菜单
This skill should be used when the user asks to "review the board", "show the case status", "what's on the board", "show investigation progress", "display the case", or wants to see the current state of their investigation CaseBoard.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
Use when debugging interactive CLI, REPL, TUI, ssh, telnet, nc, watch-mode, dev server, long-running command, terminal prompt flow, or any command that may not exit. Provides a PTY-backed MCP workflow for spawning terminal sessions, sending text and keys, reading output, managing multiple sessions, and exporting full transcripts.
This skill should be used when a user asks to debug an interactive CLI, REPL, TUI, prompt loop, shell wizard, watch mode, long-running terminal process, or any command that hangs, waits for input, redraws incorrectly, needs multiple inputs, behaves differently in a real terminal, or requires comparing tmux panes. Trigger on phrases like “it hangs after Continue?”, “the prompt never appears,” “my curses UI breaks in a small terminal,” “the watcher only fails after I answer the prompt,” or “inspect pane 2.”
macOS offensive security assistant — helps engineers audit applications for security vulnerabilities, identify bypass vectors in macOS security controls, and learn macOS internals through real-world case studies (CVEs). Covers: app vulnerability assessment (entitlement/injection/sandbox/TCC analysis), system internals, binary analysis, shellcode crafting (x64/ARM64), dylib injection, Mach IPC exploitation, function hooking, XPC attacks, sandbox escapes, TCC bypasses, symlink/hardlink attacks, kernel code execution, persistence mechanisms, Gatekeeper/XProtect bypass, AMFI/MACF internals, launch constraints, application-runtime injection (Electron/Chromium/NIB/.NET/Java/Python), IOKit/DriverKit driver attacks, MDM/DEP exploitation, keychain attacks, dangerous entitlements, and full penetration testing workflows. Use this skill whenever the user asks about: checking macOS apps for security issues, auditing entitlements or sandbox profiles, learning macOS security internals, macOS security research, macOS privile
微步在线威胁情报查询工具。支持IP、域名、文件哈希威胁情报查询，漏洞情报查询，资产测绘等功能。支持微信登录自动化和X语言高级搜索。当用户需要查询威胁情报、进行资产测绘或使用微步在线平台时，应使用此技能。
This skill should be used when the user asks to "close the case", "conclude the investigation", "wrap up", "present findings", or when the convergence check indicates the case has been solved. Produces the final resolution with complete evidence chain.
This skill should be used when the user asks to "discuss the case", "brainstorm about the investigation", "I'm stuck", "what do you think", or when the investigation loop detects a deadlock, hypothesis ambiguity, or needs user input to break a tie. Facilitates structured case discussion.
基于 SOC 职业分类
| name | review-board |
| description | This skill should be used when the user asks to "review the board", "show the case status", "what's on the board", "show investigation progress", "display the case", or wants to see the current state of their investigation CaseBoard. |
Present the current CaseBoard state in a human-readable format, showing all fragments, threads, hypotheses, and the investigation's overall progress.
For Detective v2 cases, prefer MCP tools:
detective_graph_overviewdetective_list_nodesdetective_list_edgesdetective_convergence_statusdetective_export_markdowndetective_export_mermaidOnly use legacy scripts if the MCP server is unavailable.
Use this section only for legacy v1 flat JSON case files when the Detective MCP server is unavailable. For v2/v2.1 cases, use the MCP-first review flow above.
python $PLUGIN_ROOT/scripts/board.py status .detective/cases/<case-id>.json
python $PLUGIN_ROOT/scripts/scoring.py suggest-phase .detective/cases/<case-id>.json
python $PLUGIN_ROOT/scripts/convergence.py .detective/cases/<case-id>.json
Also read the full case file to access fragment details:
cat .detective/cases/<case-id>.json
Display in this structured format:
## Case: <title>
**Phase**: <current phase> | **Actions**: <taken>/<budget> | **Converged**: <yes/no>
### Active Hypotheses (<count>)
| ID | Description | Confidence | Supporting | Contradicting |
|----|-------------|------------|------------|---------------|
| <id> | <content> | <conf> | <count> | <count> |
### Eliminated Hypotheses (<count>)
| ID | Description | Reason |
|----|-------------|--------|
| <id> | <content> | <elimination_reason> |
### Evidence Chain (<count> pieces)
- [Anchor] <content> (source: <source>)
- [Evidence] <content> (source: <source>)
- [Clue] <content> (needs verification)
### Constraints (<count> active)
- <constraint content> → eliminates: <hypothesis ids>
### Key Connections
- <from> --<type>--> <to> (most important threads)
### Investigation Log (last 5 actions)
- Round N: <action description> → <outcome>
After the board display, add a brief analytical summary:
If the user asks for a visual/graph representation:
python $PLUGIN_ROOT/scripts/board.py export-graph .detective/cases/<case-id>.json
This outputs DOT format which can be rendered with Graphviz.
For legacy v1 flat JSON case files only, if multiple files exist and MCP is unavailable, ask the user which legacy case to inspect.
Use these scripts only for legacy v1 flat JSON case files when the Detective MCP server is unavailable:
scripts/board.py — Legacy board status and DOT graph exportscripts/scoring.py — Legacy phase suggestionscripts/convergence.py — Legacy convergence status check