Miko

Go语言免杀技术套件，结合SGN预处理、多层加密、IPv4/UUID/MAC/IPv6混淆、VEH内存保护、NTDLL脱钩、冷门回调执行、抗沙箱检测、减熵处理、静态伪装、版本信息嵌入等技术生成高免杀Loader

对 Python 代码进行安全漏洞审计。当用户提到"代码审计"、"安全审查"、"安全检查"、"漏洞扫描"、 "安全评估"、"代码 review 安全"、"找漏洞"、"有没有安全问题"、"帮我看看这段代码有没有安全问题"、 "review this code for security"、"audit"、"security audit"、"vulnerability scan" 时， 必须使用此 skill。适用于 Python 项目、代码片段、模块或整个仓库的安全审计。

Generate medical device cybersecurity registration deliverables from project input files. Use when Codex needs to read DOCX/PDF/PNG project evidence such as user manuals, SRS, design documents, architecture diagrams, FDA cybersecurity guidance, or prior reports, then produce a cybersecurity risk management report draft, project fact sheet, missing-information list, traceability content, STRIDE threat model, risk analysis, SBOM/security-transparency notes, or user-manual cybersecurity supplement.

API发现与未授权测试入口 - 主动探测各类API端点，对发现的API进行未授权访问测试

JS信息收集入口 - 提取硬编码凭据、API路径、路由、认证逻辑、运行时存储；检测到框架特征时触发对应子技能

登录与鉴权测试 - Token权限分析、认证绕过、暴力破解、JWT/OAuth攻击、验证码绕过

单网站渗透主入口 - 流程编排，按阶段触发各子技能

信息收集入口 - 目标类型判断、CDN检测、WAF识别、端口扫描

渗透测试禁止项 - 集中管理所有禁止测试的端点、操作和范围限制

工具路径与配置 - 集中管理所有工具路径、配套文件、MCP工具、字典

漏洞发现与验证 - 根据前期发现的功能点，针对性测试各类Web漏洞

Dump DEX files from a running Android app for unpacking/deobfuscation. Activate when the user wants to unpack an Android APK, dump DEX from memory, extract decrypted DEX files, or defeat class-loading packing.

Generate Frida hook scripts using modern Frida API. Activate when the user wants to write Frida scripts, hook functions at runtime, trace calls or arguments or return values, intercept native or ObjC or Java methods, dump memory or exports, or handle native module load timing for Android and other targets.

IDAPython and IDALib script reference for reverse engineering. Activate when the user needs to write IDAPython scripts in IDA, use IDALib for headless analysis, operate on IDB databases, debug with IDA, manipulate memory/registers, traverse functions/blocks/instructions, work with Hex-Rays decompiler API, handle obfuscation, or batch-process binaries.

Dump decrypted iOS app binaries (砸壳) from jailbroken devices using frida-ios-dump. Activate when the user wants to decrypt an iOS app, dump an IPA from a device, or extract a decrypted Mach-O binary for reverse engineering.

Reconstruct data structures by analyzing memory access patterns across functions

Restore function symbols by analyzing code patterns, strings, constants, and cross-references

Dump Unity IL2CPP symbols from iOS/Android builds. Extract method names, addresses, and type info from IL2CPP binaries and global-metadata.dat, then generate IDA/Ghidra import scripts.

Debug and emulate specific code fragments or functions using the Unicorn engine. Activate when the user wants to emulate a function with Unicorn, trace binary execution without running the full program, decrypt or decode data by emulating the algorithm, or bypass environment dependencies (JNI, syscalls, libc) during emulation.

使用AI生成免杀Loader和处理Shellcode，结合IPv4混淆、XOR加密、反沙箱检测等免杀技术绕过主流杀软检测

Create new skills, modify and improve existing skills, and measure skill performance. Use when users want to create a skill from scratch, edit, or optimize an existing skill, run evals to test a skill, benchmark skill performance with variance analysis, or optimize a skill's description for better triggering accuracy.

面向授权 SRC / bounty 实战的执行型技能。只要任务是在授权范围内实际推进赏金挖掘、验证目标面、选择主线、收集证据、判断是否继续深挖、整理可提交报告材料，就应使用这个技能。它不是用来泛讲漏洞定义、生成答题式 checklist 或整理长文，而是用来驱动 agent 在安全边界内行动。

通用企业 SRC 工作流技能。只要任务涉及企业 SRC、授权范围确认、测试规则梳理、资产盘点、被动信息收集、空间测绘结果整理、导出归类、漏洞挖掘准备，或在授权范围内推进实际挖掘与记录，就应优先使用这个技能。它适合多厂商、多项目、长期复用的 SRC 场景，尤其适合需要先确认范围与规则，再结合官方资料、被动来源、导出文件和本地笔记推进工作的任务。

所有联网操作必须通过此 skill 处理，包括：搜索、网页抓取、登录后操作、网络交互等。 触发场景：用户要求搜索信息、查看网页内容、访问需要登录的网站、操作网页界面、抓取社交媒体内容（小红书、微博、推特等）、读取动态渲染页面、以及任何需要真实浏览器环境的网络任务。