Tutorial Guide

Not required under normal circumstances.Users simply ask the AI to read it in full README_AI.md, and then provide authorization tasks. The commands on the page are used to demonstrate the process automatically executed by AI and facilitate auditing and troubleshooting; only permissions, credentials, commercial licenses, or external side effects must be confirmed by the user.

This project is oriented to authorization security research, including reverse engineering, Hook/debugging, scanning, unpacking, vulnerability verification, CTF method and tool bootstrapping, etc. Security products often use keywords, static features, and behavioral heuristics for detection; these research logics may share local features with malicious samples and therefore produce false positives.However, the detection results cannot be automatically treated as false positives.

The correct approach is: only obtain it from the official repository or Release; check the version, submission source and SHA-256; review the hit files and recent differences; run in an isolated virtual machine or sandbox with minimal permissions and a restricted network. Do not add the entire project directory directly to the whitelist. If you find binaries from unknown sources, unexpected networking, credential reading, persistent startup items, hash inconsistencies, or behavior beyond the scope, you should stop immediately and handle it as a real security incident.

AI can assist in calculating hashes, interpreting scripts, and reviewing differences, but it cannot bypass organizational policies for users. When reporting false positives, please provide the security software name, detection label, relative path, SHA-256, project version and download source; do not upload company code, real samples, credentials or other sensitive files.

Select when you just want stable use v1.0.1;Choose when you need the latest fixes and are willing to follow mainline changes main. Regardless of which version you choose, do not directly overwrite updates in a workspace that has unconfirmed local modifications.

Required, but automatically refreshed by AI. Updates may add tool definitions, candidate paths, or bootstrap hints; the AI should rerun the current platform's refresh script and report the results.

Immediately stop the target's actions. ask it to reread README_AI.md、RULES.md with skills/MASTER-ROUTING.md, run master-route and first report the PRIMARY, confidence, Scope plan and required tools.

This is a normal first run state. AI finished reading README_AI.md You must first run the refresh script of the current platform to generate two indexes, Markdown and JSON; users do not need to generate them manually.

Tell the AI tool that something just changed. The AI will re-refresh the index and check candidate paths; if still not found, it should report the detection process instead of asking the user to fake "installed".

AI only automatically runs bootstrap for the Required tools of the current PRIMARY Skill, and then refreshes the index after the installation is complete. Commercial tools follow manualInstallHint and license requirements, and the AI only asks the user when a license or administrator rights are required.

AI should recognize master-route.sh Requires Python 3, check if it can be safely installed automatically and verify python3 --version;Cannot be changed to another hard-coded Shell route.

AI can use process-level -ExecutionPolicy Bypass form, the policy should not permanently degrade the entire machine. When blocked by enterprise policy, the AI should explain the blocking and request an administrator to handle it.

The user can just add "target type + intention + key technology"; the AI will automatically rerun. Still blurry, AI turns on skills/routing.md Full Matrix selection and documentation of rationale in Case timeline.

AI reads every error entry: common reasons are auth.status is not granted, network mode is missing, non-offline Case has no assets, or ready_for_act Not true. AI correction can determine the field and confirm the real authorization to the user before re-running; it cannot be bypassed with Force.

The PowerShell entry is conservative by default to offline. AI confirms the sample ownership, local file path, prohibited external connections, and out_of_scope to the user, updates the Scope, and then automatically runs Case Guard; the user does not need to edit manually. Bash can be used by AI --preset offline-sample --sample ...。

AI processes in order: Scope error → Missing timeline/workitems/evidence → Finding without evidence reference → Inconsistent hash. It cannot modify the original evidence in order to pass review; it adds evidence and records supersedes relationships when corrections are needed.

Not recommended. AI should generate a unique CaseName for each new task; when it needs to be continued, append timeline, work item, and evidence to the original Case to avoid overwriting the previous structure.

You can write optional adaptations for a client, but you can't make the core depend on it. Do not change when migrating clients routing.json, Scope Contracts and Tests; only changes how the client loads project directives or skills.

It only facilitates developers to audit, reproduce and troubleshoot, and does not mean that ordinary users must perform it manually. SELECT appears when some browsers block the clipboard; this does not affect the AI automation process.