[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M7DBBZP3SBDCSSJFY44DHRG2":3,"skill-same:01M7DBBZP3SBDCSSJFY44DHRG2":51},{"skillNo":4,"name":5,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":18,"linkOnly":19,"markdownContent":20,"markdownBody":21,"frontMatter":22,"refName":23,"commitSha":24,"skillDirectory":25,"forksCount":26,"repositoryHtmlUrl":27,"repositoryHomepageUrl":6,"ownerHtmlUrl":28,"ownerBlogUrl":6,"ownerDescription":29,"updatedAt":30,"install":31,"resources":44},"01M7DBBZP3SBDCSSJFY44DHRG2","syscall-filter-evidence",null,"alicewe1\u002Falice_skill","alicewe1","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F102134151?v=4","01M7D9STCM8HAESM958JP0989K","Alice_we","01M7D9STDR22MTD9FTTWPAZNV8",64,"GPL-3.0","https:\u002F\u002Fgithub.com\u002Falicewe1\u002Falice_skill\u002Fblob\u002Fmain\u002F_modules\u002Fsyscall-filter-evidence\u002FSKILL.md",[],[],"2026-11-15 14:19:17",false,"---\nname: syscall-filter-evidence\ndescription: |\n  Beginner-friendly workflow for System-call filter evidence collection for signals, exits, memory mapping, direct syscalls, and attribution. Extracts general methods and evidence practices without depending on any author, private repository, personal path, secret, or branded prompt. Use when a reverse-engineering task needs reliable observation, loader analysis, runtime evidence, dump validation, crash attribution, tool setup, or reproducible reporting.\nx-alice-class: reverse\n---# System-call filter evidence collection for signals, exits, memory mapping, direct syscalls, and attribution\n\n## Beginner mode\n\nExplain the object, the observation question, the required evidence, the first tool, and the success criterion before using advanced terminology.\n\n## Workflow\n\n1. Record sample hash, version, architecture, environment, entry action, and objective.\n2. Preserve raw artifacts before modifying, decoding, dumping, or patching anything.\n3. Perform the smallest observation that can distinguish competing hypotheses.\n4. Correlate static references with runtime stacks, registers, mappings, files, traffic, and outputs.\n5. Record commands, tool versions, paths, offsets, timestamps, and first-difference locations.\n6. Validate the result with a clean baseline, repeat run, edge case, and consumer tool or independent observation.\n\n## Quality gates\n\n- A string or one log line is not a call chain.\n- A dump is not valid until its structure, mappings, imports\u002Frelocations, and consumer-tool behavior agree.\n- A patch or observation hook is not stable until cold start, warm start, repeated calls, and clean baseline are compared.\n- If a prerequisite is missing, report the smallest next artifact instead of changing the environment blindly.\n\n## Deliverables\n\n- Beginner summary.\n- Evidence table and confidence level.\n- Technical chain and unresolved hypotheses.\n- Reproducible command, script, fixture, dump validation, or report.\n- Limitations, rollback notes, and next action.\n","## Beginner mode\n\nExplain the object, the observation question, the required evidence, the first tool, and the success criterion before using advanced terminology.\n\n## Workflow\n\n1. Record sample hash, version, architecture, environment, entry action, and objective.\n2. Preserve raw artifacts before modifying, decoding, dumping, or patching anything.\n3. Perform the smallest observation that can distinguish competing hypotheses.\n4. Correlate static references with runtime stacks, registers, mappings, files, traffic, and outputs.\n5. Record commands, tool versions, paths, offsets, timestamps, and first-difference locations.\n6. Validate the result with a clean baseline, repeat run, edge case, and consumer tool or independent observation.\n\n## Quality gates\n\n- A string or one log line is not a call chain.\n- A dump is not valid until its structure, mappings, imports\u002Frelocations, and consumer-tool behavior agree.\n- A patch or observation hook is not stable until cold start, warm start, repeated calls, and clean baseline are compared.\n- If a prerequisite is missing, report the smallest next artifact instead of changing the environment blindly.\n\n## Deliverables\n\n- Beginner summary.\n- Evidence table and confidence level.\n- Technical chain and unresolved hypotheses.\n- Reproducible command, script, fixture, dump validation, or report.\n- Limitations, rollback notes, and next action.\n",{},"main","19a54ac988e9929160334271f5c1924ddd9b227e","_modules\u002Fsyscall-filter-evidence",19,"https:\u002F\u002Fgithub.com\u002Falicewe1\u002Falice_skill","https:\u002F\u002Fgithub.com\u002Falicewe1","写一些自己用得上的工具，能自动化就绝不手动 · 自动化 \u002F 工程效率 \u002F Agent 技能生态 · 保持好奇，持续构建","2026-09-30 00:41:20",{"source":7,"skillName":5,"commands":32,"prompt":42,"zipAvailable":43},[33,36,39],{"tool":34,"command":35},"npx","npx skills add alicewe1\u002Falice_skill --skill syscall-filter-evidence",{"tool":37,"command":38},"bunx","bunx skills add alicewe1\u002Falice_skill --skill syscall-filter-evidence",{"tool":40,"command":41},"pnpm","pnpm dlx skills add alicewe1\u002Falice_skill --skill syscall-filter-evidence","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Falicewe1\u002Falice_skill\u002Fblob\u002Fmain\u002F_modules\u002Fsyscall-filter-evidence\u002FSKILL.md",true,[45],{"path":46,"resourceType":47,"resourceTypeDesc":48,"sizeBytes":49,"sourceHtmlUrl":50},"agents\u002Fopenai.yaml","REFERENCE","参考文档",544,"https:\u002F\u002Fgithub.com\u002Falicewe1\u002Falice_skill\u002Fblob\u002Fmain\u002F_modules\u002Fsyscall-filter-evidence\u002Fagents\u002Fopenai.yaml",[52,59,66,73,80,87],{"skillNo":53,"name":54,"nameZh":6,"description":55,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":56,"categories":57,"keywords":58,"publishedAt":18},"01M7DBMD9P6R27SWQCW5HYVWG0","alice","Alice 六类技能总路由。用户输入 Alice 或要求查看 Alice 技能菜单时，严格输出固定菜单；输入攻\u002F防模式、六类入口或直接描述任务时，按类别→领域→模块渐进路由。","https:\u002F\u002Fgithub.com\u002Falicewe1\u002Falice_skill\u002Fblob\u002Fmain\u002Faliceskill\u002FSKILL.md",[],[],{"skillNo":60,"name":61,"nameZh":6,"description":62,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":63,"categories":64,"keywords":65,"publishedAt":18},"01M7DBM8X5M7YXPYBVFMWF8HRC","alice-reverse","逆向分析渐进路由（二进制 \u002F 移动端 \u002F 协议 \u002F 取证 \u002F 保护机制 \u002F 运行时观测）。触发词：二进制\u002F移动端\u002F反编译\u002FFrida\u002FIDA\u002FGhidra\u002FPE\u002FELF\u002FAPK\u002F协议\u002F取证；先选领域索引，再按任务匹配度与评分选模块，禁止一次读取全部领域。","https:\u002F\u002Fgithub.com\u002Falicewe1\u002Falice_skill\u002Fblob\u002Fmain\u002Falice-reverse\u002FSKILL.md",[],[],{"skillNo":67,"name":68,"nameZh":6,"description":69,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":70,"categories":71,"keywords":72,"publishedAt":18},"01M7DBM630E2YKQP29194TT7HC","alice-pentest","web安全渐进路由（Web \u002F API \u002F 资产发现 \u002F 漏洞验证 \u002F 云与网络安全）。触发词：Web\u002FAPI\u002F资产发现\u002F端口\u002F漏洞验证\u002F云与网络安全；先选领域索引，再按任务匹配度与评分选模块，禁止一次读取全部领域。","https:\u002F\u002Fgithub.com\u002Falicewe1\u002Falice_skill\u002Fblob\u002Fmain\u002Falice-pentest\u002FSKILL.md",[],[],{"skillNo":74,"name":75,"nameZh":6,"description":76,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":77,"categories":78,"keywords":79,"publishedAt":18},"01M7DBM20M2VDYV5D3MYDGBTQX","alice-game","游戏攻防渐进路由（游戏客户端 \u002F 内存 \u002F 图形 \u002F 反作弊 \u002F 安全研究）。触发词：游戏客户端\u002F内存\u002F图形\u002F偏移\u002F反作弊\u002F模拟器\u002F覆盖层；先选领域索引，再按任务匹配度与评分选模块，禁止一次读取全部领域。","https:\u002F\u002Fgithub.com\u002Falicewe1\u002Falice_skill\u002Fblob\u002Fmain\u002Falice-game\u002FSKILL.md",[],[],{"skillNo":81,"name":82,"nameZh":6,"description":83,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":84,"categories":85,"keywords":86,"publishedAt":18},"01M7DBKXVEKB8931MZG23VACFN","alice-crack","卡密授权渐进路由（卡密 \u002F 激活 \u002F 授权验证 \u002F 许可证管理 \u002F 本地授权分析）。触发词：卡密\u002F激活\u002F授权验证\u002Flicense\u002F机器码\u002F试用状态；先选领域索引，再按任务匹配度与评分选模块，禁止一次读取全部领域。","https:\u002F\u002Fgithub.com\u002Falicewe1\u002Falice_skill\u002Fblob\u002Fmain\u002Falice-crack\u002FSKILL.md",[],[],{"skillNo":88,"name":89,"nameZh":6,"description":90,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":91,"categories":92,"keywords":93,"publishedAt":18},"01M7DBKTMT90MGV2WP8K73TMQD","alice-assist","技能指令渐进路由（技能路由 \u002F 评分 \u002F 吸收 \u002F 迁移 \u002F 自动化 \u002F 文档与平台集成）。触发词：技能创建\u002F吸收\u002F评分\u002F迁移\u002F自动化\u002F文档\u002F平台指令；先选领域索引，再按任务匹配度与评分选模块，禁止一次读取全部领域。","https:\u002F\u002Fgithub.com\u002Falicewe1\u002Falice_skill\u002Fblob\u002Fmain\u002Falice-assist\u002FSKILL.md",[],[]]