GitHub PowerShell Monthly Trending Repositories

zhaoxuya520/reverse-skill

Reverse Engineering / Authorized Penetration Testing / Security Research Skill Router Pack AI-powered routing + On-demand toolchain bootstrapping + Self-evolving knowledge base Supports Claude Code, Kiro, Cursor, Cline, and other AI coding clients 逆向/渗透/安全技能路由包 - AI 自动路由 + 按需自举工具链 + 自动进化经验库 | 支持 Claude Code / Kiro / Cursor / Cline 等代码 AI 客户端

reverse-skill

Cybersecurity Skills Router · 逆向技能路由包

Navigate the dark waters, sail against the stream.

About · Getting Started · Usage · Tutorial · Fast route · Routing · Ops contracts · AI Bootstrap · Sponsors · Contributing

🌐 中文 · Project website · Online tutorial

About

If you are an AI Agent, jump to README_AI.md and follow the instructions strictly.

When an AI agent (Claude Code, Codex, Cursor, OpenCode, or another compatible client) encounters an APK, a binary, frontend JS encryption, a CTF challenge, or a pentesting target, this package routes it to the right methodology, checks available tools, and executes a repeatable workflow instead of guessing commands.

User task
  → RULES.md
  → MASTER-ROUTING / master-route.ps1 (PRIMARY)
  → case-init / scope.md (auth + network_profile; no target ACT until ready)
  → Scenario skill → tools / MCP / scripts
  → timeline + Evidence→Finding→Path → report + field-journal

Why this exists:

AI agents don't know whether to use jadx, apktool, Frida, IDA, or BurpSuite for a given task
APK, ELF, JS, PCAP, and CTF tasks each need different playbooks
Tools, MCP servers, and scripts are scattered across machines
The same mistakes get repeated because experience isn't reused

Current status

Routing rules	Regression benchmark	Core skill modules	CI platforms	Client model
41 (R0–R40)	163 cases	42 tracked modules	Windows + Ubuntu	Client-neutral

The routing core is driven by one structured configuration, validated by cross-platform CI, and kept separate from optional client adapters.

PRIMARY ladder: skills/MASTER-ROUTING.md · Full matrix: skills/routing.md · Ops: skills/ops/

(back to top)

Built With

IDA Pro · radare2 · Ghidra

(back to top)

Getting Started

Prerequisites

Java / JDK — for jadx and apktool
Node.js 22.12+ — for JS toolchain and MCP servers
Python 3.x — for Frida and helper scripts
A code AI client — Claude Code, Codex, Cursor, OpenCode, or another compatible client

Installation

git clone https://github.com/zhaoxuya520/reverse-skill.git

Then refresh the tool index per platform:

Platform	Command
Windows	`powershell -File skills/scripts/refresh-tool-index.ps1`
Linux / macOS	`bash skills/scripts/refresh-tool-index.sh`
Kali Linux	`bash kali/scripts/refresh-tool-index.sh`

Check skills/tool-index.md to see detected tools.

Platform-specific docs:

Kali Linux → kali/README-kali.md
Ubuntu/Debian → docs/platforms/linux.md
macOS → docs/platforms/macos.md

(back to top)

Usage

Supported scenarios

Scenario	Entry
APK / Android analysis	`skills/apk-reverse/`
iOS / mobile	`skills/mobile-reverse/`
Binary reverse (exe/dll/so/elf)	`skills/ida-reverse/` / `skills/radare2/`
.NET / C#	`skills/dotnet-reverse/`
Frontend JS / encrypted params	`skills/js-reverse/`
DSL VM / custom JS opcode VM	`skills/reverse-engineering/dsl-vm-reverse/`
HTTP capture / request replay	anything-analyzer, Reqable MCP + `js-reverse/`
Malware / YARA	`skills/malware-analysis/`
Penetration testing / scanning	`skills/pentest-tools/`
Attack chain / red-team orchestration	`skills/attack-chain/`
Case evidence review / report handoff	`skills/case-review/`
CTF competition	`CTF-Sandbox-Orchestrator/` (42 sub-skills)
Firmware / IoT	`skills/firmware-pentest/`
Patch diff / N-day	`skills/patch-diff-exploit/`
Pwn / exploit development	`skills/pwn-chain/`
EDR bypass	`skills/edr-bypass-re/`
API / GraphQL	`skills/api-security/`
Supply chain / SBOM	`skills/supply-chain-security/`
LLM / AI security	`skills/llm-security/`
OLLVM deobfuscation	`skills/reverse-engineering/references/ollvm-deobfuscation.md`
Diagrams / reports	`skills/diagram-generator/` / `skills/docs-generator/`

Key files

File	Purpose
README_AI.md	AI agent bootstrap and configuration
RULES.md	Global routing rules (scope gate before ACT)
skills/MASTER-ROUTING.md	PRIMARY fast ladder
skills/routing.md	Task → skill routing matrix
skills/SKILL.md	Master entry point
skills/INDEX.md	Auto-generated, client-neutral skill navigation index
skills/config/routing.json	Routing single source of truth (41 rules, R0–R40)
skills/tool-index.md	Local tool status (auto-generated)
skills/scripts/master-route.ps1	One-shot PRIMARY triage (reads routing.json)
skills/scripts/case-init.ps1	Case dir: scope / timeline / workitems
skills/case-review/	Read-only Evidence graph review and artifact fixity checks
skills/scripts/test-routing.ps1	Routing regression runner (163 benchmark cases)
skills/scripts/verify-routing-coherence.ps1	Structure + supply-chain pin gate checks
skills/scripts/extract-summaries.ps1	Regenerates INDEX.md from skill frontmatter
AGENTS.md	Platform-neutral repository instructions
skills/ops/	Scope, Evidence chain, roles, timeline (skill-router form)

Testing (run after any routing/config change)

# 1. Routing regression — 163 (hint → expected PRIMARY) cases, fails CI on any mismatch
powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/test-routing.ps1
# 2. Structure coherence + supply-chain pin gate (unpinned auto-install fails)
powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/verify-routing-coherence.ps1
# 3. Smoke: verify + script parse + quick route matrix
powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/smoke.ps1
# 4. INDEX.md drift check (regenerate with extract-summaries.ps1 if dirty)
powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/extract-summaries.ps1 -Check

GitHub Actions CI runs all of the above on Windows + Ubuntu for every push/PR.

Client-neutral integration

The routing core, regression suite, manifests, and case workflow do not depend on a specific AI client. Claude Code, Codex, Cursor, OpenCode, and other clients should load the repository through their own adapter or project-instruction mechanism. Client-specific configuration must remain optional and outside the core routing contract.

Repository layout

.
├── README.md / README_zh.md / README_AI.md
├── RULES.md / RULES_zh.md
├── skills/
│   ├── MASTER-ROUTING.md / SKILL.md / routing.md
│   ├── ops/                   # ops contracts
│   ├── scripts/               # master-route, case-init, bootstrap, verify
│   ├── field-journal/
│   ├── apk-reverse/ mobile-reverse/ js-reverse/ dotnet-reverse/
│   ├── ida-reverse/ radare2/ reverse-engineering/ malware-analysis/
│   ├── pentest-tools/ attack-chain/ pwn-chain/ firmware-pentest/
│   ├── api-security/ supply-chain-security/ llm-security/
│   └── ...
├── CTF-Sandbox-Orchestrator/
├── docs/
├── kali/                      # see kali/README-kali.md
└── work/                      # local cases (gitignored)

(back to top)

Contributing

Contributions are welcome! Fork the repo, create a feature branch, and open a PR.

Fork the Project
git checkout -b feature/AmazingFeature
git commit -m 'Add some AmazingFeature'
git push origin feature/AmazingFeature
Open a Pull Request

Contributors

(back to top)

License

This project (reverse-skill) is primarily licensed under the MIT License (see LICENSE).

Submodule and third-party dependencies:

CTF-Sandbox-Orchestrator/: GNU GPLv3
Pentest Swarm AI: Original project is AGPL-3.0. This repo only invokes it via CLI or MCP and does not include its source code
Other tools (jadx, frida, nmap, burpsuite-mcp, etc.) are subject to their respective official licenses

(back to top)

Acknowledgments

Thanks to all open-source tool authors. This project integrates tools across reverse engineering, penetration testing, CTF, and security analysis — every tool is the fruit of community effort.

Special thanks to the OLLVM deobfuscation ecosystem contributors and everyone who submitted test samples, issues, and PRs.

(back to top)

Contact

Email: ww7517437@gmail.com
QQ Group: 942400892
Discord: reverse-skill community
Issues: GitHub Issues

ChrisTitusTech/winutil

Chris Titus Tech's Windows Utility - Install Programs, Tweaks, Fixes, and Updates

Chris Titus Tech's Windows Utility

A curated compilation of Windows system tasks streamline installs, debloat with tweaks, troubleshoot with config, and configure Windows updates. Run it fresh on every new Windows install.

Quick Start

WinUtil must be run as Administrator Because it performs system-wide changes.

Open PowerShell or Terminal as admin, then run:

Stable Branch (recommended)

irm https://christitus.com/win | iex

Development Branch

irm https://christitus.com/windev | iex

How to open an admin terminal

Start menu: Right-click Start → Windows PowerShell (Admin) or Terminal (Admin)
Search: Press the Windows key, and type PowerShell or Terminal, then Ctrl + Shift + Enter

Automation / Presets

Apply a predefined configuration without manual selection:

& ([ScriptBlock]::Create((irm https://christitus.com/win))) -Preset Standard

Preset	Description
`Standard`	Balanced defaults for most users
`Minimal`	Minimal changes to suit every user
`Advanced`	Deep tweaks for power users

To view exactly what each preset does, see: https://github.com/ChrisTitusTech/winutil/blob/main/config/preset.json

Build & Develop

See https://github.com/ChrisTitusTech/winutil/blob/main/.github/CONTRIBUTING.md

Resources

Support

Leave a ⭐ to show support!
Faster Dotnet Implementation for sale here: https://www.cttstore.com/windows-toolbox

Contributors

Thanks to everyone who has contributed time and effort to this project. Keep rocking 🍻

Raphire/Win11Debloat

A simple, lightweight PowerShell script that allows you to remove pre-installed apps, disable telemetry, as well as perform various other changes to declutter and customize your Windows experience. Win11Debloat works for both Windows 10 and Windows 11.

Win11Debloat

Win11Debloat is a lightweight, easy to use PowerShell script that allows you to quickly declutter and customize your Windows experience, no installation required! You can use it to remove pre-installed apps, disable telemetry, remove intrusive interface elements and much more. No need to painstakingly go through all the settings yourself or remove apps one by one. Win11Debloat makes the process quick and easy!

The script also includes many features that system administrators and power users will enjoy. Such as a powerful command-line interface, support for Windows Audit mode and the ability to make changes to other Windows users. You can also easily export & import your preferred settings, allowing you to quickly apply the same settings on all your systems. Please refer to our wiki for more details.

Did this script help you? Please consider buying me a cup of coffee to support my work

Usage

Warning

Great care went into making sure this script does not unintentionally break any OS functionality, but use at your own risk! If you run into any issues, please report them here.

Quick method

Download & run the script automatically via PowerShell.

Open PowerShell or Terminal.
Copy and paste the command below into PowerShell:

& ([scriptblock]::Create((irm "https://debloat.raphi.re/")))

Wait for the script to automatically download and launch Win11Debloat.
Carefully read through and follow the on-screen instructions.

This method supports command-line parameters to customize the behaviour of the script. Please click here for more information.

Traditional method

Manually download & run the script.

Download the latest version of the script, and extract the .ZIP file to your desired location.
Navigate to the Win11Debloat folder
Double click the Run.bat file to start the script. NOTE: If the console window immediately closes and nothing happens, try the advanced method below.
Accept the Windows UAC prompt to run the script as administrator, this is required for the script to function.
Carefully read through and follow the on-screen instructions.

Advanced method

Manually download the script & run the script via PowerShell. Recommended for advanced users.

Download the latest version of the script, and extract the .ZIP file to your desired location.
Open PowerShell or Terminal as an administrator.
Temporarily enable PowerShell execution by entering the following command:

Set-ExecutionPolicy Bypass -Scope Process -Force

In PowerShell, navigate to the directory where the files were extracted. Example: cd c:\Win11Debloat
Now run the script by entering the following command:

.\Win11Debloat.ps1

Carefully read through and follow the on-screen instructions.

This method supports command-line parameters to customize the behaviour of the script. Please click here for more information.

Features

Below is an overview of the key features and functionality offered by Win11Debloat. You can visit the the wiki for more details.

Tip

All of the changes made by Win11Debloat can easily be reverted and almost all of the apps can be reinstalled through the Microsoft Store. You can visit the wiki for more information on reverting changes.

App Removal

Remove a wide variety of preinstalled apps. Click here for more info.

Privacy & Suggested Content

Disable telemetry, diagnostic data, activity history, app-launch tracking & targeted ads.
Disable tips, tricks, suggestions & ads across Windows, the lock screen and Microsoft Edge.
Disable Windows location services, app location access and Find My Device location tracking.
Hide Microsoft 365 ads on the Settings 'Home' page, or hide the 'Home' page entirely.

AI Features

Disable & remove Microsoft Copilot, Windows Recall and Click to Do.
Prevent AI service (WSAIFabricSvc) from starting automatically.
Disable AI Features in Edge, Paint and Notepad.

System

Disable the Drag Tray for sharing & moving files.
Restore the old Windows 10 style context menu.
Turn off Enhance Pointer Precision (mouse acceleration).
Disable the Sticky Keys keyboard shortcut.
Disable Storage Sense automatic disk cleanup.
Disable fast start-up to ensure a full shutdown.
Disable BitLocker automatic device encryption.
Disable network connectivity during Modern Standby to reduce battery drain.

Windows Update

Prevent Windows from getting updates as soon as they're available.
Prevent automatic restarts after updates while signed in.
Disable sharing of downloaded updates with other PCs, also known as Delivery Optimization.
Prevent Windows from auto-installing device companion apps, like LG Monitor App, Alienware Command Center and more.

Appearance

Enable dark mode for system and apps.
Disable transparency, animations and visual effects.

Start Menu & Search

Customize the start menu by removing pinned apps, hiding recommendations, and customizing the 'All Apps' section.
Disable the Phone Link mobile devices integration in the start menu.
Disable Bing web search & Copilot integration and Microsoft Store app suggestions in Windows search.

Taskbar

Change taskbar alignment.
Customize or hide taskbar buttons like the search bar, taskview and more.
Disable widgets on the taskbar & lock screen.
Enable the 'End Task' option in the taskbar right click menu to quickly force-close apps.
Enable the 'Last Active Click' behavior in the taskbar app area. This allows you to repeatedly click on an application's icon in the taskbar to switch focus between the open windows of that application.
Customize how app buttons are shown on the taskbar.

File Explorer

Change the default location that File Explorer opens to.
Show file extensions for known file types.
Show hidden files, folders and drives.
Hide the Home, Gallery or OneDrive section from the File Explorer navigation pane.
Hide duplicate removable drive entries from the File Explorer navigation pane, so only the entry under 'This PC' remains.
Add all common folders (Desktop, Downloads, etc.) back to 'This PC' in File Explorer.
Change drive letter position or visibility in File Explorer.

Multi-tasking

Disable window snapping.
Disable Snap Assist and Snap Layout suggestions when dragging or snapping windows.
Change whether tabs are shown when snapping windows or pressing Alt+Tab.

Optional Windows Features

Enable Windows Sandbox, a lightweight desktop environment for safely running applications in isolation.
Enable Windows Subsystem for Linux which allows you to run a Linux environment directly on Windows.

Other

Disable Xbox Game Bar integration & game/screen recording. This also disables ms-gamingoverlay/ms-gamebar popups if you uninstall the Xbox Game Bar.
Disable bloat in Brave browser (AI, Crypto, News, etc.)

Advanced Features

Ability to apply changes to a different user, instead of the currently logged in user.
Sysprep mode to apply changes to the Windows Default user profile. Which ensures, all new users will have the changes automatically applied to them.

Contributing

We welcome contributions of all kinds! Please see our Contributing Guidelines for detailed instructions on how to get started and best practices for contributing.

License

Win11Debloat is licensed under the MIT license. See the LICENSE file for more information.

actions/runner-images

GitHub Actions runner images

GitHub Actions Runner Images

Table of Contents

About

This repository contains the source code used to create the VM images for GitHub-hosted runners used for Actions, as well as for Microsoft-hosted agents used for Azure Pipelines. To build a VM machine from this repo's source, see the instructions.

Available Images

Image	Architecture	YAML Label	Included Software
Ubuntu 26.04	x64	`ubuntu-26.04`	ubuntu-26.04
Ubuntu 26.04 Arm64	arm64	`ubuntu-26.04-arm`	ubuntu-26.04-arm64
Ubuntu 24.04	x64	`ubuntu-latest` or `ubuntu-24.04`	ubuntu-24.04
Ubuntu 24.04 Arm64	arm64	`ubuntu-24.04-arm`	ubuntu-24.04-arm64
Ubuntu 22.04	x64	`ubuntu-22.04`	ubuntu-22.04
Ubuntu 22.04 Arm64	arm64	`ubuntu-22.04-arm`	ubuntu-22.04-arm64
Ubuntu Slim	x64	`ubuntu-slim`	ubuntu-slim
Xcode 27	arm64	`xcode-27` or `xcode-27-xlarge`	xcode-27
macOS 26	x64	`macos-latest-large`, `macos-26-intel`, `macos-26-large`	macOS-26
macOS 26 Arm64	arm64	`macos-latest`, `macos-26` or `macos-26-xlarge`	macOS-26-arm64
macOS 15	x64	`macos-15-large`, or `macos-15-intel`	macOS-15
macOS 15 Arm64	arm64	`macos-15`, or `macos-15-xlarge`	macOS-15-arm64
macOS 14	x64	`macos-14-large`	macOS-14
macOS 14 Arm64	arm64	`macos-14` or `macos-14-xlarge`	macOS-14-arm64
Windows Server 2025	x64	`windows-latest`, `windows-2025`, or `windows-2025-vs2026`	windows-2025-vs2026
Windows Server 2022	x64	`windows-2022`	windows-2022
Windows 11 Arm64	arm64	`windows-11-arm`	windows-11-arm64
Windows 11 Arm64 with Visual Studio 2026	arm64	`windows-11-vs2026-arm`	windows-11-vs2026-arm64

Label scheme

In general the -latest label is used for the latest OS image version that is GA.
Before moving the -latest label to a new OS version we will announce the change and give sufficient lead time for users to update their workflows.
The -xlarge and -large suffixes are unique to macOS images and are only available for GitHub Actions. Learn more about GitHub Actions larger runners.

Announcements

See notable upcoming changes by viewing issues with the Announcement label.

Image Definitions

Beta

The purpose of a Beta is to collect feedback on an image before it is released to GA. The goal of a Beta is to identify and fix any potential issues that exist on that image. Images are updated on a weekly cadence. Any workflows that run on a beta image do not fall under the customer SLA in place for Actions. Customers choosing to use Beta images are encouraged to provide feedback in the runner-images repo by creating an issue. A Beta may take on different availability, i.e. public vs private.

GA

A GA (General Availability) image has been through a Beta period and is deemed ready for general use. Images are updated on a weekly cadence. In order to be moved to GA the image must meet the following criteria:

Has been through a Beta period (public or private)
Most major software we install on the image has a compatible version for the underlying OS and
All major bugs reported during the Beta period have been addressed.

This image type falls under the customer SLA for actions. GA images are eventually deprecated according to our guidelines as we only support the latest 2 versions of an OS.

Latest Migration Process

GitHub Actions and Azure DevOps use the -latest YAML label (ex: ubuntu-latest, windows-latest, and macos-latest). These labels point towards the newest stable OS version available.

The -latest migration process is gradual and happens over 1-2 months in order to allow customers to adapt their workflows to the newest OS version. During this process, any workflow using the -latest label, may see changes in the OS version in their workflows or pipelines. To avoid unwanted migration, users can specify a specific OS version in the yaml file (ex: macos-14, windows-2022, ubuntu-22.04).

Image Releases

How to best follow along with changes

Find the latest releases for this repository here.
Subscribe to the releases coming out of this repository, instructions here.
Upcoming changes: A pre-release is created when the deployment of an image has started. As soon as the deployment is finished, the pre-release is converted to a release. If you have subscribed to releases, you will get notified of pre-releases as well.
- You can also track upcoming changes using the awaiting-deployment label.
For high impact changes, we will post these in advance to the GitHub Changelog on our blog and on X.
- Ex: breaking changes, GA or deprecation of images

Cadence

We typically deploy weekly updates to the software on the runner images.

Software and Image Support

Support Policy

Tools and versions will typically be removed 6 months after they are deprecated or have reached end-of-life
We support (at maximum) 2 GA images and 1 beta image at a time. We begin the deprecation process of the oldest image label once the newest OS image label has been released to GA.
The images generally contain the latest versions of packages installed except for Ubuntu LTS where we mostly rely on the Canonical-provided repositories.
Popular tools can have several versions installed side-by-side with the following strategy:

Tool name	Installation strategy
Docker images	not more than 3 latest LTS OS\tool versions. New images or new versions of current images are added using the standard tool request process
Java	all LTS versions
Node.js	3 latest LTS versions
Go	3 latest minor versions
Python Ruby	5 most popular `major.minor` versions
PyPy	3 most popular `major.minor` versions
.NET Core	2 latest LTS versions and 1 latest version. For each feature version only latest patch is installed. Note for Ubuntu images see details.
GCC GNU Fortran Clang GNU C++	3 latest major versions
Android NDK	1 latest non-LTS, 2 latest LTS versions
Xcode	- only one major version of Xcode will be supported per macOS version - all minor versions of the supported major version will be available - beta and RC versions will be provided "as-is" in the latest available macOS image only no matter of beta/GA status of the image - when a new patch version is released, the previous patch version will be replaced
Xcode Platforms	- only three major.minor versions of platform tools and simulator runtimes will be available for installed Xcode, including beta/RC versions

Package managers usage

We use third-party package managers to install software during the image generation process. The table below lists the package managers and the software installed.

Note

Third-party repositories are re-evaluated every year to identify if they are still useful and secure.

Operating system	Package manager	Third-party repos and packages
Ubuntu	APT	docker Eclipse-Temurin (Adoptium) Erlang Firefox git-lfs git Google Cloud CLI Heroku HHvm MongoDB Mono MS Edge PostgreSQL R
	pipx	ansible-core yamllint
Windows	Chocolatey	No third-party repos installed
macOS	Homebrew	aws-cli v2 azure/bicep mongodb/brew
	pipx	yamllint

Image Deprecation Policy

Images begin the deprecation process of the oldest image label once a new GA OS version has been released.
Deprecation process begins with an announcement that sets a date for deprecation.
As it gets closer to the date, GitHub begins doing scheduled brownouts of the image.
During this time there will be an Announcement pinned in the repo to remind users of the deprecation.
Finally, GitHub will deprecate the image and it will no longer be available.

Preinstallation Policy

In general, these are the guidelines we follow when deciding what to pre-install on our images:

Popularity: widely-used tools and ecosystems will be given priority.
Latest Technology: recent versions of tools will be given priority.
Deprecation: end-of-life tools and versions will not be added.
Licensing: MIT, Apache, or GNU licenses are allowed.
Time & Space on the Image: we will evaluate how much time is saved and how much space is used by having the tool pre-installed.
Support: If a tool requires the support of more than one version, we will consider the cost of this maintenance.

Default Version Update Policy

In general, once a new version is installed on the image, we announce the default version update 2 weeks prior to deploying it.
For potentially dangerous updates, we may extend the timeline up to 1 month between the announcement and deployment.

How to Interact with the Repo

Issues: To file a bug report, or request tools to be added/updated, please open an issue using the appropriate template
Discussions: If you want to share your thoughts about image configuration, installed software, or bring a new idea, please create a new discussion. Before making a new discussion, please make sure no similar topics were created earlier in the actions category.
For general questions about using the runner images or writing your Actions workflow, please open requests in the GitHub Community discussion Actions category.

FAQs

What images are available for GitHub Actions and Azure DevOps?

The availability of images for GitHub Actions and Azure DevOps is the same. However, deprecation policies may differ. See documentation for more details:

What image version is used in my build?

Usually, image deployment takes 2-3 days, and documentation in the main branch is only updated when deployment is finished. To find out which image version and what software versions are used in a specific build, see Set up job (GitHub Actions) or Initialize job (Azure DevOps) step log.

Looking for other Linux distributions?

We do not plan to offer other Linux distributions. We recommend using Docker if you'd like to build using other distributions with the hosted runner images. Alternatively, you can leverage self-hosted runners and fully customize your VM image to your needs.

How do I contribute to the macOS source?

macOS source lives in this repository and is available for everyone. However, macOS image-generation CI doesn't support external contributions yet so we are not able to accept pull-requests for now.

We are in the process of preparing macOS CI to accept contributions. Until then, we appreciate your patience and ask you to continue to make tool requests by filing issues.

How does GitHub determine what tools are installed on the images?

For some tools, we always install the latest at the time of the deployment; for others, we pin the tool to specific version(s). For more details please see the Preinstallation Policy

How do I request that a new tool be pre-installed on the image?

Please create an issue and get an approval from us to add this tool to the image before creating the pull request.

What branch should I use to build custom image?

We strongly encourage customers to build their own images using the main branch. This repository contains multiple branches and releases that serve as document milestones to reflect what software is installed in the images at certain point of time. Current builds are not idempotent and if one tries to build a runner image using the specific tag it is not guaranteed that the build will succeed.

zoicware/RemoveWindowsAI

Force Remove Copilot, Recall and More in Windows 11

Remove Windows Ai

Why?

The current 25H2 build of Windows 11 and future builds will include increasingly more AI features and components. This script aims to remove ALL of these features to improve user experience, privacy and security.

Script Features

Disable Registry Keys
- Disable Copilot
- Disable Recall
- Disable Input Insights and typing data harvesting
- Copilot in Edge
- Disable AI Experiments Program in Paint
- Remove AI Fabric Service
- Disable AI Actions
- Disable Voice Access
- Disable AI Voice Effects
- Disable AI in Settings Search
- Disable Gaming Copilot
- Disable Copilot in All Office Apps
- Disable AI Features in Photos App
- Disable Click to Do in Snipping Tool
Prevent Reinstall of AI Packages
- Installs custom Windows Update package to prevent reinstall of AI packages in the CBS (Component-Based Servicing) store
Disable Copilot policies
- Disables policies related to Copilot and Recall in IntegratedServicesRegionPolicySet.json
Remove AI Appx Packages
- Removes all AI appx packages including Nonremovable packages and WindowsWorkload
Remove Recall Optional Feature
Remove AI Packages in CBS
- This will remove hidden and locked AI packages in the CBS (Component-Based Servicing) store
Remove AI Files
- This will do a full system cleanup removing all remaining AI installers, registry keys, and package files
Hide AI Components
- This will hide the settings page AI Components
Disable Rewrite AI Feature in Notepad
Remove Windows AI Tasks
- Forcibly removes all instances of Windows AI scheduled tasks
Update Cleanup Check
- Creates scheduled task to check if Windows has been updated and if it has, newly installed AI features will be removed
Install Classic Apps
- These options will allow you to replace the modern AI infested apps with their classic version
- Options: Replace Notepad, Paint, Snipping Tool, Photo Viewer, and Install Photos Legacy

Manual AI Disabling

Unfortunately, not all features and settings can be disabled via a script. This guide will show additional AI features to disable.

Disable Other AI Features

Read the Script Docs Here

Documentation

Warning

Some third party anti-viruses will falsely detect the script as malicious, obviously this is a false positive and the anti-virus will need to be temporarily disabled or set the script as an exclusion.

Due to the nature of making advanced changes to the system many debloat tools/scripts will be falsely detected as malware... if you are unsure about the script I always recommend testing any software in a virtual machine first

How to Use

Run From Powershell Console as Administrator

Warning

Running the script with PowerShell 7 is no longer supported and it WILL cause issues, to avoid this ensure you are running Windows PowerShell (5.1)

Launch with UI

& ([scriptblock]::Create((irm "https://raw.githubusercontent.com/zoicware/RemoveWindowsAI/main/RemoveWindowsAi.ps1")))

Compact Command:

Link shortened using open source link shortener: https://kutt.to/

& ([scriptblock]::Create((irm 'https://kutt.to/RWAI')))

Click to View UI

Command Line Options

Run in Non-Interactive Mode with All Options

& ([scriptblock]::Create((irm "https://raw.githubusercontent.com/zoicware/RemoveWindowsAI/main/RemoveWindowsAi.ps1"))) -nonInteractive -AllOptions

Run with Specific Options Example

& ([scriptblock]::Create((irm "https://raw.githubusercontent.com/zoicware/RemoveWindowsAI/main/RemoveWindowsAi.ps1"))) -nonInteractive -Options DisableRegKeys,RemoveAppxPackages,DisableCopilotPolicies

Run with Specific Options Excluded Example

& ([scriptblock]::Create((irm "https://raw.githubusercontent.com/zoicware/RemoveWindowsAI/main/RemoveWindowsAi.ps1"))) -nonInteractive -ExcludeOptions -Options DisableRegKeys,RemoveAppxPackages,DisableCopilotPolicies

All Possible Options:

DisableRegKeys          
PreventAIPackageReinstall     
DisableCopilotPolicies       
RemoveAppxPackages        
RemoveRecallFeature 
RemoveCBSPackages         
RemoveAIFiles               
HideAIComponents            
DisableRewrite      
RemoveWindowsAITasks
UpdateCleanupCheck

Run Install Classic Apps

& ([scriptblock]::Create((irm "https://raw.githubusercontent.com/zoicware/RemoveWindowsAI/main/RemoveWindowsAi.ps1"))) -nonInteractive -InstallClassicApps photoviewer,mspaint,snippingtool,notepad

All Possible Options:

photoviewer          
mspaint     
snippingtool       
notepad        
photoslegacy

Run with Backup Mode Enabled

Note

Backup Mode needs to be enabled to be able to fully revert

This creates a restore point for you

& ([scriptblock]::Create((irm "https://raw.githubusercontent.com/zoicware/RemoveWindowsAI/main/RemoveWindowsAi.ps1"))) -nonInteractive -backupMode -AllOptions

Revert Changes

& ([scriptblock]::Create((irm "https://raw.githubusercontent.com/zoicware/RemoveWindowsAI/main/RemoveWindowsAi.ps1"))) -nonInteractive -revertMode -AllOptions

Updates

Given that Microsoft are continually updating and adding new AI features this script will attempt to stay updated for the newest stable build.

You can view the newest updates to the script here: https://github.com/zoicware/RemoveWindowsAI/commits/main/

Note

Any feature added to an Insider build will not be added to this script till it's added to the latest stable release

Tip

Submitting an AI Feature

If you find an AI feature or registry key that is not currently removed or disabled by the script submit an issue with as much information as possible and I will add it to the script.

Donation

If you would like to support my work consider donating 😃

Join The Discord

YT Guide

How to Remove ALL Windows AI Features

ntdevlabs/tiny11builder

Scripts to build a trimmed-down Windows 11 image.

tiny11builder

Scripts to build a trimmed-down Windows 11 image - now in PowerShell!

Introduction :

Tiny11 builder, now completely overhauled.
After more than a year (for which I am so sorry) of no updates, tiny11 builder is now a much more complete and flexible solution - one script fits all. Also, it is a steppingstone for an even more fleshed-out solution.

You can now use it on ANY Windows 11 release (not just a specific build), as well as ANY language or architecture. This is made possible thanks to the much-improved scripting capabilities of PowerShell, compared to the older Batch release.

This is a script created to automate the build of a streamlined Windows 11 image, similar to tiny10. The script has also been updated to use DISM's recovery compression, resulting in a much smaller final ISO size, and no utilities from external sources. The only other executable included is oscdimg.exe, which is provided in the Windows ADK and it is used to create bootable ISO images. Also included is an unattended answer file, which is used to bypass the Microsoft Account on OOBE and to deploy the image with the /compact flag. It's open-source, so feel free to add or remove anything you want! Feedback is also much appreciated.

Also, for the very first time, introducing tiny11 core builder! A more powerful script, designed for a quick and dirty development testbed. Just the bare minimum, none of the fluff. This script generates a significantly reduced Windows 11 image. However, it's not suitable for regular use due to its lack of serviceability - you can't add languages, updates, or features post-creation. tiny11 Core is not a full Windows 11 substitute but a rapid testing or development tool, potentially useful for VM environments.

⚠️ Script versions:

tiny11maker.ps1 : The regular script, which removes a lot of bloat but keeps the system serviceable. You can add languages, updates, and features post-creation. This is the recommended script for regular use.
⚠️ tiny11coremaker.ps1 : The core script, which removes even more bloat but also removes the ability to service the image. You cannot add languages, updates, or features post-creation. This is recommended for quick testing or development use.

Instructions:

Download Windows 11 from the Microsoft website or Rufus
Mount the downloaded ISO image using Windows Explorer.
Open PowerShell 5.1 as Administrator.
Change the script execution policy :

Set-ExecutionPolicy Bypass -Scope Process

Using -Scope Process you keep your original policy intact as this change only lasts for the current PowerShell session.

Start the script :

C:/path/to/your/tiny11/script.ps1 -ISO <letter> -SCRATCH <letter>

You can see of the script by running the get-help command.

Select the drive letter where the image is mounted (only the letter, no colon (😃)
Select the SKU that you want the image to be based.
Sit back and relax 😃
When the image is completed, you will see it in the folder where the script was extracted, with the name tiny11.iso

What is removed:

Tiny11maker	Tiny11coremaker
Clipchamp News Weather Xbox GetHelp GetStarted Office Hub Solitaire PeopleApp PowerAutomate ToDo Alarms Mail and Calendar Feedback Hub Maps Sound Recorder Your Phone Media Player QuickAssist Internet Explorer Tablet PC Math Edge OneDrive	all from regular tiny + Windows Component Store (WinSxS) Windows Defender (only disabled, can be enabled back if needed) Windows Update (wouldn't work without WinSxS, enabling it would put the system in a state of failure) WinRE

Keep in mind that you cannot add back features in tiny11 core!
You will be asked during image creation if you want to enable .net 3.5 support!

Known issues:

Although Edge is removed, there are some remnants in the Settings, but the app in itself is deleted.
You might have to update Winget before being able to install any apps, using Microsoft Store.
Outlook and Dev Home might reappear after some time. This is an ongoing battle, though the latest script update tries to prevent this more aggressively.
If you are using this script on arm64, you might see a glimpse of an error while running the script. This is caused by the fact that the arm64 image doesn't have OneDriveSetup.exe included in the System32 folder.

Features to be implemented:

~~disabling telemetry~~ (Implemented in the 04-29-24 release!)
~~more ad suppression~~ (Partially implemented in the 09-06-25 release!)
improved language and arch detection
more flexibility in what to keep and what to delete
maybe a GUI???

And that's pretty much it for now!

❤️ Support the Project

If this project has helped you, please consider showing your support! A small donation helps me dedicate more time to projects like this. Thank you!

Patreon | PayPal | Ko-fi Thanks for trying it and let me know how you like it!

dartraiden/NVIDIA-patcher

Adds 3D acceleration support for P106-090 / P106-100 / P104-090 / P104-100 / P102-100 / CMP 30HX / CMP 40HX / CMP 50HX / CMP 70HX / CMP 90HX / CMP 170HX mining cards as well as RTX 3060 3840SP, RTX 3080 Ti 20 GB, RTX 4070 10 GB, L40 ES, and RTX 5080M ES N22W-ES-A1.

English | Русский

English

NVIDIA patched drivers

How to use it

Windows

Linux

Donation

If you like my project, please press "Star" in the top right corner. You can also donate me some money:

Boosty
YooMoney
WebMoney
Crypto:
- BTC: bc1qakj06mgfcv8ypqeg38d6svwpefxluz90scmwvd
- LTC: ltc1qmhvewg7zjmmjw2uuyl37g26vxjjpywteppt6s9
- ETH: 0xf27585a4d02ac0308297621fac33763cd100c9f0
- USDT (Ethereum, ERC20): 0xf27585a4d02ac0308297621fac33763cd100c9f0
- TRX: TF3yJNg9wctvbNT9PteXezxc3zuzpvHk22
- USDT (Tron, TRС20): TF3yJNg9wctvbNT9PteXezxc3zuzpvHk22
- XMR (Monero): 86kq7awBWZKQt6ndJFJSdNEkAZzZQp6Fz4ToenTLNNjmGZS83LUbWEL9xtem3jwTy23KGfZr2sqK5TH5gy7bFr53QY5RN1D

Русский

Пропатченные драйверы NVIDIA

Добавляют поддержку 3D-ускорения майнинговым картам P106-090 / P106-100 / P104-100 / P104-101 / P102-100 / CMP 30HX / CMP 40HX / CMP 50HX / CMP 70HX / CMP 90HX / CMP 170HX, а также картам RTX 3060 3840SP, RTX 3080 Ti 20 GB, RTX 4070 10 GB, L40 ES и RTX 5080M ES N22W-ES-A1.

Как пользоваться

Windows

Linux

Поддержать проект

Если вам понравился этот проект, нажмите «Звезду» в правом верхнем углу. Кроме того вы можете заслать мне деньги:

Boosty
YooMoney
WebMoney
Криптовалюта:
- BTC: bc1qakj06mgfcv8ypqeg38d6svwpefxluz90scmwvd
- LTC: ltc1qmhvewg7zjmmjw2uuyl37g26vxjjpywteppt6s9
- ETH: 0xf27585a4d02ac0308297621fac33763cd100c9f0
- USDT (Ethereum, ERC-20): 0xf27585a4d02ac0308297621fac33763cd100c9f0
- XMR (Monero): 86kq7awBWZKQt6ndJFJSdNEkAZzZQp6Fz4ToenTLNNjmGZS83LUbWEL9xtem3jwTy23KGfZr2sqK5TH5gy7bFr53QY5RN1D

dotnet/core

.NET news, announcements, release notes, and more!

.NET Release Notes

Welcome to the home of .NET release notes and news.

Releases

Releases under active support or development:

Version	Release Date	Release type	Support phase	Latest Patch Version	End of Support
.NET 11.0	November 10, 2026	STS	Preview	11.0.0-preview.7	TBD
.NET 10.0	November 11, 2025	LTS	Active	10.0.11	November 14, 2028
.NET 9.0	November 12, 2024	STS	Maintenance	9.0.19	November 10, 2026
.NET 8.0	November 14, 2023	LTS	Maintenance	8.0.30	November 10, 2026

Discussions

Follow GitHub Discussions, where you will find the latest news on releases, including PSAs and CVEs.

You can subscribe to discussions with the following RSS feeds:

Category	GitHub Discussions	RSS Feed
All Discussions	🔗	🔗
News	🔗	🔗
General	🔗	🔗

hak5/usbrubberducky-payloads

The Official USB Rubber Ducky Payload Repository

Payload Library for the USB Rubber Ducky by Hak5

This repository contains payloads, extensions and languages for the Hak5 USB Rubber Ducky. Community developed payloads are listed and developers are encouraged to create pull requests to make changes to or submit new payloads.

Payloads here are written in official DuckyScript™ specifically for the USB Rubber Ducky. Payloads here must be compiled using Hak5 PayloadStudio. Hak5 does NOT guarantee payload functionality. See Legal and Disclaimers

View Featured Ducky Payloads and Leaderboard
Get your payload in front of thousands. Enter to win over $2,000 in prizes in the Hak5 Payload Awards!

Shop

Getting Started

Build and Encode Payloads with PayloadStudio | QUICK START GUIDE | Your First Payload

Documentation / Learn More

Community

Got Questions? Need some help? Reach out:

Discord | Forums

Additional Links

Follow the creators

Korben's Socials

Darren's Socials

About the NEW USB Rubber Ducky

A "flash drive" that types keystroke injection payloads into unsuspecting devices at incredible speeds.

Launch Video | Introducing Keystroke Reflection | Introducing OS Detection

New USB Rubber Ducky (A+C, DuckyScript 3.0, 2022)

Computers trust humans. Humans use keyboards. Hence the universal spec — HID, or Human Interface Device.

A keyboard presents itself as a HID, and in turn it's inherently trusted as human by the computer.

The USB Rubber Ducky — which looks like an innocent flash drive to humans — takes advantage of this trust to deliver powerful payloads, injecting keystrokes at superhuman speeds.

Easily automate any task you can perform with a keyboard with an easy to learn language designed specifically for the USB Rubber Ducky.

About DuckyScript™

Legacy DuckyScript (1.0)

Hak5 introduced Keystroke Injection in 2010 with the USB Rubber Ducky™. This technique, developed by Hak5 founder Darren Kitchen, was his weapon of choice for automating mundane tasks at his IT job — fixing printers, network shares and the like. Today the USB Rubber Ducky is a hacker culture icon, synonymous with the keystroke injection technique it pioneered. It’s found its way into the hearts and toolkits of Cybersecurity and IT pros the world over — including many movies and TV shows! Core to its success is its simple language, DuckyScript™. Originally just three commands, it could be learned by anyone—regardless of experience—in minutes.

With the new USB Rubber Ducky in 2022, DuckyScript 3.0 has been introduced.

DuckyScript 3.0

DuckyScript 3.0 is a feature rich, structured programming language. It includes all of the previously available commands and features of the original DuckyScript.

(DuckyScript 3.0 is backwards compatible with DuckyScript 1.0; this means all your favorite DuckyScript 1.0 payloads are valid DuckyScript 3.0)

Additionally, DuckyScript 3.0 introduces control flow constructs, loops, functions, extensions. Plus, DuckyScript 3.0 includes many features specific to keystroke injection attack/automation, such as HID & Storage attack modes, OS Detection, Keystroke Reflection (Video + Whitepaper), jitter and randomization to name a few.

While many of the Hak5 Tools run various versions of DuckyScript; unlike the Bash Bunny, Key Croc and even the officially licenced DuckyScript compatible devices from O.MG - which use INTERPRETED versions of DuckyScript - the USB Rubber Ducky uses COMPILED inject.bin payloads.

Interpreted DuckyScript means the payload runs straight from source code (the code you write e.g. DELAY 1000).

Compiled DuckyScript means that there is both source code and an inject.bin generated from the source code. (DuckyScript 1.0 was "encoded" rather than "compiled" - references to either mean the same)

The files in this repository are the source code in the form of payload.txt files.

Learn DuckyScript directly from the creators

Learn Advanced DuckyScript directly from the creators and unlock creative potential for the USB Rubber Ducky. Covering all aspects of advanced DuckyScript and Keystroke Injection attacks, these practical lessons build on one another from the basics on up.

This online course includes 7 hours of video instruction covering 54 lessons, 40+ exercises to reinforce your knowledge, quizzes throughout as well as 8 projects to test your skills.

Build your payloads with PayloadStudio

Take your DuckyScript™ payloads to the next level with this full-featured, web-based (entirely client side) development environment.

Payload studio features all of the conveniences of a modern IDE, right from your browser. From syntax highlighting and auto-completion to live error-checking and repo synchronization - building payloads for Hak5 hotplug tools has never been easier!

Supports your favorite Hak5 gear - USB Rubber Ducky, Bash Bunny, Key Croc, Shark Jack, Packet Squirrel & LAN Turtle!

Become a PayloadStudio Pro and Unleash your hacking creativity!
OR
Try Community Edition FREE

Payload Studio Themes Preview GIF

Payload Studio Autocomplete Preview GIF

DuckyScript Ecosystem

Languages

Support for different keyboard layouts can be found, modified or contributed to in the languages/ directory of this repository.

Compiling payloads for the correct language / keyboard layout has never been easier:

Open PayloadStudio > Settings > Compiler Settings

PayloadStudio includes all the languages provided in this repo built-in for your convenience.

PayloadStudio Pro has a dedicated language editor specifically for editing and building language files!

The default language is US (languages/us.json)

Extensions

It should be clear by now that so much is possible with DuckyScript 3.0. The combination of keystroke injection with various attack modes, logic and data processing, along with the built-in features like randomization and internal variables — the possibilities for advanced payload functions seems endless.

Payload Studio Extensions Preview GIF

As the payload library continues to grow, so too will the DuckyScript 3.0 language. To that end, the extensions feature of the language and editor facilitate the continued growth of the language. Extensions are blocks of reusable code which may be implemented in any payload. Think of them as snippets, or building blocks, upon which your next payload may benefit. While Hak5 developers cannot envision all possible use cases for the USB Rubber Ducky, the DuckyScript language has been architected in such a way so that the community as a whole may gain new features and abilities with each contributed extension.

Extensions (beyond some first party examples) are currently reserved for collections of helper functions (+ required variables, defines, and configuration options) required to make a complex task simple - abstracting very complex problems down into one or a few calls for the ease of use to others (example: the translate extension).

To add an extension to your payload, simply start typing the name of the desired extension in your payload from within PayloadStudio then select it from the auto-complete drop down. Alternatively the full library can be found from within the Extensions folder of this repo.

Contributing

View Featured Payloads and Leaderboard

Please adhere to the following best practices and style guides when submitting a payload.

Once you have developed your payload, you are encouraged to contribute to this repository by submitting a Pull Request. Reviewed and Approved pull requests will add your payload to this repository, where they may be publically available.

Please include all resources required for the payload to run. If needed, provide a README.md in the root of your payload's directory to explain things such as intended use, required configurations, or anything that will not easily fit in the comments of the payload.txt itself. Please make sure that your payload is tested, and free of errors. If your payload contains (or is based off of) the work of other's please make sure to cite their work giving proper credit.

Purely Destructive payloads will not be accepted. No, it's not "just a prank".

Subject to change. Please ensure any submissions meet the latest version of these standards before submitting a Pull Request.

Naming Conventions

Please give your payload a unique, descriptive and appropriate name. Do not use spaces in payload, directory or file names. Each payload should be submit into its own directory, with - or _ used in place of spaces, to one of the categories such as exfiltration, phishing, remote_access or recon. Do not create your own category.

Staged Payloads

"Staged payloads" are payloads that download code from some resource external to the payload.txt.

While staging code used in payloads is often useful and appropriate, using this (or another) github repository as the means of deploying those stages is not. This repository is not a CDN for deployment on target systems.

Staged code should be copied to and hosted on an appropriate server for doing so by the end user - Github and this repository are simply resources for sharing code among developers and users. See: GitHub acceptable use policies

Additionally, any source code that is intended to be staged (by the end user on the appropriate infrastructure) should be included in any payload submissions either in the comments of the payload itself or as a seperate file. Links to staged code are unacceptable; not only for the reasons listed above but also for version control and user safety reasons. Arbitrary code hidden behind some pre-defined external resource via URL in a payload could be replaced at any point in the future unbeknownst to the user -- potentially turning a harmless payload into something dangerous.

Including URLs

URLs used for retrieving staged code should refer exclusively to example.com using DEFINE in any payload submissions see Payload Configuration section below.

Staged Example

Example scenario: your payload downloads a script and the executes it on a target machine.

Include the script in the directory with your payload
Provide instructions for the user to move the script to the appropriate hosting service.
Provide a DEFINE with the placeholder example.com for the user to easily configure once they have hosted the script

Simple Example of this style of payload

Payload Configuration

Be sure to take the following into careful consideration to ensure your payload is easily tested, used and maintained. In many cases, payloads will require some level of configuration by the end payload user.

Abstract configuration(s) for ease of use. Use DEFINE where possible. Best practice is to use labels that start with # for easy identification throughout your payload.
Remember to use PLACEHOLDERS for configurable portions of your payload - do not share your personal URLs, API keys, Passphrases, etc...
URLs to staged payloads SHOULD NOT BE INCLUDED. URLs should be replaced by example.com. Provide instructions on how to specific resources should be hosted on the appropriate infrastructure.
Make note of both REQUIRED and OPTIONAL configuration(s) in your payload using comments at the top of your payload or "inline" where applicable

Example: 
	BEGINNING OF PAYLOAD 
	... Payload Documentation... 

	REM CONFIGURATION
	REM REQUIRED - Provide URL used for Example
	DEFINE #MY_TARGET_URL example.com

	REM OPTIONAL - How long until payload starts; default 5s
	DEFINE #BOOT_DELAY 5000

	DELAY #BOOT_DELAY
	...
	STRING #MY_TARGET_URL
	...

Payload Documentation

Payloads should begin with REM comments specifying the title of the payload, the author, the target, and a brief description.

Example:
	BEGINNING OF PAYLOAD

	REM Title: Example Payload
	REM Author: Korben Dallas
	REM Description: Opens hidden powershell and
	REM Target: Windows 10
	REM Props: Hak5, Darren Kitchen, Korben
	REM Version: 1.0
	REM Category: General

Legal

Payloads from this repository are provided for educational purposes only. Hak5 gear is intended for authorized auditing and security analysis purposes only where permitted subject to local and international laws where applicable. Users are solely responsible for compliance with all laws of their locality. Hak5 LLC and affiliates claim no responsibility for unauthorized or unlawful use.

USB Rubber Ducky and DuckyScript are the trademarks of Hak5 LLC. Copyright © 2010 Hak5 LLC. All rights reserved. No part of this work may be reproduced or transmitted in any form or by any means without prior written permission from the copyright owner. USB Rubber Ducky and DuckyScript are subject to the Hak5 license agreement (https://hak5.org/license) DuckyScript is the intellectual property of Hak5 LLC for the sole benefit of Hak5 LLC and its licensees. To inquire about obtaining a license to use this material in your own project, contact us. Please report counterfeits and brand abuse to legal@hak5.org. This material is for education, authorized auditing and analysis purposes where permitted subject to local and international laws. Users are solely responsible for compliance. Hak5 LLC claims no responsibility for unauthorized or unlawful use. Hak5 LLC products and technology are only available to BIS recognized license exception ENC favorable treatment countries pursuant to US 15 CFR Supplement No 3 to Part 740.

Disclaimer

As with any script, you are advised to proceed with caution.

Generally, payloads may execute commands on your device. As such, it is possible for a payload to damage your device. Payloads from this repository are provided AS-IS without warranty. While Hak5 makes a best effort to review payloads, there are no guarantees as to their effectiveness.

Orange-Cyberdefense/GOAD

game of active directory

GOAD (v3)

🔖 Documentation : https://orange-cyberdefense.github.io/GOAD/

Description

GOAD is a pentest active directory LAB project. The purpose of this lab is to give pentesters a vulnerable Active directory environment ready to use to practice usual attack techniques.

Caution

This lab is extremely vulnerable, do not reuse recipe to build your environment and do not deploy this environment on internet without isolation (this is a recommendation, use it as your own risk).
This repository was build for pentest practice.

Licenses

This lab use free Windows VM only (180 days). After that delay enter a license on each server or rebuild all the lab (may be it's time for an update 😉)

Available labs

GOAD Lab family and extensions overview

GOAD : 5 vms, 2 forests, 3 domains (full goad lab)

GOAD-Light : 3 vms, 1 forest, 2 domains (smaller goad lab for those with a smaller pc)

MINILAB: 2 vms, 1 forest, 1 domain (basic lab with one DC (windows server 2019) and one Workstation (windows 10))
SCCM : 4 vms, 1 forest, 1 domain, with microsoft configuration manager installed

NHA : A challenge with 5 vms and 2 domains. no schema provided, you will have to find out how break it.

DRACARYS : A challenge with 3 vms and 1 domains. no schema provided, you will have to find out how break it.

ScoopInstaller/Extras

📦 The Extras bucket for Scoop.

Scoop Extras

Extra manifests for Scoop, the Windows command-line installer. For manifests that don't fit the Main criteria.

How do I install these manifests?

To add this bucket, run scoop bucket add extras. To install, do scoop install <manifest>.

How do I contribute new manifests?

To make a new manifest contribution, please read the Contributing Guide.

github/copilot-plugins

The official GitHub Copilot plugins collection — MCP servers, skills, hooks, and other extensibility tools for GitHub Copilot.

copilot-plugins

The official GitHub Copilot plugins collection ✨

Extend the power of GitHub Copilot with MCP servers, skills, hooks, and other extensibility tools — all in one place.

🔌 What's Inside

Skills — Reusable prompts and workflows for common tasks
MCP Servers — Model Context Protocol servers that give Copilot new capabilities (coming soon)
Hooks — Custom integrations and event-driven automations
Extensibility Tools — Building blocks for creating your own plugins (coming soon)

🌐 External Plugins

This marketplace also references plugins hosted in other repositories:

Advanced Security — Access to GitHub Advanced Security capabilities such as dependency scanning and secret scanning.
Microsoft Skills for Fabric — fabric-skills, fabric-authoring, fabric-consumption, fabric-operations, powerbi-authoring. Skills and agents for Microsoft Fabric (Lakehouse, Warehouse, Power BI, Eventhouse, Eventstream, Dataflows, Spark).
Microsoft C++ Language Server — Navigate and interact with your C++ code.
Power Platform Skills — power-pages, model-apps, mcp-apps, canvas-apps, code-apps-preview, mobile-app, power-automate. Plugins for Power Platform development (Power Pages sites, model-driven and canvas apps, code apps, MCP App widgets, mobile apps, and Power Automate cloud flows).

🤝 Contributing

We'd love your contributions! Please read our Contributing Guide for details on how to submit pull requests.

📄 License

This project is licensed under the MIT License.

microsoftgraph/microsoft-graph-docs-contrib

Documentation for the Microsoft Graph REST API

Microsoft Graph documentation

Thank you for your interest in Microsoft Graph documentation! For the best experience, we recommend you view this content on Microsoft Learn.

Give us your feedback

Your feedback is important to us.

To let us know about any questions or issues you find in the documentation, leave feedback using the standard experience.
We also encourage you to fork, make the fix, and do a pull request of your proposed changes. See CONTRIBUTING.md for contributing guidelines.
To let us know about your programming experience, what you would like to see in future versions, code samples, and so on, enter your suggestions and ideas at Microsoft 365 Developer Platform Tech Community.

Code of conduct

This project has adopted the Microsoft Open Source Code of Conduct. For more information see the Code of Conduct FAQ or contact opencode@microsoft.com with any additional questions or comments.

microsoft/fabric-toolbox

Fabric toolbox is a repository of tools, accelerators, scripts, and samples to accelerate your success with Microsoft Fabric, brought to you by Fabric CAT.

Welcome to the Fabric Toolbox

Fabric toolbox is a repository of tools, accelerators, scripts, and samples to help you work with Microsoft Fabric. This repository is brought to you by the Fabric Customer Advisory Team (CAT) and will continue to grow as we develop new tools and accelerators.

These assets should be treated as examples that you can use to create the solutions that are appropriate for your use case. If you have any issues, please use the issues tab of this repository and we will work to address issues on a best effort basis.

Monitoring

$${\color{yellow}UPDATED!}$$ Fabric Cost Analysis (FCA)
$${\color{yellow}UPDATED!}$$ Fabric Unified Admin Monitoring (FUAM)
Fabric Platform Monitoring (Monitor Fabric with RTI and Capacity Events)
Workspace Monitoring Report Templates
Fabric Spark Monitoring (Monitor Spark with RTI)

Accelerators

Samples

Scripts

$${\color{green}NEW!}$$ Mirror CCI Tables for Fabric SQL DB
CI Views
DW/SQL AE Properties
DW Active Requests
DW Copy DMV to Table
DW Queries Running at Timepoint
DW SP Kill Queries

Tools

$${\color{green}NEW!}$$ Fabric Assessment Tool
$${\color{yellow}UPDATED!}$$ Fabric Data Factory Migration Assistant
DAX Performance Tuner MCP Server
Semantic Model MCP Server
Open Mirroring SDK
MicrosoftFabricMgmt PowerShell Module
Gen2 Dedicated Pool to Fabric DW Table Copy
Semantic Model Audit
Copy Warehouse
TPCH Benchmarking
DAX Performance Testing

Contributing

This project welcomes contributions and suggestions. Most contributions require you to agree to a Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us the rights to use your contribution. For details, visit https://cla.opensource.microsoft.com.

When you submit a pull request, a CLA bot will automatically determine whether you need to provide a CLA and decorate the PR appropriately (e.g., status check, comment). Simply follow the instructions provided by the bot. You will only need to do this once across all repos using our CLA.

This project has adopted the Microsoft Open Source Code of Conduct. For more information see the Code of Conduct FAQ or contact opencode@microsoft.com with any additional questions or comments.

Trademarks

This project may contain trademarks or logos for projects, products, or services. Authorized use of Microsoft trademarks or logos is subject to and must follow Microsoft's Trademark & Brand Guidelines. Use of Microsoft trademarks or logos in modified versions of this project must not cause confusion or imply Microsoft sponsorship. Any use of third-party trademarks or logos are subject to those third-party's policies.

SkipToTheEndpoint/OpenIntuneBaseline

Community-driven baseline to accelerate Intune adoption and learning.

OpenIntuneBaseline

| |

Important

This has been developed as a starting point or foundation and is not necessarily considered "complete". It is being made available to allow learning, development, and knowledge-sharing amongst communities.

No liability is assumed for the usage or application of the settings within this project in production tenants.

About the Author

James is a Technical Architect and Microsoft MVP in both Intune and Windows, and has been working in the IT industry for over 20 years, with the last 8 being primarily within Intune. He is also a recognised contributor to the CIS Windows Benchmarks. He has a wealth of experience across the Microsoft 365 stack, with a focus on security and compliance, and is a regular attendee and speaker at community events such as MMS and Workplace Ninja Summit, and is passionate about sharing knowledge and helping others.

About the Project

Project History

The OpenIntuneBaseline (OIB) project was started in early 2021 as a way to provide a "known good" baseline security posture for Windows devices managed by Microsoft Intune, after being disappointed with the admin and user experience of other available baselines.

Security Framework Adherence

When creating the initial Windows baseline, substantial data analysis was carried out over well-known security frameworks, such as:

NCSC Device Security Guidance
CIS Windows Benchmarks
ACSC Essential Eight
Intune Security Baselines for Windows, Edge & Defender for Endpoint
Microsoft Best Practice

The OIB was not created by simply applying the recommendations from these frameworks. While there is obviously significant overlap, I was driven to create something that included a number of user-experience additions not seen in the above frameworks, as well as my own significant experience implementing these across multiple customer environments, and how admin managability can be impacted by doing so.

Security frameworks tend to be seen as unmovable hard requirements rather than what they are, which is a set of recommendations. In fact, the CIS themselves preface their benchmarks with the following:

It is acceptable if 100% of the benchmark is not applied, as it is the responsibility and decision of each organization to determine which settings are applicable to their unique needs.

It is impossible to create a true "one-size-fits-all" set of policies due to the massively differing nature of enterprise requirements. There is also a significant amount of "noise" in the security community, with many recommending settings that are not necessarily required or beneficial, such as enforcing default behaviour that a standard user cannot change, or settings that have been included in GPO baselines since the days of Windows 7.

This baseline is designed to be a starting point or guide, and all configurations applied to an environment regardless of source should be reviewed and adjusted to suit your own business requirements.

That being said, if there's something you feel is missing or should be included, please feel free to raise an issue or submit a PR.

Importing the Baseline

There are three options to import the baseline:

OIB Deployer

My own tool, the OIB Deployer, allows for platform-specific, granular deployment of the baseline, as well as being able to check for existing OIB policies in your tenant, and highlight missing or updated policies.

Only requires a single application permission accepting (DeviceManagementConfiguration.ReadWrite.All), and can do a complete import in less than a minute!

IntuneManagement

The OG deployment method, and how I still export the majority of baseline policies.

These files have been exported using the IntuneManagement tool developed by Mikael Karlsson, and can be imported in the same way. Please consult the IntuneManagement documentation for further information on how to import the baseline or for issues.

You can choose to import as much or as little of the baseline as you wish, though you will need to change the "Root folder" to the appropriate folder for the platform (e.g. WINDOWS), or policy types (e.g. Settings Catalog) you wish to import.

Native Import

I understand not everyone has the ability or permissions to use the IntuneManagement tool, and have been asked to support using the native import/export functionality in Intune.

NOTE: The Native Import is limited to only importing Settings Catalog policies in the Device Configuration blade. This means settings outside of that (e.g. Compliance, Endpoint Security) are not available. I would recommend submitting feedback within Intune to expand the ability to import/export all policy types.

Versioning & Repo Structure

This project started as Windows only and the naming convention has been somewhat... fluid. Now that additional OS's have been added, some form of standardisation is necessary. Version numbers will primarily follow the format of Major.Minor, occasionally using Major.Minor.Patch if something fits in the "bug fix" category.

Each OS will have its own folder, with OS-specific files (readme, changelog, baseline JSON's, supporting information etc.) contained within.

The current OIB versions are:

OS	Current Release	Change Log	Wiki Page
Windows	v3.8	Link	Link
Windows 365	v1.0	Link	Link
MacOS	v1.0	Link	Link

Please consult the wiki pages and README.md in each OS folder for more information.

Policy Naming Convention

Across the OIB, the following naming convention is used, seen below with some examples:

OS		Identifier		Category		Device/User Assignment		Sub-Category		Version
Win	-	OIB	-	Device Security	-	D	-	Login and Lock Screen	-	v3.0
Win365	-	OIB	-	Device Security	-	D	-	Resource Redirection	-	v1.0
MacOS	-	OIB	-	Microsoft Edge	-	D	-	Security	-	v1.0

Further information on the naming convention can be found in the FAQ.

ScoopInstaller/Scoop

A command-line installer for Windows.

Scoop

Features | Installation | Documentation

Scoop is a command-line installer for Windows.

What does Scoop do?

Scoop installs apps from the command line with a minimal amount of friction. It:

Eliminates User Account Control (UAC) prompt notifications.
Hides the graphical user interface (GUI) of wizard-style installers.
Prevents polluting the PATH environment variable. Normally, this variable gets cluttered as different apps are installed on the device.
Avoids unexpected side effects from installing and uninstalling apps.
Resolves and installs dependencies automatically.
Performs all the necessary steps to get an app to a working state.

Scoop is quite script-friendly. Your environment can become the way you like by using repeatable setups. For example:

scoop install sudo
sudo scoop install 7zip git openssh --global
scoop install aria2 curl grep sed less touch
scoop install python ruby go perl

If you have built software that you would like others to use, Scoop is an alternative to building an installer (like MSI or InnoSetup). You just need to compress your app to a .zip file and provide a JSON manifest that describes how to install it.

Installation

Run the following commands from a regular (non-admin) PowerShell terminal to install Scoop:

Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser
Invoke-RestMethod -Uri https://get.scoop.sh | Invoke-Expression

Note: The first command makes your device allow running the installation and management scripts. This is necessary because Windows 10 client devices restrict execution of any PowerShell scripts by default.

It will install Scoop to its default location:

C:\Users\<YOUR USERNAME>\scoop

You can find the complete documentation about the installer, including advanced installation configurations, in ScoopInstaller/Install. Please create new issues there if you have questions about the installation.

Multi-connection downloads with `aria2`

Scoop can utilize aria2 to use multi-connection downloads. Simply install aria2 through Scoop and it will be used for all downloads afterward.

scoop install aria2

By default, scoop displays a warning when running scoop install or scoop update while aria2 is enabled. This warning can be suppressed by running scoop config aria2-warning-enabled false.

You can tweak the following aria2 settings with the scoop config command:

aria2-enabled (default: true)
aria2-warning-enabled (default: true)
aria2-retry-wait (default: 2)
aria2-split (default: 5)
aria2-max-connection-per-server (default: 5)
aria2-min-split-size (default: 5M)
aria2-options (default: )

Inspiration

Homebrew
Sub

What sort of apps can Scoop install?

The apps that are most likely to get installed fine with Scoop are those referred to as "portable" apps. These apps are compressed files which can run standalone after being extracted. This type of apps does not produce side effects like changing the Windows Registry or placing files outside the app directory.

Scoop also supports installer files and their uninstallation methods. Likewise, it can handle single-file apps and PowerShell scripts. These do not even need to be compressed. See the runat package for an example: it is simply a GitHub gist.

Contribute to this project

If you would like to improve Scoop by adding features or fixing bugs, please read our Contributing Guide.

Support this project

If you find Scoop useful and would like to support the ongoing development and maintenance of this project, you can donate here:

PayPal (one-time donations)

Known application buckets

The following buckets are known to Scoop:

main - Default bucket which contains popular non-GUI apps.
extras - Apps that do not fit the main bucket's criteria.
games - Open-source and freeware video games and game-related tools.
nerd-fonts - Nerd Fonts.
nirsoft - A collection of over 250+ apps from Nirsoft.
sysinternals - The Sysinternals suite from Microsoft.
java - A collection of Java development kits (JDKs) and Java runtime engines (JREs), Java's virtual machine debugging tools and Java based runtime engines.
nonportable - Non-portable apps (may trigger UAC prompts).
php - Installers for most versions of PHP.
versions - Alternative versions of apps found in other buckets.

The main bucket is installed by default. You can make use of more buckets by typing:

scoop bucket add <name>

For example, to add the extras bucket, type:

scoop bucket add extras

You would be able to install apps from the extras bucket now.

Other application buckets

Many other application buckets hosted on GitHub can be found on ScoopSearch or via other search engines.

PowerShellMafia/PowerSploit

PowerSploit - A PowerShell Post-Exploitation Framework

This project is no longer supported

PowerSploit is a collection of Microsoft PowerShell modules that can be used to aid penetration testers during all phases of an assessment. PowerSploit is comprised of the following modules and scripts:

CodeExecution

Execute code on a target machine.

`Invoke-DllInjection`

Injects a Dll into the process ID of your choosing.

`Invoke-ReflectivePEInjection`

Reflectively loads a Windows PE file (DLL/EXE) in to the powershell process, or reflectively injects a DLL in to a remote process.

`Invoke-Shellcode`

Injects shellcode into the process ID of your choosing or within PowerShell locally.

`Invoke-WmiCommand`

Executes a PowerShell ScriptBlock on a target computer and returns its formatted output using WMI as a C2 channel.

ScriptModification

Modify and/or prepare scripts for execution on a compromised machine.

`Out-EncodedCommand`

Compresses, Base-64 encodes, and generates command-line output for a PowerShell payload script.

`Out-CompressedDll`

Compresses, Base-64 encodes, and outputs generated code to load a managed dll in memory.

`Out-EncryptedScript`

Encrypts text files/scripts.

`Remove-Comment`

Strips comments and extra whitespace from a script.

Persistence

Add persistence capabilities to a PowerShell script

`New-UserPersistenceOption`

Configure user-level persistence options for the Add-Persistence function.

`New-ElevatedPersistenceOption`

Configure elevated persistence options for the Add-Persistence function.

`Add-Persistence`

Add persistence capabilities to a script.

`Install-SSP`

Installs a security support provider (SSP) dll.

`Get-SecurityPackages`

Enumerates all loaded security packages (SSPs).

AntivirusBypass

AV doesn't stand a chance against PowerShell!

`Find-AVSignature`

Locates single Byte AV signatures utilizing the same method as DSplit from "class101".

Exfiltration

All your data belong to me!

`Invoke-TokenManipulation`

Lists available logon tokens. Creates processes with other users logon tokens, and impersonates logon tokens in the current thread.

`Invoke-CredentialInjection`

Create logons with clear-text credentials without triggering a suspicious Event ID 4648 (Explicit Credential Logon).

`Invoke-NinjaCopy`

Copies a file from an NTFS partitioned volume by reading the raw volume and parsing the NTFS structures.

`Invoke-Mimikatz`

Reflectively loads Mimikatz 2.0 in memory using PowerShell. Can be used to dump credentials without writing anything to disk. Can be used for any functionality provided with Mimikatz.

`Get-Keystrokes`

Logs keys pressed, time and the active window.

`Get-GPPPassword`

Retrieves the plaintext password and other information for accounts pushed through Group Policy Preferences.

`Get-GPPAutologon`

Retrieves autologon username and password from registry.xml if pushed through Group Policy Preferences.

`Get-TimedScreenshot`

A function that takes screenshots at a regular interval and saves them to a folder.

`New-VolumeShadowCopy`

Creates a new volume shadow copy.

`Get-VolumeShadowCopy`

Lists the device paths of all local volume shadow copies.

`Mount-VolumeShadowCopy`

Mounts a volume shadow copy.

`Remove-VolumeShadowCopy`

Deletes a volume shadow copy.

`Get-VaultCredential`

Displays Windows vault credential objects including cleartext web credentials.

`Out-Minidump`

Generates a full-memory minidump of a process.

`Get-MicrophoneAudio`

Records audio from system microphone and saves to disk

Mayhem

Cause general mayhem with PowerShell.

`Set-MasterBootRecord`

Proof of concept code that overwrites the master boot record with the message of your choice.

`Set-CriticalProcess`

Causes your machine to blue screen upon exiting PowerShell.

Privesc

Tools to help with escalating privileges on a target.

`PowerUp`

Clearing house of common privilege escalation checks, along with some weaponization vectors.

Recon

Tools to aid in the reconnaissance phase of a penetration test.

`Invoke-Portscan`

Does a simple port scan using regular sockets, based (pretty) loosely on nmap.

`Get-HttpStatus`

Returns the HTTP Status Codes and full URL for specified paths when provided with a dictionary file.

`Invoke-ReverseDnsLookup`

Scans an IP address range for DNS PTR records.

`PowerView`

PowerView is series of functions that performs network and Windows domain enumeration and exploitation.

Recon\Dictionaries

A collection of dictionaries used to aid in the reconnaissance phase of a penetration test. Dictionaries were taken from the following sources.

admin.txt - http://cirt.net/nikto2/
generic.txt - http://sourceforge.net/projects/yokoso/files/yokoso-0.1/
sharepoint.txt - http://www.stachliu.com/resources/tools/sharepoint-hacking-diggity-project/

License

The PowerSploit project and all individual scripts are under the BSD 3-Clause license unless explicitly noted otherwise.

Usage

Refer to the comment-based help in each individual script for detailed usage information.

To install this module, drop the entire PowerSploit folder into one of your module directories. The default PowerShell module paths are listed in the $Env:PSModulePath environment variable.

The default per-user module path is: "$Env:HomeDrive$Env:HOMEPATH\Documents\WindowsPowerShell\Modules" The default computer-level module path is: "$Env:windir\System32\WindowsPowerShell\v1.0\Modules"

To use the module, type Import-Module PowerSploit

To see the commands imported, type Get-Command -Module PowerSploit

If you're running PowerShell v3 and you want to remove the annoying 'Do you really want to run scripts downloaded from the Internet' warning, once you've placed PowerSploit into your module path, run the following one-liner: $Env:PSModulePath.Split(';') | % { if ( Test-Path (Join-Path $_ PowerSploit) ) {Get-ChildItem $_ -Recurse | Unblock-File} }

For help on each individual command, Get-Help is your friend.

Note: The tools contained within this module were all designed such that they can be run individually. Including them in a module simply lends itself to increased portability.

Contribution Rules

We need contributions! If you have a great idea for PowerSploit, we'd love to add it. New additions will require the following:

The script must adhere to the style guide. Any exceptions to the guide line would need an explicit, valid reason.
The module manifest needs to be updated to reflect the new function being added.
A brief description of the function should be added to this README.md
Pester tests must accompany all new functions. See the Tests folder for examples but we are looking for tests that at least cover the basics by testing for expected/unexpected input/output and that the function exhibits desired functionality. Make sure the function is passing all tests (preferably in mutiple OSes) prior to submitting a pull request. Thanks!

Script Style Guide

For all contributors and future contributors to PowerSploit, I ask that you follow this style guide when writing your scripts/modules.

Avoid Write-Host at all costs. PowerShell functions/cmdlets are not command-line utilities! Pull requests containing code that uses Write-Host will not be considered. You should output custom objects instead. For more information on creating custom objects, read these articles:
- http://blogs.technet.com/b/heyscriptingguy/archive/2011/05/19/create-custom-objects-in-your-powershell-script.aspx
- http://technet.microsoft.com/en-us/library/ff730946.aspx
If you want to display relevant debugging information to the screen, use Write-Verbose. The user can always just tack on '-Verbose'.
Always provide descriptive, comment-based help for every script. Also, be sure to include your name and a BSD 3-Clause license (unless there are extenuating circumstances that prevent the application of the BSD license).
Make sure all functions follow the proper PowerShell verb-noun agreement. Use Get-Verb to list the default verbs used by PowerShell. Exceptions to supported verbs will be considered on a case-by-case basis.
I prefer that variable names be capitalized and be as descriptive as possible.
Provide logical spacing in between your code. Indent your code to make it more readable.
If you find yourself repeating code, write a function.
Catch all anticipated errors and provide meaningful output. If you have an error that should stop execution of the script, use 'Throw'. If you have an error that doesn't need to stop execution, use Write-Error.
If you are writing a script that interfaces with the Win32 API, try to avoid compiling C# inline with Add-Type. Try to use the PSReflect module, if possible.
Do not use hardcoded paths. A script should be useable right out of the box. No one should have to modify the code unless they want to.
PowerShell v2 compatibility is highly desired.
Use positional parameters and make parameters mandatory when it makes sense to do so. For example, I'm looking for something like the following:
- [Parameter(Position = 0, Mandatory = $True)]
Don't use any aliases unless it makes sense for receiving pipeline input. They make code more difficult to read for people who are unfamiliar with a particular alias.
Try not to let commands run on for too long. For example, a pipeline is a natural place for a line break.
Don't go overboard with inline comments. Only use them when certain aspects of the code might be confusing to a reader.
Rather than using Out-Null to suppress unwanted/irrelevant output, save the unwanted output to $null. Doing so provides a slight performance enhancement.
Use default values for your parameters when it makes sense. Ideally, you want a script that will work without requiring any parameters.
If a script creates complex custom objects, include a ps1xml file that will properly format the object's output.

	Atlas Cloud is a full-modal AI inference platform that provides unified API access to 400+ curated image, video, audio, 3D, and language models. Atlas Cloud supports reverse-skill with model services for cross-platform routing verification, documentation, and open security workflows.
	Kite AI builds identity and payment infrastructure for the agent economy. Its support helps sustain reverse-skill's open-source maintenance, routing benchmarks, and platform-neutral security workflows.