菜单
IoTSpy project context — architecture, conventions, and security caveats specific to this codebase. Use when working in the IoTSpy repo, especially alongside dotnet-engineer, security-code-review, or threat-modeling. Pointers into in-repo docs rather than duplicated facts that rot.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Senior .NET engineering guidance for ASP.NET Core, EF Core, SignalR, Polly, auth, testing, and observability. Use when designing or debugging .NET code, choosing between library options, planning a migration, or asked how something in the .NET ecosystem actually behaves.
Systematic security review across the full attack surface — input handling, authorization, resource use, errors, crypto, secrets, and dependencies. Use when asked to review code for security, audit an endpoint, or check whether something is safe before merging. Also trigger on "is this OK?" / "any issues here?" — security bugs hide in code that looks fine.
Structured threat modeling for systems, features, and architecture changes — STRIDE plus OWASP/ATT&CK, calibrated by impact and likelihood. Use when asked for a threat model or design security review, or when someone describes a design and asks "is this secure?" / "how could this be abused?" / "what could go wrong?"
| name | iotspy-context |
| description | IoTSpy project context — architecture, conventions, and security caveats specific to this codebase. Use when working in the IoTSpy repo, especially alongside dotnet-engineer, security-code-review, or threat-modeling. Pointers into in-repo docs rather than duplicated facts that rot. |
This skill holds only the IoTSpy-specific bits that matter when reasoning about the codebase. Generic .NET, security-review, and threat-modeling guidance live in their own skills. Don't duplicate facts here that already live in CLAUDE.md or AGENT.md — point to them and let them be the source of truth.
CLAUDE.md — quick commands, project structure, current state (test counts, migration count, completed phases). This is the canonical place for "how big is the project right now."AGENT.md — full technical reference: commands, architecture, naming conventions, testing guidance, known operational requirements (setcap, JSON enum serialization, iOS cert constraints, SQLite migration foot-guns).docs/ARCHITECTURE.md — detailed architecture spec.docs/CODE-PATTERNS.md — implementation patterns to follow when adding controllers, repositories, hubs, decoders.docs/PHASES-COMPLETED.md / docs/PHASES-ROADMAP.md — phase history and roadmap.docs/TROUBLESHOOTING.md — known issues and resolutions.When asked "what's the current state" / "how many tests" / "which migration is latest" / "what phase are we on", read CLAUDE.md rather than answering from memory. State drifts.
The project layout is stable, even when counts change:
IoTSpy.Api — ASP.NET Core host, REST controllers, SignalR hubs, middlewareIoTSpy.Core — domain models, interfaces, enums; must not take infrastructure dependenciesIoTSpy.Storage — EF Core DbContext + repositories (SQLite/Postgres)IoTSpy.Proxy — TLS MITM/passthrough, SSL stripping, WebSocket/MQTT/CoAP proxiesIoTSpy.Protocols — MQTT, DNS, CoAP, WebSocket, gRPC, Modbus, OpenRTB, telemetry decodersIoTSpy.Scanner — port scan, fingerprinting, CVE lookup, packet captureIoTSpy.Manipulation — rules engine, scripted breakpoints, replay, fuzzer, AI mock, OpenRTB PII, API spec generation, content replacementIoTSpy.*.Tests — unit + integration testsfrontend/ — Vite 6 + React 19 + TypeScript dashboardNamespace prefix is IoTSpy (capital I, o, T, S). Docker image/container name is iotspy.
dotnet test before committing. All backend tests must stay green.dotnet ef migrations add <Name> --project src/IoTSpy.Storage --startup-project src/IoTSpy.Api).AddHostedService(sp => sp.GetRequiredService<T>()) — never double-register.AddControllers().AddJsonOptions(...) and AddSignalR().AddJsonProtocol(...). Missing the SignalR call sends numeric enum values over live captures and crashes the frontend timeline.iotspy-connect (timeout → retry → circuit breaker, keyed per upstream host) and iotspy-tls (timeout only).When reviewing code or threat-modeling for this codebase, these are the IoTSpy-specific surfaces a generic skill won't catch:
Dual-use research tool. IoTSpy intentionally MITMs TLS, strips SSL, scans ports, captures packets, and rewrites traffic. Things that would be malicious in another context are core features here. Do not flag these as bugs — call them out as design decisions when the surrounding context shifts (e.g., if the proxy accepts connections from outside a research lab, the threat model changes).
Single-user JWT, BCrypt password in ProxySettings row (Id=1). The whole product authenticates against one row. Anything weakening that row's hash, leaking it, or bypassing the Auth__JwtSecret ≥ 32-char guard is critical. Verify the secret-length enforcement is reachable on every entry point (controllers, SignalR, design-time DbContext factory).
SignalR token via ?access_token= query param. This means tokens can land in proxy/access logs. Reviewing logging or middleware that sees URLs needs to consider redaction.
Roslyn (C#) and Jint (JS) scripted breakpoints. Anywhere user-supplied scripts execute is RCE-by-design. Confirm it stays gated behind admin auth, that scripts cannot escape into the host process beyond the documented surface, and that imports/timeouts are bounded. Flag any change that broadens the script API.
SharpPcap CAP_NET_RAW / CAP_NET_ADMIN. The API process gets raw socket access via setcap. Any new code path that handles arbitrary sockets or executes privileged operations should be audited against this elevated capability.
TLS validation intentionally disabled upstream in the proxy. Don't spread that pattern outside the proxy. Other components (telemetry, AI mock client, scanner) must validate TLS normally.
Captured-data confidentiality. The product's value is intercepted traffic — credentials, tokens, payloads. Storage encryption-at-rest, retention, and access control on captures, replays, and exports are core, not nice-to-have.
Migration foot-gun on SQLite. AlterColumn emits PRAGMA foreign_keys = 0 which can't run inside the EF transaction wrapper. Use migrationBuilder.Sql(...) directly. See AGENT.md § "EF Core migrations on SQLite" for the worked example.
iOS/macOS leaf cert constraints. ≤397-day validity, AKI keyid-only, IP-as-GeneralName.IPAddress. If you regenerate the root CA, delete leaf certs from the database. See AGENT.md for the SQL.
dotnet-engineer: when designing a new controller, hub, repository, or background service in this repo. Apply IoTSpy conventions on top of generic .NET advice.security-code-review: when reviewing IoTSpy code, layer the IoTSpy-specific risks above onto the generic 7-step checklist.threat-modeling: when modeling new IoTSpy features, anchor "dual-use tool" considerations from this skill into the model.When in doubt about a project-specific fact, read CLAUDE.md and AGENT.md. Don't paraphrase from memory.