SpecterOps

Use when writing Outflank C2 Python BOF wrappers for OC2 V2 (*_bof.s1.py, BaseBOFTask, outflank_stage1, stage1) or V3 (oc2_sdk_python, @command, manifest.json, command provider), when porting/migrating/converting a V2 BOF script to a V3 application, or when…

Performs security review of arbitrary Go packages, including libraries, frameworks, CLIs, HTTP and gRPC services, and backend applications. Covers authentication and authorization, request parsing, SSRF, SQL and command injection, templates and filesystems,…

Develop Outflank C2 event-driven Python bots. Use when creating or debugging OC2 automations.

Use this skill when the user asks about Linux process injection, using ptrace for injection, LD_PRELOAD injection, writing to procfs, remote access via process_vm_writev, seccomp notify injection, PTRACE_POKETEXT, GOT overwrite, remote thread creation on…

Provide macOS guidance for initial access using app bundles, installer packages, and disk images, including current Gatekeeper behavior and pkgbuild and hdiutil examples.

Malleable C2 profile development for Cobalt Strike. Use when writing C2 profiles or profile overrides for Cobalt Strike.

Perform CWE-grounded security code reviews and precise weakness mapping using a locally derived MITRE CWE corpus, relationship graphs, mapping notes, detection methods, mitigations, and schema semantics. Use when Codex needs to audit source code or pull…

Perform adversarial Python security code reviews grounded in the OpenSSF Secure Coding Guide for Python. Use when Codex needs to audit large Python repositories, recovered or decompiled Python source, Python services or scripts with unclear trust boundaries,…

Addresses GitHub Dependabot security alerts by listing open alerts, identifying affected Python/uv, frontend npm, and Titus Go projects, upgrading vulnerable dependencies, running verification, and committing fixes. Use when the user wants to fix Dependabot…

Build a new Nemesis file enrichment module end-to-end with explicit user approval gates for output mode, library choice, sample files, and integration testing.

Manages Python package dependencies. Use when adding, upgrading, removing, or syncing Python/pypi packages in projects or libs.

Use this skill for Janus requests to design, add, or adjust source ingestors/parsers for live APIs or local files, including Mythic, Ghostwriter, Cobalt Strike REST, Outflank implant logs, new C2 telemetry sources, parser normalization, pull/load CLI wiring,…

Use this skill for Janus requests that ask what to measure, how to measure it, which analyzer should answer it, or how to implement or adjust source-aware analysis for Mythic or Ghostwriter telemetry.

Use this skill for Janus requests that ask for insights from any Janus artifact, including report HTML, bundles, analyzer outputs, events.ndjson, raw exports, or standalone JSON snippets.

Interview the user relentlessly about a plan or design until reaching shared understanding, resolving each branch of the decision tree. Use when the user wants to stress-test a plan, get grilled on their design, or mentions "grill me".

Use for all OpenHound collector work, including planning, graph schema, source collection, assets, lookup/preproc, registration, and validation.

Add a newly supported AI agent/tool or a newly discovered artifact file, directory, or glob to Blacklight while keeping Scout and Rules catalogs, generated target tables, schemas, and validation surfaces aligned. Use for requests to add agent support,…

Safely interpret and communicate findings from AI coding-agent session data. Use when analyzing paired exported session-report JSON and text files (including Blacklight Codex reports), approved `.codex` session artifacts, session-history JSON/JSONL, tool…

Use when creating, reviewing, or improving OpenHound/BloodHound OpenGraph edge description markdown for Okta, GitHub, Jamf, or other OpenGraph extensions with Abuse Info, an optional Reverting Abuse Actions subsection, Opsec Considerations, platform-specific…