[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6GQ9JFEWDMK6EV2AB01ZKTW":3,"skill-same:01M6GQ9JFEWDMK6EV2AB01ZKTW":119},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":51,"linkOnly":52,"markdownContent":53,"markdownBody":54,"frontMatter":55,"refName":56,"commitSha":57,"skillDirectory":58,"forksCount":59,"repositoryHtmlUrl":60,"repositoryHomepageUrl":6,"ownerHtmlUrl":61,"ownerBlogUrl":62,"ownerDescription":63,"updatedAt":64,"install":65,"resources":78},"01M6GQ9JFEWDMK6EV2AB01ZKTW","ctf-forensics",null,"Use when the user mentions forensics, pcap, packet capture, wireshark, tshark, memory dump, volatility, steganography or stego, hidden data in an image\u002Faudio\u002Fvideo, recovering deleted or embedded files, disk image, .dd\u002F.E01\u002F.raw\u002F.mem\u002F.vmem\u002F.dmp\u002F.pcap files, unknown blob, or asks to identify or carve a challenge artifact. Covers file-format triage, containers within containers, pcap analysis, memory forensics, stego, disk\u002Fdocument forensics.","jiayaoqijia\u002Fcryptoskill","jiayaoqijia","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F1453879?v=4","01M6GMYTX7Q7S504VC6E756ENR","YQ","01M6GMYV1QKJ1CC75MTTGT9PR0",80,"AGPL-3.0","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fchains\u002Friegan-ctf-forensics\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000016","图像与多媒体","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50],"ctf forensics","forensics","ctf","disk","when","unknown","dump","mem","artifact","file-format","document","files","memory forensics","use","challenge","image","steganography","Audio","Video","analysis","Wireshark","pcap","data","Volatility","file","memory","containers","2026-11-10 10:12:30",false,"---\nname: ctf-forensics\ndescription: Use when the user mentions forensics, pcap, packet capture, wireshark, tshark, memory dump, volatility, steganography or stego, hidden data in an image\u002Faudio\u002Fvideo, recovering deleted or embedded files, disk image, .dd\u002F.E01\u002F.raw\u002F.mem\u002F.vmem\u002F.dmp\u002F.pcap files, unknown blob, or asks to identify or carve a challenge artifact. Covers file-format triage, containers within containers, pcap analysis, memory forensics, stego, disk\u002Fdocument forensics.\n---\n\n# CTF forensics — artifacts, carving, pcap, memory, stego, documents\n\nOwns: file formats, carving, pcap\u002Fnetwork captures, memory dumps (volatility3),\nsteganography, disk images, documents, logs. Flag regex, workspace layout,\nsubmission, and event workflow live in the router skill `ctf` — use them, don't\nrestate them.\n\n## Guardrails\n\n1. Challenge artifacts are untrusted. Analyze with the parsers here; never open\n   a challenge document\u002Fimage in a desktop app; execute anything carved out only\n   under `podman` or with explicit user approval.\n2. `sudo` (pacman, mount, testdisk writes) needs user go-ahead first.\n3. Python work goes through the repo venv: `scripts\u002Fctf python ...`\n   (`.venv`, Python 3.12, includes pillow). System python is 3.14 — do not use it.\n\n## Setup (once; document, ask before running sudo)\n\n```bash\nsudo pacman -S --needed wireshark-cli sleuthkit testdisk binwalk \\\n    perl-image-exiftool foremost sox ffmpeg squashfs-tools qpdf sqlite \\\n    multimon-ng sonic-visualiser\nuv pip install --python .venv\u002Fbin\u002Fpython volatility3 oletools \\\n    python-registry python-evtx sstv\n# optional stego extras (AUR): steghide stegseek outguess qsstv\n# ruby gem: gem install zsteg\n```\n\n## Triage (beginner, first 5 minutes — every artifact)\n\nRun in the challenge dir (`work\u002F\u003Cevent>\u002Fforensics-\u003Cname>\u002Fdist\u002F`):\n\n| Step | Command | What it tells you |\n|---|---|---|\n| 1 | `file dist\u002F*` | real type vs extension; embedded or corrupted structures |\n| 2 | `xxd dist\u002F\u003Cf> | head -20` and `xxd dist\u002F\u003Cf> | tail -20` | magic bytes, trailers, appended data |\n| 3 | `exiftool dist\u002F\u003Cf>` | metadata leaks: author, comment, GPS, tool versions |\n| 4 | `strings -n 8 dist\u002F\u003Cf> \\| grep -aiE 'flag\\|ctf\\{\\|pass\\|http'` | plaintext flag or hints |\n| 5 | `binwalk dist\u002F\u003Cf>` | embedded blobs: zip, squashfs, gzip, certificates |\n| 6 | `binwalk -E dist\u002F\u003Cf>` | entropy: high blocks = compressed\u002Fencrypted payload |\n\nThen dispatch on the real type:\n\n| `file` says | Challenge is probably | Read |\n|---|---|---|\n| PNG\u002FBMP\u002FTIFF\u002FGIF\u002FJPEG image | stego | `references\u002Fstego.md` |\n| audio (wav\u002Fmp3\u002Fflac) | stego (spectrogram, LSB, SSTV, DTMF) | `references\u002Fstego.md` |\n| video (mp4\u002Favi\u002Fwebm) | frame-level stego, metadata | `references\u002Fstego.md` |\n| pcap \u002F pcapng | network forensics | `references\u002Fpcap.md` + `scripts\u002Fpcap-triage.sh` |\n| memory dump (raw\u002Fvmem\u002Fdmp\u002Flime) | memory forensics | `references\u002Fmemory.md` |\n| disk image (dd\u002FE01\u002Fraw fs) | deleted files, registry, evtx | `references\u002Fdisk-docs.md` |\n| PDF \u002F OLE (doc\u002Fxls) \u002F OOXML | hidden text, macros, embedded | `references\u002Fdisk-docs.md` |\n| archive \u002F zip \u002F 7z | nested containers, password | `references\u002Ftriage-tree.md` |\n| data \u002F unknown | container-in-container, encoding | `references\u002Ftriage-tree.md` |\n\nFull decision tree with per-node commands: `references\u002Ftriage-tree.md`.\n\n## Playbook (expert, terse)\n\n| Attack | Preconditions | Command | Reference |\n|---|---|---|---|\n| 10-minute pcap triage | tshark | `scripts\u002Fpcap-triage.sh cap.pcap` | `references\u002Fpcap.md` |\n| Follow one TCP stream | stream index N | `tshark -r c.pcap -q -z follow,tcp,ascii,N` | `references\u002Fpcap.md` |\n| Export transferred files | http\u002Fsmb\u002Fftp\u002Ftftp\u002Fimf | `tshark -r c.pcap --export-objects http,out\u002F` | `references\u002Fpcap.md` |\n| USB keystroke recovery | usb pcap, `usb.capdata` | see HID map | `references\u002Fpcap.md` |\n| DNS\u002FICMP exfil reassembly | capture + odd domains | `dns.qry.name` \u002F `data.data` fields | `references\u002Fpcap.md` |\n| TLS decrypt | keylog file from challenge | `-o tls.keylog_file:keys.log` | `references\u002Fpcap.md` |\n| Windows memory hunt | dump + volatility3 | `vol -f d.vmem windows.pslist` ... | `references\u002Fmemory.md` |\n| Linux memory hunt | dump + matching ISF symbols | `linux.bash`, `linux.pslist` | `references\u002Fmemory.md` |\n| Disk partition walk | image | `mmls` → `fls -o \u003Coff>` → `icat` | `references\u002Fdisk-docs.md` |\n| Recover deleted files | image | `tsk_recover` \u002F `icat` on deleted inode | `references\u002Fdisk-docs.md` |\n| Offline registry hives | SAM\u002FSYSTEM\u002FNTUSER.DAT | python-registry | `references\u002Fdisk-docs.md` |\n| evtx event logs | *.evtx | `evtx_dump f.evtx \\| grep ...` | `references\u002Fdisk-docs.md` |\n| Word\u002FExcel macros | doc(x|m)\u002Fxls | `olevba f.doc` | `references\u002Fdisk-docs.md` |\n| PNG\u002FBMP LSB | image | `zsteg -a f.png` or `scripts\u002Flub.py f.png` | `references\u002Fstego.md` |\n| JPEG steghide | jpg\u002Fwav\u002Fmp3 carrier | `steghide extract -sf f.jpg -p \"\"` | `references\u002Fstego.md` |\n| steghide brute force | wordlist | `stegseek f.jpg wordlist.txt` | `references\u002Fstego.md` |\n| Audio spectrogram | wav (convert mp3 first) | `sox f.wav -n spectrogram -o s.png` | `references\u002Fstego.md` |\n| SSTV \u002F DTMF \u002F morse | wav | `sstv -d f.wav -o out.png`; `multimon-ng -a DTMF -t wav f.wav` | `references\u002Fstego.md` |\n| Video frame diff | ffmpeg | `ffmpeg -i v.mp4 -vf fps=1 f_%03d.png` | `references\u002Fstego.md` |\n| Carve embedded zip | any blob | `binwalk -Me f` or `grep -abo $'PK\\x03\\x04' f` + `dd` | `references\u002Ftriage-tree.md` |\n| Broken PNG header | IHDR size\u002FCRC wrong | recompute CRC (snippet) | `references\u002Fstego.md` |\n\nEscalation order when a reference runs dry: `triage-tree.md` containers section\n→ raw `strings`\u002Fhexdiff of the exact region → wrong-skill check (XOR keys and\nclassical ciphers → `ctf-crypto`; packed binaries → `ctf-rev`).\n\n## References\n\n- `references\u002Ftriage-tree.md` — decision tree by artifact type; manual carving;\n  container-within-container patterns; entropy reading.\n- `references\u002Fstego.md` — image\u002Faudio\u002Fvideo steganography toolchains and when\n  each applies.\n- `references\u002Fpcap.md` — tshark deep dive: filters, export objects, USB HID,\n  exfil channels, TLS keylog decryption.\n- `references\u002Fmemory.md` — volatility3 on Windows\u002FLinux dumps, plugin order,\n  process\u002Fmemory dumping, symbol tables.\n- `references\u002Fdisk-docs.md` — sleuthkit workflow, deleted recovery, offline\n  registry, evtx, recycle bin, browser history, Office\u002FPDF document forensics.\n\n## Scripts\n\n- `scripts\u002Fpcap-triage.sh \u003Ccap.pcap>` — tshark stats + export objects + flag\n  grep in one shot; degrades to strings when tshark is absent.\n- `scripts\u002Flub.py \u003Cimage>` — LSB bit-plane extractor\u002Fprintable-run scanner\n  (pillow optional, in `.venv` already).\n\n## Toolbox\n\n| Tool | Install | Purpose |\n|---|---|---|\n| tshark, capinfos | `sudo pacman -S wireshark-cli` | pcap analysis backend |\n| binwalk (v3) | `sudo pacman -S binwalk` | signatures, `-e` extract, `-E` entropy |\n| exiftool | `sudo pacman -S perl-image-exiftool` | metadata for any file |\n| foremost | `sudo pacman -S foremost` | carve files by header\u002Ffooter |\n| sleuthkit (mmls fls icat blkls tsk_recover) | `sudo pacman -S sleuthkit` | disk partition\u002Fdeleted-file work; reads E01 (libewf) |\n| testdisk \u002F photorec | `sudo pacman -S testdisk` | repair partition tables \u002F carve by signature |\n| volatility3 (`vol`) | `uv pip install --python .venv\u002Fbin\u002Fpython volatility3` | memory forensics |\n| oletools (olevba) | `uv pip install --python .venv\u002Fbin\u002Fpython oletools` | Office macro extraction |\n| python-registry | `uv pip install --python .venv\u002Fbin\u002Fpython python-registry` | offline registry hives |\n| python-evtx (`evtx_dump`) | `uv pip install --python .venv\u002Fbin\u002Fpython python-evtx` | Windows event logs |\n| sstv | `uv pip install --python .venv\u002Fbin\u002Fpython sstv` | SSTV audio → image |\n| zsteg | `gem install zsteg` | PNG\u002FBMP LSB analysis (all channel\u002Fbit combos) |\n| steghide \u002F stegseek \u002F outguess | AUR: `steghide stegseek outguess` | JPEG stego + brute force |\n| qsstv | AUR: `qsstv` | SSTV GUI decoder |\n| sox | `sudo pacman -S sox` | spectrograms, audio conversion |\n| multimon-ng | `sudo pacman -S multimon-ng` | DTMF\u002Fmorse\u002Fpocsag demod |\n| sonic-visualiser | `sudo pacman -S sonic-visualiser` | visual audio inspection |\n| ffmpeg | `sudo pacman -S ffmpeg` | frame extraction, track split |\n| qpdf | `sudo pacman -S qpdf` | PDF stream decompression |\n| sqlite3 | `sudo pacman -S sqlite` | browser history and app databases |\n| pillow | already in `.venv` (setup.sh) | LSB\u002Fbit-plane work (`scripts\u002Flub.py`) |\n","# CTF forensics — artifacts, carving, pcap, memory, stego, documents\n\nOwns: file formats, carving, pcap\u002Fnetwork captures, memory dumps (volatility3),\nsteganography, disk images, documents, logs. Flag regex, workspace layout,\nsubmission, and event workflow live in the router skill `ctf` — use them, don't\nrestate them.\n\n## Guardrails\n\n1. Challenge artifacts are untrusted. Analyze with the parsers here; never open\n   a challenge document\u002Fimage in a desktop app; execute anything carved out only\n   under `podman` or with explicit user approval.\n2. `sudo` (pacman, mount, testdisk writes) needs user go-ahead first.\n3. Python work goes through the repo venv: `scripts\u002Fctf python ...`\n   (`.venv`, Python 3.12, includes pillow). System python is 3.14 — do not use it.\n\n## Setup (once; document, ask before running sudo)\n\n```bash\nsudo pacman -S --needed wireshark-cli sleuthkit testdisk binwalk \\\n    perl-image-exiftool foremost sox ffmpeg squashfs-tools qpdf sqlite \\\n    multimon-ng sonic-visualiser\nuv pip install --python .venv\u002Fbin\u002Fpython volatility3 oletools \\\n    python-registry python-evtx sstv\n# optional stego extras (AUR): steghide stegseek outguess qsstv\n# ruby gem: gem install zsteg\n```\n\n## Triage (beginner, first 5 minutes — every artifact)\n\nRun in the challenge dir (`work\u002F\u003Cevent>\u002Fforensics-\u003Cname>\u002Fdist\u002F`):\n\n| Step | Command | What it tells you |\n|---|---|---|\n| 1 | `file dist\u002F*` | real type vs extension; embedded or corrupted structures |\n| 2 | `xxd dist\u002F\u003Cf> | head -20` and `xxd dist\u002F\u003Cf> | tail -20` | magic bytes, trailers, appended data |\n| 3 | `exiftool dist\u002F\u003Cf>` | metadata leaks: author, comment, GPS, tool versions |\n| 4 | `strings -n 8 dist\u002F\u003Cf> \\| grep -aiE 'flag\\|ctf\\{\\|pass\\|http'` | plaintext flag or hints |\n| 5 | `binwalk dist\u002F\u003Cf>` | embedded blobs: zip, squashfs, gzip, certificates |\n| 6 | `binwalk -E dist\u002F\u003Cf>` | entropy: high blocks = compressed\u002Fencrypted payload |\n\nThen dispatch on the real type:\n\n| `file` says | Challenge is probably | Read |\n|---|---|---|\n| PNG\u002FBMP\u002FTIFF\u002FGIF\u002FJPEG image | stego | `references\u002Fstego.md` |\n| audio (wav\u002Fmp3\u002Fflac) | stego (spectrogram, LSB, SSTV, DTMF) | `references\u002Fstego.md` |\n| video (mp4\u002Favi\u002Fwebm) | frame-level stego, metadata | `references\u002Fstego.md` |\n| pcap \u002F pcapng | network forensics | `references\u002Fpcap.md` + `scripts\u002Fpcap-triage.sh` |\n| memory dump (raw\u002Fvmem\u002Fdmp\u002Flime) | memory forensics | `references\u002Fmemory.md` |\n| disk image (dd\u002FE01\u002Fraw fs) | deleted files, registry, evtx | `references\u002Fdisk-docs.md` |\n| PDF \u002F OLE (doc\u002Fxls) \u002F OOXML | hidden text, macros, embedded | `references\u002Fdisk-docs.md` |\n| archive \u002F zip \u002F 7z | nested containers, password | `references\u002Ftriage-tree.md` |\n| data \u002F unknown | container-in-container, encoding | `references\u002Ftriage-tree.md` |\n\nFull decision tree with per-node commands: `references\u002Ftriage-tree.md`.\n\n## Playbook (expert, terse)\n\n| Attack | Preconditions | Command | Reference |\n|---|---|---|---|\n| 10-minute pcap triage | tshark | `scripts\u002Fpcap-triage.sh cap.pcap` | `references\u002Fpcap.md` |\n| Follow one TCP stream | stream index N | `tshark -r c.pcap -q -z follow,tcp,ascii,N` | `references\u002Fpcap.md` |\n| Export transferred files | http\u002Fsmb\u002Fftp\u002Ftftp\u002Fimf | `tshark -r c.pcap --export-objects http,out\u002F` | `references\u002Fpcap.md` |\n| USB keystroke recovery | usb pcap, `usb.capdata` | see HID map | `references\u002Fpcap.md` |\n| DNS\u002FICMP exfil reassembly | capture + odd domains | `dns.qry.name` \u002F `data.data` fields | `references\u002Fpcap.md` |\n| TLS decrypt | keylog file from challenge | `-o tls.keylog_file:keys.log` | `references\u002Fpcap.md` |\n| Windows memory hunt | dump + volatility3 | `vol -f d.vmem windows.pslist` ... | `references\u002Fmemory.md` |\n| Linux memory hunt | dump + matching ISF symbols | `linux.bash`, `linux.pslist` | `references\u002Fmemory.md` |\n| Disk partition walk | image | `mmls` → `fls -o \u003Coff>` → `icat` | `references\u002Fdisk-docs.md` |\n| Recover deleted files | image | `tsk_recover` \u002F `icat` on deleted inode | `references\u002Fdisk-docs.md` |\n| Offline registry hives | SAM\u002FSYSTEM\u002FNTUSER.DAT | python-registry | `references\u002Fdisk-docs.md` |\n| evtx event logs | *.evtx | `evtx_dump f.evtx \\| grep ...` | `references\u002Fdisk-docs.md` |\n| Word\u002FExcel macros | doc(x|m)\u002Fxls | `olevba f.doc` | `references\u002Fdisk-docs.md` |\n| PNG\u002FBMP LSB | image | `zsteg -a f.png` or `scripts\u002Flub.py f.png` | `references\u002Fstego.md` |\n| JPEG steghide | jpg\u002Fwav\u002Fmp3 carrier | `steghide extract -sf f.jpg -p \"\"` | `references\u002Fstego.md` |\n| steghide brute force | wordlist | `stegseek f.jpg wordlist.txt` | `references\u002Fstego.md` |\n| Audio spectrogram | wav (convert mp3 first) | `sox f.wav -n spectrogram -o s.png` | `references\u002Fstego.md` |\n| SSTV \u002F DTMF \u002F morse | wav | `sstv -d f.wav -o out.png`; `multimon-ng -a DTMF -t wav f.wav` | `references\u002Fstego.md` |\n| Video frame diff | ffmpeg | `ffmpeg -i v.mp4 -vf fps=1 f_%03d.png` | `references\u002Fstego.md` |\n| Carve embedded zip | any blob | `binwalk -Me f` or `grep -abo $'PK\\x03\\x04' f` + `dd` | `references\u002Ftriage-tree.md` |\n| Broken PNG header | IHDR size\u002FCRC wrong | recompute CRC (snippet) | `references\u002Fstego.md` |\n\nEscalation order when a reference runs dry: `triage-tree.md` containers section\n→ raw `strings`\u002Fhexdiff of the exact region → wrong-skill check (XOR keys and\nclassical ciphers → `ctf-crypto`; packed binaries → `ctf-rev`).\n\n## References\n\n- `references\u002Ftriage-tree.md` — decision tree by artifact type; manual carving;\n  container-within-container patterns; entropy reading.\n- `references\u002Fstego.md` — image\u002Faudio\u002Fvideo steganography toolchains and when\n  each applies.\n- `references\u002Fpcap.md` — tshark deep dive: filters, export objects, USB HID,\n  exfil channels, TLS keylog decryption.\n- `references\u002Fmemory.md` — volatility3 on Windows\u002FLinux dumps, plugin order,\n  process\u002Fmemory dumping, symbol tables.\n- `references\u002Fdisk-docs.md` — sleuthkit workflow, deleted recovery, offline\n  registry, evtx, recycle bin, browser history, Office\u002FPDF document forensics.\n\n## Scripts\n\n- `scripts\u002Fpcap-triage.sh \u003Ccap.pcap>` — tshark stats + export objects + flag\n  grep in one shot; degrades to strings when tshark is absent.\n- `scripts\u002Flub.py \u003Cimage>` — LSB bit-plane extractor\u002Fprintable-run scanner\n  (pillow optional, in `.venv` already).\n\n## Toolbox\n\n| Tool | Install | Purpose |\n|---|---|---|\n| tshark, capinfos | `sudo pacman -S wireshark-cli` | pcap analysis backend |\n| binwalk (v3) | `sudo pacman -S binwalk` | signatures, `-e` extract, `-E` entropy |\n| exiftool | `sudo pacman -S perl-image-exiftool` | metadata for any file |\n| foremost | `sudo pacman -S foremost` | carve files by header\u002Ffooter |\n| sleuthkit (mmls fls icat blkls tsk_recover) | `sudo pacman -S sleuthkit` | disk partition\u002Fdeleted-file work; reads E01 (libewf) |\n| testdisk \u002F photorec | `sudo pacman -S testdisk` | repair partition tables \u002F carve by signature |\n| volatility3 (`vol`) | `uv pip install --python .venv\u002Fbin\u002Fpython volatility3` | memory forensics |\n| oletools (olevba) | `uv pip install --python .venv\u002Fbin\u002Fpython oletools` | Office macro extraction |\n| python-registry | `uv pip install --python .venv\u002Fbin\u002Fpython python-registry` | offline registry hives |\n| python-evtx (`evtx_dump`) | `uv pip install --python .venv\u002Fbin\u002Fpython python-evtx` | Windows event logs |\n| sstv | `uv pip install --python .venv\u002Fbin\u002Fpython sstv` | SSTV audio → image |\n| zsteg | `gem install zsteg` | PNG\u002FBMP LSB analysis (all channel\u002Fbit combos) |\n| steghide \u002F stegseek \u002F outguess | AUR: `steghide stegseek outguess` | JPEG stego + brute force |\n| qsstv | AUR: `qsstv` | SSTV GUI decoder |\n| sox | `sudo pacman -S sox` | spectrograms, audio conversion |\n| multimon-ng | `sudo pacman -S multimon-ng` | DTMF\u002Fmorse\u002Fpocsag demod |\n| sonic-visualiser | `sudo pacman -S sonic-visualiser` | visual audio inspection |\n| ffmpeg | `sudo pacman -S ffmpeg` | frame extraction, track split |\n| qpdf | `sudo pacman -S qpdf` | PDF stream decompression |\n| sqlite3 | `sudo pacman -S sqlite` | browser history and app databases |\n| pillow | already in `.venv` (setup.sh) | LSB\u002Fbit-plane work (`scripts\u002Flub.py`) |\n",{"name":5,"description":7},"main","3df1d0d67b30ff15236561f8c0f9f06d33f42dfd","skills\u002Fchains\u002Friegan-ctf-forensics",17,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia","https:\u002F\u002Feth2030.com","Hardcore infra. Building @alt-research and applied cryptography.","2026-11-11 08:47:40",{"source":8,"skillName":5,"commands":66,"prompt":76,"zipAvailable":77},[67,70,73],{"tool":68,"command":69},"npx","npx skills add jiayaoqijia\u002Fcryptoskill --skill ctf-forensics",{"tool":71,"command":72},"bunx","bunx skills add jiayaoqijia\u002Fcryptoskill --skill ctf-forensics",{"tool":74,"command":75},"pnpm","pnpm dlx skills add jiayaoqijia\u002Fcryptoskill --skill ctf-forensics","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fchains\u002Friegan-ctf-forensics\u002FSKILL.md",true,[79,85,89,93,97,101,107,111,115],{"path":80,"resourceType":81,"resourceTypeDesc":82,"sizeBytes":83,"sourceHtmlUrl":84},"references\u002Fdisk-docs.md","REFERENCE","参考文档",9274,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fchains\u002Friegan-ctf-forensics\u002Freferences\u002Fdisk-docs.md",{"path":86,"resourceType":81,"resourceTypeDesc":82,"sizeBytes":87,"sourceHtmlUrl":88},"references\u002Fmemory.md",5711,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fchains\u002Friegan-ctf-forensics\u002Freferences\u002Fmemory.md",{"path":90,"resourceType":81,"resourceTypeDesc":82,"sizeBytes":91,"sourceHtmlUrl":92},"references\u002Fpcap.md",8872,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fchains\u002Friegan-ctf-forensics\u002Freferences\u002Fpcap.md",{"path":94,"resourceType":81,"resourceTypeDesc":82,"sizeBytes":95,"sourceHtmlUrl":96},"references\u002Fstego.md",10045,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fchains\u002Friegan-ctf-forensics\u002Freferences\u002Fstego.md",{"path":98,"resourceType":81,"resourceTypeDesc":82,"sizeBytes":99,"sourceHtmlUrl":100},"references\u002Ftriage-tree.md",8169,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fchains\u002Friegan-ctf-forensics\u002Freferences\u002Ftriage-tree.md",{"path":102,"resourceType":103,"resourceTypeDesc":104,"sizeBytes":105,"sourceHtmlUrl":106},"scripts\u002Flub.py","SCRIPT","脚本",6590,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fchains\u002Friegan-ctf-forensics\u002Fscripts\u002Flub.py",{"path":108,"resourceType":103,"resourceTypeDesc":104,"sizeBytes":109,"sourceHtmlUrl":110},"scripts\u002Fpcap-triage.sh",3541,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fchains\u002Friegan-ctf-forensics\u002Fscripts\u002Fpcap-triage.sh",{"path":112,"resourceType":81,"resourceTypeDesc":82,"sizeBytes":113,"sourceHtmlUrl":114},"SOURCE.md",333,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fchains\u002Friegan-ctf-forensics\u002FSOURCE.md",{"path":116,"resourceType":81,"resourceTypeDesc":82,"sizeBytes":117,"sourceHtmlUrl":118},"TRUST.auto.yaml",2120,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fchains\u002Friegan-ctf-forensics\u002FTRUST.auto.yaml",[120,148,171,188,201,211],{"skillNo":121,"name":122,"nameZh":6,"description":123,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":124,"licenseFileUrl":125,"sourceHtmlUrl":126,"categories":127,"keywords":128,"publishedAt":51},"01M712C436EQYE43342Q4E7GG1","recipe-performance","Diagnose a specific MetaMask user flow's real-app performance and Sentry critical-user-flow telemetry with deterministic mm-harness recipes. Use for CUF boundaries, cold\u002Fwarm\u002Fbackground-resume behavior, latency regressions, lifecycle tags, duplicate or blocking network requests, long tasks, layout\u002Fpaint cost, screen redraws, React rerenders, or browser trace analysis where tests alone cannot prove the real app.","MIT","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fwallets\u002Fmetamask-official-recipe-performance\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fwallets\u002Fmetamask-official-recipe-performance\u002FSKILL.md",[],[129,130,131,132,133,134,135,136,137,138,139,140,43,141,142,143,144,145,146,147],"performance","recipe performance","recipe","mm","sentry","harness","app","deterministic","recipes","flow","cold","critical","tasks","react","browser","layout","screen","network","metamask",{"skillNo":149,"name":150,"nameZh":6,"description":151,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":152,"licenseFileUrl":153,"sourceHtmlUrl":154,"categories":155,"keywords":156,"publishedAt":51},"01M70XT2F8A5CQZ81JBP98KSW3","mexc-spot-websocket","MEXC Spot WebSocket workflows for public streams, protobuf handling, depth maintenance, listen keys, and private streams without exposing API keys.","Apache-2.0","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-spot-websocket\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-spot-websocket\u002FSKILL.md",[],[157,158,159,160,161,162,163,164,165,166,167,168,169,170],"mexc spot websocket","spot","websocket","api","workflows","public","listen","streams","depth","keys","for","api keys","maintenance","protobuf",{"skillNo":172,"name":173,"nameZh":6,"description":174,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":152,"licenseFileUrl":175,"sourceHtmlUrl":176,"categories":177,"keywords":178,"publishedAt":51},"01M70XT0MBXN3WZY1BKN0CPNKR","mexc-spot-rest","MEXC Spot REST workflows for public data, signed account requests, orders, wallet\u002Fadmin actions, and secure signing without exposing API keys.","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-spot-rest\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-spot-rest\u002FSKILL.md",[],[179,158,180,181,182,183,184,168,167,166,185,186,46,162,187,161,160],"mexc spot rest","REST","admin","signing","Wallet","requests","actions","secure","orders",{"skillNo":189,"name":190,"nameZh":6,"description":191,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":152,"licenseFileUrl":192,"sourceHtmlUrl":193,"categories":194,"keywords":195,"publishedAt":51},"01M70XSYSVZ2N0N91XCAR2CAK0","mexc-futures-websocket","MEXC Futures WebSocket workflows for public streams, private account\u002Forder\u002Fposition streams, ping\u002Fpong, subscriptions, and depth maintenance.","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-futures-websocket\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-futures-websocket\u002FSKILL.md",[],[196,197,159,198,199,169,167,200,165,164,162,161],"mexc futures websocket","futures","position","ping","subscriptions",{"skillNo":202,"name":203,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":124,"licenseFileUrl":204,"sourceHtmlUrl":205,"categories":206,"keywords":207,"publishedAt":51},"01M6H0ZWHVE5W04WG2DKQE2SQC","0xklen-version-and-refresh-sanctions-lists","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-version-and-refresh-sanctions-lists\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-version-and-refresh-sanctions-lists\u002FSKILL.md",[],[208,209,210],"refresh","0xklen version and refresh sanctions lists","version",{"skillNo":212,"name":213,"nameZh":6,"description":214,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":124,"licenseFileUrl":215,"sourceHtmlUrl":216,"categories":217,"keywords":218,"publishedAt":51},"01M6H0Z28Q3R8J0S799GJQWXM3","verify-tests-cover-changed-lines","Use when a PR adds code that the existing suite may not exercise. Measures patch coverage — the share of newly changed lines hit by tests — before approving.","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-verify-tests-cover-changed-lines\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-verify-tests-cover-changed-lines\u002FSKILL.md",[],[219,220,221,222,223,224,225,37,226,227,228],"tests","cover","verify tests cover changed lines","verify","coverage","pr","exercise","patch","code","share"]