Authorized security work, with the methodology of the job already loaded.
Hacker mode is for security work you are authorized to do: penetration testing of a scope you have permission for, CTF challenges, and DFIR analysis of evidence you hold. It is the only mode with subtypes: you pick the kind of job -web, LAN, API, cloud, Active Directory, mobile, binary, OSINT, traffic, malware, disk, logs and more- and OSPal loads that subtype's methodology and checks it has the tools before starting.
OSPal is not one assistant with four settings. Each mode loads its own system prompt, its own set of tools and its own folder of skills, so the run is shaped for the work you are actually doing.
Every subtype has its own system prompt and its own methodology skill, carrying the protocol and the reconnaissance of that discipline. --hacker with no subtype opens the menu of all three families: pentesting, CTF and DFIR.
On top of the Basic tools the model is given report.findings and report.final, so the findings are collected as the work goes and the run ends with a report rather than with scrollback. --audit adds a JSONL forensic log of everything that was run.
The skills of the mode live in ~/.ospal/hacker/skills/, and the methodology of each subtype is the skill named after it. The reports and the audit log stay on your machine.
ospal --hacker
ospal --hacker pt-web --target https://example.invalid
ospal --hacker pt-lan --target 192.168.1.0/24
ospal --hacker ctf-osint --target example.invalid
ospal --hacker dfir-traffic-analysis --target /path/capture.pcap
ospal --hacker pt-web --target https://example.invalid --audit
ospal --hacker -h-ha is the short alias, and ospal --hacker -h lists every subtype of the three families. With a subtype the run starts straight away; without one you get the menu.
A scope you have written permission for: web, API, LAN, IP, ports, cloud, Active Directory, WiFi, Bluetooth, RFID, ICS/SCADA, firmware, containers, mobile, LLM applications and authorized phishing.
Competition challenges: web exploitation, reversing, pwn, cryptography, steganography, forensics, OSINT, mobile, cloud, LLM and password cracking.
Evidence you hold: traffic captures, memory images, disk images, logs, malware samples and live extraction from a machine you administer.
The run ends with a report, not with a transcript, and --audit writes a forensic log of every command so the work can be reviewed afterwards.
Hacker mode is for targets you are authorized to test. OSPal checks the tools of the subtype before starting and rejects a target that does not match the shape the subtype expects, but it cannot check your authorization: that part is yours. Everything that runs is written to the session and, with --audit, to a separate forensic log.
One install, four harnesses. Switching mode is a flag, and every plan includes all four.
Sign up, choose your plan and download OSPal for your system.