Menu
Develop Outflank C2 event-driven Python bots. Use when creating or debugging OC2 automations.
The review-first prompt is selected by default. You can switch to a direct command or download a local copy.
Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.
Based on SOC occupation classification
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/SpecterOps/skills --skill oc2-bot-developmentThe command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
Showing SKILL.md
| name | oc2-bot-development |
| description | Develop Outflank C2 event-driven Python bots. Use when creating or debugging OC2 automations. |
| metadata | {"author":"Outflank"} |
Outflank C2 Server has support for running bots. These bots are written in Python and react on events that happen in the server. Currently, these events are:
Bots can be used to automate certain tasks, such as automatically sending a few tasks to the implant, exiting when the implant is not in the correct domain or notifying the operator when a new implant arrives.
Do not use this skill unless Outflank C2 support is requested.
Use when writing Outflank C2 Python BOF wrappers for OC2 V2 (*_bof.s1.py, BaseBOFTask, outflank_stage1, stage1) or V3 (oc2_sdk_python, @command, manifest.json, command provider), when porting/migrating/converting a V2 BOF script to a V3 application, or when passing an existing @artifacts/ catalog file.
Performs security review of arbitrary Go packages, including libraries, frameworks, CLIs, HTTP and gRPC services, and backend applications. Covers authentication and authorization, request parsing, SSRF, SQL and command injection, templates and filesystems, crypto/session handling, concurrency, and unsafe/cgo edges.
Use this skill when the user asks about Linux process injection, using ptrace for injection, LD_PRELOAD injection, writing to procfs, remote access via process_vm_writev, seccomp notify injection, PTRACE_POKETEXT, GOT overwrite, remote thread creation on Linux, or bypassing Yama ptrace restrictions.