Find the correct arm64e kernel and per-SoC kernelcache for a research target on Apple Silicon macOS. Use when: (1) `/System/Library/Kernels/kernel` reports as `Mach-O 64-bit executable x86_64` on an Apple Silicon Mac and you wonder which binary the system actually boots; (2) you need the per-SoC arm64e kernel for a specific Mac model (t8140 = A18 Pro / MacBook Neo, t8103 = M1, t8112 = M2, t6000/t6020/t6030/t6031/t6041/t6050 = M-Pro/ Max/Ultra families, t8122/t8132 = newer A-series in Mac, t8142 = next-gen MacBook Air, vmapple = virtualization); (3) you need the monolithic prelinked kernelcache that the BootROM actually loads (it's NOT at /System/Library/Kernels and NOT named "kernel" — it's at /System/Volumes/Preboot/<UUID>/restore/kernelcache.release.macNg where macNg is a board-id, e.g. mac17g for Mac17,5); (4) you took a "pre-update kernel snapshot" by copying /System/Library/Kernels/ kernel and a diff agent told you it's the wrong architecture; (5) you need to know whether two Mac models share a kernel bu
Reliably diff a single macOS kext between two macOS versions (e.g. 26.4.1 vs 26.5) when both kexts ship inside the kernelcache. Use when: (1) you need to confirm whether a kext was actually changed across a point release (kext CFBundleVersion is unreliable in macOS 26+: bumps with no code change, AND code changes with no version bump are both common); (2) you've extracted two .macho files but they differ in raw byte hash entirely because of linker relocation churn; (3) you need to rule out a silent CVE patch in a security-sensitive kext (e.g. AppleJPEGDriver, IOAESAccelerator, AppleH16CameraInterface, AppleUSBAudio, MT7932 DEXT); (4) you saw a 100-version kext bump and want to know whether it's a real change or just a SDK marker; (5) two kernelcaches have the same kext at different load VAs and a raw diff shows ~16% byte difference. Covers: kernelcache extraction with pyimg4 + ipsw, kext extraction with kmutil splitkc, PC-relative- immediate masking, load/store offset masking, opcode-class change counting, LC
Enumerate the server-side NSXPC attack surface of an Apple daemon without extracting its private-framework binaries from the dyld shared cache. Use when: (1) need to know what XPC methods a daemon like rapportd, sharingd, nearbyd, homed, coreduetd exposes on each of its mach endpoints, (2) need to distinguish an entitlement-gated mach service from an ungated one before crafting entitled-client exploits, (3) need to dump Obj-C/Swift XPC protocol method signatures without running dsc_extractor, Ghidra, or class-dump, (4) mapping CUPairingDaemon, CUSharingDaemon, CUFindMy*Daemon and similar private-framework XPC listeners. Two techniques: (a) `dlopen` on shared-cache-only framework paths + Obj-C runtime reflection (`objc_getClass`, `class_copyMethodList`, `protocol_copyMethodDescriptionList`), and (b) NSXPCConnection two-pass fingerprint (locally-handled selector vs unknown-method) to classify each mach endpoint as entitlement-gated / schema-rejecting / silent-drop / inactive.
Triage "my screen just flashed like a screenshot" reports on macOS by reading WindowServer/SkyLight unified logs. Use when: (1) user reports random screen flashes resembling Cmd+Shift+3 with no saved screenshot file, (2) need to distinguish screen-capture activity (replayd / SCK / screencapture) from benign Spaces/Mission-Control transitions, Stage Manager moves, Notification Center slide-ins, or HDR re-mode events, (3) auditing whether a sandboxed app is actually capturing the screen vs. just probing TCC permissions. Covers macOS 14–26 (Sonoma → 26) on Apple Silicon. Includes the specific log markers that prove "this was a swipe gesture, not surveillance."
Produce branded, professionally formatted PDF reports with selectable themes (light/cyber), cover page, table of contents, running header, page-N-of-M footer, consistent typography, modern tables, callouts, and ordered/unordered lists. Use whenever the user asks for a PDF report, briefing, white paper, audit deliverable, technical memo, or wants existing markdown/text/HTML content turned into a polished PDF — even if they don't explicitly say "PDF formatting". Also use when the user asks for a "tactical", "terminal", "cyber", or "dark mode" PDF, or wants the report to match a specific brand palette. Prefer this skill over generic PDF tools when output style/branding matters.
Structured Analytic Techniques (SAT) for rigorous analysis of user-supplied data. Applies intelligence community cognitive discipline to technical problems. Use when user provides logs asking about breach/anomaly/incident/compromise, crash dump/stack trace asking about cause, code diff asking if fix is correct/complete, or claim/statement asking for validity assessment. Triggers on "apply SAT", "structured analysis", "generate hypotheses", or "why did X happen" with ambiguous causation. Modes: BREACH_DETECTION, CRASH_ANALYSIS, FIX_VERIFICATION, STATEMENT_ANALYSIS, GENERAL_HYPOTHESIS.
Godot Engine 4.x game development skill for GDScript, scene architecture, physics, UI, shaders, and project structure. Use when creating games, prototypes, or interactive applications in Godot. Triggers on requests involving GDScript code, .tscn/.tres files, node hierarchies, signals, tweens, animations, tilemaps, collision layers, export variables, autoloads, or any Godot-specific development task.
This skill should be used when the user asks to write Zig code, configure build.zig, create build.zig.zon package manifests, or work with .zig files. Triggers on: Zig syntax, allocators, comptime, error unions, defer/errdefer, slices, optionals, cross-compilation, C interop, or any request mentioning Zig explicitly. Covers build system, testing, memory management, generics via comptime, and idiomatic patterns.