eni-case-lab · alicewe1 - Agent Skill

01 前言 Front Matter

name: eni-case-lab
description: 全局自动路由 | Create reproducible technical research workspaces for reverse engineering, penetration testing, memory analysis, fuzzing, malware analysis, protocol research, and CTF cases. Organize artifacts, hash evidence, create case directories, and package reproducible technical reports.
x-alice-class: assist

Create a clean, repeatable case before complex analysis.

Run scripts/new_case.py <name> --root <directory> to create a case workspace.
Put untouched inputs under artifacts/original/.
Run scripts/hash_artifact.py <path> --manifest <case>/manifest.json for each input.
Keep derived files under work/, scripts under scripts/, evidence under evidence/, and final outputs under output/.

Case lifecycle, commands, snapshots, local services: read references/case-workflow.md.
Evidence, hashes, timestamps, logs, PCAP, dumps, and reporting: read references/evidence.md.

Record tool versions, exact commands, environment, timestamps, and output paths.
Prefer deterministic scripts and configuration over manual-only steps.
Track assumptions and failed hypotheses in notes.md.
Keep service ports/processes and cleanup commands in the case manifest.

Package the manifest, scripts, evidence index, key artifacts, results, verification commands, and cleanup instructions.

Alice 六类技能总路由。用户输入 Alice 或要求查看 Alice 技能菜单时，严格输出固定菜单；输入攻/防模式、六类入口或直接描述任务时，按类别→领域→模块渐进路由。

逆向分析渐进路由（二进制 / 移动端 / 协议 / 取证 / 保护机制 / 运行时观测）。触发词：二进制/移动端/反编译/Frida/IDA/Ghidra/PE/ELF/APK/协议/取证；先选领域索引，再按任务匹配度与评分选模块，禁止一次读取全部领域。

web安全渐进路由（Web / API / 资产发现 / 漏洞验证 / 云与网络安全）。触发词：Web/API/资产发现/端口/漏洞验证/云与网络安全；先选领域索引，再按任务匹配度与评分选模块，禁止一次读取全部领域。

游戏攻防渐进路由（游戏客户端 / 内存 / 图形 / 反作弊 / 安全研究）。触发词：游戏客户端/内存/图形/偏移/反作弊/模拟器/覆盖层；先选领域索引，再按任务匹配度与评分选模块，禁止一次读取全部领域。

卡密授权渐进路由（卡密 / 激活 / 授权验证 / 许可证管理 / 本地授权分析）。触发词：卡密/激活/授权验证/license/机器码/试用状态；先选领域索引，再按任务匹配度与评分选模块，禁止一次读取全部领域。

技能指令渐进路由（技能路由 / 评分 / 吸收 / 迁移 / 自动化 / 文档与平台集成）。触发词：技能创建/吸收/评分/迁移/自动化/文档/平台指令；先选领域索引，再按任务匹配度与评分选模块，禁止一次读取全部领域。