# tradecraft-windows

Windows execution, persistence, and COM proxy validation workflows.

- **Kind:** plugin (installs as one bundle)
- **Owner:** SpecterOps
- **Source:** https://github.com/SpecterOps/skills (`plugins/tradecraft-windows`)
- **Pinned commit:** `e655f93ab694c446b76672efe6e71e62aac0b7b8`
- **Page:** https://forefy.com/plugins/f6e690f7-24b1-5c81-817e-f610d8a1ee3c
- **API (JSON):** https://forefy.com/api/asr/plugins/f6e690f7-24b1-5c81-817e-f610d8a1ee3c

## Install

Ask your agent: `Install the tradecraft-windows plugin securely from: https://forefy.com/plugins/f6e690f7-24b1-5c81-817e-f610d8a1ee3c globally to ~/.claude/skills`

Or run the pinned install script: `curl -fsSL https://forefy.com/api/asr/plugins/f6e690f7-24b1-5c81-817e-f610d8a1ee3c/install | bash` (`?location=project` for the current project, `&shell=powershell` with `irm ... | iex`; `harness=agents` prints the Codex commands).

## Skills in this plugin (1)

- [com-proxy-triage](https://forefy.com/skills/fe439743-2063-4501-9846-2a26fa45e7e9): Use this skill when the user wants to triage Windows COM proxy/hijack candidates by capturing `HKCU\Software\Classes\CLSID\{...}\InProcServer32` `NAME NOT FOUN…