HG-ha/Argusai

access-control-workflow

Use for IDOR, horizontal/vertical privilege checks, multi-account comparisons, and business state-machine testing.

active-directory-workflow

Reviews authorized Active Directory environments through offline SharpHound/PingCastle report import and bounded Kerberos/no-password Certipy AD CS inventory. Use for Active Directory, AD CS, Certipy, BloodHound, SharpHound, PingCastle, LDAP, 域控, 活动目录, 域安全,…

agent-todo

Manage structured todos for multi-step agent work. Use when the user asks to execute, investigate, scan, fix, analyze, or continue a task with multiple steps.

ai-app-security

Use for testing AI/LLM-integrated features inside the *target* application — chatbots, RAG search, AI support agents, or any endpoint that feeds user/document input to an LLM. Covers prompt injection, insecure output handling, excessive agency, and RAG data…

assistant-cron

Schedule recurring or durable continuation turns (interval/cron). Use for patrols, briefings, scans, and periodically resuming unfinished Agent work; manage via cron_* tools.

authorized-pentest

Use when the user asks for an authorized penetration test, exploit-chain planning, controlled vulnerability verification, ROE handling, or safe validation of network/service findings.

binary-triage

Use for EXE, DLL, ELF, process dump, malware triage, native reverse engineering, decompiling/disassembling a function, understanding code, unpacking installers / setup.exe (Inno Setup), and PATCHING / modifying a binary (NOP a check, change a jump, redirect a…

browser-attach-workflow

Choose between the hidden automation browser (watched in the Browser sidebar) and attaching the user's real Chrome/Edge. Launching a debug browser does not attach it; call browser_attach_existing next. Team members share that one attached browser.

case-evidence-workflow

Use for multi-step security analysis, reverse engineering, audits, exploit verification, reports, or any task where evidence must survive context compaction. Establishes Case, Artifact, Evidence, and stable-reference habits across Web, network, mobile, and…

channel-interaction

Interact well on paired remote channels (Feishu, Telegram, Discord, Slack, DingTalk, WeCom, WeChat, Webhook). Prefer clickable UI-block decisions, stage replies under /live, and deliver sandbox files with channel_send_file — not MCP.

cloud-security-workflow

Reviews authorized cloud accounts, container images, and Kubernetes clusters with read-only Trivy, Prowler, and kubectl workflows. Use for AWS, Azure, GCP, Kubernetes, K8s, container image, cloud posture, 云安全, 云账户, 容器镜像, or 集群安全.

daily-productivity

Use when the user asks to organize files, transform documents, summarize a file, generate tables/checklists, manage reminders, or handle ordinary desktop productivity chores.

desktop-automation

Use when the user asks to observe or control local desktop applications outside the browser, including screenshots, mouse, keyboard, hotkeys, opening QQ/WeChat/music apps, or macOS/Windows desktop automation permissions.

findings-review

Review scan findings and present them clearly. Use when the user asks about results, vulnerabilities, findings, or what a scan discovered.

firmware-security-workflow

Performs offline, non-executing firmware triage over an authorized image or already extracted root filesystem. Use for firmware, rootfs, binwalk, embedded Linux, IoT image, 固件分析, 物联网固件, 文件系统提取, or 嵌入式安全.

hardware-security-workflow

Plans identification-only hardware assessment and offline UART/flash evidence analysis without erase, program, write, unlock, voltage changes, or automatic elevation. Use for UART, JTAG, SWD, OpenOCD, CHIPSEC, sigrok, flash dump, 硬件安全, 串口, 闪存, or 逻辑分析仪.

http-desync-workflow

Use for HTTP request smuggling, cache poisoning and raw HTTP validation under explicit authorization.

iac-security-workflow

Performs offline Infrastructure-as-Code review with Trivy and Checkov over authorized local Terraform, CloudFormation, Kubernetes, Helm, Dockerfile, ARM, Bicep, and CI configuration. Use for IaC, Terraform, Checkov, misconfiguration, 基础设施即代码, 配置审计, or 云配置代码.

identity-workflow

Use for CORS, CSRF, OAuth/OIDC/SAML/JWT analysis and PoC generation.

js-reverse

Use for any JavaScript reverse-engineering task — deobfuscation, source map recovery, webpack/Vite/Rollup unpacking, dynamic browser hooks, custom sign/encrypt scheme recovery, WASM disassembly, Python-only PoC generation. Use when the user asks "how does…

knowledge-base

Distill, retrieve, and revise your own long-term knowledge across assistant sessions. Use proactively at the start of any non-trivial task (search for prior solutions) and at the end (sediment what worked). Also use when the user says "记一下", "沉淀", "记到知识库",…

mcp-provision-workflow

Extend ArgusAI through reviewed MCP servers, external CLIs, adapters, or desktop software. Safely discover, pin, stage, register, validate, use, and revoke third-party capabilities.

memory-recall

Recall previous conversations, decisions, scan tasks, user preferences, and cross-session context. Use when the user refers to earlier work, says "之前", "刚才", "上次", "以前", "那个任务", "其他会话", or asks what was discussed before.

mobile-dast-workflow

Plans observation-first dynamic testing of authorized Android or iOS applications with an existing Appium server, test device, proxy, and bounded logs. Use for Appium, mobile DAST, Android dynamic testing, iOS dynamic testing, 移动动态测试, 手机应用测试, or 真机流量分析.

mobile-reverse

Use for Android APK, iOS IPA, mobile app reverse engineering, Frida/JADX/APKTool planning, mobile API extraction, certificate pinning analysis, and mobile traffic evidence workflows.

multi-agent-orchestration

Decide between a persistent Team-sidebar squad (team_*) and temporary child Agents inside this chat (spawn_agent / spawn_team / run_subagent). Words like 小队, 团队, 建队, or "let the team do it" mean the persistent Team. spawn_team is only a one-off split of the…

network-triage

Use for system and network security triage, host/service discovery, CIDR assessment, port/service evidence, protocol review, and pcap-oriented analysis.

oob-workflow

Use for blind SSRF, blind XSS, XXE, command injection and SQLi OOB correlation via ArgusAI's built-in Interactsh client.

pcap-workflow

Performs safe offline packet-capture triage with TShark summaries, display filters, and clear-text HTTP metadata extraction. Use for PCAP/PCAPNG files, packet captures, Wireshark/TShark analysis, network forensics, 流量包, 抓包分析, 数据包分析, 网络取证, or 离线流量分析.

poc-page-workflow

Create safe local HTML proof-of-concept pages for authorized web security tests, one-click attack demos, XSS labs, opener/name payloads, and browser interaction PoCs. Do not use for CORS exploitability verification.

post-exploit-assessment

Use for authorized post-exploitation impact assessment, safe impact modeling, evidence planning, and sandbox-only lab harness generation. Do not use for persistence, stealth, credential theft, lateral movement automation, or data exfiltration.

proactive-defense

Plans and executes authorized defensive security operations: business security checks, log review, attack-surface baselines, patrols, alert triage, incident response, and attack tracing. Use when the user asks for 主动防御、业务安全检查、日志检查、安全巡检、告警处置、攻击溯源 or equivalent…

proxy-decrypt-workflow

Decrypt application-layer encrypted proxy traffic (AES/DES/3DES/SM4/RC4/XOR/RSA, base64/hex/gzip layers, custom JS) by building ArgusAI decryption rules. Use when captured requests/responses look encrypted or encoded, or the user asks to auto-decrypt traffic…

proxy-guide

Help users set up and use the passive proxy. Use when the user asks about proxy, passive scanning, traffic capture, MITM, or intercepting HTTP/HTTPS.

proxy-rewrite-workflow

Actively rewrite or block live proxied HTTP traffic with ArgusAI rewrite rules — inject/strip headers, change method/query/status, replace body text, or short-circuit a request with a canned response. Use when the user wants to tamper with, mock, block, or…

proxy-traffic-query

Write ArgusAI's field-style traffic filter expressions (host:/re/ method:POST status:4xx resp.body:/token/ …) for proxy_search_traffic, decryption-rule match fields and the GUI filter box. Use when searching, filtering or selecting captured proxy flows, or…

race-condition-workflow

Use for authorized race-condition and business timing tests such as duplicate coupon redemption, double spending, limit bypass, repeated state transitions, and TOCTOU flaws. Uses one bounded Python script inside the session sandbox to issue a synchronized…

repository-audit

Use for white-box testing, source-code audit, repository review, SAST-like investigation, code review for security, or when the user provides a local source directory. Triggers include 白盒, 白盒测试, 源码审计, 代码审计, 仓库审计, source code audit, repository audit, codebase…

sca-sbom-workflow

Performs offline software composition analysis, local dependency inventory, SBOM generation/diff, and vulnerability-result review with Syft, Trivy, and OSV-Scanner. Use for SCA, SBOM, CycloneDX, SPDX, dependency vulnerabilities, software supply chain, Syft,…

scan-setup

Guide users through creating a security scan. Use ONLY when the user explicitly asks to scan, audit, test, or run security checks on a URL. Do not trigger this skill from vague requests like "看下这个 URL" or "analyze this page" — start with read-only inspection…