NeverSight/NeverD

neverd-x64-c-quality

Continue NeverD x64 PE/COFF C-quality work: HighC structured C, LLVMC (llvm-to-C / `neverd decompile --llvm`) for obfuscated executables, Windows SEH/C++ EH readability, unnamed globals, local declarations, and Win64 ABI. Use when the user asks to improve x64…

github-ci-runtime-debugging

Diagnose NeverD runtime tests that fail only or intermittently on GitHub Actions. Use for runner-specific crashes, signals, timeouts, or semantic mismatches; not ordinary local failures or workflow configuration errors.

anti-cheat-systems

Analyze anti-cheat architecture and detection tradeoffs across client, kernel, hypervisor, and backend layers. Use for system-level defense design; use narrower skills for PCIe DMA or Windows kernel details.

awesome-game-security-overview

Maintain the awesome-game-security resource index. Use when adding or reclassifying links, organizing categories, or checking README format; use topic skills for security research itself.

compiler-development

Build compiler frontends, IR generation, optimization pipelines, or code generation with LLVM. Use for language and DSL compiler work; use narrower LLVM skills for isolated tooling or analysis tasks.

dma-attack-techniques

Analyze PCIe DMA threats, FPGA device behavior, and IOMMU defenses. Use for DMA-specific threat modeling or detection; use windows-kernel-security for kernel mechanisms without a DMA boundary.

dynamic-instrumentation

Build dynamic instrumentation, runtime tracing, coverage, profiling, or monitoring with LLVM-related tooling. Use static-analysis when execution is not part of the analysis.

game-engine-resources

Research game-engine internals, source trees, SDK extraction, plugins, and engine-specific security surfaces. Use for Unreal, Unity, Source, Godot, or custom-engine structure rather than generic cheat techniques.

game-hacking-techniques

Classify game-cheat implementation surfaces and their defensive implications. Use for authorized threat modeling of memory access, injection, overlays, input, or engine attack surfaces.

graphics-api-hooking

Analyze graphics API interception, overlays, and render pipelines across DirectX, OpenGL, and Vulkan. Use for swap-chain, Present, SwapBuffers, shader, draw-call, or capture interactions.

llvm-learning

Teach LLVM, Clang, and compiler concepts or assemble a learning path. Use for explanations and educational resources, not implementation work covered by a specialized LLVM skill.

llvm-optimization

Implement or analyze LLVM optimization passes, pipelines, and generated-code quality. Use for IR transformation and pass behavior, not general application performance tuning.

llvm-security

Apply or develop LLVM sanitizers, compiler hardening, and exploit mitigations. Use when secure compilation is central, not for general vulnerability analysis unrelated to the toolchain.

llvm-tooling

Build Clang plugins, LibTooling tools, LLDB extensions, or clangd/LSP integrations. Use for developer tooling around LLVM, not compiler pipeline implementation.

mlir-development

Build MLIR or CIR dialects, conversions, passes, and multi-level compiler pipelines. Use when MLIR/CIR is the implementation substrate, including ML and domain-specific compilers.

mobile-security

Analyze Android or iOS game security and platform protections. Use for APK/IPA, mobile IL2CPP, Frida, root or jailbreak, emulator, mobile kernel, or mobile anti-cheat research.

neverd-semantic-invariant-debugging

Diagnose NeverD lifting bugs caused by duplicated or divergent semantic decisions across pipeline surfaces. Use for cross-architecture, cross-format, order-dependent, verifier, PHI, ABI, or provenance inconsistencies; not isolated feature work.

qt-ui-design

Design or audit UI for Qt/QML, Qt projects, web, or embedded MPU or MCU targets. Use when creating screens, layouts, navigation, or auditing UX.

reverse-engineering-tools

Select and use reverse-engineering workflows for protected game or anti-cheat binaries. Use for disassembly, decompilation, debugging, memory artifacts, anti-analysis, and tool choice; use narrower skills for lifting or kernel internals.

static-analysis

Implement LLVM-based dataflow, pointer, taint, dependency, or verification analyses. Use for static program-analysis algorithms and tools, not runtime instrumentation.

windows-kernel-security

Analyze Windows kernel security mechanisms used by drivers and game protection. Use for callbacks, IRQL, kernel memory, PatchGuard, DSE, HVCI, or driver trust; use dma-attack-techniques for PCIe DMA.

systematic-debugging

Diagnose reproducible bugs and test failures by gathering evidence, isolating the failing boundary, and testing a root-cause hypothesis. Use when the cause is unclear or an attempted fix did not work.