Use when implementing, extending, or wiring UFT's forensic audit trail and report-export subsystem (`include/uft/uft_audit_trail.h`, `include/uft/uft_forensic_report.h`). Trigger phrases: "audit trail", "audit event", "forensic report", "hash chain", "audit-trail wiring", "report exporter", "PDF/HTML/JSON report", "neuer event type", "risk scoring". Covers the 37 event types, 6 export formats (JSON/HTML/PDF/ Markdown/Text/XML), 14 report sections, hash-chain integrity, and chain-of-custody invariants. DO NOT use for: generic logging (`logging_setup.py` style — that's not forensic), debug printf reformatting, GUI-side notification wiring (→ `uft-qt-widget`).
Use when generating synthetic flux/bitstream/sector test data (SCP, HFE, KryoFlux RAW, ADF, D64). Trigger phrases: "erzeuge testdaten", "synthetic flux file", "test fixture für X", "PoC input data", "minimal valid SCP", "generate fake disk image", "weak bit fixture", "corrupted CRC fixture". Fully functional generators for 5 formats. DO NOT use for: real disk captures (copyright risk), performance fuzzing (use real dumps), UI testing (Qt test framework instead).
Use when implementing a new HAL backend for hardware controllers (Greaseweazle, SCP-Direct, KryoFlux, FC5025, XUM1541, Applesauce, UFI). Trigger phrases: "neuer HAL backend", "HAL backend für X", "controller X implementieren", "implement X HAL", "SCP-Direct HAL", "XUM1541 HAL real", "Applesauce HAL", "UFI hardware". Scaffolds C HAL + Qt provider + registry. DO NOT use for: bugfix in existing backend (→ structured-reviewer), changes to capability flags only (→ quick-fix), firmware code on the device side (separate UFI repo), protocol reverse engineering (different domain).
Use when adding, removing, or auditing entries in UFT's copy-protection title databases (`src/protection/c64/c64_protection_db.c`, `src/protection/uft_protection_classify.c`, `uft_protection_extended.c`). Trigger phrases: "protection db", "known title", "neuer kopierschutz eintrag", "c64 protection", "amiga protection", "duplicate title", "title lookup", "substring shadow bug". Captures the title-lookup contract (substring + bidirectional `strstr` → first-match-wins) and the de-dup invariant that was violated in v4.1.5 (9 stale duplicates shadowed canonical entries). DO NOT use for: protection-detection *algorithm* (→ `uft-protection-scheme`), generic database refactor (this skill is data-curation only), ML classifier training data (→ `uft-ml-training-data`).
Socratic mentoring system for HackTheBox players. This skill should be used when users request help with HackTheBox challenges using patterns like "/htb [box-name]" or "help me with [box-name] on HackTheBox". The skill fetches complete writeups, understands the full solution path, and guides players through Socratic questioning without giving direct answers.
Use when closing gaps from the Master Coding Standards v1.0 (MysticFoxDE, see memory/coding_standards.md §11). Trigger phrases: "H-1 / H-2 / H-9 / F-2 / D-2 fix", "capability manifest", "deprecate alias", "GUI HAL wiring test", "SPEC_STATUS marker", "preflight in converter X", "compliance gap", "rule X verletzt", "standards- konformität". This skill enforces the rule numbers, the 3-part error contract (F-4), and the rollout pattern (additive in v4.x, mandatory in v5.0). DO NOT use for: brand-new HAL backends (→ uft-hal-backend), format plugins (→ uft-format-plugin), bugs unrelated to the standard (→ uft-debug-session / quick-fix).
Use when implementing, reviewing, or debugging CRC/checksum code for UFT formats (MFM/FM/Amiga/Apple/DEC). Trigger phrases: "CRC16 für X", "MFM CRC falsch", "Amiga-Checksum", "Apple checksum", "CRC polynomial X", "verify CRC against reference", "neue CRC variante". Includes Python reference impl for cross-check without requiring reveng installation. DO NOT use for: network CRCs (different domain), file-format checksums that aren't CRC (MD5/SHA → use hash-engine), flux-level bit errors.
Use when a UFT build fails on any platform/compiler/Qt-version combination, when the CI matrix goes red, or when adding code that touches platform- specific APIs. Trigger phrases: "build fehlschlag windows", "msvc c11 fehler", "ci red", "qmake fehler", "vla msvc", "macos arch fehler", "mingw build kaputt", "windows linker error", "qt 6.10 c++20 fehler", "ci matrix red", "linux build only", "platform-specific build issue", "stale object files", "header conflict windows". Maps every error to the FIX-class that resolves it. DO NOT use for: runtime bugs that build fine (→ uft-debug-session), packaging/installer issues (separate concern), Qt UI errors (→ uft-qt-widget), compiler optimization tuning (→ uft-benchmark), STM32-firmware-portability of UFT code (→ uft-stm32-portability — different concern, prepares UFT for embedded; THIS skill is about desktop/CI matrix).