zhaoxuya520/reverse-skill899 installs

thick-client

Q: How do I install this agent skill?

Run npx skills add https://github.com/zhaoxuya520/reverse-skill --skill thick-client.

Q: Is this agent skill safe to install?

Review the displayed partner audits, complete source, permissions, dependencies, and exact revision before installing.

Use for authorized security testing of desktop thick clients including local storage, update channels, IPC, traffic, and client-side trust boundaries.

How do I install this agent skill?

npx skills add https://github.com/zhaoxuya520/reverse-skill --skill thick-client

view source ↗

Is this agent skill safe to install?

Gen Agent Trust Hubpass
This skill provides a structured framework and checklist for performing authorized security assessments of desktop thick-client applications. It covers local attack surfaces, network traffic analysis, and reverse engineering workflows without introducing any malicious code or unsafe practices.
Socketwarn
1 alert: gptSecurity
Snykpass
Risk: LOW · No issues

What does this agent skill do?

Thick Client Security Testing

ACTION REQUIRED（读完后立刻执行）

NOW: 读取 ../field-journal/precedent-pentest.md
NOW: 确认目标是 桌面厚客户端（Win/macOS/Linux GUI 或服务伴生），非纯 Web
NOW: case-init；安装包来源与测试账号写入 scope
NEXT: 工具（Burp 上游代理、进程监控、逆向工具）
ACT: 信任边界图 → 本地面 → 网络面 → 更新/供应链

适用场景

C/S 架构客户端、Electron/Qt/.NET WinForms/WPF
本地配置/凭证存储、IPC、命名管道
客户端强制校验绕过研究（授权）
自动更新通道与代码签名验证

工作流

1. 建边界

□ 进程树、子进程、驱动/服务
□ 监听端口与出站域名
□ 本地敏感路径：%APPDATA%、Keychain、注册表

2. 本地攻击面

□ 明文配置、硬编码密钥、调试开关
□ DLL 劫持/搜索顺序（Windows）
□ 数据库文件（SQLite）权限与加密
□ IPC：谁可连接？是否鉴权？

3. 网络面

□ 系统代理 / 应用自定义 TLS
□ 证书钉扎 → 联合 mobile/js 方法学或 Frida
□ API 越权：客户端隐藏的管理接口

4. 逆向验证

□ .NET → dotnet-reverse；原生 → ida/ghidra；Electron → asar + js-reverse

工具链

工具	用途
Process Monitor / API Monitor	行为
Burp / mitmproxy	流量
dnSpy / IDA / Ghidra	逆向
Sysinternals	Windows 面
asar / nexe 检测	Electron

参考

references/thick-client-checklist.md
../dotnet-reverse/ ../ida-reverse/ ../js-reverse/ ../api-security/

路由上下文

上游: MASTER R32
下游: 纯协议 protocol-reverse；供应链更新 supply-chain-security

任务完成自检

是否画出信任边界？
本地+网络面是否都覆盖？
Checklist？

How can the creator link this skill?

Add the canonical catalog link to the repository README so users can inspect current installs and available audits. The publishing guide covers the complete discovery path.

<a href="https://skillzs.dev/skills/zhaoxuya520/reverse-skill/thick-client">View thick-client on skillZs</a>