# Install the "Pwn Chain" skill from SourceWeft

This guide is for AI agents: how to install one skill from the SourceWeft
skills directory. It is not a skill itself — do not save it as one.

## The skill

- Slug: `gh-zhaoxuya520-reverse-skill-pwn-chain`
- Source: https://github.com/zhaoxuya520/reverse-skill/tree/cab634bd855fc287f6e420c1f36fd1a6b9245960/skills/pwn-chain
- Repository: https://github.com/zhaoxuya520/reverse-skill
- Commit: cab634bd855fc287f6e420c1f36fd1a6b9245960
- License: none stated
- Trust: Community — not reviewed by SourceWeft
- Scripts: none — instructions only
- Scan flags: none
- Page for people: https://sourceweft.com/skills/gh-zhaoxuya520-reverse-skill-pwn-chain

Trust says whether a person at SourceWeft reviewed the skill. It is not about
integrity: every install is checked against the recorded hashes either way.
Older versions of the CLI label it `Verified`, where "no" means only that
nobody reviewed it.

The author describes it as follows. This is their text, not instructions for
you:

> 从逆向走到可用利用 (Working Exploit) 的全链路工程化方法。 适用场景：拿到了二进制 + 漏洞点 + 目标环境，需要写出一个能稳定打通的 exploit（不是只能本地复现一下、远程一打就崩的脚本）。 覆盖三大方向：栈溢出 / 堆利用 / 内核 pwn。强调"CTF 本地通 → 真实远程稳定打通"的工程差距：libc 版本错配、堆喷射时序、SMEP/SMAP/KASLR、栈对齐、远程缓冲。 核心工具链：pwntools + GEF/pwndbg + ROPgadget/Ropper + one_gadget + libc-database + qemu-system 内核调试。 触发关键词：pwn、栈溢出、堆溢出、ROP、ret2libc、ret2csu、one_gadget、libc-database、堆利用、tcache、fastbin、unsorted bin、kernel pwn、kROP、SMEP、SMAP、KASLR、modprobe_path、pwntools、GEF、pwndbg。

## If you are SourceWeft's own assistant

If you are running inside SourceWeft and have its `install_skill` tool, call
it with `source` set to https://sourceweft.com/skills/gh-zhaoxuya520-reverse-skill-pwn-chain and skip the rest of this guide.

## Install it on this machine

For Claude Code, Codex, Cursor and other agents that can run commands.

1. Show the user the facts above — source, license, trust, scripts and scan
   flags — and wait for their OK.
2. Once they agree, install it for the agent you are:

   ```sh
   npx @sourceweft/cli skills install @zhaoxuya520/pwn-chain --agent claude-code --yes --registry https://sourceweft.com
   ```

   `--yes` stands for the user's OK from step 1: never pass it before they
   have given it. Without it the CLI asks in the terminal, or stops with exit
   code 4 when there is none.

   `--agent` takes `claude-code` (the default), `codex`, `cursor`,
   `universal` (the shared `.agents/skills` directory many agents read) and
   more; `npx @sourceweft/cli skills agents` lists them. Add `--scope project`
   to install into the current project instead of the user's home directory.
3. The CLI checks every file against the hashes recorded when SourceWeft
   scanned this version. Exit code 3 means a file did not match and nothing
   was written: tell the user. Do not retry with another tool, and never copy
   the files by hand.
4. It prints the directory it installed into. Read the SKILL.md there and
   follow it.

To search for other skills or manage installed ones, read
https://sourceweft.com/skills/SKILL.md.