菜单
Semantic code search, and call graph analysis with GrepAI. Use when (1) searching code by meaning/intent rather than exact text, (2) finding function callers or callees, or (3) integrating GrepAI with AI agents via JSON/TOON output.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Use when the user wants to search Censys, write CenQL queries, investigate IPs/domains/certs, pivot from one asset to related infrastructure, hunt threats, or aggregate internet data. Triggers on: "search censys", "look up this IP", "find hosts running X", "pivot from this cert", "what else does this org own", "censeye", "censys aggregate", or any internet recon/threat hunting task — even if the user doesn't say "censys" explicitly.
Store, retrieve, and reflect on agentic memories via the Hindsight API. Use for persistent cross-session memory — conversation history, fact recall, memory-grounded answers, per-user memory banks. Triggers: remember: , retain/recall/reflect, agent memory, or storing document knowledge in a searchable memory store.
Search the web with Exa's neural search API via curl. Use when the user wants to search the web, fetch clean page contents from URLs, or get an LLM answer with citations — including triggers like "exa", "search the web", "look this up", "latest on", or factual questions needing fresh sources. Auth via `op` CLI (`op://infra/exa/token`).
Automate Google NotebookLM to generate AI podcasts, audio overviews, study guides, FAQs, briefing docs, and deep dives from YouTube, PDFs, URLs, audio, and images. Use for "create a podcast", "audio overview", "study guide", conversational AI-host audio, or chatting/querying multiple documents as one knowledge base. Triggers - "notebooklm", "audio briefing", "podcast about", "deep dive from". NOT for plain transcription, TTS, audio editing, or basic summarization.
Symbolic execution and binary analysis with angr (Python). Use when the user wants to find an input that reaches a target address, solve a crackme/keygen, check branch reachability, recover a CFG over indirect calls, or reason about constraints on program inputs. Trigger on phrases like "symbolic execution", "solve this crackme", "what input reaches", "find the flag with angr", "constraint solving", "angr CFG", or any RE task where the question is "what input makes the program do X". Pairs with the rizin-re skill — use rizin to find target addresses, then angr to solve for inputs that reach them.
Interactive binary reverse engineering with rizin via a persistent tmux session. Use when the user wants to open a binary and explore it — disassemble functions, find strings, inspect imports/exports, trace control flow, analyze malware, work CTF challenges, or do vulnerability research. Trigger on phrases like "open this binary", "reverse engineer", "disassemble", "analyze with rizin", "what does this function do", "find the flag", or any RE task involving an executable or library file.
| name | grepai |
| description | Semantic code search, and call graph analysis with GrepAI. Use when (1) searching code by meaning/intent rather than exact text, (2) finding function callers or callees, or (3) integrating GrepAI with AI agents via JSON/TOON output. |
Semantic code search and call graph tracing. Unlike grep/ripgrep (exact text match), GrepAI searches by meaning -- "authenticate user" finds login, auth, signin code.
grepai init --provider ollama --backend gob --yes # initialize project (interactive: picks provider + backend)
grepai watch --background # start background daemon to build/maintain index
grepai status # check index health
Use accompanying MCP server tools, not bash. If MCP tools are not available, tell the user to enable them. If you encounter initialization errors, you are free to init and start.
Describe intent, not implementation. Use 3-7 descriptive English words.
| Bad | Good |
|---|---|
getUserById | fetch user record from database using ID |
auth | user authentication and authorization |
handleError | error handling and response to client |
Natural questions also work: "how are users authenticated", "where is the database configured".
If you know the exact function name, use regular grep instead.
See references/configuration.md for search boosting and trace configuration options.
| Problem | Solution |
|---|---|
| No results | Check index: grepai status. Re-index: rm .grepai/index.gob && grepai watch |
| Irrelevant results | Be more specific, use different words, try synonyms |
| Function not found (trace) | Check spelling (case-sensitive), verify enabled_languages |
| Missing callers/callees | Try precise mode, check ignore patterns |
| Graph too large/timeout | Reduce --depth, trace specific function instead of main |