opencode-skills-collection 4.0.42 → 4.0.44

package/bundled-skills/mobile-reverse/references/ios-reverse-guide.md

@@ -0,0 +1,177 @@
+# iOS 逆向工程专项
+
+## IPA 获取与解密
+
+```bash
+# 从 App Store 下载
+ipatool search "Target App"
+ipatool purchase -b com.target.app
+ipatool download -b com.target.app -o app.ipa
+
+# 从设备提取已安装应用
+# 越狱设备
+scp root@device:/private/var/containers/Bundle/Application/*/Target.app .
+
+# 解密（App Store 二进制为加密 FAT 格式）
+# frida-ios-dump（推荐）
+python3 dump.py com.target.app -o decrypted.ipa
+
+# Clutch
+Clutch -i  # 列出已安装
+Clutch -d 1  # 解密第 1 个
+
+# dumpdecrypted
+DYLD_INSERT_LIBRARIES=dumpdecrypted.dylib /path/to/App
+```
+
+## Mach-O 分析
+
+```bash
+# 基本信息
+otool -l TargetBinary | grep crypt    # 加密状态
+otool -L TargetBinary                 # 动态库依赖
+otool -hv TargetBinary                # 头部信息
+jtool2 --pages TargetBinary           # 内存页信息
+
+# Fat Binary 瘦身
+lipo -info TargetBinary
+lipo TargetBinary -thin arm64 -output TargetBinary_arm64
+
+# 符号分析
+nm -g TargetBinary                    # 导出符号
+nm -a TargetBinary                    # 全部符号
+swift-demangle <mangled_name>         # Swift 符号还原
+
+# class-dump
+class-dump -H TargetBinary -o headers/
+# 导出 ObjC 类及方法声明到 headers/ 目录
+```
+
+## Objective-C 运行时分析
+
+```text
+消息传递机制：
+objc_msgSend(id self, SEL op, ...)  →  动态方法派发
+  ↓
+运行时查找：
+1. 类方法列表 cache
+2. 类方法列表
+3. 逐级父类查找
+4. +resolveInstanceMethod / +resolveClassMethod
+5. forwardingTargetForSelector
+6. methodSignatureForSelector + forwardInvocation
+```
+
+### Frida ObjC Hook
+
+```javascript
+// Hook 实例方法
+var hook = ObjC.classes.ClassName["- instanceMethod:"];
+Interceptor.attach(hook.implementation, {
+    onEnter: function(args) {
+        // args[0] = self, args[1] = selector, args[2+] = method args
+        console.log("self: " + new ObjC.Object(args[0]));
+        console.log("arg: " + args[2].toInt32());
+    }
+});
+
+// Hook 类方法
+var hook = ObjC.classes.ClassName["+ classMethod:"];
+Interceptor.attach(hook.implementation, { ... });
+
+// 调用 ObjC 方法
+var NSString = ObjC.classes.NSString;
+var str = NSString.stringWithString_("test");
+console.log(str.UTF8String());
+```
+
+## Swift 逆向
+
+```text
+Swift 名称修饰（Name Mangling）：
+$s10ModuleName5ClassC6method3argSi_tF
+  │ │         │     │ │      │  │   └─ 参数类型
+  │ │         │     │ │      │  └───── 返回类型  
+  │ │         │     │ │      └──────── 参数名
+  │ │         │     │ └─────────────── 方法名
+  │ │         │     └──────────────── 类名(长度+名称)
+  │ │         └────────────────────── 模块名
+  │ └──────────────────────────────── 标识符标识
+  └────────────────────────────────── 全局标识
+
+工具: swift-demangle, Hopper (自动还原)
+```
+
+## 越狱检测绕过
+
+```text
+检测方法分类：
+
+1. 文件系统检查：
+   □ /Applications/Cydia.app
+   □ /var/lib/apt/
+   □ /bin/bash
+   □ /usr/sbin/sshd
+   → Hook NSFileManager.fileExistsAtPath:
+
+2. 沙箱逃逸检测：
+   □ fork() 是否成功（沙箱内禁止）
+   □ system() 调用
+   → Hook fork → 返回 -1
+
+3. Dyld 注入检测：
+   □ _dyld_get_image_count > 限制值
+   → 限制返回值在合理范围
+
+4. Scheme 检测：
+   □ cydia:// URL Scheme
+   → Hook UIApplication.canOpenURL:
+
+5. sysctl 检测：
+   □ CTL_KERN/KERN_PROC/KERN_PROC_PID → kinfo_proc
+   → Hook sysctl → 清空 p_flag P_TRACED 位
+```
+
+### Frida 统一绕过脚本
+
+```javascript
+// 文件检测绕过
+var NSFileManager = ObjC.classes.NSFileManager;
+var defaultManager = NSFileManager.defaultManager();
+Interceptor.attach(defaultManager["- fileExistsAtPath:"].implementation, {
+    onLeave: function(retval) {
+        var path = ObjC.Object(args[2]).toString();
+        if (path.includes("Cydia") || path.includes("apt") || 
+            path.includes("sshd") || path.includes("bash")) {
+            retval.replace(0); // false
+        }
+    }
+});
+
+// fork 绕过
+Interceptor.replace(Module.findExportByName(null, "fork"), 
+    new NativeCallback(function() { return -1; }, 'int', []));
+
+// dyld 绕过
+var _dyld_get_image_count = Module.findExportByName(null, "_dyld_get_image_count");
+Interceptor.attach(_dyld_get_image_count, {
+    onLeave: function(retval) {
+        if (retval.toInt32() > 200) retval.replace(200);
+    }
+});
+```
+
+## 关键防护绕过清单
+
+| 防护 | iOS 绕过方法 |
+|------|-------------|
+| App Store 加密 | frida-ios-dump / Clutch |
+| SSL Pinning | Objection `ios sslpinning disable` / SSL Kill Switch 2 |
+| 越狱检测 | Objection `ios jailbreak disable` / 自定义 Frida Hook |
+| 反调试 (PT_DENY_ATTACH) | Frida 启动后注入 / debugserver |
+| 完整性校验 | Hook MAC 检查 / 代码签名验证 |
+| 反注入 | 修改 Mach-O 去除 __RESTRICT 段 |
+| Swift 混淆 | swift-demangle + LLM 辅助语义恢复 |
+| 屏幕截图防护 | Hook UIScreen.mainScreen.snapshotViewAfterScreenUpdates |
+
+Source: OWASP MSTG, frida-ios-dump, The iPhone Wiki

package/bundled-skills/muapi-media/SKILL.md

@@ -0,0 +1,311 @@
+---
+name: muapi-media
+description: "Generate images and videos with MuAPI's schema-driven asynchronous media API while protecting keys, polling, and output downloads."
+category: media
+risk: critical
+source: self
+source_type: self
+date_added: "2026-08-26"
+author: Anil-matcha
+tags: [muapi, image-generation, video-generation, media-api]
+tools: [claude, codex, cursor, gemini]
+---
+
+# MuAPI Media
+
+## Overview
+
+Use MuAPI's unified asynchronous API for image and video generation when a
+workflow needs model choice without a separate integration for every provider.
+The catalog and each model's input schema are authoritative; this skill does
+not guess fields, bundle an SDK, or hide a billable generation request. For a
+capability overview, see the [MuAPI AI video API](https://muapi.ai/ai-video-api).
+
+## When to Use This Skill
+
+- Use when the user explicitly asks to generate an image or video with MuAPI.
+- Use when an existing media workflow needs a hosted asynchronous API and can
+  send an authorized HTTPS request.
+- Use when the user needs to compare or switch among current media models
+  without changing the surrounding submit-and-poll workflow.
+- Do not use this skill for text chat or for a provider whose current schema
+  has not been fetched and checked.
+
+## Preconditions
+
+1. Confirm that the user is authorized to send the prompt and any reference
+   media to a third-party service.
+2. Explain that generation may be billable and obtain approval immediately
+   before the generation request.
+3. Require `MUAPI_API_KEY` in the environment. Never ask the user to paste it
+   into chat, source files, command history, or logs.
+4. Confirm the requested media type, output location, and whether the user
+   wants a single generation or an explicitly approved batch.
+
+## API Contract
+
+| Operation | Method and endpoint |
+| --- | --- |
+| List current models | `GET https://api.muapi.ai/api/v1/models` |
+| Read one model's schema | `GET https://api.muapi.ai/api/v1/models/{model}` |
+| Submit a generation | `POST https://api.muapi.ai/{catalog endpoint}` |
+| Poll a prediction | `GET https://api.muapi.ai/api/v1/predictions/{request_id}/result` |
+
+Generation and prediction requests use:
+
+```text
+x-api-key: $MUAPI_API_KEY
+Content-Type: application/json
+```
+
+The catalog returns a model name, category, endpoint, and other metadata. The
+endpoint value already includes `/api/v1/`; append it to `https://api.muapi.ai`
+without adding a second version prefix. Model input and output fields vary, so
+read the selected model's schema immediately before preparing a request.
+
+## How It Works
+
+### 1. Discover and validate a model
+
+Use a temporary directory for response files and keep credentials out of every
+file. The catalog lookup is read-only:
+
+```bash
+workdir=$(mktemp -d "${TMPDIR:-/tmp}/muapi-media.XXXXXX")
+
+curl --fail --silent --show-error \
+  --header "Accept: application/json" \
+  "https://api.muapi.ai/api/v1/models" \
+  --output "$workdir/models.json"
+
+jq -r '
+  .models[]
+  | select(((.category // "") | ascii_downcase | test("image|video|audio|3d")))
+  | [.name, .category, .endpoint]
+  | @tsv
+' "$workdir/models.json"
+```
+
+Select a model from the current catalog, then fetch its detailed schema. Do
+not copy a payload from a different model just because the names look similar:
+
+```bash
+export MUAPI_MODEL="<model name from the catalog>"
+
+curl --fail --silent --show-error \
+  --header "Accept: application/json" \
+  "https://api.muapi.ai/api/v1/models/${MUAPI_MODEL}" \
+  --output "$workdir/model.json"
+
+jq '.input_schema.schemas.input_data' "$workdir/model.json"
+```
+
+Check required fields, types, enum values, size limits, and the output schema.
+If the model requires an image or video input, use the exact documented field
+and an authorized HTTPS input URL; do not invent an upload contract.
+
+### 2. Prepare one reviewed request
+
+Set the key only in the environment and stop before submission if it is absent:
+
+```bash
+test -n "${MUAPI_API_KEY:-}" || {
+  echo "Set MUAPI_API_KEY before generation." >&2
+  exit 1
+}
+
+export MUAPI_PROMPT="A small paper boat crossing a calm pond at sunrise, steady camera"
+
+# Add only fields confirmed by model.json. This example uses a prompt field;
+# many models also require duration, resolution, aspect ratio, or an input URL.
+jq -n \
+  --arg prompt "$MUAPI_PROMPT" \
+  '{prompt: $prompt}' \
+  > "$workdir/request.json"
+```
+
+Review the model, requested parameters, destination, and estimated cost with
+the user. Do not put `MUAPI_API_KEY` in `request.json`.
+
+### 3. Submit exactly once
+
+Resolve the catalog endpoint and make one POST. Do not automatically retry a
+generation POST after a timeout: the original task may have been accepted.
+
+```bash
+model_endpoint=$(jq -er --arg name "$MUAPI_MODEL" '
+  .models[]
+  | select(.name == $name)
+  | .endpoint
+  | select(type == "string" and startswith("/api/v1/"))
+' "$workdir/models.json")
+
+curl --fail --silent --show-error \
+  --request POST \
+  "https://api.muapi.ai${model_endpoint}" \
+  --header @- \
+  --header "Content-Type: application/json" \
+  --data "@$workdir/request.json" \
+  --output "$workdir/submit.json" <<EOF
+x-api-key: ${MUAPI_API_KEY}
+EOF
+
+request_id=$(jq -er '
+  .request_id // .id // .data.request_id // .data.id // .output.id
+  | select(type == "string" and length > 0)
+' "$workdir/submit.json")
+```
+
+Keep the request ID for diagnosis. Never print request headers or the key.
+
+### 4. Poll with a finite deadline
+
+Poll the original request ID, accept only documented terminal states, and stop
+after a bounded number of attempts. The response shape can vary, so use the
+selected model's output schema when extracting the result URL:
+
+```bash
+result_url="https://api.muapi.ai/api/v1/predictions/${request_id}/result"
+
+for attempt in $(seq 1 120); do
+  curl --fail --silent --show-error \
+    "$result_url" \
+    --header @- \
+    --output "$workdir/result.json" <<EOF
+x-api-key: ${MUAPI_API_KEY}
+EOF
+
+  status=$(jq -r '.status // .data.status // .output.status // "unknown"' \
+    "$workdir/result.json")
+  case "$status" in
+    completed|succeeded|success) break ;;
+    failed|error|canceled|cancelled|timeout)
+      jq -r '.error // .data.error // .output.error // "MuAPI generation failed"' \
+        "$workdir/result.json" >&2
+      exit 1
+      ;;
+  esac
+  sleep 2
+done
+
+test "$status" = completed \
+  || test "$status" = succeeded \
+  || test "$status" = success
+```
+
+Do not create a second paid task merely because polling was interrupted. First
+poll the known request ID again and inspect its sanitized status.
+
+### 5. Download without the API key
+
+Extract an HTTPS output URL using the model's output schema. Download it with
+a fresh request that has no MuAPI header, validate the file, and only then
+return or publish it:
+
+```bash
+output_url=$(jq -er '
+  .output.outputs[0]
+  // .data.output.outputs[0]
+  // .outputs[0]
+  // .data.outputs[0]
+  // .output.video
+  // .data.output.video
+  | select(type == "string" and startswith("https://"))
+' "$workdir/result.json")
+
+curl --fail --silent --show-error \
+  "$output_url" \
+  --output "$workdir/output.bin"
+
+test -s "$workdir/output.bin"
+file "$workdir/output.bin"
+```
+
+Do not add `x-api-key` to this request. Reject non-HTTPS output URLs, avoid
+following unvalidated redirects, and use a downloader that checks each
+redirect destination and DNS result when the service returns a redirecting or
+user-controlled URL. Never execute a downloaded file as code.
+
+## Examples
+
+### Read-only model discovery
+
+```bash
+curl --fail --silent --show-error \
+  "https://api.muapi.ai/api/v1/models" \
+  | jq -r '.models[] | [.name, .category, .endpoint] | @tsv'
+```
+
+### One text-to-video request
+
+```text
+1. Discover a current Text to Video model.
+2. Fetch its detailed input_schema and confirm that prompt and the requested
+   duration/resolution fields are accepted.
+3. Obtain approval, submit one POST with MUAPI_API_KEY, and save request_id.
+4. Poll the result endpoint at most 120 times.
+5. Download the HTTPS output without the API key and validate the video file.
+```
+
+## Best Practices
+
+- Treat the live model catalog and detailed schema as authoritative.
+- Keep each generation request explicit and obtain approval before billable
+  work.
+- Submit one POST per task; retry only bounded, idempotent GET polling.
+- Use a finite polling deadline and preserve the request ID on failure.
+- Keep API keys in the environment or an approved secret manager.
+- Use temporary files with restrictive local permissions and remove sensitive
+  response data after the workflow finishes.
+- Validate HTTPS output URLs, size, content type, and basic image/video decode
+  before handing media to another tool.
+- Respect prompt rights, model restrictions, and the user's consent for any
+  uploaded reference media.
+
+## Limitations
+
+- This is an instruction-only skill; it does not install an SDK or background
+  worker.
+- Models, schemas, prices, output retention, and supported fields can change;
+  the live catalog is authoritative.
+- Generation is asynchronous and may take minutes or fail after submission.
+- Output URLs can expire and may not be reusable as permanent asset links.
+- A successful HTTP response does not guarantee a valid or usable media file.
+- This skill does not replace human review of media quality, rights, safety, or
+  provider policy compliance.
+
+## Security & Safety Notes
+
+- Treat prompts and reference media as data sent to a third party; obtain
+  consent and avoid unnecessary personal or confidential information.
+- Never log, echo, commit, or include `MUAPI_API_KEY` in JSON payloads or
+  process arguments; pass authenticated curl headers through protected stdin or
+  a protected config file.
+- Do not forward the API key to output hosts, redirects, browser URLs, or
+  user-controlled domains.
+- Do not use this workflow for bulk generation, file hosting, or unrelated
+  network transfers without explicit authorization.
+- Keep generated media in a controlled output directory and inspect it before
+  opening or sharing it.
+
+## Common Pitfalls
+
+- **Problem:** The API returns a validation error.
+  **Solution:** Fetch the selected model's current schema and rebuild the
+  payload from its required fields and allowed values.
+- **Problem:** A timeout occurs immediately after POST.
+  **Solution:** Preserve the request ID if available and poll it before
+  considering any resubmission.
+- **Problem:** The output is HTML, JSON, or an empty file.
+  **Solution:** Check the HTTPS URL, response status, content type, file size,
+  and basic media decode before treating it as generated output.
+- **Problem:** A download request would send the API key to a CDN.
+  **Solution:** Create a fresh header-free download request and validate every
+  redirect destination.
+
+## Additional Resources
+
+- [MuAPI API reference](https://muapi.ai/docs/api-reference) for authentication,
+  request lifecycle, and endpoint details.
+- [MuAPI AI video API](https://muapi.ai/ai-video-api) for current video
+  capabilities and model-oriented discovery.

package/bundled-skills/ot-ics/SKILL.md

@@ -0,0 +1,117 @@
+---
+name: ot-ics
+description: "Authorized OT/ICS security assessment: Purdue-model zoning review, PLC/SCADA exposure, industrial protocol discovery, and passive-first evaluation discipline."
+risk: offensive
+source: "https://github.com/zhaoxuya520/reverse-skill"
+source_repo: "zhaoxuya520/reverse-skill"
+source_type: community
+date_added: "2026-08-25"
+license: "MIT"
+license_source: "https://github.com/zhaoxuya520/reverse-skill/blob/main/LICENSE"
+---
+> **⚠️ AUTHORIZED USE ONLY**
+> This skill is for educational purposes or authorized security assessments only.
+> You must have explicit, written permission from the system owner before using this tool.
+> Misuse of this tool is illegal and strictly prohibited.
+
+> **Mandatory confirmation gate**
+> Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:
+> 1. Ask the user to state the exact target URL, IP, account, or resource.
+> 2. Ask the user to confirm written authorization and the permitted scope.
+> 3. Show the exact command(s) and explain their expected effect.
+> 4. Wait for explicit confirmation in the current conversation.
+>
+> Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.
+
+# OT / ICS Security
+## When to Use
+
+- Passive assessment of industrial networks within an approved scope.
+- Documenting PLC/SCADA exposure and zoning violations.
+
+
+## 适用场景
+
+- 工控/SCADA/DCS 安全评估（授权）
+- Purdue 模型分区与跨区通道
+- Modbus/DNP3/S7/EtherNet/IP 等协议暴露
+- 工程师站、HMI、历史库、跳板主机
+- IT/OT 融合边界（防火墙规则、单向闸）
+
+## 安全铁律（MUST）
+
+```text
+MUST NOT 在未明确允许时：
+- 对 PLC 写线圈/寄存器
+- 全网高速率扫描生产 OT
+- 中断安全仪表系统（SIS）相关路径
+优先：只读识别、流量镜像、离线固件/配置分析
+```
+
+## 工作流
+
+### Phase 1 — 分区与资产
+
+```text
+□ Purdue L0–L5 草图：现场设备 → 控制 → 监督 → 站点 DMZ → 企业
+□ 资产清单：PLC/RTU/HMI/工程师站/历史库/Jump host
+□ 协议与端口基线（仅授权网段）
+```
+
+### Phase 2 — 被动与只读
+
+```text
+□ SPAN/镜像 PCAP → protocol-reverse / Wireshark 工控解析器
+□ 配置与工程文件离线审计（TIA/RSLogix 导出等）
+□ 默认口令与明文协议（Modbus 无认证）记录为 Finding，不写盘改值
+```
+
+### Phase 3 — 受限主动（仅授权）
+
+```text
+□ 低速识别，维护窗口
+□ 只读功能码优先
+□ 每步 Evidence；异常立即停止并通报
+```
+
+### Phase 4 — 固件/补丁面
+
+```text
+□ 控制器固件版本 → CVE 映射（不盲刷固件）
+□ 联合 firmware-pentest 做离线镜像分析
+```
+
+## 工具链
+
+| 工具 | 用途 | 注意 |
+|------|------|------|
+| Wireshark 工控 dissectors | 被动解析 | 镜像流量 |
+| Nmap NSE（受限） | 识别 | 速率与时间窗 |
+| Claroty/Nozomi 等 | 资产发现 | 商业/现场 |
+| PLC 厂商工程软件 | 配置审计 | 离线优先 |
+| binwalk / Ghidra | 固件 | 离线 |
+
+## 参考
+
+- `references/ot-safe-assessment.md`
+- `../firmware-pentest/` `../protocol-reverse/` `../network` via pentest-tools
+
+## 路由上下文
+
+**上游**: MASTER R28  
+**下游**: 固件深挖 `firmware-pentest`；协议 `protocol-reverse`；IT 横向 `windows-ad`/`attack-chain`  
+**同级**: 不要用普通 Web 扫默认参数打 OT
+
+## 任务完成自检
+
+- [ ] 是否默认被动/只读并记录授权边界？
+- [ ] 是否避免对控制回路写操作（除非明确允许）？
+- [ ] Finding 是否含物理/过程影响说明？
+- [ ] Checklist / journal？
+
+## Limitations
+
+- Active scanning can crash PLCs; default to passive capture.
+- Specialized protocols need vendor documentation rarely available publicly.
+
+> Adapted from [zhaoxuya520/reverse-skill](https://github.com/zhaoxuya520/reverse-skill) (MIT).

package/bundled-skills/ot-ics/references/ot-safe-assessment.md

@@ -0,0 +1,10 @@
+# OT 安全评估安全清单
+
+1. 授权范围与紧急联系人  
+2. 是否允许主动探测 / 写操作（默认否）  
+3. 维护窗口与回滚方案  
+4. 流量镜像优先于端口扫  
+5. 发现高危立即停止扩大并通报  
+6. 报告区分：可远程利用 vs 需物理接触  
+
+常见协议端口（识别用，非利用手册）：Modbus/TCP 502、S7comm 102、EtherNet/IP 44818、DNP3 20000。