chainreactors

Use this skill when the agent needs to understand aiscan mechanisms, available capabilities, scanner pseudo-commands, and tool invocation rules.

Use this skill when working with proton for sensitive information scanning — detecting API keys, tokens, credentials, and secrets in files or piped data.

Use this skill to learn how to use the playwright pseudo-command for headless browsing, screenshots, network capture, and interactive vulnerability verification. Aligned with microsoft/playwright-cli conventions.

Use this skill when working with scan for the multi-stage aiscan pipeline across discovery, web probing, weak credentials, POC checks, and verification.

Use this skill when working with neutron for template-based POC execution, template filtering, and POC result analysis.

Use this skill when working with gogo for host, port, service, banner, fingerprint, or vulnerability-hint discovery.

Use katana for deep web crawling with full parameter discovery. Produces URLs with query strings, form targets, and JS endpoints that spray crawl strips.

Use this skill when working with zombie for authorized weak credential checks and authentication result analysis.

IoM Operational Security (OPSEC) advisor. Provides OPSEC methodology guidance, helps users understand operational risks, build secure operating habits, and accumulate experience through a case library. Does not execute commands directly; serves as decision support. Concrete technical specifications and OPSEC scoring are maintained in the iom-pentest skill. Trigger conditions: use when the user asks "is this safe?", "will this be detected?", "how should I think about OPSEC?", "risk assessment", "operational security advice", or "help me analyze the detection surface".

Autonomous penetration testing via IoM C2 MCP tools. Adaptively executes based on user intent: situational awareness, reconnaissance, privilege escalation, credential harvesting, lateral movement, persistence, and more. Presents an execution plan and waits for user confirmation before sensitive operations. Trigger conditions: user mentions penetration testing, red team, post-exploitation, privilege escalation, lateral movement, credentials, persistence, situational awareness, or any scenario involving security assessment of a target through IoM.

Complete user guide for the IoM (Implant-over-Middleware) C2 framework. Covers architecture concepts, basic operations, startup parameters, authentication configuration, troubleshooting, documentation resources, and community feedback. Trigger conditions: use this skill when the user asks about how IoM works, command usage, architecture concepts, configuration methods, how to troubleshoot issues, where to find documentation, or how to file an issue. Should also trigger for questions like "how do I connect", "what is a session", "I got an error", or "is there documentation".

MAL (Malice Scripting Language) plugin development guide. Helps users write Lua plugins for IoM, covering plugin structure, command registration, BOF invocation, resource management, event callbacks, testing, debugging, and publishing workflows. Trigger conditions: when users want to write MAL plugins, extend IoM commands, write Lua scripts, integrate BOFs, develop custom modules, or ask questions like "how to write a mal plugin", "how to add a new command to IoM", or "what Lua APIs are available".

Autonomous penetration testing through IoM C2 MCP tools. Covers the full engagement lifecycle: reconnaissance, privilege escalation, credential harvesting, lateral movement, and persistence. Operates in an OODA loop — each phase analyzes results before deciding the next action. Use this skill whenever the user wants to run automated pentest, red team assessment, privilege escalation analysis, post-exploitation, or any offensive operation through IoM — even if they just mention "pentest", "提权", "横向", "信息收集", "凭据", "持久化", or "自动化测试".

为任何项目生成定制化 OKR skill。分析项目内容、文档、结构、历史，在目标项目 .claude/skills/okr/ 下生成可加载的 SKILL.md 并部署每日追踪 Action。

本项目的 OKR 目标和关键结果。每次开始新任务前参考此 OKR 确保工作方向一致。生成时间：2026-03-17。基于项目诊断 + 用户意图共同生成。

CTF 运维指南 — 回连验证、nuclei 模板使用、共享状态协议。 自动注入所有 CTF worker 的 system prompt。