malice-network

IoM Operational Security (OPSEC) advisor. Provides OPSEC methodology guidance, helps users understand operational risks, build secure operating habits, and accumulate experience through a case library. Does not execute commands directly; serves as decision support. Concrete technical specifications and OPSEC scoring are maintained in the iom-pentest skill. Trigger conditions: use when the user asks "is this safe?", "will this be detected?", "how should I think about OPSEC?", "risk assessment", "operational security advice", or "help me analyze the detection surface".

Autonomous penetration testing via IoM C2 MCP tools. Adaptively executes based on user intent: situational awareness, reconnaissance, privilege escalation, credential harvesting, lateral movement, persistence, and more. Presents an execution plan and waits for user confirmation before sensitive operations. Trigger conditions: user mentions penetration testing, red team, post-exploitation, privilege escalation, lateral movement, credentials, persistence, situational awareness, or any scenario involving security assessment of a target through IoM.

Complete user guide for the IoM (Implant-over-Middleware) C2 framework. Covers architecture concepts, basic operations, startup parameters, authentication configuration, troubleshooting, documentation resources, and community feedback. Trigger conditions: use this skill when the user asks about how IoM works, command usage, architecture concepts, configuration methods, how to troubleshoot issues, where to find documentation, or how to file an issue. Should also trigger for questions like "how do I connect", "what is a session", "I got an error", or "is there documentation".

MAL (Malice Scripting Language) plugin development guide. Helps users write Lua plugins for IoM, covering plugin structure, command registration, BOF invocation, resource management, event callbacks, testing, debugging, and publishing workflows. Trigger conditions: when users want to write MAL plugins, extend IoM commands, write Lua scripts, integrate BOFs, develop custom modules, or ask questions like "how to write a mal plugin", "how to add a new command to IoM", or "what Lua APIs are available".

Autonomous penetration testing through IoM C2 MCP tools. Covers the full engagement lifecycle: reconnaissance, privilege escalation, credential harvesting, lateral movement, and persistence. Operates in an OODA loop — each phase analyzes results before deciding the next action. Use this skill whenever the user wants to run automated pentest, red team assessment, privilege escalation analysis, post-exploitation, or any offensive operation through IoM — even if they just mention "pentest", "提权", "横向", "信息收集", "凭据", "持久化", or "自动化测试".