v0.3.1

v0.3.1 consolidates vulnerability research and replaces fixed operator roles with focused task briefs and composable technical skills.

Changes

• Consolidate vuln-research under knowledge-offensive/, with focused references for assessment coverage, binary experiments, patch-diff analysis, and variant research.
• Remove the duplicate vulnerability-research and vulnerability-search skills, preserve useful guidance in canonical skills, and improve PoC review and research handoffs.
• Add orchestration for delegation, model and effort selection, scheduling, and result integration, with an optional Claude Code execution reference.
• Rename and rework offensive-orchestration around shared target/session ownership, evidence attribution, and direct task-to-skill routing. Remove the 11 redundant skills in offensive-roles/.
• Preserve engagement-level evidence checks in evidence-before-claims; update mobile/backend routing, README, catalog, repository guidance, and installer selection.

Updating

Delete the old malskill skill folders from the agent's skills directory and reinstall the latest version.

Verification

• The four skills affected by the orchestration and role consolidation passed frontmatter validation and directory sweeps, with no broken links, placeholder markers, or workstation paths.
• Selector tests passed: 20 run, one platform-specific test skipped on Windows.
• Changed-file hygiene and Git whitespace checks passed.
• Six routing scenarios were compared with and without the old roles in isolated Claude Code decision trials. The updated routing preserved useful decisions without selecting removed roles. These checks do not establish automatic skill activation or live-target reliability.

Full changelog: v0.3.0...v0.3.1

v0.3.0

v0.3.0 refines the collection's research, engineering, and operating guidance, with clearer skill boundaries and evidence checks.

Changes

• Organize architecture, software guidelines, debugging, TDD, and testing reliability under coding-behaviours/; consolidate MCP authoring in mcp-creator.
• Refine evidence, design, reading-budget, completion-verification, memory, and untrusted-input guidance. Rework 1337 as a concise, methodical security operating mode with integrated Markdown/Obsidian task notes.
• Improve session handoffs, including optional human-readable handoffs, and natural writing guidance in humanizer.
• Strengthen general research, external-feedback triage, and targeted research for blocked tasks. Refine README and AGENTS authoring guidance.
• Improve CVE source coverage and applicability, security research prerequisites, PoC dependency/control review, artifact extraction prompts, and multi-agent job/evidence handling.
• Add skill-app authoring guidance; expand Windows/Linux internals and forensic references, including cloud/SaaS logs and survey evidence.
• Separate the concise README from the detailed catalog. Repair remaining references and the polluter test path after the coding-skill reorganization.

Updating

Delete the old malskill skill folders and reinstall the latest version.

Verification

• Frontmatter validation: all 335 skills passed.
• Full Markdown sweep: no broken links. Reported example markers and sample paths were reviewed; changed-file hygiene passed.
• Repository Python suite: 55 passed, one POSIX-terminal test skipped on Windows.
• PowerShell installer: 119 assertions passed.
• MCP checker: 6 tests passed. PE metadata helper: 19 tests passed.
• Representative research workflows were compared on offline synthetic fixtures; identified omissions were corrected and checked. These checks do not establish live-target or cross-model reliability.

Checks ran locally; the repository has no GitHub Actions workflow.

Full changelog: v0.2.0...v0.3.0

v0.2.0

v0.2.0 updates the skill collection, nested installation workflow, and repository maintenance tools.

Changes

• Add a shared recursive checkbox selector to the PowerShell and Bash installers, with category colors, whole-category selection, persistent child selection, and partial-selection indicators. Root-level skills and skill folders containing other skills remain selectable.
• Index PowerShell source paths to reduce the long destination-check pause. Show that phase explicitly while retaining source-overlap and junction protection.
• Support discovery of the nested collection through the existing Skills CLI: npx skills add AeonDave/malskill -g. No malskill npm package is required.
• Move agent-authoring skills to harness-dev/; rename agents-claude-creator to claude-agents-creator. Refresh Claude Code guidance against 2.1.293, OpenCode against 1.18.35, and Pi against 1.1.0.
• Move and revise the four assessment research skills under knowledge-offensive/, with concrete applicability checks, artifact review, evidence tracking, and prompt evaluation.
• Update AdaptixC2 v2 plugin, extender, generator, and lifecycle guidance against the current source contracts.
• Centralize repository scaffolding, validation, hygiene, sweeping, and packaging in root scripts/, with regression tests under tests/. Update AGENTS.md, skill-creator, and README accordingly.
• Include the humanizer behavior skill and remove the CodeMachine template skill from the collection.

Migration

Replace installed agents-claude-creator copies with claude-agents-creator. For grouped layouts, reinstall the four harness skills under harness-dev/ and the four research skills under knowledge-offensive/, then remove their old knowledge/ copies. The installers update selected destinations; they do not migrate old paths or remove retired skills.

The local installers require Python 3.10+ with PyYAML. PowerShell requires PowerShell 7. The selector uses the keyboard; mouse selection is not implemented.

Verification

• All 336 skills passed frontmatter validation. Sweeps of the changed skill directories found no broken links, scaffold markers, or workstation paths; changed-file hygiene passed.
• Repository suite: 39 Python tests passed, with one POSIX-terminal test skipped on Windows; 119 PowerShell installer assertions passed.
• OpenCode template: typecheck and 18 tests passed against plugin/SDK 1.18.35.
• Pi template and three examples: typecheck passed against published Pi 1.1.0; two template tests and five scaffold tests passed.
• Both template package dry runs contained exactly the four intended files.
• Skills CLI listing discovered all 336 nested skills without installing them.

Checks ran locally; the repository has no GitHub Actions workflow. This release does not claim provider-backed agent sessions or live Claude Managed Agents execution were tested.