galyarderlabs

Reverse engineers malware binaries using NSA's Ghidra disassembler and decompiler to understand internal logic, cryptographic routines, C2 protocols, and evasion techniques at the assembly and pseudo-C level. Activates for requests involving malware reverse engineering, disassembly analysis, decompilation, binary analysis, or understanding malware internals.

Use when important product, technical, or founder decisions need to be captured as durable context with rationale, tradeoffs, and follow-up implications.

Triage a bug or issue. Explore the codebase to find root cause, then create a fix plan.

Use when legacy prompts or older framework flows reference `elite-developer` and you need the modern runtime to resolve that capability cleanly.

Use when recovery planning requires verification that backups are restorable, complete, and safe to trust before an incident or recovery event.

Documentation and codemap specialist. Generates codemaps, updates READMEs, and syncs documentation with the source code.

Use when legacy prompts or older framework flows reference `e2e-runner` and you need the modern runtime to resolve that capability cleanly.

Investor Email Specialist. Use to write fundraising outreach, warm intro blurbs, follow-ups, investor updates, and close-the-loop emails with founder-grade brevity and specificity.

Open Source License guidance, selection, compliance review, and drafting. Use this skill when users ask about choosing open source licenses, checking license compatibility, reviewing projects for OSS compliance, generating LICENSE/NOTICE files, or understanding specific license terms. Triggers include questions about MIT, Apache, GPL, BSD, LGPL, AGPL, copyleft, permissive licenses, license compati

Use when you have a spec or requirements for a multi-step task, before touching code

Develops comprehensive threat actor profiles for APT groups, criminal organizations, and hacktivist collectives by aggregating TTP documentation, historical campaign data, tooling fingerprints, and attribution indicators from multiple intelligence sources. Use when briefing executives on sector-specific threats, updating threat model assumptions, or prioritizing defensive controls against specific

Coordinate a full Galyarder Framework release across engineering verification, npm, GitHub, smoke testing, and announcement follow-up. Use when leadership asks to ship a release, not merely to discuss versioning.