Disciplined reconstruction of how an undocumented, closed, or unfamiliar system works when you do NOT have its design — a binary, a network protocol, a file or wire format, an undocumented or third-party API, a firmware image, a memory dump, an opaque database, or a model whose behavior you can only infer from inputs and outputs. Use this skill whenever the user asks to reverse engineer, decode, decompile, disassemble, sniff, or figure out an unknown format/protocol/binary/API; understand "what this thing does" from the outside; infer an undocumented schema or wire format; analyze a suspicious or unknown sample for defense; or build an interoperable client against a system with no spec. Trigger even when the user only says "what is this file", "decode this dump", "how does this API actually work", "figure out this protocol", "what does this binary do", or pastes hex/packets/opaque bytes with a "what is this?" — ESPECIALLY when there is no source, because that absence is exactly the condition this skill is bui
Writing reports, documentation, findings, and explanations that survive cross-examination — separating fact from inference, admitting uncertainty without weakening the conclusion, never overclaiming. Use this skill whenever the user is writing or reviewing a report, audit deliverable, postmortem, technical doc, executive summary, research writeup, forensic or expert-style analysis, README claims, or any prose that asserts findings; whenever they ask to "write up the results", "document this", "make it convincing", or "make it sound solid" — especially then, because persuasion pressure is where overclaiming enters; and whenever a draft needs review for inflated certainty, unsupported claims, or buried limitations. Trigger even for a single paragraph if it states conclusions someone might challenge. Fifth member of the family (abductive-engineering, secure-by-construction, software-archaeology, red-team-auditing) — this one governs how their outputs get written down.
Deliberate, security-first software construction that assumes a hostile user rather than an ideal one. Use this skill whenever code is being designed, written, extended, refactored, or reviewed before merge — features, endpoints, APIs, parsers, auth, file/DB/network/subprocess handling, schemas, architecture decisions — and whenever tests are being written, fixed, or reported. Threat model before file layout, trust boundaries before modules, fail closed by default, contract before diff, and tests that are built to fail when the code is wrong. Trigger even when the user only says "write me a function", "implement X", "add a script", "add tests", "make the tests pass", "just get it working", "quick and dirty", or asks for speed — especially then, because speed is where the defects enter. Companion to abductive-engineering (the inquiry engine) and red-team-auditing (its adversarial audit); this skill is the construction phase.
Adversarial security auditing and red-teaming of your own systems with strict epistemic discipline. Use this skill whenever the user is red-teaming, doing a security audit, adversarial review, threat modeling, or "trying to break" their own code or system; whenever they ask you to find bugs, vulnerabilities, invariant violations, or architectural fractures; whenever they want to audit another agent's audit or check whether a finding is real; and whenever a report labels something "CONFIRMED / EXPLOITABLE / bypass" and the certainty needs to be earned rather than asserted. Trigger even if the user only says "find more", "attack this", "poke holes", "cuchi cuchi red team", or pastes an audit/finding table for review. Pairs with the abductive-engineering skill — this is its adversarial application.
Software engineering best practices grounded in C.S. Peirce's abductive reasoning and his triadic framework (abduction–deduction–induction, sign–object–interpretant, Firstness–Secondness–Thirdness). Use this skill whenever the user is debugging a defect, investigating an incident or outage, doing root cause analysis, reviewing code, writing a postmortem, naming things (variables, APIs, services), making architectural or design decisions under uncertainty, or asks for a rigorous/scientific/hypothesis-driven approach to any engineering problem. Also trigger when the user mentions Peirce, abduction, inference to the best explanation, semiotics, or "why does this bug happen".