Universal workflow for complete reverse engineering of endpoint detection and response (EDR) products. Every EDR dropped into this workspace gets the same systematic treatment: full decompilation, rule extraction, ML model extraction, vulnerability analysis, detection gap analysis, and tradecraft development.
When given a new EDR product, create this structure under <product>/:
<product>/
| name | edr-reverse-engineering |
|---|---|
| description | Standardized workflow for reverse engineering endpoint security products, including extraction, decompilation, rule and model recovery, vulnerability analysis, detection gap analysis, proof-of-concept planning, live probes, and stakeholder reports. Use when Claude is asked to analyze an endpoint detection and response product, endpoint protection agent, security sensor, antivirus engine, or similar endpoint security package from installer artifacts, extracted binaries, live systems, or prior workspace outputs. |
Use this skill to run a complete, repeatable reverse-engineering workflow for endpoint security products. Apply the same structure to every product so outputs can be compared across analyses and future work can resume without rediscovery.
| """ | |
| The most atomic way to train and run inference for a GPT in pure, dependency-free Python. | |
| This file is the complete algorithm. | |
| Everything else is just efficiency. | |
| @karpathy | |
| """ | |
| import os # os.path.exists | |
| import math # math.log, math.exp |
An attempt to find a good agent orchestrator or two, that can support these styles of software AI dev:
Ideally one tool could be used for both.
Leave any suggestions in the comments please, all are welcome.
name: codex-researcher description: > Use this agent when you need to conduct research on any topic using OpenAI's Codex CLI. This includes gathering information about technologies, companies, market trends, scientific topics, historical events, or any subject requiring in-depth analysis. The agent leverages the codex exec command with web search to perform comprehensive research. model: inherit color: green
| # script to scan MS Office files, looking for "Shell.Explorer" OLE objects which could match CVE-2026-21509 | |
| # using oletools - https://github.com/decalage2/oletools | |
| # Philippe Lagadec 2026-01-28 | |
| # NOTES: | |
| # According to the MS advisory https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21509 | |
| # the CVE-2026-21509 vulnerability is related to CLSID "EAB22AC3-30C1-11CF-A7EB-0000C05BAE0B", | |
| # corresponding to the "Shell.Explorer" COM object, which can be used to open the legacy | |
| # Internet Explorer engine (aka Trident/MSHTML) from any application. | |
| # So to exploit CVE2026-21509 from a MS Office document, one could use either an OLE object |
| { | |
| "type": "rpc", | |
| "tid": "32", | |
| "action": "PanDirect", | |
| "method": "execute", | |
| "predefinedCacheUpdate": "false", | |
| "cloudCacheUpdate": "false", | |
| "result": { | |
| "result": { | |
| "entry": [ |
| # train_grpo.py | |
| # | |
| # See https://github.com/willccbb/verifiers for ongoing developments | |
| # | |
| """ | |
| citation: | |
| @misc{brown2025grpodemo, | |
| title={Granular Format Rewards for Eliciting Mathematical Reasoning Capabilities in Small Language Models}, | |
| author={Brown, William}, |
g.co, Google's official URL shortcut (update: or Google Workspace's domain verification, see bottom), is compromised. People are actively having their Google accounts stolen.
Someone just tried the most sophisticated phishing attack I've ever seen. I almost fell for it. My mind is a little blown.
Someone named "Chloe" called me from 650-203-0000 with Caller ID saying "Google". She sounded like a real engineer, the connection was super clear, and she had an American accent. Screenshot.
They said that they were from Google Workspace and someone had recently gained access to my account, which they had blocked. They asked me if I had recently logged in from Frankfurt, Germany and I said no.
I asked if they can confirm this is Google calling by emailing me from a Google email and they said sure and sent me this email and told me to look for a case number in it, which I saw in
| #!/usr/bin/env python | |
| # Impacket - Collection of Python classes for working with network protocols. | |
| # | |
| # Copyright Fortra, LLC and its affiliated companies | |
| # | |
| # All rights reserved. | |
| # | |
| # This software is provided under a slightly modified version | |
| # of the Apache Software License. See the accompanying LICENSE file | |
| # for more information. |