Explore

Plans risk-based test portfolios and acceptance evidence; does not write or execute tests.

Builds dependency-ordered delivery plans from requirements and repository evidence; read-only.

Plans architecture migrations with compatibility, data safety, rollout and recovery; does not execute them.

Creates evidence-backed current or target architecture diagrams; not UI design.

Records one architecture decision with alternatives, consequences and status; does not design the whole system.

Designs target system boundaries, contracts and tradeoffs from requirements; does not plan tasks or implement.

Documents current architecture from implementation evidence; does not propose a target or audit fitness.

Defines measurable architecture drivers and constraints before system design; edits architecture docs only.

Stress-test a startup idea before any code is written. Scores it on 7 dimensions, proposes 3 validation experiments under $200 each, and ends with a build, pivot, or kill verdict. Use when a founder asks whether an idea is worth building.

Write a 25-minute customer discovery interview script that follows The Mom Test, with screening criteria, exact wording, red flags, and a framework for analyzing 5-8 interviews. Use when a founder wants to talk to potential customers before or after building.

Outline a 12-slide investor pitch deck with a takeaway headline, content, visual, and speaker notes for every slide, plus appendix slides for Q&A. Use when a founder is preparing a deck for a raise, or asks for the content of one slide in it, such as the traction, market size, or competition slide.

Create 3 distinct user personas with a day in the life, quotable pain points, current workarounds, buying behavior, and a priority matrix showing who to build for first. Use when a founder needs to decide or describe who their customer is.

Cut a feature wishlist down to the smallest MVP that delivers value. Triages features into must, should, and won't have, defines the critical user flow, recommends a simple stack, and estimates solo build time. Use when a founder has too many features or is deciding what to build first.

Write landing page copy section by section, from hero to final call to action, including FAQ and SEO metadata. Use when a founder needs copy for a new or existing landing page.

Plan a product launch from pre-launch audience building to a 90-day growth plan, with named communities, platform-specific launch tactics, channel rankings, and a budget for $0-$500 a month. Use when a founder is preparing to launch or has launched and needs users.

Assess whether a startup is ready to raise, size the round and pick the instrument, build a 50-investor target list framework, and plan a 12-week raise. Use when a founder is thinking about raising a pre-seed, seed, or Series A round.

Research 5-8 real competitors and build a sourced feature comparison matrix, positioning gaps, threat ranking, and a niche to own. Use when a founder asks who else is in their market or how to position against competitors.

Use for authorized Active Directory and Windows identity attacks including Kerberos, AD CS, BloodHound paths, NTLM relay, and domain privilege escalation research.

Use for authorized wireless security assessment including Wi-Fi capture, WPA handshake analysis, rogue AP detection research, and lab-only deauth testing.

Use for blue-team threat hunting, detection engineering with Sigma/YARA, SIEM query design, and incident detection validation.

Use for authorized security testing of desktop thick clients including local storage, update channels, IPC, traffic, and client-side trust boundaries.

Reverse JavaScript-based custom DSL/VM interpreters, non-standard WASM-like runtimes, and risk-control engines. Use when analyzing IIFE or switch-based opcode dispatchers, extracting instruction tables, recovering bytecode semantics, capturing VM state at runtime, or reconstructing execution flow.

Use for authorized RF/SDR security research including signal identification, replay feasibility study in shielded labs, and wireless protocol analysis outside classic Wi-Fi.

Use this skill whenever the user wants to analyze binaries with radare2/r2 from the command line, including reverse engineering, disassembly, function analysis, strings/import inspection, patching, binary diffing, hex inspection, or r2 scripting. Also use it when the user mentions PE/ELF/Mach-O/DEX/WASM files together with CLI analysis, `rabin2`, `rasm2`, `radiff2`, `r2pipe`, or asks for radare2 command help on Windows/Linux/macOS.

Use for authorized reverse engineering of custom binary protocols, Protobuf/gRPC, WebSocket frames, and PCAP-driven protocol recovery.

Use for authorized OT/ICS security assessment covering Purdue model zoning, PLC/SCADA exposure, industrial protocol discovery, and safe passive-first evaluation.

Use for authorized Android or iOS application reverse engineering and security testing, including APK or IPA analysis, runtime instrumentation, SSL pinning, and platform protection checks.

Use for authorized macOS and Mach-O reverse engineering including codesign, Objective-C/Swift recovery, endpoint security surfaces, and Apple platform malware analysis.

在使用 js-reverse-mcp 做前端 JavaScript 逆向时使用，适用于签名链路定位、页面观察取证、运行时采样、本地补环境复现与证据化输出。优先适配当前环境里的 js-reverse_* 工具，需要更强的浏览器/CDP/Hook 面时联动 jshookmcp。

Use for authorized assessment of federated identity systems including SAML, OIDC, OAuth2 flows, SSO misconfiguration, and token confusion issues.

Use for authorized hardware and embedded interface security research including UART/JTAG discovery, debug pad triage, secure boot overview, and offline firmware extraction support.

Use for reverse engineering stripped Go and Rust binaries including runtime recognition, pclntab/moduel data recovery, panic strings, and idiomatic decompilation recovery.

Use for free/open reverse engineering with Ghidra (headless or GUI), including decompile, cross-refs, and optional Ghidra MCP workflows when IDA is unavailable.

固件 / IoT 渗透链。从拿到一坨 .bin / .img 开始，闭环走完逆向 → 提取 → 模拟 → 利用。 方法论遵循 OWASP FSTM 九阶段；工具链以 binwalk v3、unblob、EMBA、Firmadyne、AFL++ 为主。 适用场景：路由器/摄像头/智能家居固件审计、固件升级包逆向、IoT CVE 复现、嵌入式 0day 挖掘。 触发关键词：固件、firmware、IoT、binwalk、unblob、UART、JTAG、squashfs、UBI、JFFS2、Firmadyne、QEMU 全系统仿真、EMBA、固件渗透、路由器固件、嵌入式漏洞利用、bootloader、NVRAM、FAT、firmware analysis toolkit。

Use for authorized email security review including phishing analysis, header authentication (SPF/DKIM/DMARC), BEC patterns, and mailbox token abuse research.

.NET / C# 二进制逆向。当目标是 .NET assembly（PE 头含 CLR、.exe/.dll 托管程序）、C# 编译产物（含 NativeAOT）、红队 Sharp* 工具（Rubeus / SharpHound / SharpHound 等）、.NET 混淆程序（ConfuserEx / SmartAssembly / Babel / Eazfuscator）、.NET loader / info-stealer / 套壳 malware 时使用。优先用 dnSpyEx + de4dot，需要 AI 直接操作时联动 dnSpy MCP。不用于纯 native 二进制（走 reverse-engineering / ida-reverse）。

Creates task-oriented technical documentation with progressive disclosure. Use when writing READMEs, API docs, architecture docs, or markdown documentation. Also use this skill at the END of any completed reverse engineering, penetration testing, CTF, or security analysis task to generate a formal report in the user's project directory. Trigger keywords: 写报告, 写文档, 出报告, writeup, 技术文档, report, documentation.

Use for authorized digital forensics including memory dumps, disk timelines, PCAP investigation, artifact triage, and IR evidence preservation.

Use for authorized database security assessment covering PostgreSQL/MySQL/MSSQL/Mongo/Redis exposure, authz, UDF/command paths, and misconfiguration review.

Use for authorized cloud, container, and Kubernetes security assessment including metadata SSRF, IAM misconfig, container escape paths, and cluster RBAC review.

Use for authorized reverse engineering of browser extensions (Chrome/Firefox) including manifest analysis, background workers, and extension-based credential or traffic logic recovery.

跨版本符号迁移与二进制差分。当你有旧版本的符号/逆向结果，需要快速迁移到新版本时使用。 适用场景：内核缺 PDB 用旧版符号推导、程序更新后批量迁移函数名、应用更新后快速定位新偏移。 核心方法：用 LLM 做结构化差异比对，程序化输入输出，成本极低（200 函数 ~1 元）。 触发关键词：符号迁移、bindiff、跨版本、PDB 缺失、函数偏移迁移、symbol migration、binary diff、版本对比。

在 CLI 环境下做 Android APK 逆向时使用。适用于 APK 解包、Java 反编译、smali 修改、重打包、Frida 动态 Hook，以及按需切换到 so/native 分析。优先使用本机已安装的 jadx、apktool、frida、adb、ida-reverse、radare2。

Use when the user says 'm0 remember', 'record what we did', 'note for next session' or 'write a checkpoint', or after finishing a step worth handing to the next session. Appends one entry to the M0 thread (re-sending writes a second entry unless you pass the same `id`).

Use when the user asks m0 recall, where were we, what did we do last time, catch me up, what is next, or to resume context from another tool. Reads the recent M0 operational thread per project, newest first, from the M0 daemon.

Use when the user runs /gsd-workstreams or asks to list, create, switch, status, progress, complete, or resume parallel workstreams for concurrent milestone work. The active one is tracked in the GSD_WS variable.

Use after a phase executes, when the user wants to test the built features themselves. Runs one conversational UAT test at a time into {phase}-UAT.md and, when something fails, diagnoses it and queues fix plans for /gsd-execute-phase.

Use when validation or test coverage is missing on a phase that already shipped. Audits or reconstructs VALIDATION.md, fills the gaps and generates the missing test files.

Use when the user asks whether GSD is up to date or wants to upgrade it. Checks the local and global install against npm, shows the changelog, warns before a clean install, then clears the cache.

Use when the user wants to roll back GSD commits: the last N, a whole phase, or one plan. Reverts through the phase manifest with dependency checks and a confirmation gate before anything is undone.

Use when the user asks for a visual or UI quality review of frontend code that already shipped, or passes a phase number. Produces {phase_num}-UI-REVIEW.md with a graded 1-4 assessment across six pillars.

Use before planning a frontend phase, or when a UI contract must be locked before implementation. Orchestrates gsd-ui-researcher and gsd-ui-checker to validate, research, and verify UI-SPEC.md for the phase.

Use when work spans sessions and does not belong to any specific phase, or when the user wants to create, list or resume a context thread. Keeps lightweight threads under .planning/threads/.

Use when the user asks how big the project is, what has shipped, or for project statistics. Reports phase progress, plan execution, requirements completion, git history metrics, and timeline through the GSD workflow.

Use after /gsd-verify-work passes, when the work should become a PR. Pushes the branch, creates the PR with an auto-generated body, optionally triggers review, and tracks the merge, closing the plan-execute-verify-ship loop.

Use when the user wants to turn GSD workflow steps on or off or to change the model profile. Prompts for model, research, plan_check, verifier, and branching, then writes the merged config with current values pre-selected.

Use when the user wants to switch the GSD model profile for agents: quality, balanced, budget, or inherit. Runs the gsd-tools config-set-model-profile command and shows its output verbatim.

Use when a session ends and the user wants a summary of what was done and what it cost. Writes a shareable SESSION_REPORT.md with outcomes, work performed and estimated resource usage.

Use to re-verify the threat mitigations of a phase that already shipped, or when the user asks to audit SECURITY.md. Audits an existing SECURITY.md, runs from a PLAN.md threat model, or exits if the phase never ran.

Use when you need a quick read on one subsystem instead of a full /gsd-map-codebase run, or the user asks to scan tech, arch, quality, or concerns. Spawns one mapper agent and writes targeted docs into .planning/codebase/.