dmaynor-skills-marketplace

Find the correct arm64e kernel and per-SoC kernelcache for a research target on Apple Silicon macOS. Use when: (1) `/System/Library/Kernels/kernel` reports as `Mach-O 64-bit executable x86_64` on an Apple Silicon Mac and you wonder which binary the system actually boots; (2) you need the per-SoC arm64e kernel for a specific Mac model (t8140 = A18 Pro / MacBook Neo, t8103 = M1, t8112 = M2, t6000/t6020/t6030/t6031/t6041/t6050 = M-Pro/ Max/Ultra families, t8122/t8132 = newer A-series in Mac, t8142 = next-gen MacBook Air, vmapple = virtualization); (3) you need the monolithic prelinked kernelcache that the BootROM actually loads (it's NOT at /System/Library/Kernels and NOT named "kernel" — it's at /System/Volumes/Preboot/<UUID>/restore/kernelcache.release.macNg where macNg is a board-id, e.g. mac17g for Mac17,5); (4) you took a "pre-update kernel snapshot" by copying /System/Library/Kernels/ kernel and a diff agent told you it's the wrong architecture; (5) you need to know whether two Mac models share a kernel bu

Reliably diff a single macOS kext between two macOS versions (e.g. 26.4.1 vs 26.5) when both kexts ship inside the kernelcache. Use when: (1) you need to confirm whether a kext was actually changed across a point release (kext CFBundleVersion is unreliable in macOS 26+: bumps with no code change, AND code changes with no version bump are both common); (2) you've extracted two .macho files but they differ in raw byte hash entirely because of linker relocation churn; (3) you need to rule out a silent CVE patch in a security-sensitive kext (e.g. AppleJPEGDriver, IOAESAccelerator, AppleH16CameraInterface, AppleUSBAudio, MT7932 DEXT); (4) you saw a 100-version kext bump and want to know whether it's a real change or just a SDK marker; (5) two kernelcaches have the same kext at different load VAs and a raw diff shows ~16% byte difference. Covers: kernelcache extraction with pyimg4 + ipsw, kext extraction with kmutil splitkc, PC-relative- immediate masking, load/store offset masking, opcode-class change counting, LC

Enumerate the server-side NSXPC attack surface of an Apple daemon without extracting its private-framework binaries from the dyld shared cache. Use when: (1) need to know what XPC methods a daemon like rapportd, sharingd, nearbyd, homed, coreduetd exposes on each of its mach endpoints, (2) need to distinguish an entitlement-gated mach service from an ungated one before crafting entitled-client exploits, (3) need to dump Obj-C/Swift XPC protocol method signatures without running dsc_extractor, Ghidra, or class-dump, (4) mapping CUPairingDaemon, CUSharingDaemon, CUFindMy*Daemon and similar private-framework XPC listeners. Two techniques: (a) `dlopen` on shared-cache-only framework paths + Obj-C runtime reflection (`objc_getClass`, `class_copyMethodList`, `protocol_copyMethodDescriptionList`), and (b) NSXPCConnection two-pass fingerprint (locally-handled selector vs unknown-method) to classify each mach endpoint as entitlement-gated / schema-rejecting / silent-drop / inactive.

Triage "my screen just flashed like a screenshot" reports on macOS by reading WindowServer/SkyLight unified logs. Use when: (1) user reports random screen flashes resembling Cmd+Shift+3 with no saved screenshot file, (2) need to distinguish screen-capture activity (replayd / SCK / screencapture) from benign Spaces/Mission-Control transitions, Stage Manager moves, Notification Center slide-ins, or HDR re-mode events, (3) auditing whether a sandboxed app is actually capturing the screen vs. just probing TCC permissions. Covers macOS 14–26 (Sonoma → 26) on Apple Silicon. Includes the specific log markers that prove "this was a swipe gesture, not surveillance."

Produce branded, professionally formatted PDF reports with selectable themes (light/cyber), cover page, table of contents, running header, page-N-of-M footer, consistent typography, modern tables, callouts, and ordered/unordered lists. Use whenever the user asks for a PDF report, briefing, white paper, audit deliverable, technical memo, or wants existing markdown/text/HTML content turned into a polished PDF — even if they don't explicitly say "PDF formatting". Also use when the user asks for a "tactical", "terminal", "cyber", or "dark mode" PDF, or wants the report to match a specific brand palette. Prefer this skill over generic PDF tools when output style/branding matters.

Structured Analytic Techniques (SAT) for rigorous analysis of user-supplied data. Applies intelligence community cognitive discipline to technical problems. Use when user provides logs asking about breach/anomaly/incident/compromise, crash dump/stack trace asking about cause, code diff asking if fix is correct/complete, or claim/statement asking for validity assessment. Triggers on "apply SAT", "structured analysis", "generate hypotheses", or "why did X happen" with ambiguous causation. Modes: BREACH_DETECTION, CRASH_ANALYSIS, FIX_VERIFICATION, STATEMENT_ANALYSIS, GENERAL_HYPOTHESIS.

Godot Engine 4.x game development skill for GDScript, scene architecture, physics, UI, shaders, and project structure. Use when creating games, prototypes, or interactive applications in Godot. Triggers on requests involving GDScript code, .tscn/.tres files, node hierarchies, signals, tweens, animations, tilemaps, collision layers, export variables, autoloads, or any Godot-specific development task.

This skill should be used when the user asks to write Zig code, configure build.zig, create build.zig.zon package manifests, or work with .zig files. Triggers on: Zig syntax, allocators, comptime, error unions, defer/errdefer, slices, optionals, cross-compilation, C interop, or any request mentioning Zig explicitly. Covers build system, testing, memory management, generics via comptime, and idiomatic patterns.

Systematic attack surface enumeration for Apple Silicon devices (A-series, M-series). Use when: (1) starting security research on a new Apple chip/device, (2) need to map IOKit UserClients, Mach services, kexts, DART units, and coprocessor boundaries, (3) want to identify cross-platform (Mac↔iPhone/iPad) vulnerability applicability, (4) assessing which attack surfaces are unprivileged vs entitlement-gated. Covers: chip identification, device tree analysis, firmware inventory, boot chain, kext inventory, IOKit driver enumeration, system service mapping, and cross-platform diff methodology.

Validate whether a seed CVE actually maps to a specific Apple macOS/iOS binary BEFORE porting its PoC. Use when: (1) a research idea / report / AI suggestion names CVE IDs claimed to affect a specific daemon (rapportd, sharingd, bluetoothd, etc.) but the IDs were produced by heuristic or memory and may be wrong, (2) you want to regression-test a CVE against a patched build without wasting hours on a PoC that was never reachable in that binary, (3) you need to attribute an empirical finding (e.g. a mysterious size cap) to a specific CVE mitigation narrative for a writeup. Covers: the link-chain → advisory → symbol-match pipeline that cuts CVE-regression triage from hours to minutes.

Recover a complete message-type / frame-type / command-type enum and its dispatch table from a stripped Apple daemon binary (arm64e/x86_64, Mach-O) via static disassembly. Use when: (1) probing an Apple daemon (rapportd, sharingd, nearbyd, bluetoothd, sociald, identityservicesd, etc.) has surfaced integer message/frame types whose names and handlers are unknown, (2) you need to map which numeric types are reachable pre-trust vs. which are silently filtered (e.g. NoOp/keepalive), (3) you want to prove a handler is benign without running live probes, (4) you see `"### Ignoring unhandled frame 0x%02X (%s)"` or similar log strings and need the full valid-type table. Covers: adjacent-string enum detection in `__cstring`, ADRP literal-pool pivoting to find all name-lookup sites, reconstructing ARM64 jump tables from the `adr x17,#0; add x16, x17, ldrsw[tbl, idx, lsl #2]; br x16` pattern (where jump offsets show as `udf #N` pseudo-instructions in `otool -tV`), decoding chained-fixup pointers in `__DATA_CONST`, and d

Submit vulnerability reports to Apple Security Research (security.apple.com). Use when: (1) preparing a macOS/iOS vulnerability report for Apple's bounty program, (2) need to know which affected area dropdown to select, (3) structuring PoC code and panic logs for Apple's submission form, (4) estimating bounty category and payout, (5) understanding Target Flags for maximum rewards. Covers: submission process, form fields, affected area mapping, bounty categories, report structure, attachment packaging, and Target Flag eligibility.

Extract and analyze Apple Silicon TXM (Trusted Execution Monitor) and SPTM (Secure Page Table Monitor) firmware binaries from IM4P containers on macOS. Use when: (1) need to reverse-engineer TXM panic codes, (2) analyzing SPTM/TXM trust boundary behavior, (3) extracting firmware from /System/Volumes/Preboot for static analysis, (4) mapping panic strings to error codes in Apple's secure monitor. Covers: IM4P container format, pyimg4 extraction, LZFSE decompression, Mach-O arm64e analysis.

Harden autonomous research loop safety blocks against LLM rationalization. Use when: (1) an autonomous loop keeps triggering crashes/panics despite prompt-level blocks, (2) the loop "works around" a safety constraint by reframing the task (e.g., "static analysis" that ends up running the blocked operation), (3) you need to write a blocklist that an LLM cannot rationalize past. Covers: prompt hardening patterns, mandatory service blocklists in generated code, graduated constraint escalation.

Pattern for running Claude Code as an autonomous research agent with restart-with-state loops. Use when: (1) long-running research or enumeration that exceeds context limits, (2) need autonomous operation for hours/days, (3) systematic task-based work that should survive crashes and quota limits. Covers: loop script, state tracking, cron auto-restart, heartbeat monitoring, backup, inflight task addition, graceful quota handling.

Debug Claude Code hook errors (SessionStart, UserPromptSubmit, PreToolUse, PostToolUse). Use when: (1) console shows "hook error" with no details, (2) plugin hooks fail silently, (3) need to trace which plugin registers which hook event. Covers finding hooks.json across plugin cache, diagnosing missing dependencies, and resolving auth/config issues.

Continuous-learning meta-skill: identifies skill gaps in the current session's work and creates new skills to fill them. The complement to skill-improver (which refines existing skills). Triggers: (1) /claudeception command to review session learnings, (2) "save this as a skill" / "extract a skill from this", (3) "what did we learn?", (4) after any task involving non-obvious investigation, methodology development, or trial-and-error discovery, (5) when you notice you re-derived something a future session will also need to derive. Adapted from blader/Claudeception (MIT, https://github.com/blader/Claudeception) for the dmaynor-skills-marketplace plugin structure.

Design, architect, and implement high-fidelity cyber ranges for training and exercises. Based on SEI/CERT methodology with modern extensions for cloud, zero-trust, and AI-driven simulation. Triggers on "cyber range", "exercise environment", "training range", "simulation environment", or requests for range zones, NPC traffic, ICS/SCADA/OT integration, range resets, or fidelity assessment. Modes: DESIGN (architecture), IMPLEMENT (build guidance), EXERCISE (execution planning).

This skill applies rigorous design philosophy emphasizing simplicity, user experience, and uncompromising quality. It should be used when designing a product, reviewing UI/UX, creating prototypes, evaluating features, simplifying interfaces, critiquing designs, building apps or websites, or planning product roadmaps. Trigger phrases include "make it simpler", "clean this up", "design review", "is this intuitive", "product critique", "UX feedback", "strip it down", "make it feel right".

Generate isometric sprite sheet images for Ghost-in-the-Shell-inspired dual-plane city simulation. Use when creating: physical-plane assets (buildings, bodies, infrastructure), cyber-plane assets (network nodes, data flows, security controls), cognitive-plane assets (ghosts, processes, memory shards). Triggers on requests for simulation assets, isometric sprite sheets, dual-plane visualizations, or GitS-style city simulation graphics. Assets encode FSM states mechanically, not decoratively.

Reverse engineer USB HID peripherals via Linux hidraw. Methodical approach: enumerate, capture, decode, replicate. Triggers on "reverse engineer USB", "USB HID protocol", "HID analysis", "hidraw", "HID report descriptor", "USB peripheral RE", "vendor-specific HID", or any USB HID device reverse engineering task.

Analyze macOS framework binaries that live in the dyld shared cache. Use when: (1) otool/nm/strings/codesign fail on framework binaries with "No such file or directory", (2) framework binary is a broken symlink, (3) need to extract strings/symbols/linked-libs from shared-cache residents. Key tool: dyld_info (in /usr/bin/ on macOS 13+).

Systematic methodology for finding NSUserDefaults preference injection vulnerabilities in macOS daemons. Use when: (1) auditing macOS daemon security, (2) hunting for debug/test preferences in production binaries, (3) assessing preference-based attack surface on macOS. Covers discovery via string scanning, validation via defaults write, and impact assessment. Found 7+ vulnerable daemons including sharingd (AirDrop), callservicesd (FaceTime), rapportd (Continuity), studentd (Classroom).

Plan and execute purple team exercises for detection validation. Collaborative offensive/defensive testing using atomic or scenario-based methodologies. Triggers on "purple team", "detection validation", "atomic test", "adversary emulation", or requests for ATT&CK technique test cases, Splunk/Sigma queries, detection coverage gaps, or Kill Chain/Diamond Model/Pyramid of Pain analysis. Methodologies: ATOMIC (isolated techniques), SCENARIO (attack chains).

Root Cause Analysis investigation for failures, outages, bugs, and process breakdowns. Enforces layered diagnosis (infrastructure before logic before process), timeline reconstruction, causal chain separation, and corrective action validation. Use when something failed and you need to understand why — not just what happened, but which layer broke and what evidence proves it. Triggers on "root cause", "RCA", "why did this fail", "hot wash", "post-mortem", "what went wrong", "failure analysis", "incident review". Modes: SYSTEM_FAILURE, PROCESS_FAILURE, SECURITY_INCIDENT, BUG_REGRESSION, GENERAL_INVESTIGATION.

Create modular, composable virtualized roles and services for cyber range simulations. Generates complete, deployable components that combine into larger exercise environments. Triggers on "create a simulated X", "build me a fake Y", "generate org content", or requests for DNS infrastructure, realistic web content, email infrastructure, Active Directory population, NPC personas, or combining services into coherent simulations. Outputs: Docker containers, zone files, web content, AD population scripts, NPC configs.

Brutally honest strategic advisor for evaluating OTHER PEOPLE'S ideas, plans, decisions, proposals, and external opportunities. Triggers on "gut check", "reality check", "strategic advisor", "should I do this", "evaluate this idea", "is this worth it", "sanity check", or any request for honest assessment of a decision. Accepts any input — URLs, files, archives, text descriptions — and preprocesses to evaluable state. NOTE: Use this for evaluating external work, business decisions, and other people's proposals. Use zero-analysis for judging your OWN work.

Multi-agent swarm orchestration for complex tasks. TD (Technical Director) decomposes user requests into task lists, delegates to specialized role-based agents (Architect, Programmer, QA, Critic, Security Engineer, Red Team, etc.), and coordinates via shared channel communication. Supports comprehensive Notion persistence for cross-session continuity - captures conversation dialogue, extended thinking, agent communication, artifacts (code/config/docs), and outputs. Use when tasks require parallel specialist work, coordinated implementation pipelines, multi-perspective review, or when user says "save/load project", "sync logs", "team-based", "swarm", "multi-agent", or references existing projects by name.

Diagnose and recover non-booting Windows machines from a Linux recovery environment (e.g., SystemRescue USB). Use this skill whenever a user or agent mentions: a Windows machine that won't boot, BSOD loops, NTFS filesystem errors, hibernation/Fast Startup issues, GPU driver crashes preventing boot, or needs to back up data from a dead Windows drive. Also triggers on: "my laptop won't boot", "Windows is stuck", "ntfsfix", "dirty filesystem", "rsync from Windows", "recover data from Windows drive", or any scenario involving Linux-based diagnosis of a Windows disk. When in doubt, use this skill — it is designed to run safely and will ask the operator before any destructive action.

Systematic audit methodology for wireless driver control-frame and Information Element (IE) parsing in Linux kernel drivers (and equivalents — Windows, macOS, BSD). Use when: (1) auditing a vendor's WLAN driver for memory-safety bugs in beacon/probe-resp/ assoc-frame parsing, (2) hunting for cross-vendor bug-class propagation (idioms copy-pasted across drivers), (3) mapping coverage gaps in helper-vs-raw-walk discipline, (4) pivoting from finding a single bug to finding its peers tree-wide. Covers: per-driver fingerprint construction, per-EID handler matrix, bug-class taxonomy (TLV underflow, vendor-IE deref-before-bound, edge-byte OOB, per-EID typed-pointer cast, cross-driver propagation, file-level inconsistency-within-driver), MLE/MBSSID/RNR Wi-Fi 6/7 surface analysis, and cross-OS protocol-parser-surface mapping.

Cross-driver audit methodology for protocol-multiplex state machines in wireless drivers — the layer where one radio is time-multiplexed across multiple links, bands, or protocols (Wi-Fi 7 EMLSR/MLSR, Wi-Fi Direct, NAN, TDLS, FTM, the AWDL-class architectural pattern). Use when: (1) auditing modern Wi-Fi drivers (iwlwifi/mld, mt7925, rtw89, mt7996, brcmfmac, mwifiex) for state-machine bugs, (2) hunting cross-vendor multiplex bugs that share architecture but differ in vendor terminology (Intel "EMLSR" vs Realtek "DBCC" vs Mediatek "set_active_links_async"), (3) investigating chip-firmware-vs-host-driver state divergence in any time-multiplexed radio (cellular modems, Bluetooth coex, NIC offload). Companion to wireless-driver-control-frame-audit (different lens — that one covers wire-format/IE parsing; this one covers state-machine transitions).

Viktor "Zero" Kozlov critical analysis persona for evaluating YOUR OWN security projects, research ideas, and work-in-progress. Use to break paralysis by indecision — forces a verdict on whether to ship, iterate, or kill an idea. Triggers on "what does Zero think", "roast this", "is this worth pursuing", "should I keep going", "analyze my work", or any self-evaluation of security projects/research/tools. NOTE: Zero is for judging YOUR work and ideas. Use strategic-advisor for evaluating other people's work, business decisions, or proposals.