メニュー
Manual vulnerability research skill for finding advisories, downloading affected and fixed artifacts, diffing patches, confirming root cause, and writing reliable reports across products and technologies.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
| name | pentest-cve-reverse-engineer |
| description | Manual vulnerability research skill for finding advisories, downloading affected and fixed artifacts, diffing patches, confirming root cause, and writing reliable reports across products and technologies. |
Turn a public vulnerability lead into an evidence-backed report.
Use a simple path:
Normalize the request into the smallest useful target.
Capture:
Use the strongest anchor first: exact advisory, exact version pair, exact patch, exact package, then broader product search.
Prefer sources that are closest to the code and release process:
Record disagreements instead of smoothing them over.
Collect the facts needed to reproduce the research:
Rank leads by evidence quality, exploitability, business impact, and availability of affected/fixed artifacts.
Fetch the minimum artifact set needed to prove the change:
Use official sources where possible:
Verify artifacts with version metadata, checksums, signatures, manifest files, changelogs, or package headers when available.
Diff the vulnerable and fixed versions.
Useful commands:
diff -ruN old new
git diff --no-index -- old new
rg -n "CVE|security|sanitize|escape|auth|permission|nonce|token|sql|exec|deserialize|upload|path|redirect" old new
Focus on changes that affect trust boundaries:
Build a short evidence chain:
Mark each claim:
Use a controlled lab or static proof that matches the evidence.
Good validation outputs:
Keep proof steps bounded to verification of the disclosed issue.
Write the result so another analyst can audit it quickly.
Recommended files:
<identifier-or-product>/
README.md
report.md
poc.md
changes.diff
references.md
Use only the files that add value for the case.
# <Identifier> - <Product> <Vulnerability Class>
## Summary
<One paragraph with product, affected versions, condition, impact, and fix.>
## Identification
- Identifier:
- Product:
- Component:
- Affected versions:
- Fixed version:
- Vulnerability class:
- CWE:
- Attacker position:
- Confidence:
## Evidence
- Advisory:
- Fixed release or patch:
- Affected artifact:
- Fixed artifact:
## Root Cause
<Explain source to sink or condition to impact. Name files, functions, routes, parameters, and checks.>
## Patch Analysis
<Explain what changed and why it removes or reduces the issue.>
## Proof
<Minimal lab-safe request, call, setup, or static proof. Include prerequisites.>
## Impact
<Practical outcome and limits.>
## Remediation
<Upgrade, patch, config mitigation, detection, or compensating control.>
## Gaps
<Unknowns, unverified assumptions, source disagreements, or missing artifacts.>
Shodan CLI-only search workflow for query design, filter selection, count/stats validation, and search-result retrieval through /root/.local/bin/shodan.
Controlled lab skill for Hack The Box, CTF, and private lab workflows from reconnaissance, enumeration, vulnerability research, exploitation, foothold, and privilege escalation through evidence consolidation.
Static malware reverse-engineering and threat-intelligence triage for unknown files, Windows EXE/PE binaries, scripts, archives, ISOs, JavaScript, PowerShell, documents, and unpacked payloads. Use when a user provides a sample path, hash, filename, or file and asks whether it is malicious, benign, suspicious, contains IoCs, or should be reverse engineered with Ghidra, strings, capa, YARA, public TI, and structured phase artifacts.
BEC and AiTM incident-response skill for suspicious sign-ins, mailbox abuse, forwarding, inbox rules, session theft, token replay, consent abuse, and secondary phishing.
Defensive incident-response companion for Microsoft Entra ID, Microsoft 365, Defender, and mixed identity or endpoint incidents. Use for sign-in triage, public-IP enrichment, initial scoping, containment planning, and analyst-ready notes.
Incident-response reporting skill for decision-ready summaries, timelines, containment records, executive handoff, remediation plans, and unresolved evidence gaps.