ur-agent 1.80.9 → 1.81.0

package/docs/AGENT_FEATURES.md

@@ -9,6 +9,27 @@ reproducible autonomous software engineering agent: every substantial task can
 be driven as `spec -> plan -> patch -> test -> report -> rollback`, with the
 spec as the durable source of truth and command evidence as the success gate.
 
+## v1.81.0 Addition
+
+- UR now provides an explicit `/mode redteam` for authorized researchers. A
+  versioned warning must be acknowledged, activation lasts only for the current
+  session, and UR's topic-level security restrictions are replaced dynamically
+  without changing provider/model policy.
+- Engagement scope, permissions, sandboxing, approvals, and evidence remain
+  active. Scope approval is session-bound, and recognized active security tools
+  are blocked at Bash/PowerShell permission entry when targets or parameters are
+  outside it.
+- The official `reverse-skills` plugin adds UR-native reverse engineering,
+  exploit development, malware/EDR, application, platform/radio, forensics,
+  LLM-security, and reporting workflows. Its `requiredMode: "redteam"` manifest
+  gate is enforced during discovery and invocation.
+
+## v1.80.10 Addition
+
+| Addition | Surface | What it adds |
+| --- | --- | --- |
+| Deterministic read-only agent registry | Public bundle, development runtime, `Agent` gate | Ships the protected `Explore` and `Plan` definitions in every public runtime so task-free research always has a real read-only destination. Tests now exercise the real registry and verify the release feature flag. |
+
 ## v1.80.9 Addition
 
 | Addition | Surface | What it adds |

package/docs/CONFIGURATION.md

@@ -58,7 +58,8 @@ it to `0` to require a task before every mutation. Set `enabled` to `false` to
 return to advisory task tracking. Profiles that omit `TaskCreate` are not
 gated, because they could not satisfy the requirement. The main session may
 launch UR's shipped `Explore` and `Plan` agents before a task exists in any
-permission mode. These exact built-in definitions are forced read-only; custom,
+permission mode. These core definitions are always registered in public builds
+and are forced read-only; custom,
 write-capable, nested, named/team, and worktree delegation still requires an
 actionable parent task. As provider-independent compatibility, an unnamed
 main-session `general-purpose` call is reduced to the shipped Explore definition

package/docs/REDTEAM.md

@@ -0,0 +1,64 @@
+# Redteam mode
+
+`redteam` is UR's explicit, session-scoped mode for authorized security researchers. It changes UR's own prompt policy so UR does not refuse a topic solely because it involves exploit development, malware modification, payloads, persistence, credential testing, phishing simulation, detection evasion, or other dual-use research.
+
+It does not change the policy of the selected model or provider. Local models, API providers, and subscription CLI bridges keep their own behavior. UR reports provider refusals as provider behavior rather than claiming that redteam mode overrides them.
+
+## Activate
+
+The first activation displays a mandatory risk warning and does not enable the mode:
+
+```text
+/mode redteam
+```
+
+After reading it, acknowledge the current warning version:
+
+```text
+/mode redteam --accept-risk
+```
+
+The acknowledgement is stored in user settings, but activation is never persisted. Every new session starts in its normal mode. Later sessions can activate with `/mode redteam`; `/mode redteam off` or selecting another working mode disables it.
+
+## What remains enforced
+
+Redteam removes UR topic-level restrictions, not operational controls:
+
+- normal tool permissions and explicit deny rules;
+- OS sandbox and workspace boundaries;
+- current-session engagement scope and target/port/tool/intensity limits;
+- action-specific approval prompts;
+- secrets handling, evidence, and audit records.
+
+Before active target testing:
+
+```text
+/scope set local
+/scope allow-tool nmap
+/scope allow-port 443
+/scope rate 10
+/scope approve
+/scope show
+```
+
+For a non-local engagement, use `/scope set <target-type> <target>`, add any additional hosts and allowed ports, then approve it in the current session. Scope approval expires when the session changes. Bash and PowerShell block recognized active security tools outside that scope even in permissive permission modes. Offline artifact analysis and local research code authoring do not require a remote target scope.
+
+Owned IPv4 networks can be scoped with CIDR (for example,
+`/scope set owned-network 10.20.30.0/24`). Active commands must expose an
+explicit host, URL, or IP/CIDR so UR can verify it; unresolved shell variables
+and indirect target files fail closed. Wildcard subdomains require an explicit
+`*.example.com` scope entry.
+
+Scope, findings, evidence, and security memory are stored under the gitignored `.ur/security/`. Existing `.309/security/` records are read and migrated when encountered.
+
+## Reverse Skills
+
+The bundled `reverse-skills` plugin is UR-exclusive and declares `requiredMode: "redteam"`. Its skills are hidden/disabled outside redteam and recheck the mode on invocation. The plugin adapts the MIT-licensed `zhaoxuya520/reverse-skill` methodology into UR-native workflows without installing cross-client configuration or bundling separately licensed components.
+
+Install/enable it from the official marketplace if it is not already enabled, activate redteam, then start with:
+
+```text
+/reverse-skills:start <research task>
+```
+
+Review [the plugin README](../plugins/core/reverse-skills/README.md) for its capability map and provenance.

package/docs/TROUBLESHOOTING.md

@@ -113,6 +113,10 @@ ur provider status
   shape without relying on a specific model name. Prompts that also direct
   implementation, testing, command execution, or file changes remain blocked
   until an actionable task exists.
+- If the same failure persists on 1.80.9, upgrade to 1.80.10. The 1.80.9 public
+  bundle could still compile the protected `Explore` and `Plan` registry entries
+  out, leaving the correct routing decision with no read-only destination.
+  Version 1.80.10 makes both core agents deterministic in public builds.
 
 ### Ollama stops with `unavailable tool "WebSearch"`
 

package/docs/USAGE.md

@@ -38,11 +38,18 @@ Useful commands from inside UR:
 /session unarchive <session-id>
 /fix-bug describe the failure and reproduction steps
 /research init current-tools --question "What changed?"
+/mode redteam
 /design3d doctor
 /design3d init product-shot --engine blender --units mm --format blend
 /design3d init studio-scene --engine 3dsmax --units cm --format max
 ```
 
+`/mode redteam` is a session-only security-research policy mode. Its first use
+shows a mandatory warning and requires `/mode redteam --accept-risk`. It removes
+UR's topic-level security restrictions while retaining target scope, tool
+permissions, sandboxing, action approvals, and audit evidence. It cannot change
+the selected provider/model's own policy. See [Redteam mode](REDTEAM.md).
+
 `/design3d doctor` reports installed applications. `MISSING` means that optional
 application is not installed or is not on `PATH`; it is not a UR failure. On
 macOS, Autodesk 3ds Max is expected to be missing because it is a Windows

package/docs/VALIDATION.md

@@ -19,10 +19,35 @@ You need:
 
 ```sh
 ur --version
-# expected for this release: "1.80.9 (UR-Nexus)"
+# expected for this release: "1.81.0 (UR-Nexus)"
 ```
 
-### 0.0 Read-only research delegation starts cleanly (1.80.9)
+### 0.0 Redteam mode and Reverse Skills (1.81.0)
+
+```sh
+bun test test/redteamMode.test.ts test/marketplaceTree.test.ts test/settingsDocCoverage.test.ts
+node ./bin/ur.js plugin validate plugins/core/reverse-skills
+```
+
+The tests verify session-dynamic UR policy, the mandatory warning contract,
+topic classification only changing in redteam, current-session scope approval,
+active-tool target enforcement, `.ur/security/` persistence, marketplace
+integrity, settings documentation, and the plugin's `requiredMode` manifest.
+
+Manual interactive check:
+
+```text
+/mode redteam
+/mode redteam --accept-risk
+/mode
+/mode redteam off
+```
+
+The first command must warn without activating; acknowledgement activates only
+the current session; status must show `redteam (session only)`; leaving the mode
+must restore the default UR policy.
+
+### 0.1 Read-only research delegation starts cleanly (1.80.10)
 
 Start an interactive session with task enforcement enabled and ask UR to
 research a change, both normally and from Plan Mode. Before any task exists,
@@ -31,6 +56,11 @@ built-in `Explore` and `Plan` agent calls should initialize without
 Accept Edits or Approve All. Custom agents and ordinary general-purpose agents
 should remain blocked until they have an actionable parent task.
 
+The installed public bundle must list both core definitions in its active
+built-in registry; a correct research classifier without those definitions is
+not a passing state. Development and release builds must both enable
+`BUILTIN_EXPLORE_PLAN_AGENTS`.
+
 Repeat with multiple available model families. A model may correctly emit
 `subagent_type: "Explore"`; if it instead emits `general-purpose` with an
 explicit read-only brief or a pure research/report-only brief, UR must safely

package/docs/plugins.md

@@ -74,6 +74,12 @@ rather than a JS entry point.
 | `lspServers` | object | LSP servers for language adapters. |
 | `languageAdapters` | object | Language → engine/LSP metadata. |
 | `dependencies` | object | Other plugins that must be enabled. |
+| `requiredMode` | `"redteam"` | Runtime-gate every command/skill in the plugin to an active UR mode. |
+
+`requiredMode` is enforced both during command discovery and again at
+invocation, so a command loaded earlier cannot run after the user leaves the
+mode. It is a capability gate, not a permission grant: all ordinary tool,
+sandbox, scope, and approval checks still run.
 
 Validate a manifest strictly at any time:
 
@@ -153,6 +159,9 @@ installs are always explicit user actions gated by plugin policy. `ur plugin
 doctor` surfaces the capability surface so you can review what a plugin touches
 before enabling it.
 
+The first-party `reverse-skills` plugin demonstrates a mode-gated skill pack.
+It is available only in `/mode redteam`; see [Redteam mode](REDTEAM.md).
+
 ## Troubleshooting
 
 - **Plugin not loaded:** run `ur plugin list` to confirm it is installed and

package/documentation/app.js

@@ -74,8 +74,8 @@ const featureGroups = [
   {
     title: 'Security and operations',
     tags: ['sandbox', 'scope', 'diagnostics', 'policy'],
-    text: 'Permission modes, project safety policy, allow/deny tool lists, optional OS sandboxing, diagnostic commands, security scope, threat modeling, hardening, and vulnerability checks.',
-    commands: ['ur safety', 'ur doctor', '/sandbox', '/scope', '/security', '/vuln'],
+    text: 'Permission modes, project safety policy, allow/deny tool lists, optional OS sandboxing, diagnostic commands, security scope, and a warning-gated, session-only redteam research policy that leaves provider/model policy independent.',
+    commands: ['ur safety', 'ur doctor', '/sandbox', '/mode redteam', '/scope', '/security', '/vuln'],
   },
 ];
 
@@ -552,8 +552,8 @@ const slashGroups = [
   },
   {
     title: 'Security operations',
-    items: ['/safety', '/security', '/scope', '/threat-model', '/compliance', '/lab', '/playbook', '/kali', '/harden', '/vuln', '/ir'],
-    text: 'Read-only security workflows, test scope definition, threat modeling, hardening, vulnerability checks, and incident response.',
+    items: ['/safety', '/mode redteam', '/security', '/scope', '/threat-model', '/compliance', '/lab', '/playbook', '/kali', '/harden', '/vuln', '/ir'],
+    text: 'Read-only security workflows plus a warning-gated, session-only redteam research policy. Redteam keeps scope, permissions, sandboxing, approvals, evidence, and provider/model policy independent.',
   },
   {
     title: 'Media and research',

package/documentation/index.html

@@ -45,7 +45,7 @@
     <main id="content" class="content">
       <header class="topbar">
         <div>
-          <p class="eyebrow">Version 1.80.9</p>
+          <p class="eyebrow">Version 1.81.0</p>
           <h1>UR-Nexus Documentation</h1>
           <p class="lead">A practical, tutorial-style reference for installing, configuring, automating, extending, and operating UR-Nexus.</p>
         </div>

package/extensions/jetbrains-ur/build.gradle.kts

@@ -7,7 +7,7 @@ plugins {
 }
 
 group = "dev.urnexus"
-version = "1.80.9"
+version = "1.81.0"
 
 repositories {
     mavenCentral()

package/extensions/vscode-ur-inline-diffs/package.json

@@ -2,7 +2,7 @@
   "name": "ur-inline-diffs",
   "displayName": "UR Inline Diffs",
   "description": "Review, apply, and reject UR inline diff bundles from .ur/ide/diffs inside VS Code.",
-  "version": "1.80.9",
+  "version": "1.81.0",
   "publisher": "ur-nexus",
   "engines": {
     "vscode": "^1.92.0"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ur-agent",
-  "version": "1.80.9",
+  "version": "1.81.0",
   "description": "UR-Nexus — autonomous engineering workflow engine (plan, execute, test, verify, document, benchmark, reproduce)",
   "type": "module",
   "packageManager": "bun@1.3.14",

package/plugins/bunBundleDev.ts

@@ -15,6 +15,9 @@ import { plugin } from 'bun'
 
 const enabledFlags = new Set([
   'TREE_SITTER_BASH',
+  // Explore/Plan are a supported public capability and the safe target for
+  // task-free read-only delegation. Keep development aligned with bundles.
+  'BUILTIN_EXPLORE_PLAN_AGENTS',
   ...(process.env.FEATURE_FLAGS ?? '').split(',').filter(Boolean),
 ])
 

package/plugins/core/reverse-skills/.ur-plugin/plugin.json

@@ -0,0 +1,15 @@
+{
+  "name": "reverse-skills",
+  "version": "1.0.0",
+  "description": "UR-native reverse engineering and red-team research workflows, available exclusively in UR redteam mode.",
+  "author": {
+    "name": "UR maintainers",
+    "url": "https://github.com/Maitham16/UR"
+  },
+  "homepage": "https://github.com/Maitham16/UR/tree/master/plugins/core/reverse-skills",
+  "repository": "https://github.com/Maitham16/UR",
+  "license": "MIT",
+  "keywords": ["redteam", "reverse-engineering", "malware", "exploit-development", "security-research"],
+  "requiredMode": "redteam",
+  "skills": "./skills"
+}

package/plugins/core/reverse-skills/CAPABILITIES.md

@@ -0,0 +1,17 @@
+# Capability routing map
+
+This map preserves the upstream capability surface in a smaller UR-native set of composable skills.
+
+| UR skill | Adapted upstream areas |
+|---|---|
+| `reverse-skill-router` | master routing, attack-chain routing, case intake |
+| `binary-reverse` | reverse-engineering, IDA, Ghidra, radare2, binary diff, .NET, Go/Rust, macOS, JS, browser extensions, DSL/VM, protocol reverse |
+| `exploit-development` | pwn-chain, patch-diff exploit, attack-chain, pentest tools |
+| `application-redteam` | API, code audit, database, identity federation, email, supply chain, cloud/K8s, thick client, browser automation |
+| `malware-edr-research` | malware analysis, anti-analysis, EDR/AV reverse engineering and validation |
+| `platform-radio-security` | APK/mobile, firmware, hardware, OT/ICS, Wi-Fi, SDR/radio |
+| `forensics-threat-hunting` | digital forensics, threat hunting, incident evidence, detection engineering |
+| `llm-agent-security` | LLM/agent security, prompt injection, tool abuse, memory and supply-chain tests |
+| `research-evidence` | case review, documentation, diagrams, evidence-to-finding traceability |
+
+The upstream CTF Sandbox Orchestrator is not included because it is separately GPL-licensed. Pentest Swarm and other external services are not bundled or automatically invoked.

package/plugins/core/reverse-skills/NOTICE

@@ -0,0 +1,12 @@
+Reverse Skills for UR contains an adaptation of methods and documentation from:
+
+  reverse-skill
+  https://github.com/zhaoxuya520/reverse-skill
+  upstream commit 289c24b1617411a16b1e8d3032cce0f2fe52911d
+  Copyright (c) 2026 zhaoxuya520
+  Licensed under the MIT License.
+
+The UR adaptation reorganizes the material into UR-native skills, replaces
+cross-client bootstrap behavior with UR scope and permission controls, and
+excludes separately licensed components. No endorsement by the upstream author
+is implied.

package/plugins/core/reverse-skills/README.md

@@ -0,0 +1,17 @@
+# Reverse Skills for UR
+
+This first-party plugin adapts the methodology of `zhaoxuya520/reverse-skill` into UR-native research skills. It is intentionally unavailable until the user activates `/mode redteam` and acknowledges UR's risk warning.
+
+The integration is UR-only:
+
+- manifests, paths, commands, scope records, and instructions use UR conventions;
+- it never installs itself into Claude, Codex, Cursor, Cline, or another client;
+- it does not auto-download tools or write third-party client configuration;
+- active tooling remains gated by the current session's `/scope` approval, normal tool permissions, sandboxing, and audit controls;
+- the selected model/provider may still enforce its own policy.
+
+Start with `/reverse-skills:start <task>` (or invoke the `reverse-skills:reverse-skill-router` skill directly). The router selects one or more specialist skills covering binary reverse engineering, exploitation, application testing, malware/EDR research, platform and radio security, forensics, LLM security, and evidence/reporting.
+
+## Provenance
+
+The adaptation is based on upstream commit `289c24b1617411a16b1e8d3032cce0f2fe52911d` (MIT). UR excludes the upstream GPL CTF orchestrator, external AGPL services, client-specific bootstrap scripts, field journals, and machine-specific configuration. See `NOTICE` and `UPSTREAM-LICENSE`.

package/plugins/core/reverse-skills/UPSTREAM-LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 zhaoxuya520
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/plugins/core/reverse-skills/UR-INTEGRATION.md

@@ -0,0 +1,27 @@
+# UR redteam execution contract
+
+These rules apply to every skill in this plugin.
+
+1. Confirm UR redteam mode is active. Plugin gating normally guarantees this; never suggest bypassing the gate.
+2. Separate offline research from target operations. Reading, decompiling, documenting, and authoring local research artifacts may proceed under normal file/tool permissions.
+3. Before network access, sample execution, exploitation, credential testing, radio transmission, device mutation, or any other target operation, inspect `/scope show`. Require a scope approved in the current UR session. Mode activation and warning acceptance are not target authorization.
+4. Use only the hosts, ports, tools, and intensity recorded in scope. Stop when a discovered pivot or target is outside it; ask the user to update and reapprove scope.
+5. Continue to honor UR permission prompts, sandboxing, secrets handling, and action-specific confirmations. Never weaken these controls or silently elevate privileges.
+6. Prefer reproducible case directories, hashes, timestamps, commands, raw evidence, and findings that distinguish observation from inference.
+7. Do not auto-install tools or alter another AI client's configuration. If a dependency is absent, report it and propose an UR-native installation or MCP setup for explicit approval.
+8. The selected model/provider is independent. If it declines a request, state that accurately; do not imply UR redteam mode can override provider policy.
+
+Recommended case layout:
+
+```text
+case/
+  scope.md
+  timeline.md
+  evidence/
+  artifacts/
+  notes/
+  findings.md
+  report.md
+```
+
+Preserve originals. Work on hashed copies for mutation, patching, dynamic execution, or fuzzing.

package/plugins/core/reverse-skills/commands/start.md

@@ -0,0 +1,11 @@
+---
+description: "Route an authorized security-research task into the UR-exclusive Reverse Skills capability pack."
+argument-hint: "<research task>"
+allowed-tools:
+  - "Skill"
+---
+
+Invoke the `reverse-skills:reverse-skill-router` skill with the user's arguments.
+Follow its UR redteam execution contract, select the smallest applicable set of
+specialist skills, and begin with local/passive triage. Do not interpret redteam
+mode activation as target authorization.

package/plugins/core/reverse-skills/skills/application-redteam/SKILL.md

@@ -0,0 +1,23 @@
+---
+name: application-redteam
+description: Conduct authorized application and infrastructure research across APIs, source code, web, cloud/Kubernetes, databases, identity federation, email, supply chain, browser automation, and thick clients.
+allowed-tools: Read Grep Glob Bash Edit Write WebFetch WebSearch
+---
+
+# Application red-team research
+
+Read `${UR_PLUGIN_ROOT}/UR-INTEGRATION.md`. Treat schemas, source, exported traffic, and local configurations as preferred starting evidence.
+
+## Workflow
+
+1. Inventory assets, trust boundaries, roles, identities, data classes, protocols, deployment components, third parties, and explicit exclusions.
+2. Map reachable surface from OpenAPI/GraphQL schemas, routes, client bundles, IPC, update channels, cloud manifests, IAM/RBAC, CI workflows, SBOMs, and database configuration.
+3. Build an authorization matrix: actor × object × action × tenant. Test authentication, session/token lifecycle, object/function/property authorization, workflow transitions, and confused-deputy paths.
+4. Validate input and parser boundaries: injection, request smuggling, deserialization, upload/archive handling, SSRF, template engines, path handling, GraphQL batching, WebSocket state, and protocol downgrade.
+5. Examine identity federation precisely: issuer, audience, redirect URI, state/nonce/PKCE, signature/key selection, claim mapping, token exchange, logout, and cross-tenant binding.
+6. Review supply-chain and cloud controls: provenance, pinned actions/images, secret exposure, artifact signing, dependency reachability, IAM least privilege, metadata service, workload identity, RBAC, network policies, and admission controls.
+7. For databases and email, prefer configuration and controlled test accounts. Cover exposure, TLS, authz, dangerous defaults, backup access, SPF/DKIM/DMARC, mailbox rules, and BEC-relevant workflows.
+8. Confirm each finding with the least invasive request that proves the boundary. Respect scoped rate limits; never treat enumeration hits as verified vulnerabilities.
+9. Record raw request/response pairs with secrets redacted, affected asset/role, preconditions, impact, CWE/OWASP mapping, remediation, and a regression test.
+
+Browser automation and active scanners are target operations. Check `/scope show` before use and keep origins, accounts, ports, and rates inside the approved engagement.

package/plugins/core/reverse-skills/skills/binary-reverse/SKILL.md

@@ -0,0 +1,22 @@
+---
+name: binary-reverse
+description: Reverse compiled, managed, packed, obfuscated, browser, bytecode, VM, or protocol artifacts using static and dynamic analysis. Covers IDA, Ghidra, radare2, .NET, Go/Rust, macOS, JavaScript, browser extensions, binary diffing, and protocol reconstruction.
+allowed-tools: Read Grep Glob Bash Edit Write
+---
+
+# Binary reverse engineering
+
+Read `${UR_PLUGIN_ROOT}/UR-INTEGRATION.md`. Preserve the original artifact and hash every working copy.
+
+## Workflow
+
+1. Triage format, architecture, endianness, linkage, signatures, protections, packer/compiler/runtime clues, imports/exports, sections, strings, and embedded resources.
+2. Choose the narrowest backend: Ghidra/IDA for decompilation and xrefs, radare2 for CLI triage/patches, dnSpy/IL tools for .NET, JADX/apktool for APK, browser devtools for JS/extensions, and Wireshark/custom parsers for protocols. Verify availability instead of guessing paths.
+3. Build a symbol map from entrypoints, exports, handlers, constants, string xrefs, call graphs, serialization boundaries, syscalls, crypto use, and state transitions.
+4. Form explicit hypotheses. Record evidence that would confirm or falsify each one.
+5. Use dynamic work only when static evidence cannot settle the question: debugger breakpoints, API hooks, emulation, tracing, symbolic execution, or controlled replay. Execute unknown artifacts only in an approved isolated scope.
+6. For version diffing, normalize symbols and match functions by control flow, constants, strings, and callers before interpreting security impact.
+7. For custom VMs or protocols, recover framing/opcode tables, operand widths, state, errors, checksums, and test vectors; build a minimal parser/emulator with round-trip tests.
+8. Synthesize a map of components, data flow, security-relevant behavior, unresolved questions, and reproducible commands.
+
+Never patch the only copy. Keep offset/address notation explicit about image base, file offset, RVA/VA, architecture, and version.

package/plugins/core/reverse-skills/skills/exploit-development/SKILL.md

@@ -0,0 +1,22 @@
+---
+name: exploit-development
+description: Turn a known vulnerability into a reproducible PoC or reliable authorized exploit, including stack/heap/kernel pwn, patch-diff analysis, exploit chains, fuzzing, and remote-environment stabilization.
+allowed-tools: Read Grep Glob Bash Edit Write
+---
+
+# Exploit development
+
+Read `${UR_PLUGIN_ROOT}/UR-INTEGRATION.md`. Active execution requires a currently approved scope; local code authoring and artifact analysis do not.
+
+## Workflow
+
+1. State the vulnerability primitive and evidence: corruption/control, read/write capability, authentication boundary, reachable input, affected versions, and reliability constraints.
+2. Reproduce with the smallest deterministic trigger. Capture build/version, mitigations, crash state, registers, stack/heap evidence, and sanitizer/debugger output.
+3. Select a strategy from the actual mitigations and environment: controlled crash, info leak, ROP/JOP, ret2libc, heap primitive, race stabilization, sandbox escape boundary, or kernel primitive.
+4. Separate stages: trigger → primitive → control → payload/effect → cleanup. Test each stage independently.
+5. Parameterize target-specific values. Detect versions and fail closed on mismatch; do not silently spray or broaden targets.
+6. For patch diffing, compare vulnerable/fixed paths, identify the invariant introduced by the patch, create a non-destructive regression PoC, then assess exploitability.
+7. Stabilize for the approved environment: transport buffering, timeouts, ASLR leaks, libc/build IDs, stack alignment, heap grooming, retries with bounded rates, and observable failure modes.
+8. Deliver source, exact invocation, expected output, limitations, impact, detection ideas, and remediation/regression tests.
+
+Use destructive effects only when explicitly requested, within an owned/lab scope, and after the specific tool action is approved. Prefer proof markers over persistent shells when either demonstrates impact.

package/plugins/core/reverse-skills/skills/forensics-threat-hunting/SKILL.md

@@ -0,0 +1,22 @@
+---
+name: forensics-threat-hunting
+description: Perform disk, memory, packet, and log forensics; build timelines and IOCs; create YARA/Sigma detections; and conduct evidence-driven threat hunts.
+allowed-tools: Read Grep Glob Bash Edit Write
+---
+
+# Forensics and threat hunting
+
+Read `${UR_PLUGIN_ROOT}/UR-INTEGRATION.md`. Preserve chain of custody and distinguish collection facts, parsed observations, hypotheses, and conclusions.
+
+## Workflow
+
+1. Define questions, relevant time range/timezone, assets, evidence owners, collection authority, retention constraints, and known contamination.
+2. Acquire or reference immutable images/exports. Record tool/version, source identifier, timestamps, cryptographic hashes, and transfer history.
+3. Normalize time and identity. Build a cross-source timeline from filesystem, process, authentication, endpoint, cloud, DNS/proxy, network, registry/config, persistence, and application evidence.
+4. Memory: enumerate processes, handles, modules, sockets, injected/executable regions, callbacks, credentials exposure, kernel anomalies, and relevant process artifacts without altering the source image.
+5. Network: reconstruct flows/sessions, protocol metadata, DNS/TLS, transferred objects, beacon patterns, authentication, and lateral movement; retain packet references for every claim.
+6. Hunt from falsifiable hypotheses mapped to behaviors and ATT&CK, not single brittle IOCs. State data prerequisites, query window, exclusions, expected false positives, and coverage gaps.
+7. Convert stable observations to YARA/Sigma/EDR queries with fixtures and negative tests. Separate high-confidence indicators from contextual leads.
+8. Produce an incident timeline, affected assets/accounts, confidence, impact, containment options, eradication/recovery considerations, and unresolved collection needs.
+
+Do not delete, quarantine, reset accounts, or alter production telemetry without the relevant operational approval.

package/plugins/core/reverse-skills/skills/llm-agent-security/SKILL.md

@@ -0,0 +1,22 @@
+---
+name: llm-agent-security
+description: Test LLM and agent systems for prompt injection, tool abuse, memory poisoning, data leakage, unsafe autonomy, identity failures, and model or skill supply-chain risks.
+allowed-tools: Read Grep Glob Bash Edit Write WebFetch WebSearch
+---
+
+# LLM and agent security
+
+Read `${UR_PLUGIN_ROOT}/UR-INTEGRATION.md`. Define which agent, environment, accounts, tools, data, and external targets are authorized before active testing.
+
+## Workflow
+
+1. Model the system: instruction hierarchy, models/providers, retrieval, memory, tools/MCP servers, identities, secrets, sandboxes, approval paths, subagents, channels, plugins/skills, and data egress.
+2. Define assets and invariants: instruction integrity, confidentiality boundaries, tool authorization, target scope, tenant separation, provenance, auditability, and recoverability.
+3. Build a test matrix for direct/indirect prompt injection, encoded/multimodal input, retrieval poisoning, tool-output injection, confused deputy, excessive agency, argument injection, approval bypass, memory persistence, cross-session leakage, and denial/cost exhaustion.
+4. Use synthetic secrets and canary assets. Never use real credentials when a test token proves the path.
+5. Evaluate at the action boundary: what instructions reached the model, what tool arguments were proposed, which policy/permission gate decided, what actually executed, and what audit evidence remained.
+6. Test plugin/model/data supply chains: provenance, signatures/hashes, pinned versions, transitive tools, install scripts, configuration writes, remote content, and update behavior.
+7. Measure repeatability across phrasing, placement, roles, models, and sessions. Record both successful and blocked attempts so control efficacy is visible.
+8. Remediate with least-privilege tools, typed schemas, target constraints, provenance labels, untrusted-content isolation, confirmation at consequential actions, scoped credentials, memory boundaries, and regression evals.
+
+Do not treat disclosure of a system prompt alone as equivalent to tool compromise. Report the concrete violated invariant and demonstrated impact.

package/plugins/core/reverse-skills/skills/malware-edr-research/SKILL.md

@@ -0,0 +1,28 @@
+---
+name: malware-edr-research
+description: Analyze, modify, build, and test malware-like samples, implants, anti-analysis behavior, and EDR/AV telemetry or evasion in authorized research environments.
+allowed-tools: Read Grep Glob Bash Edit Write
+---
+
+# Malware and EDR research
+
+Read `${UR_PLUGIN_ROOT}/UR-INTEGRATION.md`. UR redteam mode permits complete technical work in this domain; execution and target controls still apply.
+
+## Sample workflow
+
+1. Preserve and hash the sample. Record provenance, acquisition time, file type, architecture, signatures, packer/compiler clues, and analysis environment.
+2. Perform static triage: headers, sections, imports/exports, resources, strings/deobfuscation, config, embedded payloads, crypto, persistence, C2/protocol, privilege and anti-analysis behavior.
+3. Build behavioral hypotheses and an observation plan before execution.
+4. In an approved isolated lab, collect process tree, filesystem/registry/config changes, services/tasks, network/DNS/TLS, IPC, injected regions, API/syscall traces, and memory artifacts. Snapshot and bound egress.
+5. Correlate static and dynamic evidence. Extract IOCs with confidence and expiration/context, then produce YARA/Sigma/EDR detections with positive and negative tests.
+
+## EDR/AV research workflow
+
+1. Define the product/version and telemetry boundary: user-mode hooks, kernel callbacks, ETW providers, AMSI, script engines, memory scanning, call-stack analytics, and cloud correlation.
+2. Establish a benign observable baseline, then isolate one detection dimension per experiment.
+3. Reverse the relevant component or capture telemetry to identify the real invariant; do not infer a bypass from process exit alone.
+4. Implement the smallest research harness for unhooking, syscall path changes, memory layout, AMSI/ETW behavior, stack provenance, or execution chain under study.
+5. Validate both effect and telemetry: expected action occurred, product state remained healthy, event visibility changed as predicted, and controls recovered after the test.
+6. Document prerequisites, affected versions, detection gaps, countermeasures, and reproducible lab steps.
+
+Never execute an unknown sample on the host by default. Never allow uncontrolled egress, persistence outside the case lab, propagation, or target expansion. Work on copies and make teardown explicit.

package/plugins/core/reverse-skills/skills/platform-radio-security/SKILL.md

@@ -0,0 +1,22 @@
+---
+name: platform-radio-security
+description: Research mobile apps, firmware, embedded hardware, OT/ICS systems, Wi-Fi, wireless, and SDR/radio targets in owned or explicitly authorized labs.
+allowed-tools: Read Grep Glob Bash Edit Write
+---
+
+# Platform, device, and radio security
+
+Read `${UR_PLUGIN_ROOT}/UR-INTEGRATION.md`. Device mutation, packet injection, RF transmission, wireless association, and active OT traffic require explicit current-session scope.
+
+## Workflow
+
+1. Inventory device/app/version, physical interfaces, radios, boot chain, update path, storage, debug ports, network protocols, mobile protections, and safety/availability constraints.
+2. Acquire read-only artifacts first: app package, firmware image, flash dump, UART logs, update bundle, traffic capture, board photos, symbols, configuration, and bill of materials. Hash and preserve originals.
+3. Mobile: map components, permissions/entitlements, exported surfaces, IPC/deep links, WebViews, local secrets, TLS/pinning, root/jailbreak checks, native libraries, and backend trust boundaries. Use controlled Frida/Objection hooks only in the approved lab.
+4. Firmware/hardware: unpack filesystems, identify architecture and bootloader, map services and credentials, review signing/rollback, emulate when possible, and use UART/JTAG/SWD in read-only mode before any write.
+5. OT/ICS: model Purdue zones and process consequences. Prefer passive captures and configuration review. Use protocol-aware simulation/digital twins; do not scan or fuzz production controllers.
+6. Wi-Fi: record owned SSIDs/BSSIDs/channels and test stations. Bound deauthentication, handshake/PMKID capture, rogue AP, and credential validation to the lab and approved rates.
+7. SDR/radio: identify jurisdiction, frequency, power, bandwidth, duty cycle, shielding/dummy-load needs, and receive-only alternatives. Default to receive-only; require explicit approval for transmission or replay.
+8. Validate findings with a reversible proof, record physical/safety preconditions, and provide remediation plus recovery steps.
+
+Stop immediately on unexpected process impact, uncontrolled RF propagation, unsafe actuator state, or evidence that the observed asset is outside scope.

package/plugins/core/reverse-skills/skills/research-evidence/SKILL.md

@@ -0,0 +1,33 @@
+---
+name: research-evidence
+description: Establish scope, review case integrity, preserve evidence-to-finding traceability, generate security diagrams, and produce reproducible technical reports.
+allowed-tools: Read Grep Glob Bash Edit Write
+---
+
+# Research evidence and reporting
+
+Read `${UR_PLUGIN_ROOT}/UR-INTEGRATION.md`.
+
+## Case review
+
+Verify that:
+
+- every active action is covered by a current-session approved UR scope;
+- target, time, account, port, tool, intensity, and exclusions are consistent across scope, timeline, commands, and evidence;
+- originals and derived artifacts have hashes and provenance;
+- every finding links to raw evidence and a reproducible validation path;
+- observations, inferences, confidence, and unresolved questions are labeled;
+- secrets and personal data are minimized/redacted without destroying evidentiary value;
+- cleanup/recovery actions and residual changes are recorded.
+
+## Finding format
+
+For each finding include identifier, title, affected asset/version, severity and rationale, confidence, prerequisites, description, evidence references, exact reproduction, demonstrated impact, likely root cause, CWE/OWASP/ATT&CK mapping where relevant, remediation, regression verification, and limitations.
+
+## Diagrams
+
+Use Mermaid, Graphviz, or PlantUML only when topology or sequence adds clarity. Useful views include trust/data flow, attack path, protocol/state machine, process tree, call graph, evidence lineage, and incident timeline. Keep node identifiers stable and link diagram claims to evidence IDs.
+
+## Report
+
+Produce an executive summary, authorization/scope, methodology, environment and tools, findings ordered by risk, attack/evidence narrative, remediation priorities, validation plan, limitations, artifact index with hashes, and timeline. Never claim exploitation or control that the evidence did not verify.