Search Results for "C2" | AgentCC

deep-analysis

Performs focused, depth-first investigation of specific reverse engineering questions through iterative analysis and database improvement. Answers questions like "What does this function do?", "Does this use crypto?", "What's the C2 address?", "Fix types in this function". Makes incremental improvements (renaming, retyping, commenting) to aid understanding. Returns evidence-based answers with new investigation threads. Use after binary-triage for investigating specific suspicious areas or when user asks focused questions about binary behavior.

schema-normalizer

Normalize cross-skill JSONL interfaces (ids + titles + citation key formats) so downstream skills do not rely on best-effort joins. **Trigger**: schema normalize, jsonl contract, interface drift, join drift, 字段不一致, schema 规范化. **Use when**: you have generated C2-C4 JSONL artifacts (outline/briefs/bindings/packs/anchors) and want deterministic, stable fields before self-loops/writing. **Skip if**: you are not using the survey pipelines, or the workspace already has a fresh PASS `output/SCHEMA_NORMALIZATION_REPORT.md` for the current artifacts. **Network**: none. **Guardrail**: NO PROSE; deterministic transforms only; do not invent evidence/claims; only fill missing ids/titles from `outline/outline.yml`.

citation-diversifier

Raise citation diversity/density (NO NEW FACTS): generate an in-scope “citation budget” plan per H3 so drafts stop failing the global unique-citation gate and stop looking under-cited. **Trigger**: cite boost, citation budget, unique citations too low, add more citations, improve reference density, 引用太少, 增加引用, 引用密度. **Use when**: `pipeline-auditor` FAILs due to low unique citations, or you want to increase cite density without changing claims. **Skip if**: you need new papers (fix C1/C2 mapping first), or `citations/ref.bib` / `outline/writer_context_packs.jsonl` is missing. **Network**: none. **Guardrail**: NO NEW FACTS; do not invent citations; only use keys already present in `citations/ref.bib`; keep citations within each H3’s allowed scope (`outline/writer_context_packs.jsonl` / `outline/evidence_bindings.jsonl`).

prose-writer

Write `output/DRAFT.md` (or `output/SNAPSHOT.md`) from an approved outline and evidence packs, using only verified citation keys from `citations/ref.bib`. **Trigger**: write draft, prose writer, snapshot, survey writing, 写综述, 生成草稿, section-by-section drafting. **Use when**: structure is approved (`DECISIONS.md` has `Approve C2`) and evidence packs exist (`outline/subsection_briefs.jsonl`, `outline/evidence_drafts.jsonl`). **Skip if**: approvals are missing, or evidence packs are incomplete / scaffolded (missing-fields, TODO markers). **Network**: none. **Guardrail**: do not invent facts or citations; only cite keys present in `citations/ref.bib`; avoid pipeline-jargon leakage in final prose.

tutorial-module-writer

Write the tutorial content (`output/TUTORIAL.md`) from an approved module plan, including exercises and answer outlines. **Trigger**: write tutorial, tutorial modules, 教程写作, TUTORIAL.md. **Use when**: tutorial pipeline 的写作阶段（C3），且 `DECISIONS.md` 已记录 HUMAN 对 scope/running example 的批准（C2）。 **Skip if**: module plan 未完成/未批准（先跑 `module-planner`/`exercise-builder` 并通过 Approve C2）。 **Network**: none. **Guardrail**: 只写已批准范围；保持 running example 一致；每模块包含练习与答案要点。

section-mapper

Map papers from the core set to each outline subsection and write `outline/mapping.tsv` with coverage tracking. **Trigger**: section mapper, mapping.tsv, coverage, paper-to-section mapping, 论文映射, 覆盖率. **Use when**: structure 阶段（C2），已有 `papers/core_set.csv` + `outline/outline.yml`，需要确保每小节有足够支持论文再进入 evidence/writing。 **Skip if**: 还没有 outline（先跑 `outline-builder`）或 core set 还没收敛。 **Network**: none. **Guardrail**: 覆盖率可审计（避免所有小节重复用同几篇）；为弱覆盖小节留下明确补救方向（扩 query / 合并小节）。

concept-graph

Build a concept graph (nodes + prerequisite edges) from a tutorial spec, saving as `outline/concept_graph.yml`. **Trigger**: concept graph, prerequisite graph, dependency graph, 概念图, 先修关系. **Use when**: tutorial pipeline 的结构阶段（C2），需要把教程知识点拆成可排序的依赖图（在写教程 prose 前）。 **Skip if**: 还没有 tutorial spec（例如缺少 `output/TUTORIAL_SPEC.md`）。 **Network**: none. **Guardrail**: 只做结构；避免写长 prose 段落。

module-planner

Plan tutorial modules from a concept graph, including module objectives and sequencing, saving as `outline/module_plan.yml`. **Trigger**: module plan, tutorial modules, course outline, 模块规划, module_plan.yml. **Use when**: tutorial pipeline 的结构阶段（C2），已有 `outline/concept_graph.yml`，需要把概念依赖转成可教学的模块序列。 **Skip if**: 还没有 concept graph（先跑 `concept-graph`）。 **Network**: none. **Guardrail**: 每模块明确 objectives + outputs（最好含 running example 步骤）；避免 prose 段落。

screening-manager

Manage title/abstract screening and record decisions into `papers/screening_log.csv` according to an approved protocol. **Trigger**: screening, title/abstract screening, inclusion/exclusion, screening_log.csv, 文献筛选, 纳入排除. **Use when**: systematic review 的 screening 阶段（C2），protocol 已锁定并通过 HUMAN 审批。 **Skip if**: 还没有 `output/PROTOCOL.md`（或 protocol 未通过签字）。 **Network**: none. **Guardrail**: 每条记录包含决策与理由；保持可审计（不要把“未读/不确定”当作纳入）。

citation-injector

Apply a `citation-diversifier` budget report by injecting *in-scope* citations into an existing draft (NO NEW FACTS), so the run passes the global unique-citation gate without citation dumps. **Trigger**: citation injector, apply citation budget, inject citations, add citations safely, 引用注入, 按预算加引用, 引用增密. **Use when**: `output/CITATION_BUDGET_REPORT.md` exists and you need to raise *global* unique citations (or reduce over-reuse) before `draft-polisher` / `pipeline-auditor`. **Skip if**: you need more papers/citations upstream (fix C1/C2 mapping first), or `citations/ref.bib` is missing. **Network**: none. **Guardrail**: NO NEW FACTS; do not invent citations; only inject keys present in `citations/ref.bib`; keep injected citations within each H3’s allowed scope (via the budget report); avoid citation-dump paragraphs (embed cites per work).

limitation-weaver

Rewrite limitation passages so the paper keeps limitations without falling into count-based slot phrases (e.g., \"Two limitations…\") across many H3s. **Trigger**: limitation weaver, rewrite limitations, remove two limitations, 去Two limitations, 局限改写, caveat rewrite. **Use when**: `writer-selfloop` is PASS but flags repeated count-based limitation openers in `output/WRITER_SELFLOOP_TODO.md`, or multiple H3s share the same limitation cadence. **Skip if**: the limitation is evidence-missing (route upstream), or you are pre-C2 (NO PROSE). **Network**: none. **Guardrail**: do not invent facts; do not add/remove/move citation keys; do not delete subsection-specific limitations; keep claim→evidence anchoring intact.

front-matter-writer

Write the survey\x27s front matter files (Abstract, Introduction, Related Work, Discussion, Conclusion) in paper voice, with high citation density and a single evidence-policy paragraph. **Trigger**: front matter writer, introduction writer, related work writer, abstract writer, discussion writer, conclusion writer, 引言, 相关工作, 摘要, 讨论, 结论. **Use when**: you are in C5 (prose allowed) and need the paper-like \"shell\" to stop the draft reading like stitched subsections. **Skip if**: `Approve C2` is missing in `DECISIONS.md`, or `citations/ref.bib` is missing (generate citations first). **Network**: none. **Guardrail**: no pipeline jargon in final prose; no repeated evidence disclaimers; do not invent facts/citations; only use keys present in `citations/ref.bib`.

subsection-writer

Write survey prose into per-section files under `sections/` so each unit can be QA\x27d independently before merging. **Trigger**: subsection writer, per-section writing, split sections, sections/, 分小节写, 按章节拆分写作. **Use when**: `Approve C2` is recorded and writer packs exist (`outline/writer_context_packs.jsonl`); you want evidence-bounded drafting without a monolithic one-shot draft. **Skip if**: `DECISIONS.md` approval is missing, or `outline/evidence_drafts.jsonl` / `citations/ref.bib` is missing. **Network**: none. **Guardrail**: do not invent facts/citations; no TODO/ellipsis leakage; keep citations subsection- or chapter-scoped; H3 body files and chapter leads must not contain headings.

argument-selfloop

Argument self-loop: maintain an argument ledger + premise consistency report for drafted sections. **Trigger**: argument self-loop, argument chain, premise consistency, section self-check, paragraph contract, 论证自循环, 论证链路, 前提一致性, 段落论证动作. **Use when**: you are in C5 (PROSE allowed), `sections/*.md` exist, and you want to prevent “smooth but hollow” writing by enforcing argument moves + premise hygiene before merge. **Skip if**: you are pre-C2 (NO PROSE), or evidence packs are scaffolded/thin (route upstream to `evidence-selfloop` first). **Network**: none. **Guardrail**: do not invent facts; do not add/remove/move citation keys; do not move citations across subsections; the argument ledger is an intermediate artifact and must never be inserted into the paper.

style-harmonizer

De-slot and harmonize paper voice across `sections/*.md` without changing meaning or citation keys. **Trigger**: style harmonizer, de-template stems, remove slot phrases, discourse stems, 写作风格统一, 去槽位句式, 去生成器味. **Use when**: `writer-selfloop` is PASS but `output/WRITER_SELFLOOP_TODO.md` flags Style Smells (e.g., repeated count-based openers), or the draft reads like many sections share the same rhythm. **Skip if**: you need new evidence/citations (route to C3/C4), or you are pre-C2 (NO PROSE). **Network**: none. **Guardrail**: do not invent facts; do not add/remove/move citation keys; do not move citations across subsections; keep claim->evidence anchoring intact.

opener-variator

Rewrite subsection openers so they stop reading like a generated table-of-contents: remove \"overview/narration\" stems and reduce repeated opener cadences across H3s. **Trigger**: opener variator, opener rewrite, rewrite openers, overview opener, 开头改写, 小节开头, 去overview, 去旁白. **Use when**: `writer-selfloop` is PASS but flags repeated opener stems / overview narration in `output/WRITER_SELFLOOP_TODO.md`, or the draft still has a subtle “generator cadence”. **Skip if**: you are pre-C2 (NO PROSE), or the section is evidence-thin (route upstream; don’t stylize filler). **Network**: none. **Guardrail**: do not invent facts; do not add/remove/move citation keys; do not move citations across subsections; keep meaning intact.

evaluation-anchor-checker

Audit and rewrite evaluation/numeric claims to ensure they carry minimal protocol context (task + metric + constraint) and avoid underspecified model naming. **Trigger**: evaluation anchor checker, numeric claim hygiene, underspecified numbers, protocol context, 评测锚点检查, 数字断言, 指标上下文. **Use when**: before final merge/polish, or when reviewers would likely flag claims as underspecified (numbers without task/metric/budget), or `pipeline-auditor` warns about suspicious model naming. **Skip if**: evidence is too thin to justify numeric claims (route upstream to C3/C4), or you are pre-C2 (NO PROSE). **Network**: none. **Guardrail**: do not invent numbers; do not add/remove/move citation keys; if protocol context is missing, weaken/remove the numeric claim rather than guessing.

writer-selfloop

Writing self-loop for surveys: run the strict section-quality gate, then rewrite only the failing `sections/*.md` files until the report is PASS. **Trigger**: writer self-loop, writing loop, quality gate loop, rewrite failing sections, 自循环, 反复改到 PASS. **Use when**: per-section files exist but C5 is FAIL/BLOCKED (thin sections, missing leads/front matter, citation-scope violations, generator voice). **Skip if**: you are still pre-C2 (NO PROSE), or evidence packs are incomplete (fix C3/C4 first). **Network**: none. **Guardrail**: do not invent facts; only use citation keys present in `citations/ref.bib`; keep citations in-scope per `outline/evidence_bindings.jsonl`; do not add/remove citation keys during rewrites.

subsection-polisher

Polish a single H3 unit file under `sections/` into survey-grade prose (de-template + contrast/eval/limitation), without changing citation keys. **Trigger**: subsection polisher, per-subsection polish, polish section file, 小节润色, 去模板, 结构化段落. **Use when**: `sections/S*.md` exists but reads rigid/template-y; you want to fix quality locally before `section-merger`. **Skip if**: subsection files are missing, evidence packs are incomplete, or `Approve C2` is not recorded. **Network**: none. **Guardrail**: do not invent facts/citations; do not add/remove citation keys; keep citations within the same H3; keep citations subsection-scoped.

grad-paragraph

Write one survey-quality paragraph from evidence packs (tension → contrast → evaluation anchor → limitation). **Trigger**: grad paragraph, paragraph micro-structure, argument paragraph, 研究生段落, 论证段落, 对比段, 段落写作. **Use when**: you are drafting `sections/S*.md` (H3 body) and want subsection-specific, evidence-bounded prose instead of templates. **Skip if**: evidence packs are missing/incomplete (fix `subsection-briefs`/`evidence-draft`/`evidence-binder` first), or `Approve C2` is not recorded in `DECISIONS.md`. **Network**: none. **Guardrail**: do not invent facts or citations; no placeholders/ellipsis; keep claims conservative when evidence is abstract-level (avoid repeating evidence-mode boilerplate in every paragraph).

concept-scaffolding

Design progressive learning sequences that build foundational understanding before complexity. Use when breaking complex concepts into steps, managing cognitive load, or validating prerequisite understanding. Applies Bloom's progression and tier-based cognitive limits (CEFR A1-C2).

agile-v-lifecycle

Multi-cycle iteration management, document versioning, change requests, re-entry points, archival, and impact analysis. Load when starting a new cycle (C2+), processing change requests, or managing cross-cycle traceability.

pentest-c2-operator

Set up authorized C2 simulation workflows and measure defensive detection outcomes.

analyzing-cobalt-strike-beacon-configuration

Extract and analyze Cobalt Strike beacon configuration from PE files and memory dumps to identify C2 infrastructure, malleable profiles, and operator tradecraft.

cobalt-strikebeaconc2+4

extracting-config-from-agent-tesla-rat

Extract embedded configuration from Agent Tesla RAT samples including SMTP/FTP/Telegram exfiltration credentials, keylogger settings, and C2 endpoints using .NET decompilation and memory analysis.

agent-teslaratconfig-extraction+4

deobfuscating-powershell-obfuscated-malware

Systematically deobfuscate multi-layer PowerShell malware using AST analysis, dynamic tracing, and tools like PSDecode and PowerDecode to reveal hidden payloads and C2 infrastructure.

powershelldeobfuscationmalware-analysis+4

analyzing-network-traffic-for-incidents

Analyzes network traffic captures and flow data to identify adversary activity during security incidents, including command-and-control communications, lateral movement, data exfiltration, and exploitation attempts. Uses Wireshark, Zeek, and NetFlow analysis techniques. Activates for requests involving network traffic analysis, packet capture investigation, PCAP analysis, network forensics, C2 traffic detection, or exfiltration detection.

network-forensicsPCAP-analysisWireshark+2

building-c2-infrastructure-with-sliver-framework

Build and configure a resilient command-and-control infrastructure using BishopFox's Sliver C2 framework with redirectors, HTTPS listeners, and multi-operator support for authorized red team engagements.

red-teamc2-frameworksliver+4

analyzing-dns-logs-for-exfiltration

Analyzes DNS query logs to detect data exfiltration via DNS tunneling, DGA domain communication, and covert C2 channels using entropy analysis, query volume anomalies, and subdomain length detection in SIEM platforms. Use when SOC teams need to identify DNS-based threats that bypass traditional network security controls.

socdnsexfiltration+5

building-red-team-c2-infrastructure-with-havoc

Deploy and configure the Havoc C2 framework with teamserver, HTTPS listeners, redirectors, and Demon agents for authorized red team operations.

havoc-c2command-and-controlred-team-infrastructure+3

hunting-for-command-and-control-beaconing

Detect C2 beaconing patterns in network traffic using frequency analysis, jitter detection, and domain reputation to identify compromised endpoints communicating with adversary infrastructure.

threat-huntingmitre-attackc2+3

analyzing-network-covert-channels-in-malware

Detect and analyze covert communication channels used by malware including DNS tunneling, ICMP exfiltration, steganographic HTTP, and protocol abuse for C2 and data exfiltration.

covert-channelsdns-tunnelingicmp-exfiltration+4

hunting-for-beaconing-with-frequency-analysis

Identify command-and-control beaconing patterns in network traffic by applying statistical frequency analysis, jitter calculation, and coefficient of variation scoring to detect periodic callbacks from compromised endpoints.

threat-huntingbeaconingc2-detection+5

hunting-for-unusual-network-connections

Hunt for unusual network connections by analyzing outbound traffic patterns, rare destinations, non-standard ports, and anomalous connection frequencies from endpoints.

threat-huntingmitre-attacknetwork-analysis+3

None

Threat actor infrastructure tracking involves monitoring and mapping adversary-controlled assets including command-and-control (C2) servers, phishing domains, exploit kit hosts, bulletproof hosting, a

threat-intelligencectiioc+6

reverse-engineering-android-malware-with-jadx

Reverse engineers malicious Android APK files using JADX decompiler to analyze Java/Kotlin source code, identify malicious functionality including data theft, C2 communication, privilege escalation, and overlay attacks. Examines manifest permissions, receivers, services, and native libraries. Activates for requests involving Android malware analysis, APK reverse engineering, mobile malware investigation, or Android threat analysis.

malwareAndroidreverse-engineering+2

hunting-for-living-off-the-cloud-techniques

Hunt for adversary abuse of legitimate cloud services for C2, data staging, and exfiltration including abuse of Azure, AWS, GCP services, and SaaS platforms.

threat-huntingmitre-attackcloud-abuse+4

analyzing-command-and-control-communication

Analyzes malware command-and-control (C2) communication protocols to understand beacon patterns, command structures, data encoding, and infrastructure. Covers HTTP, HTTPS, DNS, and custom protocol C2 analysis for detection development and threat intelligence. Activates for requests involving C2 analysis, beacon detection, C2 protocol reverse engineering, or command-and-control infrastructure mapping.

malwareC2command-and-control+2

building-adversary-infrastructure-tracking-system

Build an automated system to track adversary infrastructure using passive DNS, certificate transparency, WHOIS data, and IP enrichment to map and monitor threat actor command-and-control networks.

infrastructure-trackingpassive-dnsc2+5

None

Malware IOC extraction is the process of analyzing malicious software to identify actionable indicators of compromise including file hashes, network indicators (C2 domains, IP addresses, URLs), regist

threat-intelligencectiioc+5

analyzing-network-traffic-of-malware

Analyzes network traffic generated by malware during sandbox execution or live incident response to identify C2 protocols, data exfiltration channels, payload downloads, and lateral movement patterns using Wireshark, Zeek, and Suricata. Activates for requests involving malware network analysis, C2 traffic decoding, malware PCAP analysis, or network-based malware detection.

malwarenetwork-analysisPCAP+2

reverse-engineering-malware-with-ghidra

Reverse engineers malware binaries using NSA's Ghidra disassembler and decompiler to understand internal logic, cryptographic routines, C2 protocols, and evasion techniques at the assembly and pseudo-C level. Activates for requests involving malware reverse engineering, disassembly analysis, decompilation, binary analysis, or understanding malware internals.

malwarereverse-engineeringGhidra+2

Mercari Shops Agent

Mercari Shops listing and sales management AI agent — automates product listings, orders, shipping, and analytics through API integration

mercarishopsecommerce+3