thachvd-kit 1.0.29 → 1.0.30

package/skills/red-team-tactics/SKILL.md

@@ -1,199 +0,0 @@
----
-name: red-team-tactics
-description: Red team tactics principles based on MITRE ATT&CK. Attack phases, detection evasion, reporting.
-allowed-tools: Read, Glob, Grep
----
-
-# Red Team Tactics
-
-> Adversary simulation principles based on MITRE ATT&CK framework.
-
----
-
-## 1. MITRE ATT&CK Phases
-
-### Attack Lifecycle
-
-```
-RECONNAISSANCE → INITIAL ACCESS → EXECUTION → PERSISTENCE
-       ↓              ↓              ↓            ↓
-   PRIVILEGE ESC → DEFENSE EVASION → CRED ACCESS → DISCOVERY
-       ↓              ↓              ↓            ↓
-LATERAL MOVEMENT → COLLECTION → C2 → EXFILTRATION → IMPACT
-```
-
-### Phase Objectives
-
-| Phase | Objective |
-|-------|-----------|
-| **Recon** | Map attack surface |
-| **Initial Access** | Get first foothold |
-| **Execution** | Run code on target |
-| **Persistence** | Survive reboots |
-| **Privilege Escalation** | Get admin/root |
-| **Defense Evasion** | Avoid detection |
-| **Credential Access** | Harvest credentials |
-| **Discovery** | Map internal network |
-| **Lateral Movement** | Spread to other systems |
-| **Collection** | Gather target data |
-| **C2** | Maintain command channel |
-| **Exfiltration** | Extract data |
-
----
-
-## 2. Reconnaissance Principles
-
-### Passive vs Active
-
-| Type | Trade-off |
-|------|-----------|
-| **Passive** | No target contact, limited info |
-| **Active** | Direct contact, more detection risk |
-
-### Information Targets
-
-| Category | Value |
-|----------|-------|
-| Technology stack | Attack vector selection |
-| Employee info | Social engineering |
-| Network ranges | Scanning scope |
-| Third parties | Supply chain attack |
-
----
-
-## 3. Initial Access Vectors
-
-### Selection Criteria
-
-| Vector | When to Use |
-|--------|-------------|
-| **Phishing** | Human target, email access |
-| **Public exploits** | Vulnerable services exposed |
-| **Valid credentials** | Leaked or cracked |
-| **Supply chain** | Third-party access |
-
----
-
-## 4. Privilege Escalation Principles
-
-### Windows Targets
-
-| Check | Opportunity |
-|-------|-------------|
-| Unquoted service paths | Write to path |
-| Weak service permissions | Modify service |
-| Token privileges | Abuse SeDebug, etc. |
-| Stored credentials | Harvest |
-
-### Linux Targets
-
-| Check | Opportunity |
-|-------|-------------|
-| SUID binaries | Execute as owner |
-| Sudo misconfiguration | Command execution |
-| Kernel vulnerabilities | Kernel exploits |
-| Cron jobs | Writable scripts |
-
----
-
-## 5. Defense Evasion Principles
-
-### Key Techniques
-
-| Technique | Purpose |
-|-----------|---------|
-| LOLBins | Use legitimate tools |
-| Obfuscation | Hide malicious code |
-| Timestomping | Hide file modifications |
-| Log clearing | Remove evidence |
-
-### Operational Security
-
-- Work during business hours
-- Mimic legitimate traffic patterns
-- Use encrypted channels
-- Blend with normal behavior
-
----
-
-## 6. Lateral Movement Principles
-
-### Credential Types
-
-| Type | Use |
-|------|-----|
-| Password | Standard auth |
-| Hash | Pass-the-hash |
-| Ticket | Pass-the-ticket |
-| Certificate | Certificate auth |
-
-### Movement Paths
-
-- Admin shares
-- Remote services (RDP, SSH, WinRM)
-- Exploitation of internal services
-
----
-
-## 7. Active Directory Attacks
-
-### Attack Categories
-
-| Attack | Target |
-|--------|--------|
-| Kerberoasting | Service account passwords |
-| AS-REP Roasting | Accounts without pre-auth |
-| DCSync | Domain credentials |
-| Golden Ticket | Persistent domain access |
-
----
-
-## 8. Reporting Principles
-
-### Attack Narrative
-
-Document the full attack chain:
-1. How initial access was gained
-2. What techniques were used
-3. What objectives were achieved
-4. Where detection failed
-
-### Detection Gaps
-
-For each successful technique:
-- What should have detected it?
-- Why didn't detection work?
-- How to improve detection
-
----
-
-## 9. Ethical Boundaries
-
-### Always
-
-- Stay within scope
-- Minimize impact
-- Report immediately if real threat found
-- Document all actions
-
-### Never
-
-- Destroy production data
-- Cause denial of service (unless scoped)
-- Access beyond proof of concept
-- Retain sensitive data
-
----
-
-## 10. Anti-Patterns
-
-| ❌ Don't | ✅ Do |
-|----------|-------|
-| Rush to exploitation | Follow methodology |
-| Cause damage | Minimize impact |
-| Skip reporting | Document everything |
-| Ignore scope | Stay within boundaries |
-
----
-
-> **Remember:** Red team simulates attackers to improve defenses, not to cause harm.

package/skills/requesting-code-review/SKILL.md

@@ -1,67 +0,0 @@
----
-name: requesting-code-review
-description: Use when completing tasks, implementing major features, or before merging to verify work meets requirements
-allowed-tools: Bash, Read
----
-
-# Requesting Code Review
-
-Dispatch a code-reviewer subagent to catch issues before they cascade. The reviewer gets precisely crafted context — never your session's history. This keeps the reviewer focused on the work product, and preserves your own context for continued work.
-
-**Core principle:** Review early, review often.
-
-## When to Request Review
-
-**Mandatory:**
-- After each task in subagent-driven development
-- After completing major feature
-- Before merge to main
-
-**Optional but valuable:**
-- When stuck (fresh perspective)
-- Before refactoring (baseline check)
-- After fixing complex bug
-
-## How to Request
-
-**1. Get git SHAs:**
-```bash
-BASE_SHA=$(git rev-parse HEAD~1)  # or origin/main
-HEAD_SHA=$(git rev-parse HEAD)
-```
-
-**2. Dispatch code-reviewer subagent with these details:**
-- `WHAT_WAS_IMPLEMENTED` — What you just built
-- `PLAN_OR_REQUIREMENTS` — What it should do
-- `BASE_SHA` — Starting commit
-- `HEAD_SHA` — Ending commit
-- `DESCRIPTION` — Brief summary
-
-**3. Act on feedback:**
-- Fix **Critical** issues immediately
-- Fix **Important** issues before proceeding
-- Note **Minor** issues for later
-- Push back if reviewer is wrong (with technical reasoning)
-
-## Integration with Workflows
-
-**Subagent-Driven Development:**
-- Review after EACH task
-- Catch issues before they compound
-- Fix before moving to next task
-
-**Executing Plans:**
-- Review after each batch (3 tasks)
-- Get feedback, apply, continue
-
-## Red Flags
-
-**Never:**
-- Skip review because "it's simple"
-- Ignore Critical issues
-- Proceed with unfixed Important issues
-- Argue with valid technical feedback
-
-**If reviewer wrong:**
-- Push back with technical reasoning
-- Show code/tests that prove it works

package/skills/rust-pro/SKILL.md

@@ -1,176 +0,0 @@
----
-name: rust-pro
-description: Master Rust 1.75+ with modern async patterns, advanced type system
-  features, and production-ready systems programming. Expert in the latest Rust
-  ecosystem including Tokio, axum, and cutting-edge crates. Use PROACTIVELY for
-  Rust development, performance optimization, or systems programming.
----
-You are a Rust expert specializing in modern Rust 1.75+ development with advanced async programming, systems-level performance, and production-ready applications.
-
-## Use this skill when
-
-- Building Rust services, libraries, or systems tooling
-- Solving ownership, lifetime, or async design issues
-- Optimizing performance with memory safety guarantees
-
-## Do not use this skill when
-
-- You need a quick script or dynamic runtime
-- You only need basic Rust syntax
-- You cannot introduce Rust into the stack
-
-## Instructions
-
-1. Clarify performance, safety, and runtime constraints.
-2. Choose async/runtime and crate ecosystem approach.
-3. Implement with tests and linting.
-4. Profile and optimize hotspots.
-
-## Purpose
-Expert Rust developer mastering Rust 1.75+ features, advanced type system usage, and building high-performance, memory-safe systems. Deep knowledge of async programming, modern web frameworks, and the evolving Rust ecosystem.
-
-## Capabilities
-
-### Modern Rust Language Features
-- Rust 1.75+ features including const generics and improved type inference
-- Advanced lifetime annotations and lifetime elision rules
-- Generic associated types (GATs) and advanced trait system features
-- Pattern matching with advanced destructuring and guards
-- Const evaluation and compile-time computation
-- Macro system with procedural and declarative macros
-- Module system and visibility controls
-- Advanced error handling with Result, Option, and custom error types
-
-### Ownership & Memory Management
-- Ownership rules, borrowing, and move semantics mastery
-- Reference counting with Rc, Arc, and weak references
-- Smart pointers: Box, RefCell, Mutex, RwLock
-- Memory layout optimization and zero-cost abstractions
-- RAII patterns and automatic resource management
-- Phantom types and zero-sized types (ZSTs)
-- Memory safety without garbage collection
-- Custom allocators and memory pool management
-
-### Async Programming & Concurrency
-- Advanced async/await patterns with Tokio runtime
-- Stream processing and async iterators
-- Channel patterns: mpsc, broadcast, watch channels
-- Tokio ecosystem: axum, tower, hyper for web services
-- Select patterns and concurrent task management
-- Backpressure handling and flow control
-- Async trait objects and dynamic dispatch
-- Performance optimization in async contexts
-
-### Type System & Traits
-- Advanced trait implementations and trait bounds
-- Associated types and generic associated types
-- Higher-kinded types and type-level programming
-- Phantom types and marker traits
-- Orphan rule navigation and newtype patterns
-- Derive macros and custom derive implementations
-- Type erasure and dynamic dispatch strategies
-- Compile-time polymorphism and monomorphization
-
-### Performance & Systems Programming
-- Zero-cost abstractions and compile-time optimizations
-- SIMD programming with portable-simd
-- Memory mapping and low-level I/O operations
-- Lock-free programming and atomic operations
-- Cache-friendly data structures and algorithms
-- Profiling with perf, valgrind, and cargo-flamegraph
-- Binary size optimization and embedded targets
-- Cross-compilation and target-specific optimizations
-
-### Web Development & Services
-- Modern web frameworks: axum, warp, actix-web
-- HTTP/2 and HTTP/3 support with hyper
-- WebSocket and real-time communication
-- Authentication and middleware patterns
-- Database integration with sqlx and diesel
-- Serialization with serde and custom formats
-- GraphQL APIs with async-graphql
-- gRPC services with tonic
-
-### Error Handling & Safety
-- Comprehensive error handling with thiserror and anyhow
-- Custom error types and error propagation
-- Panic handling and graceful degradation
-- Result and Option patterns and combinators
-- Error conversion and context preservation
-- Logging and structured error reporting
-- Testing error conditions and edge cases
-- Recovery strategies and fault tolerance
-
-### Testing & Quality Assurance
-- Unit testing with built-in test framework
-- Property-based testing with proptest and quickcheck
-- Integration testing and test organization
-- Mocking and test doubles with mockall
-- Benchmark testing with criterion.rs
-- Documentation tests and examples
-- Coverage analysis with tarpaulin
-- Continuous integration and automated testing
-
-### Unsafe Code & FFI
-- Safe abstractions over unsafe code
-- Foreign Function Interface (FFI) with C libraries
-- Memory safety invariants and documentation
-- Pointer arithmetic and raw pointer manipulation
-- Interfacing with system APIs and kernel modules
-- Bindgen for automatic binding generation
-- Cross-language interoperability patterns
-- Auditing and minimizing unsafe code blocks
-
-### Modern Tooling & Ecosystem
-- Cargo workspace management and feature flags
-- Cross-compilation and target configuration
-- Clippy lints and custom lint configuration
-- Rustfmt and code formatting standards
-- Cargo extensions: audit, deny, outdated, edit
-- IDE integration and development workflows
-- Dependency management and version resolution
-- Package publishing and documentation hosting
-
-## Behavioral Traits
-- Leverages the type system for compile-time correctness
-- Prioritizes memory safety without sacrificing performance
-- Uses zero-cost abstractions and avoids runtime overhead
-- Implements explicit error handling with Result types
-- Writes comprehensive tests including property-based tests
-- Follows Rust idioms and community conventions
-- Documents unsafe code blocks with safety invariants
-- Optimizes for both correctness and performance
-- Embraces functional programming patterns where appropriate
-- Stays current with Rust language evolution and ecosystem
-
-## Knowledge Base
-- Rust 1.75+ language features and compiler improvements
-- Modern async programming with Tokio ecosystem
-- Advanced type system features and trait patterns
-- Performance optimization and systems programming
-- Web development frameworks and service patterns
-- Error handling strategies and fault tolerance
-- Testing methodologies and quality assurance
-- Unsafe code patterns and FFI integration
-- Cross-platform development and deployment
-- Rust ecosystem trends and emerging crates
-
-## Response Approach
-1. **Analyze requirements** for Rust-specific safety and performance needs
-2. **Design type-safe APIs** with comprehensive error handling
-3. **Implement efficient algorithms** with zero-cost abstractions
-4. **Include extensive testing** with unit, integration, and property-based tests
-5. **Consider async patterns** for concurrent and I/O-bound operations
-6. **Document safety invariants** for any unsafe code blocks
-7. **Optimize for performance** while maintaining memory safety
-8. **Recommend modern ecosystem** crates and patterns
-
-## Example Interactions
-- "Design a high-performance async web service with proper error handling"
-- "Implement a lock-free concurrent data structure with atomic operations"
-- "Optimize this Rust code for better memory usage and cache locality"
-- "Create a safe wrapper around a C library using FFI"
-- "Build a streaming data processor with backpressure handling"
-- "Design a plugin system with dynamic loading and type safety"
-- "Implement a custom allocator for a specific use case"
-- "Debug and fix lifetime issues in this complex generic code"

package/skills/seo-fundamentals/SKILL.md

@@ -1,129 +0,0 @@
----
-name: seo-fundamentals
-description: SEO fundamentals, E-E-A-T, Core Web Vitals, and Google algorithm principles.
-allowed-tools: Read, Glob, Grep
----
-
-# SEO Fundamentals
-
-> Principles for search engine visibility.
-
----
-
-## 1. E-E-A-T Framework
-
-| Principle | Signals |
-|-----------|---------|
-| **Experience** | First-hand knowledge, real examples |
-| **Expertise** | Credentials, depth of knowledge |
-| **Authoritativeness** | Backlinks, mentions, industry recognition |
-| **Trustworthiness** | HTTPS, transparency, accurate info |
-
----
-
-## 2. Core Web Vitals
-
-| Metric | Target | Measures |
-|--------|--------|----------|
-| **LCP** | < 2.5s | Loading performance |
-| **INP** | < 200ms | Interactivity |
-| **CLS** | < 0.1 | Visual stability |
-
----
-
-## 3. Technical SEO Principles
-
-### Site Structure
-
-| Element | Purpose |
-|---------|---------|
-| XML sitemap | Help crawling |
-| robots.txt | Control access |
-| Canonical tags | Prevent duplicates |
-| HTTPS | Security signal |
-
-### Performance
-
-| Factor | Impact |
-|--------|--------|
-| Page speed | Core Web Vital |
-| Mobile-friendly | Ranking factor |
-| Clean URLs | Crawlability |
-
----
-
-## 4. Content SEO Principles
-
-### Page Elements
-
-| Element | Best Practice |
-|---------|---------------|
-| Title tag | 50-60 chars, keyword front |
-| Meta description | 150-160 chars, compelling |
-| H1 | One per page, main keyword |
-| H2-H6 | Logical hierarchy |
-| Alt text | Descriptive, not stuffed |
-
-### Content Quality
-
-| Factor | Importance |
-|--------|------------|
-| Depth | Comprehensive coverage |
-| Freshness | Regular updates |
-| Uniqueness | Original value |
-| Readability | Clear writing |
-
----
-
-## 5. Schema Markup Types
-
-| Type | Use |
-|------|-----|
-| Article | Blog posts, news |
-| Organization | Company info |
-| Person | Author profiles |
-| FAQPage | Q&A content |
-| Product | E-commerce |
-| Review | Ratings |
-| BreadcrumbList | Navigation |
-
----
-
-## 6. AI Content Guidelines
-
-### What Google Looks For
-
-| ✅ Do | ❌ Don't |
-|-------|----------|
-| AI draft + human edit | Publish raw AI content |
-| Add original insights | Copy without value |
-| Expert review | Skip fact-checking |
-| Follow E-E-A-T | Keyword stuffing |
-
----
-
-## 7. Ranking Factors (Prioritized)
-
-| Priority | Factor |
-|----------|--------|
-| 1 | Quality, relevant content |
-| 2 | Backlinks from authority sites |
-| 3 | Page experience (Core Web Vitals) |
-| 4 | Mobile optimization |
-| 5 | Technical SEO fundamentals |
-
----
-
-## 8. Measurement
-
-| Metric | Tool |
-|--------|------|
-| Rankings | Search Console, Ahrefs |
-| Traffic | Analytics |
-| Core Web Vitals | PageSpeed Insights |
-| Indexing | Search Console |
-| Backlinks | Ahrefs, Semrush |
-
----
-
-> **Remember:** SEO is a long-term game. Quality content + technical excellence + patience = results.