap-based memory corruption vulnerabilities. Provides comprehensive heap exploitation techniques for glibc.

This skill should be used when the user asks to "identify libc", "find libc version", "libc database", "leak libc address", "determine libc", "fingerprint libc", or needs to identify the remote libc version from leaked addresses. Provides methodology for libc fingerprinting and offset calculation.

This skill should be used when the user asks to "analyze binary", "run checksec", "check binary protections", "identify architecture", "find strings in binary", "extract symbols", "recon binary", or needs initial binary analysis before exploitation. Provides methodology for the reconnaissance phase of binary exploitation.

This skill should be used when the user asks to "disassemble binary", "analyze functions", "find vulnerability", "reverse engineer", "identify buffer size", "find dangerous functions", "analyze stack layout", or needs to perform static code analysis on a binary. Provides methodology for identifying vulnerabilities through disassembly.

This skill should be used when building attack trees, when the user mentions "attack tree", "attack path", "AND/OR tree", "threat tree", "multi-step attack", or needs to construct structured attack decompositions.

This skill should be used when creating data flow diagrams, when the user mentions "DFD", "data flow diagram", "trust boundaries", "data flows", "Mermaid diagram", or needs to visualize how data moves through the system.

This skill should be used when mapping threats to MITRE ATT&CK techniques, when the user mentions "ATT&CK", "MITRE", "T-codes", "attack techniques", "tactics and techniques", "kill chain", or needs to reference the ATT&CK Enterprise framework for threat classification.

This skill should be used when the user mentions "PASTA", "threat modeling methodology", "Process for Attack Simulation", "7-stage threat model", "OWASP threat modeling", or needs to understand the PASTA framework stages, outputs, and how they connect.

This skill should be used when classifying threats using STRIDE methodology, when the user mentions "STRIDE", "spoofing threats", "tampering threats", "repudiation", "information disclosure", "denial of service", "elevation of privilege", or needs to categorize security threats by type.

Complete taxonomy of 80+ attack plugins organized by category, technique, and OWASP mapping

Compliance requirements for LLM applications under HIPAA, COPPA, FERPA, and GDPR, with testing methodology and evidence requirements

How to identify and analyze LLM integration points across popular frameworks — OpenAI SDK, Anthropic SDK, LangChain, LlamaIndex, Vercel AI SDK

Comprehensive knowledge of the OWASP Top 10 for LLM Applications (2025), including attack mappings, detection methodology, and remediation checklists

Actionable fix patterns for LLM vulnerabilities — system prompt hardening, input validation, output filtering, and tool sandboxing

This skill should be used when the user mentions "ISO 27001", "Annex A controls", "information security controls", "ISMS controls", "compliance controls", "ISO 27001 assessment", or needs to understand specific ISO 27001:2022 control requirements for code-level compliance assessment.

Use this skill when generating ISO 27001 or NIST SP 800-53 audit evidence packs, compliance reports, evidence narratives, reviewer-ready control matrices, or when the user asks about audit evidence, compliance evidence, evidence packages, audit documentation, or ISO/NIST evidence.

This skill should be used when the user mentions "NIST 800-53", "NIST SP 800-53", "NIST controls", "federal compliance", "FedRAMP controls", "FISMA", "NIST security controls", "800-53 assessment", or needs to understand specific NIST SP 800-53 Rev 5 control requirements for code-level compliance assessment.

This skill should be used when mapping ISO 27001 controls to other compliance frameworks (SOC 2, NIST 800-53, PCI DSS), when the user asks about "cross-standard mapping", "control mapping", "SOC 2 equivalent", "NIST mapping", "PCI DSS mapping", or when findings from one standard need to be translated to another framework.

Run IRIS neurosymbolic SAST. Trigger on: run IRIS, run augur, neurosymbolic SAST, custom CodeQL taint analysis, LLM-labeled static analysis, find vulns with CodeQL, generate custom taint queries from LLM-labeled sources/sinks.