pwn 0.5.737 → 0.5.738

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: af2001b2546112668f86a37ec9ab15c0bea62dd138188fd47b0441e2101a8622
-  data.tar.gz: 9281f66b1e6563d1abe0cd057b3a8a7e6de5c9712dd58e72e188f24d51acfbfc
+  metadata.gz: 1ca56931addf19f59b18ee2776ee84b0af0a75496bcf9bd9d8453b96b9b9eef2
+  data.tar.gz: b9310696c7ae7098d37dc3c8e46b1cd2214ab652a49ef75df281b34c472a738c
 SHA512:
-  metadata.gz: e8f434c799f8cb9c67fb9d8f2f329e1e172fa1664ccfaea7bcb208febe9e3d8b42372b95210c3afb551cdb5648816f033fccdacb6897e36177a17d3b3be79a5a
-  data.tar.gz: 893e79ee5521e6c52558ea5cd69ac30c65b5a97e4a0cad3405da69bef72d48424714f971755880b8d7ca89168befe138d8edcc03636e124a09279ec7eb09c272
+  metadata.gz: d6ec57ded9a7213562cdaf4b4486d680387f8dea1ec1fbf6bfc47a2b4ed40e7c7782c40e3ab80a5164c308c5dae220442956b83cf2c0ccbddbbc2e398b1e6acf
+  data.tar.gz: 7c447c3b9e42779e4ca86038836719dad5b051a872f4bbad2bc704b54596a69644c56a92a6d877681045f3c7000cddb0a51aaa49e79be9ab1afc5de40b7fa8a2

data/.rubocop_todo.yml

@@ -20,7 +20,6 @@ Lint/NestedMethodDefinition:
     - 'lib/pwn/plugins/repl.rb'
     - 'lib/pwn/plugins/repl/ai.rb'
     - 'lib/pwn/plugins/repl/asm.rb'
-    - 'lib/pwn/plugins/repl/irc.rb'
     - 'lib/pwn/plugins/repl/mesh.rb'
     - 'lib/pwn/plugins/repl/vault.rb'
 

data/documentation/Agent-Tool-Registry.md

@@ -6,13 +6,13 @@ toolsets; the JSON-Schema for each tool is what the model actually sees.
 
 ![Tool registry](diagrams/agent-tool-registry.svg)
 
-## Toolsets to tools  (13 toolsets · 87 tools)
+## Toolsets to tools  (13 toolsets · 88 tools)
 
 | Toolset | Tools | Backed by |
 |---|---|---|
 | `http` | `http_proxy_start` · `http_proxy_stop` · `http_proxy_entries` · `http_proxy_rules` · `http_replay` | `PWN::Plugins::MitmProxy`: native HTTP HAR capture/replay; opaque CONNECT tunnels |
 | `terminal` | `shell` | `Open3.capture3` on the host, after `PWN::AI::Agent::ToolGuard` |
-| `pwn` | `pwn_eval` | `TOPLEVEL_BINDING.eval` in the live REPL process, after `ToolGuard` |
+| `pwn` | `pwn_eval` · `sbom_scan` | `TOPLEVEL_BINDING.eval` in the live REPL process, after `ToolGuard`; SBOM engines via `PWN::Plugins::SBOM` |
 | `mcp` | `mcp` | `PWN::AI::MCP` session broker → any `PWN::AI::MCP::*` stdio client |
 | `memory` | `memory_remember` · `memory_recall` · `memory_forget` · `memory_clear` · **`memory_lean`** | `PWN::Memory` → `~/.pwn/memory.json` |
 | `skills` | `skills_consolidate` · **`skills_recall`** · `skill_list` · `skill_view` · `skill_create` · `skill_add_reference` · `skill_delete` · `skill_migrate_legacy` | `~/.pwn/skills/<name>/SKILL.md` (**[agentskills.io](https://agentskills.io) spec**; legacy flat `*.md` auto-migrated) |
@@ -70,7 +70,7 @@ PWN::AI::Agent::Registry.definitions(relevance: 'nmap sweep 10.0.0.0/8', top_k:
 PWN::AI::Agent::Registry.rank(query: 'run a shell command')   # inspect ranking
 PWN::AI::Agent::Registry.preference_order                     # Env / DEFAULT_PREFERENCE
 PWN::AI::Agent::Registry.toolsets                              # -> the 13 names above
-PWN::AI::Agent::Registry.all.count                             # -> 87
+PWN::AI::Agent::Registry.all.count                             # -> 88
 ```
 
 Frontier engines leave `tool_router` off (unless you set it) and receive the

data/documentation/Diagrams.md

@@ -68,7 +68,7 @@ groups) so lines never criss-cross.
 [source](diagrams/dot/ai-integration-tool-calling.dot) · doc: [AI Integration](AI-Integration.md)
 ![ai-integration-tool-calling](diagrams/ai-integration-tool-calling.svg)
 
-### Agent Tool Registry (13 toolsets · 87 tools)
+### Agent Tool Registry (13 toolsets · 88 tools)
 [source](diagrams/dot/agent-tool-registry.dot) · doc: [Agent Tool Registry](Agent-Tool-Registry.md)
 ![agent-tool-registry](diagrams/agent-tool-registry.svg)
 

data/documentation/How-PWN-Works.md

@@ -29,7 +29,7 @@ hardware).
 |---|---|
 | `Loop` | plan → **TaskSummarizer** briefs → dispatch tool_calls → observe → repeat until `may_finalize?`. No iteration-budget abort |
 | **`TaskSummarizer`** | Executive UX: every request gets an English task compass (`emit_plan!` · `about_to` as `task k/n`) - no statement/question/goal type |
-| `Registry` | JSON-Schema function definitions grouped into 13 **toolsets** · **87 tools** · `CORE_TOOLS` = `DEFAULT_PREFERENCE` (`memory_recall` · `session_recall` · `skills_recall` · `pwn_eval` · `shell` · `mistakes_record` · `mistakes_resolve` · `learning_note_outcome` · `memory_remember`) |
+| `Registry` | JSON-Schema function definitions grouped into 13 **toolsets** · **88 tools** · `CORE_TOOLS` = `DEFAULT_PREFERENCE` (`memory_recall` · `session_recall` · `skills_recall` · `pwn_eval` · `shell` · `mistakes_record` · `mistakes_resolve` · `learning_note_outcome` · `memory_remember`) |
 | `Dispatch` / `Result` | execute a tool, capture stdout/value/error/duration |
 | `PromptBuilder` | inject MEMORY / SKILLS / LEARNING / **KNOWN MISTAKES + FIXES** / METRICS / **POLICY** / EXTROSPECTION / RECENT TURNS |
 | `Metrics` · `Learning` · `Reflect` · **`Policy`** | **introspection** - how well am I doing? (Policy is live Q / REINFORCE, advisory rank only) |

data/documentation/Plugin-Degradation.md

@@ -0,0 +1,74 @@
+# Plugin degradation and fallbacks
+
+Each `PreflightChecker` health line links here. CI asserts every plugin in
+`PLUGIN_DEPS` has an anchor and that documented fallbacks still exist.
+
+## pwn-plugins-radare2
+
+Required: `r2`. Fallback: `objdump` / `PWN::Plugins::REDB` binutils path.
+
+## pwn-plugins-gdb
+
+Required: `gdb`. Fallback: `PWN::Plugins::Debugger` still exposes `cyclic` helpers.
+
+## pwn-plugins-nuclei
+
+Required: `nuclei`. Fallback: `TransparentBrowser` + `pwn_eval`.
+
+## pwn-plugins-sqlmap
+
+Required: `sqlmap`. Fallback: `pwn_eval` HTTP clients.
+
+## pwn-plugins-frida
+
+Required: `frida`. Fallback: `Debugger` + `REDB`.
+
+## pwn-plugins-aflplusplus
+
+Required: `afl-fuzz`. Fallback: `PWN::Plugins::Fuzz.triage` on an existing crash dir.
+
+## pwn-plugins-volatility
+
+Required: `vol`. Fallback: `pwn_eval` + strings/REDB.
+
+## pwn-plugins-nmapit
+
+Required: `nmap`. Fallback: `Packet.tcp_connect_scan`.
+
+## pwn-plugins-metasploit
+
+Required: `msfconsole`. Fallback: `exploitdev`, `pwn_eval`, `PWN::Plugins::Handler`.
+
+## pwn-plugins-burpsuite
+
+Required: `burpsuite`. Fallback: `TransparentBrowser`, `nuclei`, `PWN::Plugins::MitmProxy`.
+
+## pwn-plugins-zaproxy
+
+Required: `zaproxy`. Fallback: `nuclei`, `TransparentBrowser`, `PWN::Plugins::MitmProxy`.
+
+## pwn-plugins-packet
+
+Required: `CAP_NET_RAW` **or** the capability broker helper. Install the helper
+from `documentation/Capability-Broker-Sandbox.md` (setcap the helper binary, not
+the Ruby interpreter). Fallback: `Packet.tcp_connect_scan` / `PWN::Plugins::Sock`.
+
+## pwn-plugins-k8s
+
+Required: `trivy` and docker.sock. Fallback: `sbom_scan` / `pwn_eval`.
+
+## pwn-plugins-semgrep
+
+Required: `semgrep`. Fallback: `sast` tools / `pwn_eval`.
+
+## pwn-plugins-exploitdb
+
+Required: `searchsploit`. Fallback: `intel_lookup`.
+
+## pwn-plugins-recon
+
+Required: `subfinder`, `httpx`. Fallback: `NmapIt.scan` + `Corpus.get`.
+
+## pwn-plugins-credentialattack
+
+Required: `hydra`, `john`, `hashcat`. Fallback: `pwn_eval` + `Corpus`.

data/documentation/Swarm.md

@@ -1,8 +1,7 @@
 # Swarm - Native Multi-Agent Orchestration
 
-`PWN::AI::Agent::Swarm` replaces the legacy `pwn-irc` (inspircd + weechat +
-PRIVMSG) transport with **first-class sub-agents** built directly on
-`PWN::AI::Agent::Loop`. Each persona is a *full* tool-calling agent - Memory,
+`PWN::AI::Agent::Swarm` is first-class multi-agent orchestration built
+directly on `PWN::AI::Agent::Loop`. Each persona is a *full* tool-calling agent - Memory,
 Skills, Learning, Metrics and Extrospection all apply - so the
 self-improvement loop covers the whole swarm.
 

data/documentation/What-is-PWN.md

@@ -20,7 +20,7 @@ with a **tool-calling AI agent** on top that can run the same methods.
 | `PWN::FFI::*` | **8** | Native DSP/RF backends: Volk · Liquid · FFTW · RTLSdr · HackRF · AdalmPluto · SoapySDR · Stdio |
 | `PWN::AI::*` | **6** engines | OpenAI, Anthropic, Grok (OAuth device-flow), Gemini, Ollama, Open WebUI |
 | `bin/pwn_*` + `pwn` | **54** | Headless CLI executables for CI/CD |
-| Agent toolsets | **13** · **87 tools** | terminal · pwn · memory · skills · sessions · learning · metrics · policy · extrospection · cron · swarm · reward · curriculum |
+| Agent toolsets | **13** · **88 tools** | terminal · pwn · memory · skills · sessions · learning · metrics · policy · extrospection · cron · swarm · reward · curriculum |
 
 ## Three ways to use it
 

data/documentation/pwn-REPL.md

@@ -26,7 +26,6 @@ commands.
 | `pwn-ai-sessions` | `PWN::Sessions` | List/view/delete transcripts |
 | `pwn-ai-cron` | `PWN::Cron` | List/run/toggle scheduled jobs |
 | `pwn-ai-delegate` | `Agent::Swarm` | Send one request to a persona |
-| `pwn-irc` | *(deprecated)* | Prints a pointer to `Agent::Swarm` - the IRC daemon transport is gone |
 | `toggle-debug` | `Agent::Loop` / `Plugins::Log` | Stage log per operator request to `/tmp/pwn-ai-DEBUG-<SESSION_ID>-RN.log` |
 | `toggle-trace` | `Agent::Loop` / `Plugins::Log` | Turns `toggle-debug` on with TracePoint; ENTER after each engine/tool step. Pry.config, not Env. Off turns both off. |
 | `toggle-pwn-ai-speaks` | `Plugins::Voice` | TTS every final answer on/off |

data/documentation/pwn-ai-Agent.md

@@ -101,7 +101,7 @@ $ pwn --ai "run bin/pwn_sast against ./src and push findings to DefectDojo"
 
 ## What the agent can call
 
-13 toolsets · **87 tools** - full table at
+13 toolsets · **88 tools** - full table at
 [Agent Tool Registry](Agent-Tool-Registry.md).
 
 The two that matter most:

data/etc/default_skills/browser-exploitation/SKILL.md

@@ -0,0 +1,10 @@
+---
+name: browser-exploitation
+description: Use when attacking browsers. Proxy plus Debugger.
+---
+
+# Browser exploitation
+
+1. `PWN::Plugins::MitmProxy.start` and TransparentBrowser `proxy:`.
+2. `replay` mutated requests; diff HAR entries.
+3. Native crashes go through `PWN::Plugins::Debugger` and `REDB`.

data/etc/default_skills/firmware-unpack-emulate/SKILL.md

@@ -0,0 +1,10 @@
+---
+name: firmware-unpack-emulate
+description: Use when unpacking firmware. REDB on extracted bins.
+---
+
+# Firmware unpack and emulate
+
+1. Unpack with binwalk/firmware-mod-kit outside the radio path.
+2. `PWN::Plugins::REDB.open` on extracted userland binaries.
+3. Emulate with qemu user; debug via `PWN::Plugins::Debugger.launch`.

data/etc/default_skills/heap-exploitation/SKILL.md

@@ -0,0 +1,11 @@
+---
+name: heap-exploitation
+description: Use when exploiting glibc heap. Debugger and REDB steps for tcache.
+---
+
+# Heap exploitation (tcache / fastbin)
+
+1. `PWN::Plugins::REDB.open(bin: path)` then `xrefs_to(sym: 'malloc')` and `xrefs_to(sym: 'free')`.
+2. `PWN::Plugins::Debugger.launch(bin: path)` then `break(addr_or_sym: 'main')` and `run`.
+3. Use `cyclic` / `cyclic_find` to locate overflow into tcache metadata (`tcache_perthread_struct`).
+4. Confirm with `regs` and `read_mem` after `continue`. Write the proof via `Findings.record`.

data/etc/default_skills/kernel-pwn-triage/SKILL.md

@@ -0,0 +1,11 @@
+---
+name: kernel-pwn-triage
+description: Use when triaging kernel bugs. Debugger and REDB first.
+---
+
+# Kernel pwn triage
+
+1. `PWN::Plugins::REDB.open(bin: vmlinux)` then `funcs` / `xrefs_to`.
+2. `PWN::Plugins::Debugger.attach(host: '127.0.0.1', port: 1234)` to a QEMU gdbstub (`-s`).
+3. `break(addr_or_sym: 'commit_creds')`, `continue`, `regs`, `backtrace`.
+4. Record findings with evidence paths; do not guess offsets.

data/etc/default_skills/pwn/ai/agent/swarm/SKILL.md

@@ -12,7 +12,7 @@ metadata:
 
 # PWN::AI::Agent::Swarm
 
-Native multi-agent orchestration for pwn-ai. Swarm replaces the legacy `pwn-irc` mechanism (inspircd + weechat + PRIVMSG-flattened .chat calls) with first-class sub-agents built on top of PWN::AI::Agent::Loop.run. Each persona is a full tool-calling agent — Memory, Skills, Learning, Metrics and Extrospection all apply — so the self-improvement loop covers the whole swarm. ~/.pwn/agents.yml # persona registry ~/.pwn/swarm/<swarm_id>/bus.jsonl # append-only message bus ~/.pwn/swarm/<swarm_id>/personas.json# persona -> PWN::Sessions id Cross-session / cross-process communication == another pwn-ai (or a PWN::Cron job) calling Swarm.ask/debate with the same swarm_id and reading the same bus.jsonl. No daemon required.
+Native multi-agent orchestration for pwn-ai. First-class sub-agents built on top of PWN::AI::Agent::Loop.run. Each persona is a full tool-calling agent — Memory, Skills, Learning, Metrics and Extrospection all apply — so the self-improvement loop covers the whole swarm. ~/.pwn/agents.yml # persona registry ~/.pwn/swarm/<swarm_id>/bus.jsonl # append-only message bus ~/.pwn/swarm/<swarm_id>/personas.json# persona -> PWN::Sessions id Cross-session / cross-process communication == another pwn-ai (or a PWN::Cron job) calling Swarm.ask/debate with the same swarm_id and reading the same bus.jsonl. No daemon required.
 
 ## When to use
 

data/etc/default_skills/pwn/ai/agent/tools/sbom_scan/SKILL.md

@@ -0,0 +1,45 @@
+---
+name: pwn-ai-agent-tools-sbomscan
+description: Drive PWN::Ai::Agent::Tools::SbomScan from pwn_eval.
+license: MIT
+allowed-tools: [pwn, pwn_eval]
+metadata:
+  bundled: true
+  generated: true
+  module: PWN::Ai::Agent::Tools::SbomScan
+  source: pwn/ai/agent/tools/sbom_scan.rb
+---
+
+# PWN::Ai::Agent::Tools::SbomScan
+
+Public API for PWN::Ai::Agent::Tools::SbomScan.
+
+## When to use
+
+Call `PWN::Ai::Agent::Tools::SbomScan` from `pwn_eval` when the task needs this module.
+Do not reimplement it in shell.
+
+## Methodologies
+
+Generated from `pwn/ai/agent/tools/sbom_scan.rb`. Prefer the public class methods below.
+Class methods take `(opts = {})` and read `opts`.
+
+## How to call
+
+```ruby
+PWN::Ai::Agent::Tools::SbomScan.help
+PWN::Ai::Agent::Tools::SbomScan.help(opts)
+```
+
+## Public methods
+
+- _(no public class methods parsed)_
+
+## Source
+
+`pwn/ai/agent/tools/sbom_scan.rb`
+
+## Verification
+
+`PWN::Ai::Agent::Tools::SbomScan.respond_to?(:help)` after the
+module is loaded. Read the source for parameter names.

data/etc/default_skills/pwn/corpus/SKILL.md

@@ -0,0 +1,52 @@
+---
+name: pwn-corpus
+description: Drive PWN::Corpus from pwn_eval.
+license: MIT
+allowed-tools: [pwn, pwn_eval]
+metadata:
+  bundled: true
+  generated: true
+  module: PWN::Corpus
+  source: pwn/corpus.rb
+---
+
+# PWN::Corpus
+
+Named wordlist and payload corpora under ~/.pwn/corpora.
+
+## When to use
+
+Call `PWN::Corpus` from `pwn_eval` when the task needs this module.
+Do not reimplement it in shell.
+
+## Methodologies
+
+Generated from `pwn/corpus.rb`. Prefer the public class methods below.
+Class methods take `(opts = {})` and read `opts`.
+
+## How to call
+
+```ruby
+PWN::Corpus.help
+PWN::Corpus.get(opts)
+```
+
+## Public methods
+
+- `get`
+- `update`
+- `authors`
+- `help`
+
+## References
+
+- `references/urls.md` — URLs from source
+
+## Source
+
+`pwn/corpus.rb`
+
+## Verification
+
+`PWN::Corpus.respond_to?(:get)` after the
+module is loaded. Read the source for parameter names.

data/etc/default_skills/pwn/corpus/references/urls.md

@@ -0,0 +1,3 @@
+# PWN::Corpus source links
+
+- https://raw.githubusercontent.com/danielmiessler/SecLists/master/Discovery/DNS/subdomains-top1million-5000.txt

data/etc/default_skills/pwn/engagement/SKILL.md

@@ -0,0 +1,55 @@
+---
+name: pwn-engagement
+description: Drive PWN::Engagement from pwn_eval.
+license: MIT
+allowed-tools: [pwn, pwn_eval]
+metadata:
+  bundled: true
+  generated: true
+  module: PWN::Engagement
+  source: pwn/engagement.rb
+---
+
+# PWN::Engagement
+
+Engagement scope, host state, and vault refs under ~/.pwn/engagements.
+
+## When to use
+
+Call `PWN::Engagement` from `pwn_eval` when the task needs this module.
+Do not reimplement it in shell.
+
+## Methodologies
+
+Generated from `pwn/engagement.rb`. Prefer the public class methods below.
+Class methods take `(opts = {})` and read `opts`.
+
+## How to call
+
+```ruby
+PWN::Engagement.help
+PWN::Engagement.open(opts)
+```
+
+## Public methods
+
+- `open`
+- `close`
+- `status`
+- `in_scope`
+- `warn_unless_in_scope`
+- `record_host`
+- `hosts`
+- `merge_scan`
+- `authors`
+- `help`
+- `in_scope?`
+
+## Source
+
+`pwn/engagement.rb`
+
+## Verification
+
+`PWN::Engagement.respond_to?(:open)` after the
+module is loaded. Read the source for parameter names.

data/etc/default_skills/pwn/plugins/debugger/SKILL.md

@@ -0,0 +1,62 @@
+---
+name: pwn-plugins-debugger
+description: Drive PWN::Plugins::Debugger from pwn_eval.
+license: MIT
+allowed-tools: [pwn, pwn_eval]
+metadata:
+  bundled: true
+  generated: true
+  module: PWN::Plugins::Debugger
+  source: pwn/plugins/debugger.rb
+---
+
+# PWN::Plugins::Debugger
+
+Structured GDB/MI driver with a handle registry that survives pwn_eval.
+
+## When to use
+
+Call `PWN::Plugins::Debugger` from `pwn_eval` when the task needs this module.
+Do not reimplement it in shell.
+
+## Methodologies
+
+Generated from `pwn/plugins/debugger.rb`. Prefer the public class methods below.
+Class methods take `(opts = {})` and read `opts`.
+
+## How to call
+
+```ruby
+PWN::Plugins::Debugger.help
+PWN::Plugins::Debugger.required_bins(opts)
+```
+
+## Public methods
+
+- `required_bins`
+- `launch`
+- `attach`
+- `run`
+- `break`
+- `continue`
+- `step`
+- `read_mem`
+- `write_mem`
+- `regs`
+- `backtrace`
+- `checksec`
+- `cyclic`
+- `cyclic_find`
+- `to_pwntools_offsets`
+- `close`
+- `authors`
+- `help`
+
+## Source
+
+`pwn/plugins/debugger.rb`
+
+## Verification
+
+`PWN::Plugins::Debugger.respond_to?(:required_bins)` after the
+module is loaded. Read the source for parameter names.

data/etc/default_skills/pwn/plugins/fuzz/SKILL.md

@@ -36,6 +36,7 @@ PWN::Plugins::Fuzz.socket(opts)
 - `socket`
 - `http`
 - `file_format`
+- `triage`
 - `authors`
 - `help`
 

data/etc/default_skills/pwn/plugins/handler/SKILL.md

@@ -0,0 +1,52 @@
+---
+name: pwn-plugins-handler
+description: Drive PWN::Plugins::Handler from pwn_eval.
+license: MIT
+allowed-tools: [pwn, pwn_eval]
+metadata:
+  bundled: true
+  generated: true
+  module: PWN::Plugins::Handler
+  source: pwn/plugins/handler.rb
+---
+
+# PWN::Plugins::Handler
+
+Payload generation and listener sessions without Metasploit.
+
+## When to use
+
+Call `PWN::Plugins::Handler` from `pwn_eval` when the task needs this module.
+Do not reimplement it in shell.
+
+## Methodologies
+
+Generated from `pwn/plugins/handler.rb`. Prefer the public class methods below.
+Class methods take `(opts = {})` and read `opts`.
+
+## How to call
+
+```ruby
+PWN::Plugins::Handler.help
+PWN::Plugins::Handler.required_bins(opts)
+```
+
+## Public methods
+
+- `required_bins`
+- `generate`
+- `listen`
+- `accept`
+- `interact`
+- `stop`
+- `authors`
+- `help`
+
+## Source
+
+`pwn/plugins/handler.rb`
+
+## Verification
+
+`PWN::Plugins::Handler.respond_to?(:required_bins)` after the
+module is loaded. Read the source for parameter names.

data/etc/default_skills/pwn/plugins/jobs/SKILL.md

@@ -47,6 +47,7 @@ PWN::Plugins::Jobs.required_bins(opts)
 - `harvest`
 - `list`
 - `stop`
+- `graph`
 - `authors`
 - `help`
 

data/etc/default_skills/pwn/plugins/mitm_proxy/SKILL.md

@@ -39,6 +39,7 @@ PWN::Plugins::MitmProxy.start(opts)
 - `rules`
 - `http_replay`
 - `exchange`
+- `replay`
 - `authors`
 - `help`
 

data/etc/default_skills/pwn/plugins/nmap_it/SKILL.md

@@ -37,6 +37,7 @@ PWN::Plugins::NmapIt.port_scan(opts)
 - `parse_xml_results`
 - `diff_xml_results`
 - `to_findings`
+- `scan`
 - `authors`
 - `help`
 

data/etc/default_skills/pwn/plugins/packet/SKILL.md

@@ -47,6 +47,7 @@ PWN::Plugins::Packet.open_pcap_file(opts)
 - `tcp_connect_scan`
 - `cap_net_raw`
 - `capture`
+- `health`
 - `authors`
 - `help`
 - `cap_net_raw?`

data/etc/default_skills/pwn/plugins/process_tube/SKILL.md

@@ -41,6 +41,8 @@ PWN::Plugins::ProcessTube.required_bins(opts)
 - `recvuntil`
 - `recvline`
 - `close`
+- `send_raw`
+- `register`
 - `expect`
 - `stream`
 - `reap_orphans`

data/etc/default_skills/pwn/plugins/redb/SKILL.md

@@ -0,0 +1,52 @@
+---
+name: pwn-plugins-redb
+description: Drive PWN::Plugins::REDB from pwn_eval.
+license: MIT
+allowed-tools: [pwn, pwn_eval]
+metadata:
+  bundled: true
+  generated: true
+  module: PWN::Plugins::REDB
+  source: pwn/plugins/redb.rb
+---
+
+# PWN::Plugins::REDB
+
+Persistent per-binary analysis DB under ~/.pwn/redb.
+
+## When to use
+
+Call `PWN::Plugins::REDB` from `pwn_eval` when the task needs this module.
+Do not reimplement it in shell.
+
+## Methodologies
+
+Generated from `pwn/plugins/redb.rb`. Prefer the public class methods below.
+Class methods take `(opts = {})` and read `opts`.
+
+## How to call
+
+```ruby
+PWN::Plugins::REDB.help
+PWN::Plugins::REDB.open(opts)
+```
+
+## Public methods
+
+- `open`
+- `funcs`
+- `xrefs_to`
+- `strings`
+- `decompile`
+- `annotate`
+- `authors`
+- `help`
+
+## Source
+
+`pwn/plugins/redb.rb`
+
+## Verification
+
+`PWN::Plugins::REDB.respond_to?(:open)` after the
+module is loaded. Read the source for parameter names.

data/etc/default_skills/pwn/plugins/sbom/SKILL.md

@@ -0,0 +1,48 @@
+---
+name: pwn-plugins-sbom
+description: Drive PWN::Plugins::SBOM from pwn_eval.
+license: MIT
+allowed-tools: [pwn, pwn_eval]
+metadata:
+  bundled: true
+  generated: true
+  module: PWN::Plugins::SBOM
+  source: pwn/plugins/sbom.rb
+---
+
+# PWN::Plugins::SBOM
+
+Generic lockfile/image CVE scan with engine selection.
+
+## When to use
+
+Call `PWN::Plugins::SBOM` from `pwn_eval` when the task needs this module.
+Do not reimplement it in shell.
+
+## Methodologies
+
+Generated from `pwn/plugins/sbom.rb`. Prefer the public class methods below.
+Class methods take `(opts = {})` and read `opts`.
+
+## How to call
+
+```ruby
+PWN::Plugins::SBOM.help
+PWN::Plugins::SBOM.required_bins(opts)
+```
+
+## Public methods
+
+- `required_bins`
+- `scan`
+- `authors`
+- `help`
+
+## Source
+
+`pwn/plugins/sbom.rb`
+
+## Verification
+
+`PWN::Plugins::SBOM.respond_to?(:required_bins)` after the
+module is loaded. Read the source for parameter names.