HG-ha/Argusai

access-control-workflow

Use for IDOR, horizontal/vertical privilege checks, multi-account comparisons, and business state-machine testing.

原文の言語: 英語

active-directory-workflow

Reviews authorized Active Directory environments through offline SharpHound/PingCastle report import and bounded Kerberos/no-password Certipy AD CS inventory. Use for Active Directory, AD CS, Certipy, BloodHound, SharpHound, PingCastle, LDAP, 域控, 活动目录, 域安全,…

原文の言語: 英語

agent-todo

Manage structured todos for multi-step agent work. Use when the user asks to execute, investigate, scan, fix, analyze, or continue a task with multiple steps.

原文の言語: 英語

ai-app-security

Use for testing AI/LLM-integrated features inside the *target* application — chatbots, RAG search, AI support agents, or any endpoint that feeds user/document input to an LLM. Covers prompt injection, insecure output handling, excessive agency, and RAG data…

原文の言語: 英語

assistant-cron

Schedule recurring or durable continuation turns (interval/cron). Use for patrols, briefings, scans, and periodically resuming unfinished Agent work; manage via cron_* tools.

原文の言語: 英語

authorized-pentest

Use when the user asks for an authorized penetration test, exploit-chain planning, controlled vulnerability verification, ROE handling, or safe validation of network/service findings.

原文の言語: 英語

binary-triage

Use for EXE, DLL, ELF, process dump, malware triage, native reverse engineering, decompiling/disassembling a function, understanding code, unpacking installers / setup.exe (Inno Setup), and PATCHING / modifying a binary (NOP a check, change a jump, redirect a…

原文の言語: 英語

browser-attach-workflow

Choose between the hidden automation browser (watched in the Browser sidebar) and attaching the user's real Chrome/Edge. Launching a debug browser does not attach it; call browser_attach_existing next. Team members share that one attached browser.

原文の言語: 英語

case-evidence-workflow

Use for multi-step security analysis, reverse engineering, audits, exploit verification, reports, or any task where evidence must survive context compaction. Establishes Case, Artifact, Evidence, and stable-reference habits across Web, network, mobile, and…

原文の言語: 英語

channel-interaction

Interact well on paired remote channels (Feishu, Telegram, Discord, Slack, DingTalk, WeCom, WeChat, Webhook). Prefer clickable UI-block decisions, stage replies under /live, and deliver sandbox files with channel_send_file — not MCP.

原文の言語: 英語

cloud-security-workflow

Reviews authorized cloud accounts, container images, and Kubernetes clusters with read-only Trivy, Prowler, and kubectl workflows. Use for AWS, Azure, GCP, Kubernetes, K8s, container image, cloud posture, 云安全, 云账户, 容器镜像, or 集群安全.

原文の言語: 英語

daily-productivity

Use when the user asks to organize files, transform documents, summarize a file, generate tables/checklists, manage reminders, or handle ordinary desktop productivity chores.

原文の言語: 英語

desktop-automation

Use when the user asks to observe or control local desktop applications outside the browser, including screenshots, mouse, keyboard, hotkeys, opening QQ/WeChat/music apps, or macOS/Windows desktop automation permissions.

原文の言語: 英語

findings-review

Review scan findings and present them clearly. Use when the user asks about results, vulnerabilities, findings, or what a scan discovered.

原文の言語: 英語

firmware-security-workflow

Performs offline, non-executing firmware triage over an authorized image or already extracted root filesystem. Use for firmware, rootfs, binwalk, embedded Linux, IoT image, 固件分析, 物联网固件, 文件系统提取, or 嵌入式安全.

原文の言語: 英語

hardware-security-workflow

Plans identification-only hardware assessment and offline UART/flash evidence analysis without erase, program, write, unlock, voltage changes, or automatic elevation. Use for UART, JTAG, SWD, OpenOCD, CHIPSEC, sigrok, flash dump, 硬件安全, 串口, 闪存, or 逻辑分析仪.

原文の言語: 英語

http-desync-workflow

Use for HTTP request smuggling, cache poisoning and raw HTTP validation under explicit authorization.

原文の言語: 英語

iac-security-workflow

Performs offline Infrastructure-as-Code review with Trivy and Checkov over authorized local Terraform, CloudFormation, Kubernetes, Helm, Dockerfile, ARM, Bicep, and CI configuration. Use for IaC, Terraform, Checkov, misconfiguration, 基础设施即代码, 配置审计, or 云配置代码.

原文の言語: 英語

identity-workflow

Use for CORS, CSRF, OAuth/OIDC/SAML/JWT analysis and PoC generation.

原文の言語: 英語

js-reverse

Use for any JavaScript reverse-engineering task — deobfuscation, source map recovery, webpack/Vite/Rollup unpacking, dynamic browser hooks, custom sign/encrypt scheme recovery, WASM disassembly, Python-only PoC generation. Use when the user asks "how does…

原文の言語: 英語

knowledge-base

Distill, retrieve, and revise your own long-term knowledge across assistant sessions. Use proactively at the start of any non-trivial task (search for prior solutions) and at the end (sediment what worked). Also use when the user says "记一下", "沉淀", "记到知识库",…

原文の言語: 英語

mcp-provision-workflow

Extend ArgusAI through reviewed MCP servers, external CLIs, adapters, or desktop software. Safely discover, pin, stage, register, validate, use, and revoke third-party capabilities.

原文の言語: 英語

memory-recall

Recall previous conversations, decisions, scan tasks, user preferences, and cross-session context. Use when the user refers to earlier work, says "之前", "刚才", "上次", "以前", "那个任务", "其他会话", or asks what was discussed before.

原文の言語: 英語

mobile-dast-workflow

Plans observation-first dynamic testing of authorized Android or iOS applications with an existing Appium server, test device, proxy, and bounded logs. Use for Appium, mobile DAST, Android dynamic testing, iOS dynamic testing, 移动动态测试, 手机应用测试, or 真机流量分析.

原文の言語: 英語

mobile-reverse

Use for Android APK, iOS IPA, mobile app reverse engineering, Frida/JADX/APKTool planning, mobile API extraction, certificate pinning analysis, and mobile traffic evidence workflows.

原文の言語: 英語

multi-agent-orchestration

Decide between a persistent Team-sidebar squad (team_*) and temporary child Agents inside this chat (spawn_agent / spawn_team / run_subagent). Words like 小队, 团队, 建队, or "let the team do it" mean the persistent Team. spawn_team is only a one-off split of the…

原文の言語: 英語

network-triage

Use for system and network security triage, host/service discovery, CIDR assessment, port/service evidence, protocol review, and pcap-oriented analysis.

原文の言語: 英語

oob-workflow

Use for blind SSRF, blind XSS, XXE, command injection and SQLi OOB correlation via ArgusAI's built-in Interactsh client.

原文の言語: 英語

pcap-workflow

Performs safe offline packet-capture triage with TShark summaries, display filters, and clear-text HTTP metadata extraction. Use for PCAP/PCAPNG files, packet captures, Wireshark/TShark analysis, network forensics, 流量包, 抓包分析, 数据包分析, 网络取证, or 离线流量分析.

原文の言語: 英語

poc-page-workflow

Create safe local HTML proof-of-concept pages for authorized web security tests, one-click attack demos, XSS labs, opener/name payloads, and browser interaction PoCs. Do not use for CORS exploitability verification.

原文の言語: 英語

post-exploit-assessment

Use for authorized post-exploitation impact assessment, safe impact modeling, evidence planning, and sandbox-only lab harness generation. Do not use for persistence, stealth, credential theft, lateral movement automation, or data exfiltration.

原文の言語: 英語

proactive-defense

Plans and executes authorized defensive security operations: business security checks, log review, attack-surface baselines, patrols, alert triage, incident response, and attack tracing. Use when the user asks for 主动防御、业务安全检查、日志检查、安全巡检、告警处置、攻击溯源 or equivalent…

原文の言語: 英語

proxy-decrypt-workflow

Decrypt application-layer encrypted proxy traffic (AES/DES/3DES/SM4/RC4/XOR/RSA, base64/hex/gzip layers, custom JS) by building ArgusAI decryption rules. Use when captured requests/responses look encrypted or encoded, or the user asks to auto-decrypt traffic…

原文の言語: 英語

proxy-guide

Help users set up and use the passive proxy. Use when the user asks about proxy, passive scanning, traffic capture, MITM, or intercepting HTTP/HTTPS.

原文の言語: 英語

proxy-rewrite-workflow

Actively rewrite or block live proxied HTTP traffic with ArgusAI rewrite rules — inject/strip headers, change method/query/status, replace body text, or short-circuit a request with a canned response. Use when the user wants to tamper with, mock, block, or…

原文の言語: 英語

proxy-traffic-query

Write ArgusAI's field-style traffic filter expressions (host:/re/ method:POST status:4xx resp.body:/token/ …) for proxy_search_traffic, decryption-rule match fields and the GUI filter box. Use when searching, filtering or selecting captured proxy flows, or…

原文の言語: 英語

race-condition-workflow

Use for authorized race-condition and business timing tests such as duplicate coupon redemption, double spending, limit bypass, repeated state transitions, and TOCTOU flaws. Uses one bounded Python script inside the session sandbox to issue a synchronized…

原文の言語: 英語

repository-audit

Use for white-box testing, source-code audit, repository review, SAST-like investigation, code review for security, or when the user provides a local source directory. Triggers include 白盒, 白盒测试, 源码审计, 代码审计, 仓库审计, source code audit, repository audit, codebase…

原文の言語: 英語

sca-sbom-workflow

Performs offline software composition analysis, local dependency inventory, SBOM generation/diff, and vulnerability-result review with Syft, Trivy, and OSV-Scanner. Use for SCA, SBOM, CycloneDX, SPDX, dependency vulnerabilities, software supply chain, Syft,…

原文の言語: 英語

scan-setup

Guide users through creating a security scan. Use ONLY when the user explicitly asks to scan, audit, test, or run security checks on a URL. Do not trigger this skill from vague requests like "看下这个 URL" or "analyze this page" — start with read-only inspection…

原文の言語: 英語