可复用的进攻性安全技能与AI代理插件,涵盖侦察、漏洞利用、C2、载荷开发及报告,适用于Windows、Linux、macOS和云环境。
适用于 SpecterOps 的可复用代理技能、插件和代理定义。
每个插件都包含一个位于 .codex-plugin/plugin.json 的 Codex 清单。```bash
codex plugin marketplace add /Users//Projects/skills
codex plugin marketplace add SpecterOps/skills
然后打开 Codex,并从 `/plugins` 安装。
### Codex MCP 设置
Codex 通过声明式 `mcp_servers` 配置正式支持 MCP 服务器。本仓库不再附带 MCP 运行器或首次运行安装脚本。请自行安装或克隆每个外部 MCP 服务器,然后在 `~/.codex/config.toml` 或项目 `.codex/config.toml` 中使用 `command`、`args` 以及可选的 `env` 值将 Codex 指向该服务器。
1. 在 Codex 中安装或刷新此 marketplace: ```bash
codex plugin marketplace add /Users/<user>/Projects/skills
# or
codex plugin marketplace add SpecterOps/skills
然后从 /plugins 安装相关插件。
直接在 Codex 中配置 MCP 服务器。例如 BloodHound 和 Ghostwriter 的 stdio 配置: ```toml [mcp_servers.bloodhound_mcp] command = "uv" args = ["--directory", "/path/to/bloodhound-mcp", "run", "main.py"]
[mcp_servers.bloodhound_mcp.env] BLOODHOUND_DOMAIN = "YOUR_DOMAIN" BLOODHOUND_TOKEN_ID = "YOUR_TOKEN_ID" BLOODHOUND_TOKEN_KEY = "YOUR_TOKEN_KEY" BLOODHOUND_SCHEME = "https" BLOODHOUND_PORT = "443"
[mcp_servers.ghostwriter] command = "uv" args = ["--directory", "/path/to/GhostWriterMCP", "run", "python", "-m", "ghostwritermcp.server"]
[mcp_servers.ghostwriter.env] GHOSTWRITER_URL = "https://ghostwriter.example.com/" GHOSTWRITER_API_KEY = "YOUR_API_KEY" GHOSTWRITER_CA_BUNDLE = "/path/to/ca-bundle.crt" GHOSTWRITER_OPLOG_ID = "123" GHOSTWRITER_OPERATOR = "your-callsign" GHOSTWRITER_SOURCE_IP = "10.0.0.5"
使用你的 BinjaMCP 安装所记录的命令或端点来配置 Binary Ninja MCP。对于 stdio 服务器,Codex 的配置形式为: ```toml [mcp_servers.binary_ninja_mcp] command = "npx" args = ["-y", "binary-ninja-mcp", "--host", "localhost", "--port", "9009"]
重启 Codex 后,MCP 配置才会生效,然后在依赖 MCP 辅助技能之前,请确认工具出现在 /mcp 下。
每个插件都位于 plugins/<name>/ 下,并在 .claude-plugin/plugin.json 中包含一个 Claude Code 清单。
对于本地开发:```text /plugin marketplace add /Users//Projects/skills /plugin install @specterops-skills
对于托管仓库:```text
/plugin marketplace add SpecterOps/skills
/plugin install <plugin-name>@specterops-skills
当您只想安装技能说明时,请使用 npx skills。这不会安装完整的插件行为,例如 MCP 配置、Claude 命令、钩子或代理定义。```bash
npx skills add SpecterOps/skills --list
npx skills add SpecterOps/skills --skill --agent claude-code --agent codex --global
For local testing:```bash
npx skills add /Users/<user>/Projects/skills --list
请从 CONTRIBUTING.md 开始。其中涵盖了受支持的开发环境、设置与验证命令、插件元数据脚手架、拉取请求预期,以及寻求帮助的途径。
| 技能 | 路径 |
|---|---|
cwe-code-review | SKILL.md |
| 插件 | Codex | Claude Code | MCP | 描述 |
|---|
| workflows-development | 是 | 是 | - | 面向 Specter Codex 的开发脚手架、仓库卫生、安全工具与实现工作流。 |
| code-review-and-qa | 是 | 是 | - | 面向 Specter Codex 的代码审查与 Web 应用 QA 工作流。 |
| workflows-research | 是 | 是 | - | 面向 Specter Codex 的基于源码的研究与综合工作流。 |
| ops-reconnaissance | 是 | 是 | - | 面向 Specter Codex 的侦察、OSINT、服务枚举与暴露面发现工作流。 |
| ops-appsec | 是 | 是 | - | 面向 Specter Codex 的应用与代码安全评估工作流。 |
| ops-sccm | 是 | 是 | - | Microsoft Configuration Manager 侦察与接管验证工作流。 |
| bloodhound | 是 | 是 | 手动 | BloodHound、AzureHound、GitHound/JamfHound/OktaHound OpenGraph 攻击路径查询工作流、SCIM 桥接参考,以及可选的 BloodHound MCP 打包。 |
| payloads | 是 | 是 | - | 可复用的 Electron 载荷打包、持久化、审计与发现工作流。 |
| c2-extensions | 是 | 是 | - | Beacon 对象文件开发与可复用的 C2 扩展工作流。 |
| report-drafting | 是 | 是 | 手动 | 面向安全评估交付物的发现项、报告起草、Ghostwriter MCP 与操作日志工作流。 |
| reverse-engineering | 是 | 是 | 手动 | 面向 Binary Ninja、Ghidra 及相关工具的反向工程工作流与 MCP 辅助二进制分析。 |
| report-timeline | 是 | 是 | - | 报告时间线摄取、整合与证据打包工作流。 |
| codex-observability | 是 | 是 | - | Codex 活动报告与遥测工作流。 |
| ops-infrastructure | 是 | 是 | - | 基础设施运维、SSH、隧道、防火墙与攻击性 IaC 攻击面工作流。 |
| internal-training-course | 是 | 是 | - | 内部培训课程 wiki 迁移、脚手架、内容迁移与 QA 工作流。 |
| social-engineering | 是 | 是 | - | 社会工程学研究与钓鱼借口(pretext)工作流。 |
| ludus | 是 | 是 | - | Ludus 网络靶场配置与管理技能,包含完整的 API、CLI 与部署参考。 |
| c2-mythic | 是 | 是 | - | Mythic C2 框架植入体与 C2 profile 开发工作流,涵盖代理消息协议、载荷类型定义及监听器/profile 指南。 |
| tradecraft-windows | 是 | - | - | Windows 执行、持久化与 COM 代理验证工作流。 |
| ops-adcs | 计划中 | - | - | Active Directory 证书服务评估与攻击路径验证工作流。计划中;当前未打包任何能力。 |
| ops-mssql | 计划中 | - | - | Microsoft SQL Server 侦察、权限映射与评估工作流。计划中;当前未打包任何能力。 |
| tradecraft-mac | 是 | - | - | macOS 执行、持久化与操作员验证工作流。 |
| tradecraft-linux | 是 | - | - | Linux 进程注入、执行、持久化与操作员验证工作流。 |
| c2-cobaltstrike | 是 | 是 | - | Cobalt Strike Aggressor Script、Sleep、BOF 加载器与 Malleable C2 profile 工作流。 |
| bloodhound-development | 是 | 是 | - | 操作隔离的 BHE 环境、交付 BHE/BHCE 变更,并运行聚焦的企业审查与验证工作流。 |
| go-review | 是 | 是 | - | 针对 Go 包与服务的代码安全审查,涵盖信任边界、注入、文件系统、加密、并发及 unsafe/cgo 边界。 |
| c2-outflankc2 | 是 | 是 | - | Outflank C2 (OC2) BOF 脚本与事件驱动 bot 开发工作流。 |
| 技能 | 插件 | 路径 |
|---|
git-cleanup | workflows-development | SKILL.md |
git-merge | workflows-development | SKILL.md |
git-preflight | workflows-development | SKILL.md |
readme-generation | workflows-development | SKILL.md |
scaffold-python | workflows-development | SKILL.md |
scaffold-security | workflows-development | SKILL.md |
code-review | code-review-and-qa | SKILL.md |
cpp-core-guidelines | code-review-and-qa | SKILL.md |
webapp-qa | code-review-and-qa | SKILL.md |
source-research | workflows-research | SKILL.md |
nmap-parse | ops-reconnaissance | SKILL.md |
osint-recon | ops-reconnaissance | SKILL.md |
shodan | ops-reconnaissance | SKILL.md |
secret-scan | ops-appsec | SKILL.md |
security-review | ops-appsec | SKILL.md |
webapp-review | ops-appsec | SKILL.md |
sccm-recon | ops-sccm | SKILL.md |
sccm-takeover-relay | ops-sccm | SKILL.md |
sccmhunter-install-local | ops-sccm | SKILL.md |
azurehound-analysis | bloodhound | SKILL.md |
bloodhound-ad-analysis | bloodhound | SKILL.md |
bloodhound-analysis | bloodhound | SKILL.md |
bloodhound-opengraph | bloodhound | SKILL.md |
bloodhound-query | bloodhound | SKILL.md |
openhound-development | bloodhound | SKILL.md |
openhound-github | bloodhound | SKILL.md |
openhound-jamf | bloodhound | SKILL.md |
openhound-okta | bloodhound | SKILL.md |
electron-app-audit | payloads | SKILL.md |
electron-candidate-discovery | payloads | SKILL.md |
electron-install-persistence | payloads | SKILL.md |
electron-squirrel-repackage | payloads | SKILL.md |
beacon-object-file-development | c2-extensions | SKILL.md |
c2-bof-development | c2-extensions | SKILL.md |
finding-report | report-drafting | SKILL.md |
ghostwriter-mcp | report-drafting | SKILL.md |
ghostwriter-oplog | report-drafting | SKILL.md |
binary-ninja-mcp-analysis | reverse-engineering | SKILL.md |
ghidra-mcp-analysis | reverse-engineering | SKILL.md |
timeline-asciinema | report-timeline | SKILL.md |
timeline-cobaltstrike | report-timeline | SKILL.md |
timeline-consolidator | report-timeline | SKILL.md |
timeline-ghostwriter | report-timeline | SKILL.md |
timeline-markdown-notes | report-timeline | SKILL.md |
timeline-mythic | report-timeline | SKILL.md |
timeline-pdf-notes | report-timeline | SKILL.md |
timeline-workflow | report-timeline | SKILL.md |
codex-activity-report | codex-observability | SKILL.md |
opentelemetry-codex | codex-observability | SKILL.md |
iac-attack-surface | ops-infrastructure | SKILL.md |
nftables-allow-source | ops-infrastructure | SKILL.md |
proxychains-tunnel | ops-infrastructure | SKILL.md |
ssh-ops | ops-infrastructure | SKILL.md |
course-wiki-migration-orchestrator | internal-training-course | SKILL.md |
course-wiki-stage1-scaffold | internal-training-course | SKILL.md |
course-wiki-stage2-content-migration | internal-training-course | SKILL.md |
course-wiki-stage3-qa | internal-training-course | SKILL.md |
credential-harvest-landing-page-copy | social-engineering | SKILL.md |
phishing-campaign-builder | social-engineering | SKILL.md |
phishing-email-html | social-engineering | SKILL.md |
phishing-pretext | social-engineering | SKILL.md |
pretext-brainstormer | social-engineering | SKILL.md |
vishing-pretext | social-engineering | SKILL.md |
ludus-development | ludus | SKILL.md |
mythic-implant-development | c2-mythic | SKILL.md |
mythic-profiles | c2-mythic | SKILL.md |
mythic-translation-containers | c2-mythic | SKILL.md |
com-proxy-triage | tradecraft-windows | SKILL.md |
macos-initial-access | tradecraft-mac | SKILL.md |
linux-process-injection | tradecraft-linux | SKILL.md |
cobalt-strike-aggressor-development | c2-cobaltstrike | SKILL.md |
cobalt-strike-aggressor-reference | c2-cobaltstrike | SKILL.md |
cobalt-strike-malleable-c2-development | c2-cobaltstrike | SKILL.md |
bhe-change-delivery | bloodhound-development | SKILL.md |
bhe-dev-bootstrap | bloodhound-development | SKILL.md |
bhe-dev-environment | bloodhound-development | SKILL.md |
bhe-enterprise-review | bloodhound-development | SKILL.md |
bhe-sample-data-ingest | bloodhound-development | SKILL.md |
bhe-ui-playwright | bloodhound-development | SKILL.md |
go-review | go-review | SKILL.md |
oc2-bof-script-development | c2-outflankc2 | SKILL.md |
oc2-bot-development | c2-outflankc2 | SKILL.md |
openssf-python-review | SKILL.md |
owasp-security-code-review | SKILL.md |
| 代理 | 路径 |
|---|
architect | agents/architect.toml |
bloodhound-analyst | agents/bloodhound-analyst.toml |
code-reviewer | agents/code-reviewer.toml |
course-migration | agents/course-migration.toml |
domain-ops | agents/domain-ops.toml |
exploit-dev | agents/exploit-dev.toml |
internal-network-recon | agents/internal-network-recon.toml |
ludus | agents/ludus.toml |
mythic-developer | agents/mythic-developer.toml |
osint-recon | agents/osint-recon.toml |
planner | agents/planner.toml |
poc-dev | agents/poc-dev.toml |
qa-tester | agents/qa-tester.toml |
report-writer | agents/report-writer.toml |
researcher | agents/researcher.toml |
reverse-engineer | agents/reverse-engineer.toml |
sccm-ops | agents/sccm-ops.toml |
security-researcher | agents/security-researcher.toml |
social-engineer | agents/social-engineer.toml |
ssh-operator | agents/ssh-operator.toml |
telemetry-analyst | agents/telemetry-analyst.toml |
winternals | agents/winternals.toml |
| MCP 服务器 | 插件 | 配置 |
|---|
bloodhound_mcp | bloodhound | 直接在 Codex 中使用 uv --directory /path/to/bloodhound-mcp run main.py 进行配置。 |
ghostwriter | report-drafting | 直接在 Codex 中使用 uv --directory /path/to/GhostWriterMCP run python -m ghostwritermcp.server 进行配置。 |
binary_ninja_mcp | reverse-engineering | 在 Binary Ninja 中安装 fosdickio/binary_ninja_mcp 后,直接在 Codex 中使用 npx -y binary-ninja-mcp --host localhost --port 9009 进行配置。 |
ghidra | reverse-engineering | 直接在 Codex 中使用您的 Ghidra MCP 服务器所文档化的命令或端点进行配置。 |