reverse-skill: seguridad y operaciones para investigación autorizada

Authorization is the first security control

Exige autorización, objetivo, fechas, acciones y stop conditions antes del caso. Aplica mínimo privilegio, allow-lists, aislamiento, hashes, redacción y retención a herramientas, clientes y evidencia.

Keep CTF or malware fixtures isolated from production credentials and networks. Use snapshots, disposable VMs, and egress controls for samples that may execute or phone home.

Constrain tools and clients

Tools such as Frida, Burp/Reqable, nmap, IDA/radare2/Ghidra, YARA, and exploit-development playbooks have different privilege and network implications. Run least-privilege processes, allow-list binaries and domains, require approval for active scans or writes, and record the exact tool/version used.

Client adapters and MCP servers can widen filesystem or network access. Keep them optional, review generated commands, and do not allow a model to override `RULES.md`, scope, or case policy through prompt text.

Protect evidence and reporting

Treat APKs, binaries, PCAPs, frontend payloads, credentials, and findings as sensitive. Hash artifacts, encrypt controlled storage, redact logs and reports, restrict readers, and set deletion/retention dates. Separate raw evidence from derived findings so a report can be shared without exposing a sample or secret.

Use Evidence→Finding→Path and confidence/limitations fields to prevent speculation from becoming a claim. Case-review should verify fixity before handoff.

Respond and recover

If scope changes, a tool behaves unexpectedly, or data may have leaked, stop the case and network activity, preserve redacted timelines, revoke credentials, quarantine the host/artifact, notify the owner, and restore a known-good environment. Rerun routing/coherence/smoke checks after remediation and document the decision.