tr4m0ryp

[exploit] Inspect and attack JSON Web Tokens — alg:none, key confusion (RS256→HS256), weak-secret cracking, claim tampering. Reach for it whenever the app authenticates with JWTs to test signature and verification flaws.

[recon] Fast SYN/CONNECT port scanner for hosts/CIDRs (Go, libpcap). Reach for it to find open ports across many hosts quickly, then hand the open services to nmap for deep fingerprinting.

[static-analysis] All-in-one scanner over the connected repo: dependency CVEs across MANY ecosystems (npm, NuGet/.NET, Maven, Go, pip, RubyGems…), plus IaC/Dockerfile/Kubernetes misconfig and a filesystem secret sweep. Reach for it in pre-recon/vuln-analysis for SCA on stacks osv-scanner under-covers and for deeper infra-misconfig than generic SAST.

[static-analysis] Static code analysis (SAST) over the connected repo — taint/pattern rules per vuln category, no live traffic. Reach for it in vuln-analysis to locate vulnerable code at file:line that DAST then confirms.

[static-analysis] Find secrets in a repo/history/filesystem and LIVE-VERIFY them against the issuing provider. Reach for it in vuln-analysis when you need to separate truly-active leaked credentials from dead noise.

[static-analysis] Scan a repo's files and full git history for hardcoded secrets (keys, tokens, credentials). Reach for it in vuln-analysis to find committed secrets, including ones removed from HEAD but live in history.

[static-analysis] Mine the cloned repo's OWN git history for past security/fix commits and map them to recurring hot files, then fold in dependency-CVE (osv-scanner) and history-secret (gitleaks) signals. Reach for it in pre-recon to seed 'what's been exploited before' — code patched for a vuln once is the highest-yield place to re-examine.

Full interactive setup guide for Shor (the web-security scanning platform). Invoke when a user wants to pentest a target: guides scan-type selection, repo analysis, compute recommendation, pre-flight, deployment, auth wiring, and Shor project + scan creation. Also covers deploying the Shor platform itself on GCP when it is not yet running. Handles black-box and white-box modes.

Depth-first lead finder for a penetration-testing / bug-bounty offering (founder Moussa). Use when the operator wants to surface a few high-fit custom-built B2B / high-blast-radius commerce operators -- distributors, wholesalers, B2B webshops, marketplaces, and trade platforms holding valuable/sensitive customer data, that run their own bespoke stack and would plausibly welcome a security researcher -- hard-qualify them against the ICP, resolve the single best contact for each, and store them as durable leads via the enrichment MCP tools. It deliberately does NOT target low-stakes B2C consumer-hobby shops. Discovery and qualification run in-session with web_search / web_fetch; contact resolution and lead state run on the MCP server. This skill FINDS, QUALIFIES, and STORES leads only -- it never contacts anyone and never runs a security test.

Analyse a single tracked target's WhatsApp probe data. Pulls live from the GCP server's SQLite (WAL-safe — does not interrupt collection), separates target-side acks (delivery type) from our own collector account's echo acks (sender type), classifies the target's actual physical devices into fast/phone bands by RTT signature, decomposes phone RTTs into behavioural states (foreground/screen-off/etc.), and emits a clean human-readable presence timeline in NL local time. Triggers include "analyse <name>", "show timeline for <name>", "what was <name> doing", "decompose <name>'s activity", "/analyse-target <name>".