// Use observer_ward for authorized web application and service fingerprint identification against in-scope HTTP targets.
Use when a task requires shell-level work inside the sandbox, including environment setup, script writing, code execution, running programs, downloads, package installs, scanning, or browser/tool CLIs.
Use ProjectDiscovery httpx for authorized HTTP probing, live host validation, response triage, and lightweight web fingerprint collection.
Reverse engineer binaries using Ghidra's headless analyzer. Decompile executables, extract functions, strings, symbols, and analyze call graphs without GUI.
Use agent-browser-cli to perceive and control the supervised Chromium browser inside the sandbox, interact with pages, capture screenshots/PDFs, inspect cookies/CDP/network/console state, and troubleshoot only when needed.
Use for authorized SQL injection testing with the sqlmap CLI, including detection, DBMS fingerprinting, request replay, and extraction checks against in-scope web targets.
Use for authorized host discovery, port scanning, service/version detection, NSE script checks, network inventory, and local network diagnostics with the nmap CLI.
| name | observer-ward |
| description | Use observer_ward for authorized web application and service fingerprint identification against in-scope HTTP targets. |
Use observer_ward for authorized service and web application fingerprint identification. It is useful for identifying exposed applications, middleware, services, versions, CPE-style product context, and fingerprints from community probe data.
Skill name is observer-ward; the installed CLI command is observer_ward.
observer_ward --help
-t / --target for one or more explicit targets, -l / --list for a file with one target per line, or stdin for pipeline input.-o / --output.--format json when downstream parsing with jq or later evidence review is needed.--silent when piping results to other tools so progress logs do not mix with structured output.--ir for request/response evidence and --ic for certificate evidence only when that detail is needed; both can increase output size.--debug only for troubleshooting or evidence collection because it can expose request/response details and increase output volume.