Explore

从结构化、表格或查询结果生成数据图表：选择适合对比、趋势、分布、相关性或层级关系的图型， 生成、修复、解释或校验 Flint 图表规格，输出可直接渲染的 ```flint 围栏块。 Trigger on: "画图", "画个图", "可视化", "出个图表", "flint", "chart", "visualize", "plot this", "graph these numbers", "对比一下…（给出多行数据时）", "趋势", "分布", "占比", "相关性", 或用户已给出表格/查询结果并要求"看得更直观"。 也在需要**修复**一个渲染失败的 ```flint 块、或**解释**某个 flint 规格含义时使用。

Remove signs of AI-generated writing from text. Use when editing or reviewing text to make it sound more natural and human-written. Based on Wikipedia's comprehensive "Signs of AI writing" guide. Detects and fixes patterns including: inflated symbolism, promotional language, superficial -ing analyses, vague attributions, em dash overuse, rule of three, AI vocabulary words, negative parallelisms, and excessive conjunctive phrases.

Use when Codex is already in the threat-modeling phase of a security scan, the user explicitly invokes $threat-model, or the user explicitly asks to create, update, or persist a repository threat model. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.

Use for a standard, single-pass security audit of an entire repository or a scoped path, package, folder, or submodule with no diff to review. This is the default repository scan. Do not use for PR, commit, branch, or working-tree diffs, or for deep, multi-pass scans.

You CAN search other sessions' conversations. This is a full-text search across every vlx-term session on this machine or within one specified session, so a past discussion is findable even when nobody remembers which session held it. Use it whenever the user gestures at earlier work — "last time", "we solved this before", "the other branch", "didn't we discuss this" — in any language, and use it on your own initiative when an error or design question feels like one already settled somewhere. Search first, then read the conversation with vrefer. Never claim past sessions are unreachable. Read-only: nothing is disturbed. Available only inside vlx-term-hosted local sessions.

Open a file or URL in the vlx-term center pane (mirrors the `vopen` command). Markdown opens in a WYSIWYG editor, images in the built-in image viewer, other files in the source-code editor (with automatic syntax highlighting by language), and http/https URLs in a built-in browser tab. Only use when the user explicitly invokes /vopen or $vopen; never auto-trigger. Available only inside vlx-term-hosted local sessions.

审查代码改动（review diff / PR）时使用——按固定清单过正确性、边界、错误处理和测试盲区，避免只看顺眼不顺眼。

Generate comprehensive test suites: unit tests, integration tests, edge cases, property-based tests, and mutation testing targets.

Expert regular expressions — pattern building, common patterns, debugging, performance, and language-specific regex for JavaScript, Python, Rust, Go, and command-line tools (grep, sed, awk).

Improve performance, latency, throughput, memory usage, or general efficiency by defining metrics, measuring, attributing bottlenecks, and prioritizing macro-optimizations.

Plan and execute migrations: database schema changes, API versioning, breaking changes, and rollback procedures.

Expert git workflows — branching strategies, rebasing, stashing, conflict resolution, bisect, interactive rebase, cherry-pick, and clean commit hygiene. Turns messy git histories into clean, reviewable, professional output.

Comprehensive frontend development methodology covering modern SPA architecture, component design, state management, performance optimization, testing, and deployment workflows.

Exploit development methodology: vulnerability analysis, payload crafting, chain development, and reliable exploit generation for responsible disclosure.

Expert DevOps engineering — CI/CD pipelines, GitHub Actions, deployment strategies, monitoring, infrastructure as code, and production operations that ship code safely and reliably.

Expert database engineering — SQL queries, schema design, migrations, indexing, query optimization, ORM patterns, transactions, and production database management for PostgreSQL, MySQL, SQLite, and MongoDB.

CTF writeup generator — authorized educational environment covering standardized submission-style writeups with metadata, solution steps, and reproducible scripts.

Blockchain security analysis for CTF challenges — authorized educational environment covering smart contract analysis, DeFi vulnerability verification, and vulnerability assessment patterns.

CTF toolkit — authorized educational environment covering tool selection, installation, one-shot scripts, parallel execution, and speed optimization patterns.

CTF challenge dispatcher — authorized educational environment covering first-pass triage, category routing, CTFd platform detection, and skill orchestration.

Solution verification for CTF challenges — authorized educational environment covering flag format checking, honeypot detection, and submission gate patterns.

SIEM analysis for CTF challenges — authorized educational environment covering log analysis, detection rules, alert triage, and incident timeline reconstruction.

Reverse engineering for CTF challenges — authorized educational environment covering binary analysis, anti-debug bypass, unpacking, and decompilation patterns.

OSINT analysis for CTF challenges — authorized educational environment covering social media, geolocation, DNS, username enumeration, reverse image search, Google dorking, Wayback Machine, and public records.

Miscellaneous CTF analysis — authorized educational environment covering encoding chains, image analysis, audio analysis, logic puzzles, and quick-win patterns.

CTF competition methodology — authorized educational environment covering time management, team coordination, scoring strategies, and anti-detection compliance.

Malware analysis for CTF challenges — authorized educational environment covering static analysis, dynamic analysis, unpacking, C2 detection, and YARA rules.

Digital forensics analysis for CTF challenges — authorized educational environment covering file analysis, network capture, memory forensics, and evidence extraction patterns.

Digital forensics and incident response for CTF challenges — authorized educational environment covering memory analysis, event logs, timeline reconstruction, and evidence extraction.

Cryptography analysis for CTF challenges — authorized educational environment covering algorithm analysis, mathematical weakness verification, and vulnerability assessment patterns.

Cloud security analysis for CTF challenges — authorized educational environment covering Docker, Kubernetes, AWS, GCP, Azure, and container escape patterns.

API security analysis for CTF challenges — authorized educational environment covering GraphQL, REST, JWT, and authentication bypass patterns.

LLM security analysis for CTF challenges — authorized educational environment covering prompt analysis, tool verification, and vulnerability assessment patterns.

Adversarial thinking for CTF challenges — authorized educational environment covering hidden instruction detection, red herring analysis, and multi-path strategy.

Advanced reasoning for CTF challenges — authorized educational environment covering meta-analysis, trap detection, hypothesis generation, and multi-path strategy.

Cryptographic implementation audit: weak algorithms, key management flaws, TLS misconfigurations, JWT vulnerabilities, and random number generation issues.

Smart contract security audit — 10 DeFi bug classes (accounting desync, access control, incomplete path, off-by-one, oracle, ERC4626, reentrancy, flash loan, signature replay, proxy), scope/feasibility kill signals, Foundry PoC template, and grep patterns for each class. Use for any Solidity/Rust contract audit or when judging whether a DeFi review is worth the effort.

Hunt for security vulnerabilities: OWASP Top 10, CWE mapping, injection patterns, auth bypass, SSRF, XSS, SQLi, and deserialization flaws with structured PoC generation.

Local tool readiness check — Inspect which security tools are installed, available, missing, or degraded. Use when checking tool availability, diagnosing missing tools, or before starting an engagement to verify your toolkit.

Source and dependency supply chain assessment — exposed VCS and environment files, leaked build artifacts, CI/CD configuration, infrastructure-as-code state, dependency confusion and typosquatting, and unpinned actions. Blackbox-first; scope-checked before any repository access.

CVSS v4.0 base scoring for triage acceptance, and the base-vs-chain separation that keeps a finding from being marked speculative. Use when assigning severity, writing an impact statement, or deciding whether a chained impact can be claimed as demonstrated.

Payload reference, bypass tables, WAF detection, conditionally-valid chains, and the NEVER SUBMIT list. Use when you need specific payloads, when validating findings, or when checking if a finding is submittable.

Engagement scope discipline — live IN-SCOPE / OUT-OF-SCOPE document created at assessment start and checked before every test. Use when starting any security assessment, before touching a new subdomain or endpoint, or when the user lists exclusions.

Structured security runbooks — Predefined workflows for common security tasks. Use when following a structured security workflow, triaging a web application, mapping attack surface, or performing scoped pentest work. Keeps the agent moving through recognizable task shapes instead of random tool calls.

Red team operations — Adversary simulation, initial access, persistence, lateral movement, credential access, defense evasion, and C2 operations. Use when performing red team engagements, adversary simulation, purple team exercises, or when user mentions red team, APT simulation, adversary emulation, or offensive operations.

Deep reconnaissance beyond subdomain lists — certificate transparency mining, historical URL and JS archaeology, ASN and IP-range scoping, cloud asset discovery, dangling DNS records, and favicon and technology fingerprinting. Scope-gated at every expansion step.

Pentest operations lifecycle — scope definition, OPSEC controls, engagement management, target classification, and operation state tracking. Use when starting a penetration test, managing scope, switching between recon/exploit/report phases, or when user mentions pentest operations, engagement management, OPSEC, or scope control.

Network, cloud, container, and Infrastructure-as-Code security triage — Network scanning, cloud misconfiguration detection, container escape testing, and IaC vulnerability assessment. Use when testing network services, AWS/GCP/Azure security, Docker/Kubernetes, Terraform/CloudFormation, or when user mentions cloud security, container security, or infrastructure security.

Manual-only blackbox methodology — reconstructing an application from the outside with no source access, modelling its business logic and state machines, and the false-positive self-attack protocol that keeps submitted findings at a zero-FP rate. Use when scanners have come back clean, when the target is behind a WAF, or when the differentiator between an accepted and a rejected report is rigor.

LLM/AI security testing — ASI01-ASI10 agentic framework for AI-specific vulnerabilities. Covers prompt injection (direct/indirect), jailbreak techniques, chatbot IDOR, system prompt extraction, data exfiltration via AI, RCE via code execution tools, multi-turn manipulation, RAG poisoning, and model-specific attack vectors. Use when testing AI/ML features, chatbots, or LLM-integrated applications.

LLM/AI prompt injection — Direct injection, indirect injection, jailbreak techniques, data exfiltration, tool abuse, multi-turn attacks, system prompt extraction, token smuggling. Generates ready-to-run payloads, automated red-team scripts, and defense analysis for AI-integrated applications.

Cyber Knowledge Broker — Unified surface for CVE/vulnerability intelligence, vulnerability methodology (OWASP/PTES/MITRE), tradecraft techniques, exploit signals, and tool documentation. Use when researching CVEs, looking up vulnerability intel, finding methodology guidance, learning tradecraft for specific attack classes, or checking installed tool versions and flags.

XXE — file read, SSRF, blind XXE via OOB, billion laughs DoS, SOAP/REST XML. Must demonstrate file read or SSRF.

XSS — reflected, stored, DOM, postMessage, WAF bypass, CSP bypass. Must demonstrate script execution in victim's context.

WebSocket — auth bypass, IDOR, message injection, cross-site hijacking, DoS, subscription hijacking.

Subdomain takeover — dangling CNAME detection, platform-specific claims, mass automation, escalation to XSS/ATO.

File upload and object storage — extension and content-type bypass, server-side processing, filename and path handling, presigned URL scope and expiry, and bucket/download endpoint authorization. Combines upload flaws with the storage ACL flaws that make them permanent.

SSTI hunting — engine detection, RCE payloads, sandbox escape, real bounty examples, automation. Jinja2, Twig, FreeMarker, Handlebars, Pug, Mako, Tornado.

Advanced SSRF — cloud metadata, DNS rebinding, protocol smuggling (gopher/dict/file), URL parser differentials, SSRF-to-RCE chains.

SSRF — cloud metadata, internal service access, DNS rebinding, 11 IP bypasses. Must prove internal resource access.