shadowtrace-artifact-triage
Skill39 starsChanged 34 days agoMITView on GitHub
Perform bounded passive triage of CTF files using inventory, hashes, text excerpts, and printable strings.
We split this skill into the rules it gives an agent
5 rules. About 0 are common, 2 are distinctive, and 3 are very specific to this project.
≈0
Common · estimate
Many files like this have a rule of this kind.
≈2
Distinctive · estimate
This author's own choices. Worth a look.
3
Very specific
Tied to their project's names, files or tools. Probably skip.
- Common
- Distinctive
- Very specific
- Distinctive: line 8
Start with the least invasive evidence available.
- Very specific: line 12
Use list_artifacts to establish names, sizes, and extensions.
- Very specific: line 14
Use extract_strings for binary or unknown formats.
- Very specific: line 15
Use read_text_excerpt only for bounded text inspection.
- Distinctive: line 29
Do not execute attachments merely because their extension appears familiar.
≈ “Common” is an estimate: at least 1 in 5 of the 308,232 skill files we read have a rule of the same kind, not the same words. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.
Files
ShadowTrace Artifact Triage
Start with the least invasive evidence available.
First pass
- Use
list_artifactsto establish names, sizes, and extensions. - Hash decisive files with
hash_file. - Use
extract_stringsfor binary or unknown formats. - Use
read_text_excerptonly for bounded text inspection. - Identify the smallest next tool that can confirm the leading hypothesis.
Output shape
For every important artifact, record:
- relative path;
- size and SHA-256;
- observed format;
- decisive strings or headers;
- fact versus hypothesis;
- next verification action.
Do not execute attachments merely because their extension appears familiar.
In this repository85 other files it gives its agents.
- api-securitySkill
- apk-reverseSkill
- attack-chainSkill
- binary-diffSkill
- cairnSkill
- code-sentinel-ctfSkill
- code-sentinel-engagementSkill
- code-sentinel-gpt56Skill
- code-sentinel-matrixSkill
- code-sentinel-opsSkill
- code-sentinel-payloadSkill
- code-sentinel-ptesSkill
- code-sentinelSkill
- cyberstrikeSkill
- diagram-generatorSkill
- docs-generatorSkill
- edr-bypass-reSkill
- firmware-pentestSkill
- gpt56-instruct-routerSkill
- gpt56-reverse-pentestSkill
- ida-reverseSkill
- js-reverseSkill
- llm-securitySkill
- malware-analysisSkill
- mobile-competitive-game-securitySkill
- mobile-reverseSkill
- patch-diff-exploitSkill
- pdfSkill
- pentest-toolsSkill
- src-hunterSkill
- playwright-interactiveSkill
- playwrightSkill
- pojia-anticheatSkill
- pojia-auto-opsSkill
- pojia-evasionSkill
- pojia-exploitSkill
- pojia-game-hackSkill
- pojia-game-redteamSkill
- pojia-game-securitySkill
- pojia-labSkill
- pojia-license-securitySkill
- pojia-malwareSkill
- pojia-mature-contentSkill
- pojia-memorySkill
- pojia-pentestSkill
- pojia-reverseSkill
- pojia-social-engSkill
- pojia-unlimitedSkill
- pwn-chainSkill
- radare2Skill
- range-research-scopeSkill
- recover-license-native-e2eSkill
- reverse-engineeringSkill
- screenshotSkill
- security-best-practicesSkill
- security-ownership-mapSkill
- security-threat-modelSkill
- shadowtrace-anti-debugSkill
- shadowtrace-binary-analysisSkill
- shadowtrace-binary-protectionSkill
- The first 60 shown.
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
Reviews can't be read right now.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.