hypnguyen1209

Use when pentesting a web application or API — injection, XSS/CSP, SSRF/cloud-metadata, HTTP desync & cache poisoning, SSTI/prototype-pollution/deserialization, JWT/OAuth/GraphQL/IDOR, business logic & single-packet race

Use when gaining initial access to a target — phishing, payload delivery, HTML smuggling, ISO/IMG/MOTW bypass, supply-chain, credential stuffing, exposed-service exploitation

Use when recalling prior techniques at recon/weaponize, or recording a confirmed finding at report — cross-engagement pattern memory ranked by impact

Use when attacking a network or moving laterally — L2/L3 poisoning (LLMNR/mDNS, ARP/DHCP, mitm6), coercion + NTLM relay (CVE-2025-33073), TUN pivoting (Ligolo-ng/Chisel), MitM, network-service RCE (CVE-2024-38077), WPA2/WPA3 wireless

Use when starting any offensive-security engagement or task — establishes how to find and invoke the right skill before any action (including clarifying questions, recon, exploitation, or reporting)

Use when the target has a non-Wi-Fi radio attack surface — Bluetooth/BLE (GATT, pairing, KNOB/BIAS/BleedingTooth), Zigbee/Thread/Matter & Z-Wave mesh (Touchlink, S0 downgrade), LoRaWAN/Sub-GHz LPWAN, SDR capture/replay/rolljam, smart locks/medical/IoT radios.…

Use when writing security tooling, exploits, scanners, or C2 in Python/C/Go/Rust/ASM — systems & network programming, automation, cryptography implementation

Use when escalating privileges on a Linux host — SUID/SGID & GTFOBins, sudo LPE (CVE-2025-32462/32463), capabilities & LD_PRELOAD, kernel LPE (CVE-2024-1086, Dirty Pipe, GameOver(lay)), service misconfig (PwnKit, Looney Tunables), container/namespace escape

Use when a task has 2 or more genuinely independent workstreams, or the user says in parallel, split this up, or run these at the same time. Splits work into independent lanes, runs them concurrently, and merges the results with per-lane evidence. Part of…

Use for multi-step implementation work, when a task must be finished across several turns, or the user says execute this, ship it, finish the plan, or work until done. Executes an objective to completion as durable goals with checkpointed evidence, surviving…

Use when the user says review this, check my changes, look at this PR or diff, or before merging. Reviews a concrete change across correctness, security, performance, and test coverage, then adversarially verifies each finding before reporting it. Part of…

Use when behavior must be proven by execution rather than reading, before a release, or the user says test this properly, QA it, or make sure it actually works. Adversarial end-to-end QA that runs the real thing against hostile scenarios, then fixes what…

Use when a request is vague, could mean several different things, or the user says help me think this through or I am not sure what I want yet. Resolves an ambiguous request into frozen, execution-ready requirements by asking only the questions the codebase…

Use when a task needs one specific expert lens rather than a full workflow stage. Specialist role cards (planner, executor, verifier, reviewer, security-reviewer, test-engineer, architect, critic, researcher) to adopt for focused sub-tasks. Part of codex-goat.

Use when unsure whether to plan, execute, review, or QA, or the user asks what should we do next. Chooses which codex-goat stage fits the current request and checks whether it can start right now. Part of codex-goat.

Use when work needs a written plan before code, when a request spans more than one file or subsystem, or the user says plan, design the approach, or how should we do this. Produces an evidence-backed implementation plan with testable acceptance criteria. Part…

Offload a small, high-stakes typed decision to the jev Paseo plugin by emitting a [jev] marker line. Use when a choice, a yes/no gate, or a risk level should be decided by the user (or a model they pick) rather than guessed.