philo-groves

Use this skill when MaxTAC Source should use the plugin-bundled codebase-memory-mcp MCP integration or CLI fallback for repository indexing, architecture overview, structural search, call-path tracing, diff impact mapping, ADR lookup, or code graph evidence before SAST triage, CFG work, OpenGrep authoring, or source scans.

Use this skill when MaxTAC Android needs a loop that models an Android app's user-facing resources and systematically walks activities, deep links, forms, WebViews, share targets, notifications, and other user-facing inputs for security auditing while respecting scope and safety constraints.

Use this skill when Apple Systems research needs a loop over IPSW or OTA firmware diffs, Apple security advisories, CVEs, build provenance, and binary/source patch archaeology to identify patched Apple components, infer why they changed, and enrich an ASB threat model.

Use this skill when MaxTAC Binary needs a loop to model how a binary was compiled and loaded, preserve reverse-engineering provenance, prioritize executable functions by reachability or call frequency, systematically decompile or parse functions and data structures, and produce durable functionality and security evidence.

Use this skill when MaxTAC research needs a durable security model, invariant dictionary, invariant receipts with proof obligations and refutation conditions, architecture understanding, first-order-logic-style assertions, unknown tracking, contradiction tracking, or model-backed auditor handoffs across source, web, cloud, binary, supply-chain, Android, Apple, or Microsoft targets.

Use this skill when MaxTAC research needs goal-bounded auditor subagents, verifier debate subagents, specialist bug-class review, mitigation review, or independent votes on a vulnerability hypothesis or PoV.

Use this skill when starting, organizing, or continuing an authorized MaxTAC vulnerability research session with standard directories, phases, domain loop state, closure profiles, thin closure decisions, adversarial false-negative review, subsystem notes, validation, proof, and reporting flow.

Use this skill when MaxTAC Source needs a loop to deeply audit every security-relevant function, field, route, handler, or generated code item in a bounded code subsystem, with invariant modeling, sensitivity prioritization, item-level evidence, and auditable closure.

Build human-friendly, screen-recordable proof-of-concept reproduction kits from already proofed triage-verifier evidence. Use after triage-verifier accepts a finding as proofed, or when Codex needs to turn an agent-focused PoC, proof packet, request log, crash repro, or verifier artifact into direct step-based human reproduction artifacts for bounty triagers, researchers, auditors, or screen recordings.

Establish authorized engagement context, look up public bounty scope evidence, and route cyber tasks before using specialized skills. Use for any request to model security boundaries, review code vulnerabilities, inspect web or mobile apps, research CVEs, build fuzzers, reverse or debug binaries, or analyze exploit chains, especially when target authorization, bounty program scope, impact tolerance, or the desired deliverable is unclear.

Write submission-ready vulnerability reports, advisory drafts, bounty reports, disclosure notes, remediation summaries, and attachment bundles from proofed findings and verifier evidence. Use when Codex needs to turn finding-tracker IDs, triage-verifier proof packets, auto-triage human PoC kits, exploit-chain packets, screenshots, requests, logs, CVE/CWE/CVSS data, or Mermaid diagrams into a concise report for HackerOne, Bugcrowd, GitHub Security Advisories, coordinated disclosure, internal triage, or remediation handoff.

Verify confident security findings before they are marked proofed. Use when a finding has reached the `confident` state in finding-tracker and the current research chain has ended or plateaued, or when Codex needs to harden, rewrite, reproduce, package, or sanity-check a PoC for a bug bounty, audit, advisory, crash, CVE exposure, web/API issue, source-code finding, binary finding, fuzzing result, or exploit-chain finding. Do not interrupt productive investigation; use this as the proof gate before updating a finding to `proofed`.

Perform authorized source-code vulnerability review, security patch review, exploitability triage, and remediation planning. Use when Codex needs to inspect codebases, pull requests, diffs, dependencies, configs, tests, or data flows for authn/authz flaws, injection, SSRF, deserialization, crypto misuse, secrets exposure, file/path bugs, concurrency issues, memory-safety issues, sandbox escapes, supply-chain risk, or bug bounty/code audit findings.

Analyze authorized exploit chains by combining tracked findings, confident or proofed issues, and de-escalated leads into higher-impact vulnerability hypotheses. Use when Codex needs to correlate findings, model preconditions and postconditions, consider de-escalated leads as conditional chain edges, create chain packets, update finding-tracker, or send chain findings through triage-verifier.

Plan and coordinate authorized multi-agent cyber workflows with explicit subagent roles, bounded assignments, tracker discipline, debate, deduplication, proof handoffs, and synthesis. Use when the user explicitly asks for subagents, parallel agents, delegation, debate, multiple reviewers, or staged agentic security work.

Maintain centralized security finding state across authorized cyber workflows. Use when Codex discovers, validates, proofs, de-escalates, updates, searches, deduplicates, summarizes, or hands off potential vulnerabilities, bug bounty findings, audit findings, exploitability leads, crash findings, web/API issues, CVE exposure decisions, fuzzing crashes, or reverse-engineering leads. Always use before adding a new discovered bug to check for duplicates and reduce repeated effort.

Aggressive debugging of authorized binaries, crashes, cores, sanitizers, and runtime behavior with the goal of turning crash data and runtime observations into high-severity vulnerabilities as fast as possible. Use when static reversing isn’t enough and you need runtime state, memory corruption details, register control, or exploitability evidence. Red-team focused: form exploit hypotheses quickly, reproduce aggressively in lab environments, and push promising leads hard toward proof.

Aggressive static reverse engineering of authorized binaries and native components with the explicit goal of finding high-severity vulnerabilities. Use when you have ELF, Mach-O, PE, firmware, packed artifacts, native libraries, or large decompiles (especially jadx trees) and need to hunt for bugs fast. Red-team oriented: form attack hypotheses early, chase weak signals, and hand off to dynamic/fuzzing aggressively when static hits a wall.

Aggressive red-team source code review for authorized bug bounty targets. Use when hunting for high-severity issues (especially critical/key-compromise class) in large codebases, decompiles, or complex protocol implementations. Optimized for offensive mindset: generate attack ideas first, pursue weak signals hard, and only become conservative at the final proof stage. Primary skill for deep dives on targets like Coinbase cb-mpc, Fireblocks MPC, Chainlink, Stripe, etc.

Aggressive use of CVE intelligence, public advisories, KEV, and EPSS data to find high-value vulnerabilities and variants in authorized bug bounty targets. Use to identify weak patterns in your current codebases, prioritize attack surfaces, hunt for similar issues, and assess real-world exploitability in your specific environment.

Actively hunt for and compose exploit chains that turn multiple smaller issues into high-impact (especially critical) findings. Use aggressively: during code review, after new leads appear in finding-tracker, and whenever one primitive unlocks another. Red-team focused — chains are how you turn "a bunch of medium findings" into something that actually pays.

Aggressive offensive finding management for authorized red team bug bounty work. Use to log, track, chain, and promote attack leads as fast as possible while still preventing real duplicate effort. Designed for hunters who want to stay aggressive: log weak signals early, keep promising leads alive longer, and only de-escalate after real effort. Works with the rest of the red-team skill suite (especially the aggressive code-vulnerability-review).

Turn high-quality proofed findings and strong evidence into submission-ready vulnerability reports optimized for high bounty payouts. Designed to work with the aggressive red-team stack, especially high-standard proof packets from triage-verifier. Produces clear, high-impact, well-structured reports for HackerOne, Bugcrowd, and other programs.

Final proof gate for red-team findings. Produce high-quality, near-submission-ready proof packets that can be used directly in strong bug bounty reports. Use only after a finding has reached "confident" in finding-tracker. The goal is not just verification — it is to create a clean, convincing, and well-documented exploit PoC that stands up to real triager scrutiny.

Use Cybermem to persist and retrieve reusable cyber research system knowledge as a lightweight SQLite-backed graph. Use when researching assets, threat models, bug history, vulnerability hypotheses, sources, sinks, mitigations, primitives, chains, or reusable trajectories.

Use Cyberflow to plan and track authorized cyber research workflows for Codex TAC members, including the default recon/modeling/analysis/proofing flow, deep source code audits with production-symbol ledgers, focused source code use-after-free (UAF) and lifetime/ownership audits, focused source code out-of-bounds (OOB) read/write and bounds audits, source code patch-diffing, bug-precedent analysis, ledger-based bug variant audits from history such as git, deep binary decompilation with pyghidra or IPSW, binary patch diffing with Ghidra or IPSW, dynamic custom workflows when general and targeted workflows are incompatible, agentic symbol recovery and renaming, phase gates, scoped vulnerability reasoning, threat modeling, proof packet planning, and reusable flow state across research types.