메뉴
Use when carrying Ghidra-derived symbols, functions, or addresses into LLDB confirmation and writing the dynamic result back to project evidence.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
Use when choosing or adding macOS research machines: primary, crash-test, cross-platform Apple Silicon, and Intel baseline. Fires on "add a lab machine", "which machine should run this", "primary lab host", "crash-test", "Intel baseline", and "cross-platform verification".
Use when driving Ghidra headless from Cursor for macOS reverse engineering: opening Mach-O binaries, listing functions, decompiling by address, running custom Ghidra scripts, or doing breadth sweeps across many targets. Fires on "ghidra-mcp", "decompile with Ghidra", "run a Ghidra script", "list functions in this binary", and systemic-class scan setup.
Use when starting a macOS reversing pass from an app bundle, installer, framework, XPC bundle, helper, or bare binary path. Fires on "start target", "inventory this app", "point at this bundle", "begin PASS", and "target intake".
Use when mapping a macOS target's attack surfaces to reusable vulnerability classes, generating hunt hypotheses for a new third-party app, or deciding which playbook or scanner applies. Fires on "vulnerability ontology", "bug-class map", "what bug classes apply", "generate hypotheses", and "classify this macOS surface".
Use when a macOS target appears to be Electron-based and needs ASAR, package, preload, IPC, native module, fuse, sandbox, or update review.
Use when a question touches the lab topology: what runs on the workstation, what runs on the primary lab host, how `ghidra-mcp` and `macre-vm-mcp` are wired, how to start a findings repo, which machine role to use, why Hopper is manual-only, or how to troubleshoot MCP/SSH/script sync failures.
| name | offensive-macos-gatehouse-ghidra-lldb |
| description | Use when carrying Ghidra-derived symbols, functions, or addresses into LLDB confirmation and writing the dynamic result back to project evidence. |
| folder | offensive-macos-gatehouse-ghidra-lldb |
| source | skillz-wave4 |
| trigger_phrases | ["bridge ghidra lldb","ghidra to lldb","lldb anchors","confirm this static anchor"] |
Channel boundary:
REPO_MODE=analysis. Gatehouse confirms static hypotheses in a lab-safe way. It does not start dynamic testing untilLAB_SAFETY.mdpermits the host, user, rollback, and test shape.
LAB_SAFETY.md, CORPUS.md, the dossier, and the relevant Ghidra evidence path.ghidra-scripts/export_lldb_anchors.py or a Ghidra MCP query to collect anchors.macre-vm-mcp lldb_run_anchors or lldb_run to capture image list, registers, backtrace, and targeted memory/state.artifacts/ or findings/analysis/, then update Scriptorium and HANDOFF.md.macre-vm-mcp/src/macre_vm_mcp/tools_lldb.pyghidra-scripts/export_lldb_anchors.pySkills/offensive-macos-tooling-lldb/SKILL.mdSkills/offensive-macos-scriptorium-evidence/SKILL.md