Menu
Create, write, list, and pull versioned exploit artifact folders through the kartifact CLI.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Wrap an ordinary C exploit or PoC in kernel_PoCs/common so one source project can build as a Linux or Android static executable, dynamic executable, constructor-loaded shared object, or JNI library with local, listening, or reverse-shell root payloads. Use when creating a common-compatible exploit project, converting a C program with main(), setting up exploit entry and post-escalation payload code, repairing its Makefile or entrypoint integration, or initializing the bundled example project.
Add a Linux or Android kernel exploit primitive to ingots_tools/primitives/src/primitive_data in the exact format consumed by primitives/src/primitives/__init__.py. Use when creating a new primitive entry with metadata.json, PRIMITIVE.md, and primitive.c, or when updating an agent to generate primitives for this repository.
Use the android-kdebug skill when debugging Android apps over ADB. The android-kdebug skill documents using kdebug Frida CLI, the kdebug LLDB CLI, or common adb commands.
Use this skill to launch and manage Android Cuttlefish instances using the cuttle-cli and cuttle-server.
Use the high-level object_db wrapper API to scan kernel objects in Python by loading an ObjectSet and filtering HeapObject entries with helper predicates instead of raw SQL.
Use the `testvm` CLI to pack and unpack initrds, build the default BusyBox initrd, and boot Linux kernels under QEMU on `x86_64`, `arm`, or `aarch64`. Use this when the user asks to run, debug, or explain `testvm` commands.
| name | kartifact |
| description | Create, write, list, and pull versioned exploit artifact folders through the kartifact CLI. |
Use kartifact when an unmanaged agent needs to exchange an artifact folder with the Ingots artifact database. The artifact type must come from the task or that type's documentation; kartifact intentionally has no type-discovery command.
uv run kartifact.artifactdb.sqlite or anything under the managed blobs/
directory directly.artifact.id in artifact.toml as the checked-out revision token.artifact.parent_id; it is rendered provenance.create and pull.--json when consuming output programmatically. It is a global option
and must precede the command.uv run kartifact create <type> <folder> --name <safe-name>
The name may contain letters, digits, ., _, and -. Edit the generated
artifact.toml metadata and add the artifact's files before writing it.
uv run kartifact --json write <folder>
A successful write creates an immutable database revision and rewrites the
working folder's artifact.toml with its new id and parent_id. Keep using
that rewritten folder for later revisions.
If a write reports a stale-head conflict, another revision already advanced the
same type/name. Either pull the newer revision and reapply the work, or choose a
new unused name in artifact.toml to create an intentional fork. Never remove
or replace the ID to bypass a conflict.
If kartifact reports source_update_failed, the returned artifact ID was
committed even though the working TOML could not be rewritten. Pull that ID into
a new empty folder before continuing.
uv run kartifact list <type>
uv run kartifact --json list <type>
uv run kartifact --json list <type> --include-shadowed
The default list contains visible name heads. Use --include-shadowed when an
older immutable revision is needed.
uv run kartifact --json pull <revision-id> <empty-folder>
Pull always selects by UUID, copies that revision's files, and renders canonical
database metadata into artifact.toml.