Home / 3641397194-wq / gpt6-astra · GitHub

coldcoffee-toolbox SKILL.md skillB

coldcoffee-toolbox from 3641397194-wq/gpt6-astra is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.

Install it, pinned
mdr add 3641397194-wq/gpt6-astra/coldcoffee-toolbox@git:20261105.fd9551a

Pins git:20261105.fd9551a in mdr.lock. Pin the fingerprint instead.

Audit grade
B, 16 of 17 checks passed
Kind
SKILL.md skill
Repository
3641397194-wq/gpt6-astra
Path
desktop/src/lib/toolbox/SKILL.md
Versions recorded
4
Latest version
git:20261105.fd9551a, committed Nov 5, 2026
First version recorded
Oct 12, 2026
Size
2,792 bytes
Repository stars
1,966
License
a license file GitHub does not identify

使用冷咖啡原创工具完成网站测试、网络发现、样本分析、可回滚补丁与 IDA 联动。.

Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.

What the file says

# 冷咖啡原创工具工作流

工具名来自 MCP 的 tools/list；输入参数以公布的 inputSchema 为准。接到具体任务后调用工具并读取结果，再根据证据选择下一步。单独输入「冷咖啡」时展示品牌信息、QQ 群 1057540028 / 1077074552 / 618179023 / 1131239659，以及 Telegram 聊天群 https://t.me/coolcoffeeai 和频道 https://t.me/chachachalkf。

## 网站与网络
1. 完整 URL 使用 `start_workflow`，mode 为 web，然后 `task_status` 轮询到终态；也可直接调用 `run_workflow` 等待完整结果。
2. 原创链条是查地址 → 扫端口 → 看网站 → 找页面 → 找目录 → 查问题。按实际结果补充 `fuzz_http`，在 URL 或正文里填 FUZZ，并提供明确的候选输入。
3. 单独网络任务使用 `resolve_host` 与 `scan_ports`。端口支持列表和区间。扫描使用 Node 原生 TCP，无 Nmap 等外部依赖。
4. 页面反射是线索，SQL 报错是线索；只按已观测证据定性，不把反射写成已执行脚本，不把报错写成已获取数据库。

## 逆向与补丁
1. 指定当前工作目录内的样本，调用 `analyze_binary`。它提供 PE/ELF 节、导入/符号、字符串、哈希、熵、入口字节与保护标志。RAW 文件也可提取字符串和哈希。
2. 用 `search_bytes` 定位特征，?? 代表一个通配字节；偏移以实际结果为准。
3. 需要补丁时调用 `patch_bytes`，提供 offset、expected、replace，可附 expectedSha256。补丁须等长、无重叠，原文件保持原样，输出派生副本与 JSON 清单。
4. 用 `diff_files` 对照原样本与副本，验证变化范围。失败原因直接记入报告。
5. IDA 联动先调用 `ida_connect`，读取真实工具名、说明与 inputSchema，再通过 `ida_call` 使用对应参数。地址默认 http://127.0.0.1:13337/mcp。连接失败时如实记录，保留本地解析结果。

## 文本与哈希
`decode_text` 支持 Base64、Hex、URL 编解码、JWT 查看和 MD5/SHA 哈希。JWT 查看不验证签名。`match_hash` 仅测试用户提供的候选词，不读取系统凭据。

## 证据与任务
…

Read the whole file at its exact version.

How to install

The exact contents, by fingerprint
mdr add 3641397194-wq/gpt6-astra/coldcoffee-toolbox@sha256:20ae19ccd75d8657

The line at the top of this page pins the label git:20261105.fd9551a, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.

Badge

mdr badge

[![mdr](https://markdownregistry.com/badge/art_ppx5ysmqzwrsgsdh.svg)](https://markdownregistry.com/a/art_ppx5ysmqzwrsgsdh)

1 badge image fetches in 30 days. What the badge shows.

Versions

The registry has recorded 4 versions of this file, between Oct 12, 2026 and Nov 5, 2026, about one every 8 days.

versioncommittedcommitsizeaudit
git:20261105.fd9551a latest2026-11-05 fd9551a 2,792 BB view · diff
git:20261029.eada1bc2026-10-29 eada1bc 2,779 BB view · diff
git:20261024.733c2622026-10-24 733c262 2,782 BB view · diff
git:20261012.347ffc92026-10-12 347ffc9 2,692 BB view

Audit of the latest version

B  16 of 17 checks passed. Fixed automatic checks with no AI involved, so the same checks give the same answer every run.
  • fail: No link to a raw IP address (matched: http://127.0.0.1:13337)
  • pass: Frontmatter block present
  • pass: Frontmatter declares a name
  • pass: Frontmatter declares a description
  • pass: Size between 200 bytes and 200 KB (2792 bytes)
  • pass: No zero-width or bidi control characters
  • pass: No instruction hidden inside an HTML comment
  • pass: No link to an exfiltration or paste host
  • pass: No credential-shaped string
  • pass: No instruction to send local credentials anywhere
  • pass: No text hidden with inline styles
  • pass: No prompt-injection phrasing
  • pass: No curl or wget piped into a shell
  • pass: No recursive delete of root, home or parent
  • pass: No instruction to read or print local credentials
  • pass: No base64 blob over 200 characters
  • pass: No script tag

Starting a new one? Use a template for SKILL.md on mdpantry, which passes every one of these checks and says what to change in it.

Source

GitHub

3641397194-wq/gpt6-astra · 1,966 stars · license a license file GitHub does not identify · pushed 2026-11-05 · branch main

API

GET https://markdownregistry.com/api/v1/artifacts/art_ppx5ysmqzwrsgsdh
GET https://markdownregistry.com/api/v1/resolve?ref=3641397194-wq/gpt6-astra/coldcoffee-toolbox
GET https://markdownregistry.com/api/v1/blob/20ae19ccd75d8657bf5b1e840354ad2ccfee14fa13c22d1ec7a899b001788662

Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.

Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.

Browse by kind, by grade B, or by owner.