SpecterOps

Operate Cobalt Strike for authorized red team operations using its MCP. Use when the user asks to list Beacons, run Beacon commands, or otherwise interact with Cobalt Strike.

Use for OpenHound collector and OpenGraph extension development work, including planning, graph schema, source collection, assets, lookup/preproc, registration, validation, and collector template adaptation under the BloodHound plugin.

Use when writing Outflank C2 Python BOF wrappers for OC2 V2 (*_bof.s1.py, BaseBOFTask, outflank_stage1, stage1) or V3 (oc2_sdk_python, @command, manifest.json, command provider), when porting/migrating/converting a V2 BOF script to a V3 application, or when…

Performs security review of arbitrary Go packages, including libraries, frameworks, CLIs, HTTP and gRPC services, and backend applications. Covers authentication and authorization, request parsing, SSRF, SQL and command injection, templates and filesystems,…

Develop Outflank C2 event-driven Python bots. Use when creating or debugging OC2 automations.

Use this skill when the user asks about Linux process injection, using ptrace for injection, LD_PRELOAD injection, writing to procfs, remote access via process_vm_writev, seccomp notify injection, PTRACE_POKETEXT, GOT overwrite, remote thread creation on…

Provide macOS guidance for initial access using app bundles, installer packages, and disk images, including current Gatekeeper behavior and pkgbuild and hdiutil examples.

Malleable C2 profile development for Cobalt Strike. Use when writing C2 profiles or profile overrides for Cobalt Strike.

Addresses GitHub Dependabot security alerts by listing open alerts, identifying affected Python/uv, frontend npm, and Titus Go projects, upgrading vulnerable dependencies, running verification, and committing fixes. Use when the user wants to fix Dependabot…

Build a new Nemesis file enrichment module end-to-end with explicit user approval gates for output mode, library choice, sample files, and integration testing.

Manages Python package dependencies. Use when adding, upgrading, removing, or syncing Python/pypi packages in projects or libs.

Use this skill for Janus requests to design, add, or adjust source ingestors/parsers for live APIs or local files, including Mythic, Ghostwriter, Cobalt Strike REST, Outflank implant logs, new C2 telemetry sources, parser normalization, pull/load CLI wiring,…

Use this skill for Janus requests that ask what to measure, how to measure it, which analyzer should answer it, or how to implement or adjust source-aware analysis for Mythic or Ghostwriter telemetry.

Use this skill for Janus requests that ask for insights from any Janus artifact, including report HTML, bundles, analyzer outputs, events.ndjson, raw exports, or standalone JSON snippets.

Interview the user relentlessly about a plan or design until reaching shared understanding, resolving each branch of the decision tree. Use when the user wants to stress-test a plan, get grilled on their design, or mentions "grill me".

Use for all OpenHound collector work, including planning, graph schema, source collection, assets, lookup/preproc, registration, and validation.

Add a newly supported AI agent/tool or a newly discovered artifact file, directory, or glob to Blacklight while keeping Scout and Rules catalogs, generated target tables, schemas, and validation surfaces aligned. Use for requests to add agent support,…

Safely interpret and communicate findings from AI coding-agent session data. Use when analyzing paired exported session-report JSON and text files (including Blacklight Codex reports), approved `.codex` session artifacts, session-history JSON/JSONL, tool…

Generate BloodHound product release notes from Jira exports, verify changes against local repositories, and update the release summary and navigation.

Update the BloodHound REST API reference from a release-specific OpenAPI specification.