菜单
Use when a task should persist reusable helper files such as Python deobfuscation scripts, Java helpers, reports, or Ghidra-supporting snippets into the standardized agent artifact directory tree.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Use when a task needs Mandiant capa through the local `runCapa` or `capaHelp` MCP tools, especially when forming a valid capa command string, choosing output mode, or avoiding path-quoting mistakes.
Use when a task needs the local YARA MCP tools `yaraScan`, `yaraScanInline`, `yaraWriteRule`, `yaraListRules`, or `yaraHelp`, including choosing whether to scan with a saved rule file, inline rule text, or persist a rule into the standardized generated-artifact YARA directory.
Use when writing, reviewing, or explaining YARA rule syntax, or when preparing `rule_text` for `yaraScanInline` or `yaraWriteRule` so the rule can be saved into the standardized generated-artifact YARA directory.
Use when the task requires emitting a patched binary copy through the local MCP tool lane, especially for short instruction patches or explicit byte replacements.
Use when a task would benefit from a secondary model call through the local MCP tool lane, especially for Hugging Face or OpenAI-compatible inference, decompilation cleanup, classification, or comparing competing interpretations.
Use when a task needs the local `binwalkScan`, `listBinwalkExtraction`, or `binwalkHelp` MCP tools to scan a file for embedded content, optionally extract it, or inspect extraction results.
| name | agent-artifacts-mcp |
| description | Use when a task should persist reusable helper files such as Python deobfuscation scripts, Java helpers, reports, or Ghidra-supporting snippets into the standardized agent artifact directory tree. |
Use this skill when generated helper code should be written to disk in a predictable repo-aware location instead of being left only inline in the response.
agentArtifactPaths()writeTextArtifact(artifact_type, content, filename="", overwrite=False, subdir="", description="")writePythonArtifact(content, filename="", overwrite=False, subdir="", description="", ghidra_script=False)writeJavaArtifact(content, filename="", overwrite=False, subdir="", description="", ghidra_script=False)listAgentArtifacts(artifact_type="", max_results=200)agentArtifactHelp()writePythonArtifact for deobfuscation helpers, decoders, unpackers, or standalone analysis utilities.writeJavaArtifact for Java helpers or Java-based Ghidra support code.ghidra_script=True when the helper is meant to live under the ghidra/ artifact directory instead of the generic python/ or java/ directory.writeTextArtifact for generic reports or future typed text artifacts.agentArtifactPaths when you need to confirm where the configured artifact root and typed subdirectories currently resolve.filename: simple file name only; do not pass a path.subdir: optional nested grouping under the typed artifact directory, for example a sample slug like labos.overwrite=True: only when replacing a previous generated helper intentionally.description: short note about why the helper was generated.AGENT_ARTIFACT_DIR and optional per-type overrides in .env.yaraWriteRule so they can be validated and indexed correctly.