Use for IDOR, horizontal/vertical privilege checks, multi-account comparisons, and business state-machine testing.
Reviews authorized Active Directory environments through offline SharpHound/PingCastle report import and bounded Kerberos/no-password Certipy AD CS inventory. Use for Active Directory, AD CS, Certipy, BloodHound, SharpHound, PingCastle, LDAP, 域控, 活动目录, 域安全,…
Manage structured todos for multi-step agent work. Use when the user asks to execute, investigate, scan, fix, analyze, or continue a task with multiple steps.
Use for testing AI/LLM-integrated features inside the *target* application — chatbots, RAG search, AI support agents, or any endpoint that feeds user/document input to an LLM. Covers prompt injection, insecure output handling, excessive agency, and RAG data…
Schedule recurring or durable continuation turns (interval/cron). Use for patrols, briefings, scans, and periodically resuming unfinished Agent work; manage via cron_* tools.
Use when the user asks for an authorized penetration test, exploit-chain planning, controlled vulnerability verification, ROE handling, or safe validation of network/service findings.
Use for EXE, DLL, ELF, process dump, malware triage, native reverse engineering, decompiling/disassembling a function, understanding code, unpacking installers / setup.exe (Inno Setup), and PATCHING / modifying a binary (NOP a check, change a jump, redirect a…
Choose between the hidden automation browser (watched in the Browser sidebar) and attaching the user's real Chrome/Edge. Launching a debug browser does not attach it; call browser_attach_existing next. Team members share that one attached browser.