Operate Cobalt Strike for authorized red team operations using its MCP. Use when the user asks to list Beacons, run Beacon commands, or otherwise interact with Cobalt Strike.
Use for OpenHound collector and OpenGraph extension development work, including planning, graph schema, source collection, assets, lookup/preproc, registration, validation, and collector template adaptation under the BloodHound plugin.
Use when writing Outflank C2 Python BOF wrappers for OC2 V2 (*_bof.s1.py, BaseBOFTask, outflank_stage1, stage1) or V3 (oc2_sdk_python, @command, manifest.json, command provider), when porting/migrating/converting a V2 BOF script to a V3 application, or when…
Performs security review of arbitrary Go packages, including libraries, frameworks, CLIs, HTTP and gRPC services, and backend applications. Covers authentication and authorization, request parsing, SSRF, SQL and command injection, templates and filesystems,…
Develop Outflank C2 event-driven Python bots. Use when creating or debugging OC2 automations.
Use this skill when the user asks about Linux process injection, using ptrace for injection, LD_PRELOAD injection, writing to procfs, remote access via process_vm_writev, seccomp notify injection, PTRACE_POKETEXT, GOT overwrite, remote thread creation on…
Provide macOS guidance for initial access using app bundles, installer packages, and disk images, including current Gatekeeper behavior and pkgbuild and hdiutil examples.
Malleable C2 profile development for Cobalt Strike. Use when writing C2 profiles or profile overrides for Cobalt Strike.