Tools

Use picocom to interact with IoT device UART consoles for pentesting operations including device enumeration, vulnerability discovery, bootloader manipulation, and gaining root shells. Use when the user needs to interact with embedded devices, IoT hardware, or serial consoles.

Professional network reconnaissance and port scanning using nmap. Supports various scan types (quick, full, UDP, stealth), service detection, vulnerability scanning, and NSE scripts. Use when you need to enumerate network services, detect versions, or perform network reconnaissance.

Use telnet to interact with IoT device shells for pentesting operations including device enumeration, vulnerability discovery, credential testing, and post-exploitation. Use when the user needs to interact with network-accessible shells, IoT devices, or telnet services.

Android APK unpacking and resource extraction tool for reverse engineering. Use when you need to decode APK files, extract resources, examine AndroidManifest.xml, analyze smali code, or repackage modified APKs.

Static analysis of UEFI/BIOS firmware dumps using Intel's chipsec framework. Decode firmware structure, detect known malware and rootkits (LoJax, ThinkPwn, HackingTeam, MosaicRegressor), generate EFI executable inventories with hashes, extract NVRAM variables, and parse SPI flash descriptors. Use when analyzing firmware .bin/.rom/.fd/.cap files offline without requiring hardware access.

GitHub workflow automation using `gh` CLI. Use when creating PRs, reviewing code, managing issues, auto-replying to fixed issues, adding comments, assigning users, managing labels, merging PRs, or checking CI status. Includes auto-reply script and Vietnamese templates.

Planning work in small, known-good increments. Use when starting significant work or breaking down complex tasks.

Test-Driven Development workflow. Use for ALL code changes - features, bug fixes, refactoring. TDD is non-negotiable.

TypeScript strict mode patterns. Use when writing any TypeScript code.

Control Eight Sleep pods (status, temperature, alarms, schedules).

Gemini CLI for one-shot Q&A, summaries, and generation.

iMessage/SMS CLI for listing chats, history, watch, and sending.

Best practices for using the oracle CLI (prompt + file bundling, engines, sessions, and file attachment patterns).

Terminal Spotify playback/search via spogo (preferred) or spotify_player.

Capture frames or clips from RTSP/ONVIF cameras.

Extract frames or short clips from videos using ffmpeg.

Edit PDFs with natural-language instructions using the nano-pdf CLI.

Control clawd's dedicated browser (tabs, snapshots, actions) via the clawdis CLI.

Foodora-only CLI for checking past orders and active order status (Deliveroo WIP).

Google Workspace CLI for Gmail, Calendar, Drive, Contacts, Sheets, and Docs.