diff --git a/skills/abusing-dpapi-for-credential-access/SKILL.md b/skills/abusing-dpapi-for-credential-access/SKILL.md index fc419536..59bc06c5 100644 --- a/skills/abusing-dpapi-for-credential-access/SKILL.md +++ b/skills/abusing-dpapi-for-credential-access/SKILL.md @@ -1,6 +1,6 @@ --- name: abusing-dpapi-for-credential-access -description: Extract DPAPI-protected secrets such as credentials and browser data offline and online. +description: Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys) online or offline using SharpDPAPI, SharpChrome, Mimikatz, or Impacket's dpapi.py, including domain-wide decryption via the DPAPI backup key. Use during authorized red-team credential-access engagements after gaining a foothold or when triaging DPAPI blobs pulled from a host. domain: cybersecurity subdomain: red-teaming tags: diff --git a/skills/abusing-shadow-credentials-for-privesc/SKILL.md b/skills/abusing-shadow-credentials-for-privesc/SKILL.md index b080c1c1..12110912 100644 --- a/skills/abusing-shadow-credentials-for-privesc/SKILL.md +++ b/skills/abusing-shadow-credentials-for-privesc/SKILL.md @@ -1,6 +1,6 @@ --- name: abusing-shadow-credentials-for-privesc -description: Take over Active Directory user and computer accounts by writing alternate certificate keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, and Certipy, then authenticate via PKINIT. +description: Take over Active Directory accounts by writing attacker-controlled public keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, or Certipy, then authenticate via PKINIT to recover the target's NT hash without a password reset. Use when BloodHound shows GenericWrite/GenericAll/AddKeyCredentialLink over a target, as a stealthier alternative to ForceChangePassword, during authorized red-team engagements. domain: cybersecurity subdomain: red-teaming tags: diff --git a/skills/acquiring-disk-image-with-dd-and-dcfldd/SKILL.md b/skills/acquiring-disk-image-with-dd-and-dcfldd/SKILL.md index 3ac54181..d1888abf 100644 --- a/skills/acquiring-disk-image-with-dd-and-dcfldd/SKILL.md +++ b/skills/acquiring-disk-image-with-dd-and-dcfldd/SKILL.md @@ -1,7 +1,6 @@ --- name: acquiring-disk-image-with-dd-and-dcfldd -description: Create forensically sound bit-for-bit disk images using dd and dcfldd - while preserving evidence integrity through hash verification. +description: Create forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash verification (MD5/SHA) during acquisition. Use when imaging a suspect drive, USB device, or memory card for investigation, preserving volatile disk evidence during incident response, or producing a verified copy for legal or law-enforcement proceedings before any destructive analysis. domain: cybersecurity subdomain: digital-forensics tags: diff --git a/skills/analyzing-android-malware-with-apktool/SKILL.md b/skills/analyzing-android-malware-with-apktool/SKILL.md index 1995a74b..b2fc22fc 100644 --- a/skills/analyzing-android-malware-with-apktool/SKILL.md +++ b/skills/analyzing-android-malware-with-apktool/SKILL.md @@ -1,8 +1,6 @@ --- name: analyzing-android-malware-with-apktool -description: Perform static analysis of Android APK malware samples using apktool - for decompilation, jadx for Java source recovery, and androguard for permission - analysis, manifest inspection, and suspicious API call detection. +description: Perform static analysis of Android APK malware using apktool for resource decompilation, jadx for Java source recovery, and androguard for manifest inspection, dangerous permission-combination detection, and identification of obfuscated code, dynamic code loading, and reflection-based API calls. Use to statically triage a suspicious APK without executing it or to build mobile malware detection rules. domain: cybersecurity subdomain: malware-analysis tags: diff --git a/skills/analyzing-apt-group-with-mitre-navigator/SKILL.md b/skills/analyzing-apt-group-with-mitre-navigator/SKILL.md index 304c19f1..61b8d648 100644 --- a/skills/analyzing-apt-group-with-mitre-navigator/SKILL.md +++ b/skills/analyzing-apt-group-with-mitre-navigator/SKILL.md @@ -1,8 +1,6 @@ --- name: analyzing-apt-group-with-mitre-navigator -description: Analyze advanced persistent threat (APT) group techniques using MITRE - ATT&CK Navigator to create layered heatmaps of adversary TTPs for detection gap - analysis and threat-informed defense. +description: Query ATT&CK data with attackcti, mitreattack-python, and stix2, then build MITRE ATT&CK Navigator layers and multi-layer heatmap overlays mapping one or more APT groups' TTPs for detection-gap analysis. Use to compare threat-actor technique coverage, find gaps in detection engineering, or produce Navigator visualizations for threat-intel reporting. domain: cybersecurity subdomain: threat-intelligence tags: diff --git a/skills/analyzing-bootkit-and-rootkit-samples/SKILL.md b/skills/analyzing-bootkit-and-rootkit-samples/SKILL.md index 938a9d43..9a04d838 100644 --- a/skills/analyzing-bootkit-and-rootkit-samples/SKILL.md +++ b/skills/analyzing-bootkit-and-rootkit-samples/SKILL.md @@ -1,11 +1,10 @@ --- name: analyzing-bootkit-and-rootkit-samples -description: 'Analyzes bootkit and advanced rootkit malware that infects the Master - Boot Record (MBR), Volume Boot Record (VBR), or UEFI firmware to gain persistence - below the operating system. Covers boot sector analysis, UEFI module inspection, - and anti-rootkit detection techniques. Activates for requests involving bootkit - analysis, MBR malware investigation, UEFI persistence analysis, or pre-OS malware - detection. +description: 'Analyzes bootkit and advanced rootkit malware infecting the Master + Boot Record (MBR), Volume Boot Record (VBR), or UEFI firmware for below-OS persistence, + covering boot sector analysis, UEFI module inspection, and anti-rootkit detection. + Use when compromise survives OS reinstallation or antivirus/EDR fails to detect + malware despite clear infection signs. ' domain: cybersecurity diff --git a/skills/analyzing-browser-forensics-with-hindsight/SKILL.md b/skills/analyzing-browser-forensics-with-hindsight/SKILL.md index 92831541..6d1e9aca 100644 --- a/skills/analyzing-browser-forensics-with-hindsight/SKILL.md +++ b/skills/analyzing-browser-forensics-with-hindsight/SKILL.md @@ -1,8 +1,6 @@ --- name: analyzing-browser-forensics-with-hindsight -description: Analyze Chromium-based browser artifacts using Hindsight to extract browsing - history, downloads, cookies, cached content, autofill data, saved passwords, and - browser extensions from Chrome, Edge, Brave, and Opera for forensic investigation. +description: Parse Chromium-based browser databases with Hindsight to extract and correlate browsing history, downloads, cookies, cached content, autofill data, saved passwords, and extensions from Chrome, Edge, Brave, Opera, and Vivaldi into a unified timeline (XLSX, JSON, or SQLite output). Use during incident response, insider-threat investigations, or criminal cases when you need to reconstruct a user's web activity from a browser profile. domain: cybersecurity subdomain: digital-forensics tags: diff --git a/skills/analyzing-campaign-attribution-evidence/SKILL.md b/skills/analyzing-campaign-attribution-evidence/SKILL.md index fb84e08b..0c2d4c9b 100644 --- a/skills/analyzing-campaign-attribution-evidence/SKILL.md +++ b/skills/analyzing-campaign-attribution-evidence/SKILL.md @@ -1,8 +1,6 @@ --- name: analyzing-campaign-attribution-evidence -description: Campaign attribution analysis involves systematically evaluating evidence - to determine which threat actor or group is responsible for a cyber operation. This - skill covers collecting and weighting attr +description: Systematically evaluate cyber-campaign evidence to attribute an operation to a threat actor, using the Diamond Model and Analysis of Competing Hypotheses (ACH) to weigh infrastructure overlaps, TTP consistency, malware code similarity, and timing/language artifacts into confidence-weighted attribution assessments. Use when an incident investigation needs a defensible attribution confidence level. domain: cybersecurity subdomain: threat-intelligence tags: diff --git a/skills/analyzing-cloud-storage-access-patterns/SKILL.md b/skills/analyzing-cloud-storage-access-patterns/SKILL.md index 69fdd06f..45c7495a 100644 --- a/skills/analyzing-cloud-storage-access-patterns/SKILL.md +++ b/skills/analyzing-cloud-storage-access-patterns/SKILL.md @@ -1,10 +1,6 @@ --- name: analyzing-cloud-storage-access-patterns -description: Detect abnormal access patterns in AWS S3, GCS, and Azure Blob Storage - by analyzing CloudTrail Data Events, GCS audit logs, and Azure Storage Analytics. - Identifies after-hours bulk downloads, access from new IP addresses, unusual API - calls (GetObject spikes), and potential data exfiltration using statistical baselines - and time-series anomaly detection. +description: Detect abnormal access in AWS S3, GCS, and Azure Blob Storage by analyzing CloudTrail Data Events, GCS audit logs, and Azure Storage Analytics for after-hours bulk downloads, new-IP access, and API-call spikes (e.g. GetObject) via statistical baselines and time-series anomaly detection. Use when investigating suspected cloud data exfiltration or building related detection rules. domain: cybersecurity subdomain: cloud-security tags: diff --git a/skills/analyzing-cobaltstrike-malleable-c2-profiles/SKILL.md b/skills/analyzing-cobaltstrike-malleable-c2-profiles/SKILL.md index a177d016..b0c0e1b9 100644 --- a/skills/analyzing-cobaltstrike-malleable-c2-profiles/SKILL.md +++ b/skills/analyzing-cobaltstrike-malleable-c2-profiles/SKILL.md @@ -1,8 +1,6 @@ --- name: analyzing-cobaltstrike-malleable-c2-profiles -description: Parse and analyze Cobalt Strike Malleable C2 profiles using dissect.cobaltstrike - and pyMalleableC2 to extract C2 indicators, detect evasion techniques, and generate - network detection signatures. +description: Parse and analyze Cobalt Strike Malleable C2 profiles with dissect.cobaltstrike (profiles and beacon-payload configs) and pyMalleableC2 (AST parsing) to extract HTTP/DNS transforms, URIs, headers, sleep/jitter, and injection behavior, then generate network detection signatures. Use when reverse-engineering a captured malleable profile or building detections against Cobalt Strike Beacon traffic. domain: cybersecurity subdomain: malware-analysis tags: diff --git a/skills/analyzing-command-and-control-communication/SKILL.md b/skills/analyzing-command-and-control-communication/SKILL.md index 97a4b4d7..71c7848d 100644 --- a/skills/analyzing-command-and-control-communication/SKILL.md +++ b/skills/analyzing-command-and-control-communication/SKILL.md @@ -1,10 +1,11 @@ --- name: analyzing-command-and-control-communication -description: 'Analyzes malware command-and-control (C2) communication protocols to - understand beacon patterns, command structures, data encoding, and infrastructure. - Covers HTTP, HTTPS, DNS, and custom protocol C2 analysis for detection development - and threat intelligence. Activates for requests involving C2 analysis, beacon detection, - C2 protocol reverse engineering, or command-and-control infrastructure mapping. +description: 'Analyzes malware C2 communication over HTTP, HTTPS, DNS, and custom + protocols to reverse-engineer beacon patterns, command structures, data encoding, + and infrastructure (primary servers, fallback domains, dead drops). Use after + reverse engineering reveals network traffic needing protocol analysis or when + building detection signatures for a framework like Cobalt Strike, Metasploit, + or Sliver. ' domain: cybersecurity diff --git a/skills/analyzing-disk-image-with-autopsy/SKILL.md b/skills/analyzing-disk-image-with-autopsy/SKILL.md index 01908813..48910107 100644 --- a/skills/analyzing-disk-image-with-autopsy/SKILL.md +++ b/skills/analyzing-disk-image-with-autopsy/SKILL.md @@ -1,7 +1,6 @@ --- name: analyzing-disk-image-with-autopsy -description: Perform comprehensive forensic analysis of disk images using Autopsy - to recover files, examine artifacts, and build investigation timelines. +description: Perform comprehensive forensic analysis of raw (dd), E01, or AFF disk images with Autopsy and The Sleuth Kit, recovering deleted files, examining metadata and embedded artifacts, keyword searching, and building investigation timelines with visual reports. Use for structured analysis of a forensic disk image or when stakeholders need visual reports from evidence. domain: cybersecurity subdomain: digital-forensics tags: diff --git a/skills/analyzing-email-headers-for-phishing-investigation/SKILL.md b/skills/analyzing-email-headers-for-phishing-investigation/SKILL.md index c738cdef..bc82936d 100644 --- a/skills/analyzing-email-headers-for-phishing-investigation/SKILL.md +++ b/skills/analyzing-email-headers-for-phishing-investigation/SKILL.md @@ -1,7 +1,10 @@ --- name: analyzing-email-headers-for-phishing-investigation -description: Parse and analyze email headers to trace the origin of phishing emails, - verify sender authenticity, and identify spoofing through SPF, DKIM, and DMARC validation. +description: Parse and analyze email headers (Received chain, Return-Path, Message-ID) + to trace the true origin of a phishing email and validate SPF, DKIM, and DMARC + results to confirm or rule out sender spoofing. Use when triaging a suspicious or + reported email, investigating a phishing incident, or verifying whether a message's + sender domain was spoofed. domain: cybersecurity subdomain: digital-forensics tags: diff --git a/skills/analyzing-golang-malware-with-ghidra/SKILL.md b/skills/analyzing-golang-malware-with-ghidra/SKILL.md index 6ad7c72e..0ba9ad3e 100644 --- a/skills/analyzing-golang-malware-with-ghidra/SKILL.md +++ b/skills/analyzing-golang-malware-with-ghidra/SKILL.md @@ -1,8 +1,11 @@ --- name: analyzing-golang-malware-with-ghidra -description: Reverse engineer Go-compiled malware using Ghidra with specialized scripts - for function recovery, string extraction, and type reconstruction in stripped Go - binaries. +description: Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo + and pclntab structures, recovering stripped/obfuscated function names (e.g. via + GoResolver), and extracting embedded module/dependency strings and types from Go + binaries. Use when analyzing a Go-language malware sample, deobfuscating a garble-packed + Go binary, or recovering function names and third-party dependencies from a stripped + Go executable. domain: cybersecurity subdomain: malware-analysis tags: diff --git a/skills/analyzing-linux-elf-malware/SKILL.md b/skills/analyzing-linux-elf-malware/SKILL.md index 87b1ced8..c3179478 100644 --- a/skills/analyzing-linux-elf-malware/SKILL.md +++ b/skills/analyzing-linux-elf-malware/SKILL.md @@ -1,11 +1,10 @@ --- name: analyzing-linux-elf-malware -description: 'Analyzes malicious Linux ELF (Executable and Linkable Format) binaries - including botnets, cryptominers, ransomware, and rootkits targeting Linux servers, - containers, and cloud infrastructure. Covers static analysis, dynamic tracing, and - reverse engineering of x86_64 and ARM ELF samples. Activates for requests involving - Linux malware analysis, ELF binary investigation, Linux server compromise assessment, - or container malware analysis. +description: 'Analyze malicious Linux ELF binaries — botnets, cryptominers, ransomware, + and rootkits targeting Linux servers, containers, and cloud infrastructure — through + static analysis, dynamic tracing, and reverse engineering of x86_64 and ARM samples. + Use when investigating Linux malware, triaging a suspicious ELF binary, assessing + a compromised Linux server, or analyzing container-targeted malware. ' domain: cybersecurity diff --git a/skills/analyzing-linux-system-artifacts/SKILL.md b/skills/analyzing-linux-system-artifacts/SKILL.md index 71e8fb44..b7b12333 100644 --- a/skills/analyzing-linux-system-artifacts/SKILL.md +++ b/skills/analyzing-linux-system-artifacts/SKILL.md @@ -1,8 +1,10 @@ --- name: analyzing-linux-system-artifacts -description: Examine Linux system artifacts including auth logs, cron jobs, shell - history, and system configuration to uncover evidence of compromise or unauthorized - activity. +description: Examine Linux system artifacts (auth logs, cron/systemd persistence, + shell history, SSH keys, and system configuration) to uncover evidence of compromise, + detect rootkits or backdoors, and reconstruct user/attacker activity. Use when + investigating a compromised Linux server or workstation, hunting for persistence + mechanisms, or scoping a Linux-based breach during incident response. domain: cybersecurity subdomain: digital-forensics tags: diff --git a/skills/analyzing-lnk-file-and-jump-list-artifacts/SKILL.md b/skills/analyzing-lnk-file-and-jump-list-artifacts/SKILL.md index 741eac1e..faec0618 100644 --- a/skills/analyzing-lnk-file-and-jump-list-artifacts/SKILL.md +++ b/skills/analyzing-lnk-file-and-jump-list-artifacts/SKILL.md @@ -1,8 +1,11 @@ --- name: analyzing-lnk-file-and-jump-list-artifacts -description: Analyze Windows LNK shortcut files and Jump List artifacts to establish - evidence of file access, program execution, and user activity using LECmd, JLECmd, - and manual binary parsing of the Shell Link Binary format. +description: Analyze Windows LNK shortcut files and Jump List artifacts with LECmd, + JLECmd, and manual Shell Link Binary Format parsing to establish evidence of file + access, program execution, and user activity that persists even after the target + file is deleted. Use when investigating Windows user activity, reconstructing file-access + or program-execution timelines, or examining recent/frequently-used file evidence + in a forensic exam. domain: cybersecurity subdomain: digital-forensics tags: diff --git a/skills/analyzing-malicious-pdf-with-peepdf/SKILL.md b/skills/analyzing-malicious-pdf-with-peepdf/SKILL.md index e0450e15..c7cfe301 100644 --- a/skills/analyzing-malicious-pdf-with-peepdf/SKILL.md +++ b/skills/analyzing-malicious-pdf-with-peepdf/SKILL.md @@ -2,6 +2,9 @@ name: analyzing-malicious-pdf-with-peepdf description: Perform static analysis of malicious PDF documents using peepdf, pdfid, and pdf-parser to extract embedded JavaScript, shellcode, and suspicious objects. + Use when triaging a suspicious PDF attachment from a phishing email, analyzing a + PDF-based exploit document, or building detection signatures for weaponized PDF + threats. domain: cybersecurity subdomain: malware-analysis tags: diff --git a/skills/analyzing-malware-behavior-with-cuckoo-sandbox/SKILL.md b/skills/analyzing-malware-behavior-with-cuckoo-sandbox/SKILL.md index f62df425..cafdd82c 100644 --- a/skills/analyzing-malware-behavior-with-cuckoo-sandbox/SKILL.md +++ b/skills/analyzing-malware-behavior-with-cuckoo-sandbox/SKILL.md @@ -1,10 +1,11 @@ --- name: analyzing-malware-behavior-with-cuckoo-sandbox -description: 'Executes malware samples in Cuckoo Sandbox to observe runtime behavior - including process creation, file system modifications, registry changes, network - communications, and API calls. Generates comprehensive behavioral reports for malware - classification and IOC extraction. Activates for requests involving dynamic malware - analysis, sandbox detonation, behavioral analysis, or automated malware execution. +description: 'Detonate malware samples in Cuckoo Sandbox to observe runtime behavior + — process creation, file system and registry changes, network communications, + and API calls — and generate behavioral reports for classification and IOC extraction. + Use when a sample has passed static triage and needs dynamic/behavioral analysis, + when mapping a full infection chain, or when building YARA/behavioral signatures + from observed sandbox activity. ' domain: cybersecurity diff --git a/skills/analyzing-malware-family-relationships-with-malpedia/SKILL.md b/skills/analyzing-malware-family-relationships-with-malpedia/SKILL.md index bd4a4ec3..7a58e3d4 100644 --- a/skills/analyzing-malware-family-relationships-with-malpedia/SKILL.md +++ b/skills/analyzing-malware-family-relationships-with-malpedia/SKILL.md @@ -1,8 +1,10 @@ --- name: analyzing-malware-family-relationships-with-malpedia -description: Use the Malpedia platform and API to research malware family relationships, - track variant evolution, link families to threat actors, and integrate YARA rules - for detection across malware lineages. +description: Query the Malpedia API to look up malware family aliases and naming + (platform.family_name), pull community/vendor YARA rules, link families to threat + actors, and map family relationships such as loader-payload chains and shared authorship. + Use when researching a malware family's aliases, lineage, or actor attribution, + or when sourcing YARA rules for detection. domain: cybersecurity subdomain: threat-intelligence tags: diff --git a/skills/analyzing-malware-persistence-with-autoruns/SKILL.md b/skills/analyzing-malware-persistence-with-autoruns/SKILL.md index 312b4a62..8e992e99 100644 --- a/skills/analyzing-malware-persistence-with-autoruns/SKILL.md +++ b/skills/analyzing-malware-persistence-with-autoruns/SKILL.md @@ -1,8 +1,10 @@ --- name: analyzing-malware-persistence-with-autoruns -description: Use Sysinternals Autoruns to systematically identify and analyze malware - persistence mechanisms across registry keys, scheduled tasks, services, drivers, - and startup locations on Windows systems. +description: Use Sysinternals Autoruns to systematically enumerate and analyze malware + persistence mechanisms across Windows registry run keys, scheduled tasks, services, + drivers, and startup locations. Use when hunting for persistence during Windows + incident response, triaging a compromised endpoint, or validating that malware + autostart entries have been fully identified and removed. domain: cybersecurity subdomain: malware-analysis tags: diff --git a/skills/analyzing-malware-sandbox-evasion-techniques/SKILL.md b/skills/analyzing-malware-sandbox-evasion-techniques/SKILL.md index 7e571c51..f3645d04 100644 --- a/skills/analyzing-malware-sandbox-evasion-techniques/SKILL.md +++ b/skills/analyzing-malware-sandbox-evasion-techniques/SKILL.md @@ -1,8 +1,10 @@ --- name: analyzing-malware-sandbox-evasion-techniques -description: Detect sandbox evasion techniques in malware samples by analyzing timing - checks, VM artifact queries, user interaction detection, and sleep inflation patterns - from Cuckoo/AnyRun behavioral reports +description: Detect sandbox and VM evasion techniques in malware samples by analyzing + timing checks, VM/hypervisor artifact queries, user-interaction checks, and sleep-inflation + patterns from Cuckoo or AnyRun behavioral reports. Use when a sample shows no or + minimal activity in a sandbox, when a behavioral report needs review for evasion + indicators, or when building detections for anti-analysis techniques. domain: cybersecurity subdomain: malware-analysis tags: diff --git a/skills/analyzing-mft-for-deleted-file-recovery/SKILL.md b/skills/analyzing-mft-for-deleted-file-recovery/SKILL.md index ceb7c384..f44df120 100644 --- a/skills/analyzing-mft-for-deleted-file-recovery/SKILL.md +++ b/skills/analyzing-mft-for-deleted-file-recovery/SKILL.md @@ -1,8 +1,10 @@ --- name: analyzing-mft-for-deleted-file-recovery -description: Analyze the NTFS Master File Table ($MFT) to recover metadata and content - of deleted files by examining MFT record entries, $LogFile, $UsnJrnl, and MFT slack - space using MFTECmd, analyzeMFT, and X-Ways Forensics. +description: Analyze the NTFS Master File Table ($MFT) with MFTECmd, analyzeMFT, + and X-Ways Forensics to recover metadata and content of deleted files by examining + MFT record entries, $LogFile, $UsnJrnl, and MFT slack space. Use when recovering + evidence of deleted files, reconstructing NTFS file-system timelines, or detecting + anti-forensic timestomping during a Windows forensic examination. domain: cybersecurity subdomain: digital-forensics tags: diff --git a/skills/analyzing-network-covert-channels-in-malware/SKILL.md b/skills/analyzing-network-covert-channels-in-malware/SKILL.md index 029c6cb0..7d84b1eb 100644 --- a/skills/analyzing-network-covert-channels-in-malware/SKILL.md +++ b/skills/analyzing-network-covert-channels-in-malware/SKILL.md @@ -1,8 +1,10 @@ --- name: analyzing-network-covert-channels-in-malware -description: Detect and analyze covert communication channels used by malware including - DNS tunneling, ICMP exfiltration, steganographic HTTP, and protocol abuse for C2 - and data exfiltration. +description: Detect and analyze covert communication channels used by malware, including + DNS tunneling, ICMP exfiltration, steganographic HTTP, and other protocol abuse + used for C2 and data exfiltration. Use when investigating suspicious DNS/ICMP/HTTP + traffic patterns, hunting for hidden C2 channels in network captures, or attributing + exfiltration traffic to a known tunneling toolset. domain: cybersecurity subdomain: malware-analysis tags: diff --git a/skills/analyzing-network-packets-with-scapy/SKILL.md b/skills/analyzing-network-packets-with-scapy/SKILL.md index 74b5158f..f0e5a626 100644 --- a/skills/analyzing-network-packets-with-scapy/SKILL.md +++ b/skills/analyzing-network-packets-with-scapy/SKILL.md @@ -1,8 +1,6 @@ --- name: analyzing-network-packets-with-scapy -description: Craft, send, sniff, and dissect network packets using Scapy for protocol - analysis, network reconnaissance, and traffic anomaly detection in authorized security - testing +description: Use Scapy to craft, send, sniff, and dissect TCP/UDP/ICMP/DNS packets, analyze pcap files, implement SYN scans, and detect anomalous traffic such as fragmented or malformed packets. Use when performing authorized network reconnaissance, protocol-level forensic analysis, or building traffic anomaly detection during security testing. domain: cybersecurity subdomain: network-security tags: diff --git a/skills/analyzing-outlook-pst-for-email-forensics/SKILL.md b/skills/analyzing-outlook-pst-for-email-forensics/SKILL.md index a4f4c6ff..57b5b14b 100644 --- a/skills/analyzing-outlook-pst-for-email-forensics/SKILL.md +++ b/skills/analyzing-outlook-pst-for-email-forensics/SKILL.md @@ -1,9 +1,6 @@ --- name: analyzing-outlook-pst-for-email-forensics -description: Analyze Microsoft Outlook PST and OST files for email forensic evidence - including message content, headers, attachments, deleted items, and metadata using - libpff, pst-utils, and forensic email analysis tools for legal investigations and - incident response. +description: Parse Microsoft Outlook PST and OST files using libpff and pst-utils to extract message content, headers, attachments, deleted items, and MAPI metadata, including recovery of items from the Recoverable Items folder. Use when conducting email forensic investigations, legal e-discovery, or incident response that requires reconstructing communication patterns or tracing message routing from Outlook archives. domain: cybersecurity subdomain: digital-forensics tags: diff --git a/skills/analyzing-packed-malware-with-upx-unpacker/SKILL.md b/skills/analyzing-packed-malware-with-upx-unpacker/SKILL.md index 8e8862b2..168c0468 100644 --- a/skills/analyzing-packed-malware-with-upx-unpacker/SKILL.md +++ b/skills/analyzing-packed-malware-with-upx-unpacker/SKILL.md @@ -1,10 +1,6 @@ --- name: analyzing-packed-malware-with-upx-unpacker -description: 'Identifies and unpacks UPX-packed and other packed malware samples to - expose the original executable code for static analysis. Covers both standard UPX - unpacking and handling modified UPX headers that prevent automated decompression. - Activates for requests involving malware unpacking, UPX decompression, packer removal, - or preparing packed samples for analysis. +description: 'Identifies and unpacks UPX-packed malware samples, including binaries with modified UPX magic bytes or headers that block automated decompression, to recover the original executable for static analysis. Use when a sample shows high entropy, minimal imports, or only LoadLibrary/GetProcAddress in its import table, or when preparing a packed binary for disassembly in Ghidra or IDA. ' domain: cybersecurity diff --git a/skills/analyzing-persistence-mechanisms-in-linux/SKILL.md b/skills/analyzing-persistence-mechanisms-in-linux/SKILL.md index 62e79ff6..8245e99d 100644 --- a/skills/analyzing-persistence-mechanisms-in-linux/SKILL.md +++ b/skills/analyzing-persistence-mechanisms-in-linux/SKILL.md @@ -1,8 +1,6 @@ --- name: analyzing-persistence-mechanisms-in-linux -description: Detect and analyze Linux persistence mechanisms including crontab entries, - systemd service units, LD_PRELOAD hijacking, bashrc modifications, and authorized_keys - backdoors using auditd and file integrity monitoring +description: Scan Linux systems for persistence mechanisms including crontab/systemd entries, LD_PRELOAD injection, shell profile modifications (.bashrc, .profile), and SSH authorized_keys backdoors, then correlate findings with auditd logs into an installation timeline. Use during incident response or threat hunting to detect or confirm how an adversary maintained access to a compromised Linux host. domain: cybersecurity subdomain: threat-hunting tags: diff --git a/skills/analyzing-powershell-empire-artifacts/SKILL.md b/skills/analyzing-powershell-empire-artifacts/SKILL.md index 20ff7b21..cada3e1c 100644 --- a/skills/analyzing-powershell-empire-artifacts/SKILL.md +++ b/skills/analyzing-powershell-empire-artifacts/SKILL.md @@ -1,8 +1,6 @@ --- name: analyzing-powershell-empire-artifacts -description: Detect PowerShell Empire framework artifacts in Windows event logs by - identifying Base64 encoded launcher patterns, default user agents, staging URL structures, - stager IOCs, and known Empire module signatures in Script Block Logging events. +description: Detect PowerShell Empire post-exploitation framework artifacts in Windows Script Block Logging (Event ID 4104) and Module Logging (Event ID 4103), including the default launcher string, Base64-encoded WebClient/FromBase64String payloads, known module invocations (Invoke-Mimikatz, Invoke-Kerberoast), and staging URL patterns. Use when hunting for or confirming Empire C2 activity in Windows event logs. domain: cybersecurity subdomain: threat-hunting tags: diff --git a/skills/analyzing-prefetch-files-for-execution-history/SKILL.md b/skills/analyzing-prefetch-files-for-execution-history/SKILL.md index 511ae2b1..96d46146 100644 --- a/skills/analyzing-prefetch-files-for-execution-history/SKILL.md +++ b/skills/analyzing-prefetch-files-for-execution-history/SKILL.md @@ -1,7 +1,6 @@ --- name: analyzing-prefetch-files-for-execution-history -description: Parse Windows Prefetch files to determine program execution history including - run counts, timestamps, and referenced files for forensic investigation. +description: Parse Windows Prefetch files (versions 17, 23, 26, 30) with tools like PECmd, WinPrefetchView, or python-prefetch to determine program execution history, including run counts, execution timestamps, and referenced files/DLLs. Use when building a timeline of program execution on a Windows system, confirming whether a suspicious binary ran, or correlating execution evidence with other forensic artifacts during an investigation. domain: cybersecurity subdomain: digital-forensics tags: diff --git a/skills/analyzing-ransomware-leak-site-intelligence/SKILL.md b/skills/analyzing-ransomware-leak-site-intelligence/SKILL.md index b15d69f9..5a5aee55 100644 --- a/skills/analyzing-ransomware-leak-site-intelligence/SKILL.md +++ b/skills/analyzing-ransomware-leak-site-intelligence/SKILL.md @@ -1,8 +1,6 @@ --- name: analyzing-ransomware-leak-site-intelligence -description: Monitor and analyze ransomware group data leak sites (DLS) to track victim - postings, extract threat intelligence on group tactics, and assess sector-specific - ransomware risk for proactive defense. +description: Safely monitor ransomware group Tor-hosted data leak sites (DLS) to collect and extract structured victim posting data, track group activity trends over time, and produce sector- and geography-specific ransomware risk assessments. Use when performing threat intelligence gathering on active ransomware groups or building proactive defense reporting from double-extortion leak-site activity. domain: cybersecurity subdomain: threat-intelligence tags: diff --git a/skills/analyzing-ransomware-network-indicators/SKILL.md b/skills/analyzing-ransomware-network-indicators/SKILL.md index 08804fb1..5fc96c0b 100644 --- a/skills/analyzing-ransomware-network-indicators/SKILL.md +++ b/skills/analyzing-ransomware-network-indicators/SKILL.md @@ -1,8 +1,6 @@ --- name: analyzing-ransomware-network-indicators -description: Identify ransomware network indicators including C2 beaconing patterns, - TOR exit node connections, data exfiltration flows, and encryption key exchange - via Zeek conn.log and NetFlow analysis +description: Identify ransomware-related network indicators, including C2 beaconing patterns, TOR exit node connections, data exfiltration flows, and encryption key exchange, by analyzing Zeek conn.log and NetFlow data. Use when threat hunting for active ransomware network activity or investigating suspected pre-encryption exfiltration during incident response. domain: cybersecurity subdomain: threat-hunting tags: diff --git a/skills/analyzing-ransomware-payment-wallets/SKILL.md b/skills/analyzing-ransomware-payment-wallets/SKILL.md index c536fff8..d4300b39 100644 --- a/skills/analyzing-ransomware-payment-wallets/SKILL.md +++ b/skills/analyzing-ransomware-payment-wallets/SKILL.md @@ -1,11 +1,6 @@ --- name: analyzing-ransomware-payment-wallets -description: 'Traces ransomware cryptocurrency payment flows using blockchain analysis - tools such as Chainalysis Reactor, WalletExplorer, and blockchain.com APIs. Identifies - wallet clusters, tracks fund movement through mixers and exchanges, and supports - law enforcement attribution. Activates for requests involving ransomware payment - tracing, bitcoin wallet analysis, cryptocurrency forensics, or blockchain intelligence - gathering. +description: 'Traces ransomware cryptocurrency payment flows using blockchain analysis tools such as Chainalysis Reactor, WalletExplorer, and blockchain.com APIs, identifying wallet clusters and tracking fund movement through mixers and exchanges to support law enforcement attribution. Use when tracing ransomware bitcoin payments, performing cryptocurrency wallet forensics, or gathering blockchain threat intelligence on extortion payments. ' domain: cybersecurity diff --git a/skills/analyzing-slack-space-and-file-system-artifacts/SKILL.md b/skills/analyzing-slack-space-and-file-system-artifacts/SKILL.md index d141fade..5aeefe3f 100644 --- a/skills/analyzing-slack-space-and-file-system-artifacts/SKILL.md +++ b/skills/analyzing-slack-space-and-file-system-artifacts/SKILL.md @@ -1,7 +1,6 @@ --- name: analyzing-slack-space-and-file-system-artifacts -description: Examine file system slack space, MFT entries, USN journal, and alternate - data streams to recover hidden data and reconstruct file activity on NTFS volumes. +description: Examine NTFS slack space, MFT entries, the USN Change Journal, and Alternate Data Streams (ADS) to recover hidden or residual data, reconstruct deleted-file metadata, and reconstruct available file-system change activity from USN records. Use during deep forensic analysis of an NTFS image when standard file recovery is insufficient, such as hunting for data hidden in ADS. domain: cybersecurity subdomain: digital-forensics tags: diff --git a/skills/analyzing-threat-actor-ttps-with-mitre-attack/SKILL.md b/skills/analyzing-threat-actor-ttps-with-mitre-attack/SKILL.md index b563d1d6..c2f6697e 100644 --- a/skills/analyzing-threat-actor-ttps-with-mitre-attack/SKILL.md +++ b/skills/analyzing-threat-actor-ttps-with-mitre-attack/SKILL.md @@ -1,8 +1,6 @@ --- name: analyzing-threat-actor-ttps-with-mitre-attack -description: MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics, - techniques, and procedures (TTPs) based on real-world observations. This skill covers - systematically mapping threat actor beh +description: Systematically map threat actor behavior and observed IOCs to the MITRE ATT&CK framework, build technique coverage heatmaps with the ATT&CK Navigator, identify detection gaps, and produce actionable threat intelligence reports across the Enterprise, Mobile, and ICS matrices. Use when analyzing threat actor TTPs, correlating IOCs to specific ATT&CK techniques, or assessing defensive detection coverage against adversary behavior. domain: cybersecurity subdomain: threat-intelligence tags: diff --git a/skills/analyzing-threat-actor-ttps-with-mitre-navigator/SKILL.md b/skills/analyzing-threat-actor-ttps-with-mitre-navigator/SKILL.md index b4574c1c..f3758acc 100644 --- a/skills/analyzing-threat-actor-ttps-with-mitre-navigator/SKILL.md +++ b/skills/analyzing-threat-actor-ttps-with-mitre-navigator/SKILL.md @@ -1,11 +1,6 @@ --- name: analyzing-threat-actor-ttps-with-mitre-navigator -description: 'Map advanced persistent threat (APT) group tactics, techniques, and - procedures (TTPs) to the MITRE ATT&CK framework using the ATT&CK Navigator and attackcti - Python library. The analyst queries STIX/TAXII data for group-technique associations, - generates Navigator layer files for visualization, and compares defensive coverage - against adversary profiles. Activates for requests involving APT TTP mapping, ATT&CK - Navigator layers, threat actor profiling, or MITRE technique coverage analysis. +description: 'Map advanced persistent threat (APT) group TTPs to the MITRE ATT&CK framework using the attackcti Python library to query STIX/TAXII data for group-technique associations, then generate ATT&CK Navigator layer files to visualize and compare defensive coverage against adversary profiles. Use when profiling an APT group''s techniques, building Navigator coverage heatmaps, or assessing technique coverage gaps against a specific threat actor. ' domain: cybersecurity diff --git a/skills/analyzing-threat-landscape-with-misp/SKILL.md b/skills/analyzing-threat-landscape-with-misp/SKILL.md index ee160313..feb834a3 100644 --- a/skills/analyzing-threat-landscape-with-misp/SKILL.md +++ b/skills/analyzing-threat-landscape-with-misp/SKILL.md @@ -1,10 +1,10 @@ --- name: analyzing-threat-landscape-with-misp -description: Analyze the threat landscape using MISP (Malware Information Sharing - Platform) by querying event statistics, attribute distributions, threat actor galaxy - clusters, and tag trends over time. Uses PyMISP to pull event data, compute IOC - type breakdowns, identify top threat actors and malware families, and generate threat - landscape reports with temporal trends. +description: Query a MISP (Malware Information Sharing Platform) instance via PyMISP + to compute event statistics, IOC type breakdowns, threat actor galaxy clusters, + and tag trends, and generate threat landscape reports with temporal trends. Use + when asked to analyze threat intelligence data, summarize top threat actors or + malware families, or produce a CTI landscape report from MISP events. domain: cybersecurity subdomain: threat-intelligence tags: diff --git a/skills/analyzing-typosquatting-domains-with-dnstwist/SKILL.md b/skills/analyzing-typosquatting-domains-with-dnstwist/SKILL.md index 7c4b5908..4901b63b 100644 --- a/skills/analyzing-typosquatting-domains-with-dnstwist/SKILL.md +++ b/skills/analyzing-typosquatting-domains-with-dnstwist/SKILL.md @@ -1,8 +1,9 @@ --- name: analyzing-typosquatting-domains-with-dnstwist -description: Detect typosquatting, homograph phishing, and brand impersonation domains - using dnstwist to generate domain permutations and identify registered lookalike - domains targeting your organization. +description: Generate domain permutations with dnstwist and check DNS resolution + to detect typosquatting, homograph phishing, and brand impersonation domains registered + against your organization. Use when asked to monitor for lookalike domains, investigate + a phishing domain, or assess brand-impersonation risk. domain: cybersecurity subdomain: threat-intelligence tags: diff --git a/skills/analyzing-uefi-bootkit-persistence/SKILL.md b/skills/analyzing-uefi-bootkit-persistence/SKILL.md index 7cff1b3e..c05b36a5 100644 --- a/skills/analyzing-uefi-bootkit-persistence/SKILL.md +++ b/skills/analyzing-uefi-bootkit-persistence/SKILL.md @@ -1,12 +1,10 @@ --- name: analyzing-uefi-bootkit-persistence -description: 'Analyzes UEFI bootkit persistence mechanisms including firmware implants - in SPI flash, EFI System Partition (ESP) modifications, Secure Boot bypass techniques, - and UEFI variable manipulation. Covers detection of known bootkit families (BlackLotus, - LoJax, MosaicRegressor, MoonBounce, CosmicStrand), ESP partition forensic inspection, - chipsec-based firmware integrity verification, and Secure Boot configuration auditing. - Activates for requests involving UEFI malware analysis, firmware persistence investigation, - boot chain integrity verification, or Secure Boot bypass detection. +description: 'Analyzes UEFI bootkit persistence (SPI flash implants, ESP modifications, + Secure Boot bypass, UEFI variable manipulation) using chipsec for firmware integrity + verification, detecting known families like BlackLotus, LoJax, and MoonBounce. + Use for UEFI malware analysis, firmware persistence investigation, or Secure Boot + bypass detection. ' domain: cybersecurity diff --git a/skills/analyzing-usb-device-connection-history/SKILL.md b/skills/analyzing-usb-device-connection-history/SKILL.md index 8ed46c6c..1a02c275 100644 --- a/skills/analyzing-usb-device-connection-history/SKILL.md +++ b/skills/analyzing-usb-device-connection-history/SKILL.md @@ -1,7 +1,9 @@ --- name: analyzing-usb-device-connection-history -description: Investigate USB device connection history from Windows registry, event - logs, and setupapi logs to track removable media usage and potential data exfiltration. +description: Correlate Windows registry keys (USBSTOR, MountedDevices), Event Logs, + and setupapi.dev.log to reconstruct USB device connection history, first/last-plugged + timestamps, and drive letter mappings. Use when investigating removable media usage, + tracking device provenance, or building a timeline for suspected data exfiltration. domain: cybersecurity subdomain: digital-forensics tags: diff --git a/skills/analyzing-windows-amcache-artifacts/SKILL.md b/skills/analyzing-windows-amcache-artifacts/SKILL.md index 752f6f13..101c3be0 100644 --- a/skills/analyzing-windows-amcache-artifacts/SKILL.md +++ b/skills/analyzing-windows-amcache-artifacts/SKILL.md @@ -1,12 +1,10 @@ --- name: analyzing-windows-amcache-artifacts -description: 'Parses and analyzes the Windows Amcache.hve registry hive to extract - evidence of program execution, application installation, and driver loading for - digital forensics investigations. Uses Eric Zimmerman''s AmcacheParser and Timeline - Explorer for artifact extraction, SHA-1 hash correlation with threat intel, and - timeline reconstruction. Activates for requests involving Amcache forensics, program - execution evidence, Windows artifact analysis, or application compatibility cache - investigation. +description: 'Parses the Windows Amcache.hve registry hive with Eric Zimmerman''s + AmcacheParser and Timeline Explorer to extract evidence of program execution, application + installation, and driver loading, including SHA-1 hash correlation with threat + intel and timeline reconstruction. Use for Amcache forensics, program execution + evidence gathering, or application compatibility cache investigations in DFIR work. ' domain: cybersecurity diff --git a/skills/analyzing-windows-lnk-files-for-artifacts/SKILL.md b/skills/analyzing-windows-lnk-files-for-artifacts/SKILL.md index 53a5cdb7..b2b372b6 100644 --- a/skills/analyzing-windows-lnk-files-for-artifacts/SKILL.md +++ b/skills/analyzing-windows-lnk-files-for-artifacts/SKILL.md @@ -1,7 +1,9 @@ --- name: analyzing-windows-lnk-files-for-artifacts -description: Parse Windows LNK shortcut files to extract target paths, timestamps, - volume information, and machine identifiers for forensic timeline reconstruction. +description: Parse Windows LNK shortcut files to extract target paths, MAC timestamps, + volume serial numbers, and machine identifiers for forensic timeline reconstruction. + Use when investigating recently-accessed files, tracking removable media or network + paths referenced by shortcuts, or building a DFIR timeline from LNK artifacts. domain: cybersecurity subdomain: digital-forensics tags: diff --git a/skills/analyzing-windows-prefetch-with-python/SKILL.md b/skills/analyzing-windows-prefetch-with-python/SKILL.md index fd259cdf..851a3140 100644 --- a/skills/analyzing-windows-prefetch-with-python/SKILL.md +++ b/skills/analyzing-windows-prefetch-with-python/SKILL.md @@ -1,8 +1,10 @@ --- name: analyzing-windows-prefetch-with-python -description: Parse Windows Prefetch files using the windowsprefetch Python library - to reconstruct application execution history, detect renamed or masquerading binaries, - and identify suspicious program execution patterns. +description: Parse Windows Prefetch (.pf) files with the windowsprefetch Python + library to reconstruct application execution history, run counts, and accessed + file/volume lists. Use when investigating renamed or masquerading binaries, verifying + program execution timelines, or hunting for suspicious execution patterns in incident + response. domain: cybersecurity subdomain: digital-forensics tags: diff --git a/skills/analyzing-windows-registry-for-artifacts/SKILL.md b/skills/analyzing-windows-registry-for-artifacts/SKILL.md index 189d0e95..5ddbf675 100644 --- a/skills/analyzing-windows-registry-for-artifacts/SKILL.md +++ b/skills/analyzing-windows-registry-for-artifacts/SKILL.md @@ -1,7 +1,10 @@ --- name: analyzing-windows-registry-for-artifacts -description: Extract and analyze Windows Registry hives to uncover user activity, - installed software, autostart entries, and evidence of system compromise. +description: Extract and analyze Windows Registry hives with tools like RegRipper + and Registry Explorer to uncover user activity, installed software, autostart/persistence + entries, and evidence of system compromise. Use when investigating registry-based + persistence, reconstructing user or system activity, or performing DFIR triage + on a Windows image. domain: cybersecurity subdomain: digital-forensics tags: diff --git a/skills/analyzing-windows-shellbag-artifacts/SKILL.md b/skills/analyzing-windows-shellbag-artifacts/SKILL.md index ddd14779..be42668f 100644 --- a/skills/analyzing-windows-shellbag-artifacts/SKILL.md +++ b/skills/analyzing-windows-shellbag-artifacts/SKILL.md @@ -1,8 +1,10 @@ --- name: analyzing-windows-shellbag-artifacts -description: Analyze Windows Shellbag registry artifacts to reconstruct folder browsing - activity, detect access to removable media and network shares, and establish user - interaction with directories even after deletion using SBECmd and ShellBags Explorer. +description: Analyze Windows Shellbag (BagMRU) registry artifacts with SBECmd and + Shellbags Explorer to reconstruct folder browsing activity and prove user interaction + with directories, including removable media and network shares, even after the + folders are deleted. Use when reconstructing a user's folder access history or + proving access to a since-removed directory in DFIR work. domain: cybersecurity subdomain: digital-forensics tags: diff --git a/skills/assessing-vector-and-embedding-weaknesses/SKILL.md b/skills/assessing-vector-and-embedding-weaknesses/SKILL.md index 8e8637e2..e64dea90 100644 --- a/skills/assessing-vector-and-embedding-weaknesses/SKILL.md +++ b/skills/assessing-vector-and-embedding-weaknesses/SKILL.md @@ -1,6 +1,9 @@ --- name: assessing-vector-and-embedding-weaknesses -description: Test vector stores for embedding inversion, cross-tenant leakage, and poisoning. +description: Test RAG vector stores (Pinecone, Qdrant, Weaviate, Chroma, pgvector, + FAISS) for embedding inversion, cross-tenant data leakage, and data poisoning per + OWASP LLM08:2025. Use when performing an authorized security assessment of a RAG + pipeline's retrieval layer or auditing multi-tenant vector-store isolation. domain: cybersecurity subdomain: ai-security tags: diff --git a/skills/attacking-entra-id-with-roadtools/SKILL.md b/skills/attacking-entra-id-with-roadtools/SKILL.md index 26040218..4692cc0b 100644 --- a/skills/attacking-entra-id-with-roadtools/SKILL.md +++ b/skills/attacking-entra-id-with-roadtools/SKILL.md @@ -1,6 +1,10 @@ --- name: attacking-entra-id-with-roadtools -description: Enumerate Entra ID with ROADrecon and acquire and exchange tokens with roadtx. +description: Enumerate Microsoft Entra ID (Azure AD) tenants with ROADrecon and + acquire, exchange, and abuse tokens (including primary refresh tokens) with roadtx. + Use for authorized red-team enumeration of a tenant's directory objects or for + token-based identity attacks against Entra ID you are explicitly authorized to + test. domain: cybersecurity subdomain: identity-access-management tags: diff --git a/skills/attacking-oauth-with-device-code-phishing/SKILL.md b/skills/attacking-oauth-with-device-code-phishing/SKILL.md index 5bb02a72..023bdd57 100644 --- a/skills/attacking-oauth-with-device-code-phishing/SKILL.md +++ b/skills/attacking-oauth-with-device-code-phishing/SKILL.md @@ -1,6 +1,10 @@ --- name: attacking-oauth-with-device-code-phishing -description: Run OAuth 2.0 device-code and illicit-consent phishing against Microsoft Entra ID to steal access and refresh tokens, bypass MFA, and pivot across Microsoft 365 services. +description: Run OAuth 2.0 device-code and illicit-consent phishing attacks against + Microsoft Entra ID, using TokenTactics-style tooling to steal access and refresh + tokens, bypass MFA, and pivot across Microsoft 365 services. Use for authorized + red-team engagements simulating device-code or consent-grant phishing against a + tenant you have explicit written permission to test. domain: cybersecurity subdomain: identity-access-management tags: diff --git a/skills/auditing-cloud-with-cis-benchmarks/SKILL.md b/skills/auditing-cloud-with-cis-benchmarks/SKILL.md index fccbe6ca..55268fdb 100644 --- a/skills/auditing-cloud-with-cis-benchmarks/SKILL.md +++ b/skills/auditing-cloud-with-cis-benchmarks/SKILL.md @@ -1,12 +1,6 @@ --- name: auditing-cloud-with-cis-benchmarks -description: 'This skill details how to conduct cloud security audits using Center - for Internet Security benchmarks for AWS, Azure, and GCP. It covers interpreting - CIS Foundations Benchmark controls, running automated assessments with tools like - Prowler and ScoutSuite, remediating failed controls, and maintaining continuous - compliance monitoring against CIS v5 for AWS, v4 for Azure, and v4 for GCP. - - ' +description: Audit AWS, Azure, and GCP environments against the CIS Foundations Benchmarks by running automated scans with tools like Prowler and ScoutSuite, interpreting failed controls, and tracking remediation for continuous compliance. Use when conducting a cloud security audit, validating CIS benchmark compliance (CIS v5 AWS, v4 Azure, v4 GCP), or setting up continuous cloud compliance monitoring. domain: cybersecurity subdomain: cloud-security tags: diff --git a/skills/auditing-entra-id-with-aadinternals/SKILL.md b/skills/auditing-entra-id-with-aadinternals/SKILL.md index f370e5d5..8fd0f7db 100644 --- a/skills/auditing-entra-id-with-aadinternals/SKILL.md +++ b/skills/auditing-entra-id-with-aadinternals/SKILL.md @@ -1,6 +1,6 @@ --- name: auditing-entra-id-with-aadinternals -description: Run Microsoft Entra ID tenant reconnaissance, token acquisition and manipulation, and federation backdoor testing with the AADInternals PowerShell toolkit to validate identity-attack resilience. +description: Drive the AADInternals PowerShell toolkit to perform Microsoft Entra ID tenant reconnaissance, access-token acquisition across Microsoft APIs, and federation/AD FS backdoor testing (Golden SAML, T1606.002) for defensive validation. Use during an authorized Entra ID/Microsoft 365 red-team assessment to map external attack surface or verify AD FS signing certs resist Golden SAML. domain: cybersecurity subdomain: identity-access-management tags: diff --git a/skills/auditing-mcp-servers-for-tool-poisoning/SKILL.md b/skills/auditing-mcp-servers-for-tool-poisoning/SKILL.md index 5dfdbfc9..7a54509e 100644 --- a/skills/auditing-mcp-servers-for-tool-poisoning/SKILL.md +++ b/skills/auditing-mcp-servers-for-tool-poisoning/SKILL.md @@ -1,6 +1,6 @@ --- name: auditing-mcp-servers-for-tool-poisoning -description: Scan Model Context Protocol servers and tool metadata for poisoning, SSRF, and unauthenticated exposure. +description: Audit MCP servers for tool poisoning, tool shadowing, rug pulls, SSRF, and unauthenticated exposure using Invariant Labs' mcp-scan for static/runtime scanning plus manual SSRF/auth checks and description pinning. Use before adding a new MCP server to an agent stack, when reviewing an internal MCP server, detecting rug pulls, or investigating an agent's unexpected tool-driven behavior. domain: cybersecurity subdomain: ai-security tags: diff --git a/skills/benchmarking-kubernetes-with-kube-bench/SKILL.md b/skills/benchmarking-kubernetes-with-kube-bench/SKILL.md index 0fcbc89d..2111f6da 100644 --- a/skills/benchmarking-kubernetes-with-kube-bench/SKILL.md +++ b/skills/benchmarking-kubernetes-with-kube-bench/SKILL.md @@ -1,6 +1,6 @@ --- name: benchmarking-kubernetes-with-kube-bench -description: Run CIS Kubernetes Benchmark checks and remediate findings with kube-bench. +description: Run kube-bench (Aqua Security) against a Kubernetes cluster's control-plane, kubelet, and node configuration to check compliance with the CIS Kubernetes Benchmark and remediate PASS/FAIL/WARN findings. Use when establishing a security baseline for a new cluster, performing periodic hardening audits, validating remediation after configuration changes, or gathering compliance evidence for SOC 2/PCI DSS. domain: cybersecurity subdomain: container-security tags: diff --git a/skills/building-adversary-infrastructure-tracking-system/SKILL.md b/skills/building-adversary-infrastructure-tracking-system/SKILL.md index fd388106..d30c8cb4 100644 --- a/skills/building-adversary-infrastructure-tracking-system/SKILL.md +++ b/skills/building-adversary-infrastructure-tracking-system/SKILL.md @@ -1,8 +1,6 @@ --- name: building-adversary-infrastructure-tracking-system -description: Build an automated system to track adversary infrastructure using passive - DNS, certificate transparency, WHOIS data, and IP enrichment to map and monitor - threat actor command-and-control networks. +description: Build an automated adversary infrastructure tracking system in Python (dnspython, python-whois, shodan, networkx) that pivots across passive DNS, certificate transparency logs, WHOIS records, and IP enrichment to map threat-actor C2 networks and flag newly registered domains matching known patterns. Use when pivoting from known indicators to discover related C2 infrastructure or maintaining a continuously updated map of a threat actor's network. domain: cybersecurity subdomain: threat-intelligence tags: diff --git a/skills/building-attack-pattern-library-from-cti-reports/SKILL.md b/skills/building-attack-pattern-library-from-cti-reports/SKILL.md index 1178faee..72003087 100644 --- a/skills/building-attack-pattern-library-from-cti-reports/SKILL.md +++ b/skills/building-attack-pattern-library-from-cti-reports/SKILL.md @@ -1,8 +1,6 @@ --- name: building-attack-pattern-library-from-cti-reports -description: Extract and catalog attack patterns from cyber threat intelligence reports - into a structured STIX-based library mapped to MITRE ATT&CK for detection engineering - and threat-informed defense. +description: Parse cyber threat intelligence reports (Mandiant, CrowdStrike, Talos, Microsoft) with stix2, mitreattack-python, and spaCy to extract adversary behaviors, map them to MITRE ATT&CK technique IDs, and build a searchable STIX 2.1 attack-pattern library with detection templates. Use when cataloging attack patterns from CTI reports for threat-informed detection engineering, or generating Sigma/YARA templates from documented behaviors. domain: cybersecurity subdomain: threat-intelligence tags: diff --git a/skills/building-c2-infrastructure-with-sliver-framework/SKILL.md b/skills/building-c2-infrastructure-with-sliver-framework/SKILL.md index e287786f..96955ef6 100644 --- a/skills/building-c2-infrastructure-with-sliver-framework/SKILL.md +++ b/skills/building-c2-infrastructure-with-sliver-framework/SKILL.md @@ -1,8 +1,6 @@ --- name: building-c2-infrastructure-with-sliver-framework -description: Build and configure a resilient command-and-control infrastructure using - BishopFox's Sliver C2 framework with redirectors, HTTPS listeners, and multi-operator - support for authorized red team engagements. +description: Deploy and harden a Sliver C2 team server (BishopFox's Go-based adversary emulation framework) with multi-protocol listeners (mTLS, HTTP/S, DNS, WireGuard), redirectors, domain fronting, and multi-operator support for authorized red-team operations. Use when standing up resilient C2 for a red-team engagement or generating beacon/session implants that must survive blue-team detection. domain: cybersecurity subdomain: red-teaming tags: diff --git a/skills/building-c2-redirector-infrastructure/SKILL.md b/skills/building-c2-redirector-infrastructure/SKILL.md index 8510656e..dbaa0a4c 100644 --- a/skills/building-c2-redirector-infrastructure/SKILL.md +++ b/skills/building-c2-redirector-infrastructure/SKILL.md @@ -1,7 +1,6 @@ --- name: building-c2-redirector-infrastructure -description: Architect redirectors with nginx and Apache, malleable profiles, and OPSEC - for resilient C2. +description: Build dumb-pipe and traffic-filtering C2 redirectors with nginx (proxy_pass) and Apache (mod_rewrite), deriving filter rules from a Malleable C2 profile, layering Let's Encrypt TLS, and applying OPSEC controls like domain fronting and UA/geo filtering. Use when standing up red-team C2 that must survive blue-team triage or ensuring only profile-matching implant traffic reaches the hidden team server. domain: cybersecurity subdomain: red-teaming tags: diff --git a/skills/building-cloud-siem-with-sentinel/SKILL.md b/skills/building-cloud-siem-with-sentinel/SKILL.md index 090dd168..783891bc 100644 --- a/skills/building-cloud-siem-with-sentinel/SKILL.md +++ b/skills/building-cloud-siem-with-sentinel/SKILL.md @@ -1,12 +1,6 @@ --- name: building-cloud-siem-with-sentinel -description: 'This skill covers deploying Microsoft Sentinel as a cloud-native SIEM - and SOAR platform for centralized security operations. It details configuring data - connectors for multi-cloud log ingestion, writing KQL detection queries, building - automated response playbooks with Logic Apps, and leveraging the Sentinel data lake - for petabyte-scale threat hunting across AWS, Azure, and GCP security telemetry. - - ' +description: Deploy Microsoft Sentinel as a cloud-native SIEM/SOAR by configuring multi-cloud data connectors (AWS, Azure, GCP), writing KQL detection and hunting queries, and building automated Logic Apps response playbooks. Use when establishing a centralized SOC for multi-cloud environments, migrating from a legacy SIEM, or performing petabyte-scale threat hunting; not for AWS-only setups where Security Hub/GuardDuty suffice or for endpoint EDR needs. domain: cybersecurity subdomain: cloud-security tags: diff --git a/skills/building-devsecops-pipeline-with-gitlab-ci/SKILL.md b/skills/building-devsecops-pipeline-with-gitlab-ci/SKILL.md index 7c47b85f..07e759e5 100644 --- a/skills/building-devsecops-pipeline-with-gitlab-ci/SKILL.md +++ b/skills/building-devsecops-pipeline-with-gitlab-ci/SKILL.md @@ -1,7 +1,6 @@ --- name: building-devsecops-pipeline-with-gitlab-ci -description: Design and implement a comprehensive DevSecOps pipeline in GitLab CI/CD - integrating SAST, DAST, container scanning, dependency scanning, and secret detection. +description: Configure a GitLab CI/CD pipeline that embeds SAST (Semgrep, SpotBugs, Gosec, Bandit, NodeJsScan), DAST, container scanning, dependency scanning, and secret detection via GitLab's managed security templates. Use when building a shift-left DevSecOps pipeline in GitLab, adding automated vulnerability scanning stages to .gitlab-ci.yml, or triaging scanner findings with GitLab Duo AI before deployment. domain: cybersecurity subdomain: devsecops tags: diff --git a/skills/building-identity-federation-with-saml-azure-ad/SKILL.md b/skills/building-identity-federation-with-saml-azure-ad/SKILL.md index 83e7c52a..2b0835c5 100644 --- a/skills/building-identity-federation-with-saml-azure-ad/SKILL.md +++ b/skills/building-identity-federation-with-saml-azure-ad/SKILL.md @@ -1,8 +1,6 @@ --- name: building-identity-federation-with-saml-azure-ad -description: Establish SAML 2.0 identity federation between on-premises Active Directory - and Azure AD (Microsoft Entra ID) for seamless cross-domain authentication and SSO - to cloud applications. +description: Configure SAML 2.0 identity federation between on-premises Active Directory (via AD FS or a third-party IdP) and Microsoft Entra ID, covering federation models (AD FS, password hash sync, pass-through auth, third-party IdP) and the SAML authentication flow. Use when extending on-premises authentication authority to cloud resources or designing hybrid identity SSO architecture for Entra ID. domain: cybersecurity subdomain: identity-access-management tags: diff --git a/skills/building-identity-governance-lifecycle-process/SKILL.md b/skills/building-identity-governance-lifecycle-process/SKILL.md index 57fe191a..087289c9 100644 --- a/skills/building-identity-governance-lifecycle-process/SKILL.md +++ b/skills/building-identity-governance-lifecycle-process/SKILL.md @@ -1,12 +1,6 @@ --- name: building-identity-governance-lifecycle-process -description: 'Builds comprehensive identity governance and lifecycle management processes - including joiner-mover-leaver automation, role mining, access request workflows, - periodic recertification, and orphaned account remediation using IGA platforms. - Activates for requests involving identity lifecycle management, JML processes, role-based - access provisioning, or identity governance program design. - - ' +description: Design identity governance and lifecycle (IGA) programs on platforms like SailPoint, Saviynt, or Entra ID Governance, covering joiner-mover-leaver (JML) automation, role mining, access requests, periodic recertification, and orphaned-account remediation sourced from an HR feed. Use when automating cross-system JML provisioning, remediating former-employee access, or building lifecycle processes for SOX, HIPAA, or GDPR compliance. domain: cybersecurity subdomain: identity-access-management tags: diff --git a/skills/building-incident-response-playbook/SKILL.md b/skills/building-incident-response-playbook/SKILL.md index 8cb31305..8cdb1fcb 100644 --- a/skills/building-incident-response-playbook/SKILL.md +++ b/skills/building-incident-response-playbook/SKILL.md @@ -1,13 +1,10 @@ --- name: building-incident-response-playbook -description: 'Designs and documents structured incident response playbooks that define - step-by-step procedures for specific incident types aligned with NIST SP 800-61r3 - and SANS PICERL frameworks. Covers playbook structure, decision trees, escalation - criteria, RACI matrices, and integration with SOAR platforms. Activates for requests - involving IR playbook creation, incident response procedure documentation, response - runbook development, or SOAR playbook design. - - ' +description: Designs and documents structured incident response playbooks with step-by-step + procedures per incident type, decision trees, escalation criteria, RACI matrices, + and SOAR platform integration, aligned to NIST SP 800-61r3 and SANS PICERL. Use + when creating or maturing an IR program, documenting response runbooks for a new + incident type, or designing SOAR playbooks. domain: cybersecurity subdomain: incident-response tags: diff --git a/skills/building-incident-timeline-with-timesketch/SKILL.md b/skills/building-incident-timeline-with-timesketch/SKILL.md index 948ba59d..78e3a88f 100644 --- a/skills/building-incident-timeline-with-timesketch/SKILL.md +++ b/skills/building-incident-timeline-with-timesketch/SKILL.md @@ -1,8 +1,10 @@ --- name: building-incident-timeline-with-timesketch description: Build collaborative forensic incident timelines using Timesketch to ingest, - normalize, and analyze multi-source event data for attack chain reconstruction and - investigation documentation. + normalize, and analyze multi-source event data (including Plaso output) for attack + chain reconstruction and investigation documentation. Use when reconstructing the + sequence of events during an incident investigation or when multiple analysts need + to jointly tag, annotate, and search a shared DFIR timeline. domain: cybersecurity subdomain: incident-response tags: diff --git a/skills/building-ioc-defanging-and-sharing-pipeline/SKILL.md b/skills/building-ioc-defanging-and-sharing-pipeline/SKILL.md index 4f58594d..1b18583f 100644 --- a/skills/building-ioc-defanging-and-sharing-pipeline/SKILL.md +++ b/skills/building-ioc-defanging-and-sharing-pipeline/SKILL.md @@ -1,8 +1,10 @@ --- name: building-ioc-defanging-and-sharing-pipeline -description: Build an automated pipeline to defang indicators of compromise (URLs, - IPs, domains, emails) for safe sharing and distribute them in STIX format through - TAXII feeds and threat intelligence platforms. +description: Build an automated pipeline that ingests raw IOCs (URLs, IPs, domains, + emails), normalizes and deduplicates them, then produces defanged renderings for + safe human reading alongside canonical STIX 2.1 bundles distributed via TAXII servers, + MISP, or email reports. Use when preparing indicators of compromise for safe analyst + sharing or automating threat intel distribution to TAXII/MISP feeds. domain: cybersecurity subdomain: threat-intelligence tags: diff --git a/skills/building-ioc-enrichment-pipeline-with-opencti/SKILL.md b/skills/building-ioc-enrichment-pipeline-with-opencti/SKILL.md index 098c8573..eb3e3914 100644 --- a/skills/building-ioc-enrichment-pipeline-with-opencti/SKILL.md +++ b/skills/building-ioc-enrichment-pipeline-with-opencti/SKILL.md @@ -1,8 +1,10 @@ --- name: building-ioc-enrichment-pipeline-with-opencti -description: OpenCTI is an open-source platform for managing cyber threat intelligence - knowledge, built on STIX 2.1 as its native data model. This skill covers building - an automated IOC enrichment pipeline using O +description: Build an automated IOC enrichment pipeline on OpenCTI (STIX 2.1 native + threat intel platform) using its internal enrichment connectors to pull context + from VirusTotal, Shodan, AbuseIPDB, and GreyNoise, correlate indicators with known + actors/campaigns, and score them for analyst prioritization. Use when deploying + OpenCTI or automating enrichment and confidence scoring of newly ingested indicators. domain: cybersecurity subdomain: threat-intelligence tags: diff --git a/skills/building-malware-incident-communication-template/SKILL.md b/skills/building-malware-incident-communication-template/SKILL.md index 13a0f505..416564ad 100644 --- a/skills/building-malware-incident-communication-template/SKILL.md +++ b/skills/building-malware-incident-communication-template/SKILL.md @@ -1,8 +1,10 @@ --- name: building-malware-incident-communication-template -description: Build structured communication templates for malware incidents including - stakeholder notifications, executive briefings, technical advisories, and regulatory - disclosures with severity-based escalation procedures. +description: Build structured communication templates for malware incidents (ransomware, + wiper, trojan, worm), covering internal stakeholder notifications, executive briefings, + technical advisories for IT teams, customer notifications, and regulatory disclosures, + with severity-based escalation procedures. Use when drafting or standardizing incident + communications and notification workflows for a malware outbreak. domain: cybersecurity subdomain: incident-response tags: diff --git a/skills/building-patch-tuesday-response-process/SKILL.md b/skills/building-patch-tuesday-response-process/SKILL.md index edfa858d..2d3f123a 100644 --- a/skills/building-patch-tuesday-response-process/SKILL.md +++ b/skills/building-patch-tuesday-response-process/SKILL.md @@ -1,7 +1,10 @@ --- name: building-patch-tuesday-response-process -description: Establish a structured operational process to triage, test, and deploy - Microsoft Patch Tuesday security updates within risk-based remediation SLAs. +description: Establish a repeatable operational process for triaging, testing, and + deploying Microsoft Patch Tuesday security updates (Windows, Office, Exchange, SQL + Server, Azure) via WSUS/SCCM within risk-based remediation SLAs, from advisory review + through validation. Use when building or improving a monthly patch management workflow + or prioritizing which CVEs to remediate first. domain: cybersecurity subdomain: vulnerability-management tags: diff --git a/skills/building-phishing-reporting-button-workflow/SKILL.md b/skills/building-phishing-reporting-button-workflow/SKILL.md index ba1a1f17..addb235c 100644 --- a/skills/building-phishing-reporting-button-workflow/SKILL.md +++ b/skills/building-phishing-reporting-button-workflow/SKILL.md @@ -1,8 +1,10 @@ --- name: building-phishing-reporting-button-workflow -description: Implement a phishing report button in email clients with automated triage - workflow that analyzes user-reported suspicious emails and provides feedback to - reporters. +description: Implement a phishing report button (Microsoft 365 built-in Report button + or third-party like KnowBe4/Cofense) in email clients with a SOAR-driven automated + triage workflow that classifies reported emails, extracts IOCs, takes remediation + actions, and gives feedback to reporters. Use when deploying user-reported phishing + intake or automating triage of the resulting reporting mailbox. domain: cybersecurity subdomain: phishing-defense tags: diff --git a/skills/building-ransomware-playbook-with-cisa-framework/SKILL.md b/skills/building-ransomware-playbook-with-cisa-framework/SKILL.md index cedc1c94..bdc1bcad 100644 --- a/skills/building-ransomware-playbook-with-cisa-framework/SKILL.md +++ b/skills/building-ransomware-playbook-with-cisa-framework/SKILL.md @@ -1,12 +1,10 @@ --- name: building-ransomware-playbook-with-cisa-framework -description: 'Builds a structured ransomware incident response playbook aligned with - the CISA StopRansomware Guide and NIST Cybersecurity Framework. Covers preparation, +description: Builds a structured ransomware incident response playbook aligned with + the CISA StopRansomware Guide and NIST Cybersecurity Framework, covering preparation, detection, containment, eradication, recovery, and post-incident phases with actionable - checklists. Activates for requests involving ransomware response planning, CISA - compliance, incident response playbook creation, or ransomware preparedness assessment. - - ' + checklists. Use when creating or updating a ransomware playbook, running a CISA-aligned + readiness assessment, or validating response steps during a tabletop exercise. domain: cybersecurity subdomain: ransomware-defense tags: diff --git a/skills/building-red-team-c2-infrastructure-with-havoc/SKILL.md b/skills/building-red-team-c2-infrastructure-with-havoc/SKILL.md index 755a5427..a58db54d 100644 --- a/skills/building-red-team-c2-infrastructure-with-havoc/SKILL.md +++ b/skills/building-red-team-c2-infrastructure-with-havoc/SKILL.md @@ -1,7 +1,10 @@ --- name: building-red-team-c2-infrastructure-with-havoc -description: Deploy and configure the Havoc C2 framework with teamserver, HTTPS listeners, - redirectors, and Demon agents for authorized red team operations. +description: Deploy and configure the Havoc C2 framework (teamserver, HTTPS/HTTP/SMB + listeners, Nginx redirectors, and Demon agents) with malleable traffic profiles and + OPSEC-hardened infrastructure for authorized red team operations. Use when standing + up or hardening Havoc C2 infrastructure for a written, authorized adversary emulation + engagement. domain: cybersecurity subdomain: red-teaming tags: diff --git a/skills/building-role-mining-for-rbac-optimization/SKILL.md b/skills/building-role-mining-for-rbac-optimization/SKILL.md index f1bcc3d7..0864a33e 100644 --- a/skills/building-role-mining-for-rbac-optimization/SKILL.md +++ b/skills/building-role-mining-for-rbac-optimization/SKILL.md @@ -1,8 +1,10 @@ --- name: building-role-mining-for-rbac-optimization -description: Apply bottom-up and top-down role mining techniques to discover optimal - RBAC roles from existing user-permission assignments, reducing role explosion and - enforcing least privilege. +description: Apply bottom-up and top-down role mining techniques, including clustering + algorithms and formal concept analysis, to discover optimal RBAC roles from existing + user-permission assignments, consolidating overlapping roles and enforcing least + privilege. Use when an identity program needs to reduce role explosion or redesign + its RBAC role set from access data. domain: cybersecurity subdomain: identity-access-management tags: diff --git a/skills/building-soc-escalation-matrix/SKILL.md b/skills/building-soc-escalation-matrix/SKILL.md index 63794042..c6937d9a 100644 --- a/skills/building-soc-escalation-matrix/SKILL.md +++ b/skills/building-soc-escalation-matrix/SKILL.md @@ -1,7 +1,10 @@ --- name: building-soc-escalation-matrix description: Build a structured SOC escalation matrix defining severity tiers, response - SLAs, escalation paths, and notification procedures for security incidents. + SLAs, tiered escalation paths, and notification procedures for security incidents, + using context-driven criteria that combine business risk, asset criticality, and + data sensitivity. Use when designing or revising how a SOC triages and escalates + incidents across analyst tiers. domain: cybersecurity subdomain: soc-operations tags: diff --git a/skills/building-super-timelines-with-plaso/SKILL.md b/skills/building-super-timelines-with-plaso/SKILL.md index 8778b105..a1e97bd0 100644 --- a/skills/building-super-timelines-with-plaso/SKILL.md +++ b/skills/building-super-timelines-with-plaso/SKILL.md @@ -1,6 +1,10 @@ --- name: building-super-timelines-with-plaso -description: Generate log2timeline and Plaso super-timelines and triage them in Timesketch. +description: Generate forensic super-timelines with Plaso's log2timeline.py, pinfo.py, + psort.py, and psteal.py CLI tools (fusing file-system MACB, registry, EVTX, browser + history, prefetch, LNK, and more), then triage and filter the results in Timesketch. + Use when reconstructing the full sequence of events on a compromised or forensically + imaged host during a DFIR investigation. domain: cybersecurity subdomain: digital-forensics tags: diff --git a/skills/building-threat-actor-profile-from-osint/SKILL.md b/skills/building-threat-actor-profile-from-osint/SKILL.md index cabc8d16..ca1c6095 100644 --- a/skills/building-threat-actor-profile-from-osint/SKILL.md +++ b/skills/building-threat-actor-profile-from-osint/SKILL.md @@ -1,8 +1,6 @@ --- name: building-threat-actor-profile-from-osint -description: Build comprehensive threat actor profiles using open-source intelligence - (OSINT) techniques to document adversary motivations, capabilities, infrastructure, - and TTPs for proactive defense. +description: Build threat actor profiles by collecting OSINT from vendor reports, paste sites, dark web forums, social media, and code repos, correlating indicators, mapping adversary infrastructure with tools like Maltego and SpiderFoot, and producing structured dossiers of motivations, capabilities, infrastructure, and TTPs. Use when performing attribution or building an adversary dossier from open-source intelligence. domain: cybersecurity subdomain: threat-intelligence tags: diff --git a/skills/building-threat-feed-aggregation-with-misp/SKILL.md b/skills/building-threat-feed-aggregation-with-misp/SKILL.md index 8c2e721f..ebfa9233 100644 --- a/skills/building-threat-feed-aggregation-with-misp/SKILL.md +++ b/skills/building-threat-feed-aggregation-with-misp/SKILL.md @@ -1,8 +1,6 @@ --- name: building-threat-feed-aggregation-with-misp -description: Deploy MISP (Malware Information Sharing Platform) to aggregate, correlate, - and distribute threat intelligence feeds from multiple sources for centralized IOC - management and automated SIEM integration. +description: Deploy MISP via Docker and configure feeds from sources like abuse.ch, AlienVault OTX, and CIRCL to aggregate, correlate, and distribute threat intelligence, including automated feed synchronization and STIX/TAXII-based integration with Splunk, Elasticsearch, and SOAR platforms. Use when standing up centralized IOC management or wiring multi-source threat feeds into a SIEM. domain: cybersecurity subdomain: threat-intelligence tags: diff --git a/skills/building-threat-hunt-hypothesis-framework/SKILL.md b/skills/building-threat-hunt-hypothesis-framework/SKILL.md index d8a20711..a3b1be0e 100644 --- a/skills/building-threat-hunt-hypothesis-framework/SKILL.md +++ b/skills/building-threat-hunt-hypothesis-framework/SKILL.md @@ -1,7 +1,6 @@ --- name: building-threat-hunt-hypothesis-framework -description: Build a systematic threat hunt hypothesis framework that transforms threat - intelligence, attack patterns, and environmental data into testable hunting hypotheses. +description: Build a systematic threat-hunt workflow that turns threat intelligence and ATT&CK gap analysis into testable hypotheses, then executes and validates them via EDR/SIEM queries (CrowdStrike, Defender, Splunk, Elastic, Sysmon, Velociraptor, Sigma) and documents findings in a standardized hunt report. Use when planning or running a proactive threat hunt or scoping compromise from an intel- or anomaly-driven lead. domain: cybersecurity subdomain: threat-hunting tags: diff --git a/skills/building-threat-intelligence-enrichment-in-splunk/SKILL.md b/skills/building-threat-intelligence-enrichment-in-splunk/SKILL.md index 7053ff5c..cc177aa6 100644 --- a/skills/building-threat-intelligence-enrichment-in-splunk/SKILL.md +++ b/skills/building-threat-intelligence-enrichment-in-splunk/SKILL.md @@ -1,7 +1,6 @@ --- name: building-threat-intelligence-enrichment-in-splunk -description: Build automated threat intelligence enrichment pipelines in Splunk Enterprise - Security using lookup tables, modular inputs, and the Threat Intelligence Framework. +description: Build automated IOC enrichment pipelines in Splunk Enterprise Security by ingesting threat feeds into KV Store collections and correlating them against security events via lookup tables, modular inputs, and the Threat Intelligence Framework. Use when wiring threat intel into Splunk correlation searches to flag IOC matches and cut SOC triage time. domain: cybersecurity subdomain: soc-operations tags: diff --git a/skills/building-threat-intelligence-platform/SKILL.md b/skills/building-threat-intelligence-platform/SKILL.md index af11b38e..6f71742d 100644 --- a/skills/building-threat-intelligence-platform/SKILL.md +++ b/skills/building-threat-intelligence-platform/SKILL.md @@ -1,8 +1,6 @@ --- name: building-threat-intelligence-platform -description: Building a Threat Intelligence Platform (TIP) involves deploying and - integrating multiple CTI tools into a unified system for collecting, analyzing, - enriching, and disseminating threat intelligence. T +description: Design and deploy a Threat Intelligence Platform (TIP) by integrating open-source CTI tools (MISP, OpenCTI, TheHive, Cortex) into a unified system with feed ingestion pipelines, enrichment workflows, STIX/TAXII interoperability, and analyst dashboards. Use when architecting or standing up a centralized CTI platform to collect, analyze, and disseminate threat intelligence across a security team. domain: cybersecurity subdomain: threat-intelligence tags: diff --git a/skills/building-vulnerability-aging-and-sla-tracking/SKILL.md b/skills/building-vulnerability-aging-and-sla-tracking/SKILL.md index 29ad97ee..2acbebf0 100644 --- a/skills/building-vulnerability-aging-and-sla-tracking/SKILL.md +++ b/skills/building-vulnerability-aging-and-sla-tracking/SKILL.md @@ -1,7 +1,6 @@ --- name: building-vulnerability-aging-and-sla-tracking -description: Implement a vulnerability aging dashboard and SLA tracking system to - measure remediation performance against severity-based timelines and drive accountability. +description: Implement a vulnerability aging dashboard and SLA tracking system that measures time-to-remediation against severity-based deadlines (e.g. 14 days critical, 30 days high, 60 days medium, 90 days low), with automated escalations and compliance metrics reporting. Use when designing SLA policies, building aging/remediation dashboards, or proving compliance with remediation timelines. domain: cybersecurity subdomain: vulnerability-management tags: diff --git a/skills/building-vulnerability-dashboard-with-defectdojo/SKILL.md b/skills/building-vulnerability-dashboard-with-defectdojo/SKILL.md index 01ac7964..6e0e5f3c 100644 --- a/skills/building-vulnerability-dashboard-with-defectdojo/SKILL.md +++ b/skills/building-vulnerability-dashboard-with-defectdojo/SKILL.md @@ -1,7 +1,6 @@ --- name: building-vulnerability-dashboard-with-defectdojo -description: Deploy DefectDojo as a centralized vulnerability management dashboard - with scanner integrations, deduplication, metrics tracking, and Jira ticketing workflows. +description: Deploy DefectDojo as a centralized vulnerability management dashboard that ingests findings from 200+ security scanners, deduplicates results, tracks remediation metrics, and integrates with CI/CD, Jira ticketing, and Slack notifications via its REST API. Use when consolidating scanner output into one dashboard or automating vulnerability ticketing and executive reporting. domain: cybersecurity subdomain: vulnerability-management tags: diff --git a/skills/building-vulnerability-exception-tracking-system/SKILL.md b/skills/building-vulnerability-exception-tracking-system/SKILL.md index a02a0e02..6273ac2a 100644 --- a/skills/building-vulnerability-exception-tracking-system/SKILL.md +++ b/skills/building-vulnerability-exception-tracking-system/SKILL.md @@ -1,7 +1,6 @@ --- name: building-vulnerability-exception-tracking-system -description: Build a vulnerability exception and risk acceptance tracking system with - approval workflows, compensating controls documentation, and expiration management. +description: Build a vulnerability exception and risk acceptance tracking system covering approval workflows, compensating controls documentation, and automatic expiration for vulnerabilities that miss SLA remediation timelines. Use when standing up a governance process for risk acceptance and exception approvals to support PCI DSS, SOC 2, or NIST CSF compliance. domain: cybersecurity subdomain: vulnerability-management tags: diff --git a/skills/coercing-authentication-with-coercer-petitpotam/SKILL.md b/skills/coercing-authentication-with-coercer-petitpotam/SKILL.md index a0c42749..192b51b3 100644 --- a/skills/coercing-authentication-with-coercer-petitpotam/SKILL.md +++ b/skills/coercing-authentication-with-coercer-petitpotam/SKILL.md @@ -1,6 +1,6 @@ --- name: coercing-authentication-with-coercer-petitpotam -description: Trigger machine account authentication with PetitPotam (MS-EFSR) and Coercer across MS-RPRN, MS-DFSNM, and MS-FSRVP to feed NTLM relay into AD CS Web Enrollment (ESC8) and other relay targets. +description: Trigger machine account authentication with PetitPotam (MS-EFSR) and Coercer (MS-RPRN, MS-DFSNM, MS-FSRVP, MS-EVEN) via Coercer's scan/coerce/fuzz modes, feeding the coerced NTLM auth into a relay against AD CS Web Enrollment (ESC8), LDAP (RBCD), or SMB. Use in authorized engagements to complete a coercion-relay chain against a Domain Controller, or to validate coercion detections and signing/EPA mitigations. domain: cybersecurity subdomain: red-teaming tags: diff --git a/skills/collecting-threat-intelligence-with-misp/SKILL.md b/skills/collecting-threat-intelligence-with-misp/SKILL.md index 7a2e2c99..0f11c8b4 100644 --- a/skills/collecting-threat-intelligence-with-misp/SKILL.md +++ b/skills/collecting-threat-intelligence-with-misp/SKILL.md @@ -1,8 +1,6 @@ --- name: collecting-threat-intelligence-with-misp -description: MISP (Malware Information Sharing Platform) is an open-source threat - intelligence platform for gathering, sharing, storing, and correlating Indicators - of Compromise (IOCs) of targeted attacks, threat +description: Deploy MISP, configure threat feeds (MISP community, freetext, TAXII, CSV), and use the PyMISP API to programmatically fetch, add, and search events and IOCs, building automated collection pipelines that aggregate indicators from community and commercial sources. Use when gathering, storing, or correlating IOCs and threat intelligence, or when scripting MISP ingestion via PyMISP. domain: cybersecurity subdomain: threat-intelligence tags: diff --git a/skills/collecting-volatile-evidence-from-compromised-host/SKILL.md b/skills/collecting-volatile-evidence-from-compromised-host/SKILL.md index 13ee6bc4..cb29e218 100644 --- a/skills/collecting-volatile-evidence-from-compromised-host/SKILL.md +++ b/skills/collecting-volatile-evidence-from-compromised-host/SKILL.md @@ -1,8 +1,6 @@ --- name: collecting-volatile-evidence-from-compromised-host -description: Collect volatile forensic evidence from a compromised system following - order of volatility, preserving memory, network connections, processes, and system - state before they are lost. +description: Collect volatile forensic evidence from a compromised host by following the order of volatility, preserving memory, network connections, running processes, and system state with documented chain of custody before they are lost. Use before isolating, shutting down, or remediating a compromised host, especially when fileless or memory-resident malware is suspected, root cause analysis is needed, or the evidence must hold up in legal proceedings. domain: cybersecurity subdomain: incident-response tags: diff --git a/skills/conducting-cloud-incident-response/SKILL.md b/skills/conducting-cloud-incident-response/SKILL.md index 7763ba30..e216ea68 100644 --- a/skills/conducting-cloud-incident-response/SKILL.md +++ b/skills/conducting-cloud-incident-response/SKILL.md @@ -1,11 +1,6 @@ --- name: conducting-cloud-incident-response -description: 'Responds to security incidents in cloud environments (AWS, Azure, GCP) by performing identity-based containment, - cloud-native log analysis, resource isolation, and forensic evidence acquisition adapted for ephemeral cloud infrastructure. - Activates for requests involving cloud incident response, AWS security incident, Azure compromise, GCP breach, cloud forensics, - or cloud identity compromise. - - ' +description: Respond to security incidents in AWS, Azure, and GCP via identity-based containment, cloud-native log analysis (CloudTrail, Azure Activity Logs, GCP Audit Logs), resource isolation, and forensic evidence acquisition adapted for ephemeral cloud infrastructure. Use when CSPM alerts or audit logs show compromised cloud credentials, unauthorized IAM changes, or a breach spanning cloud services. domain: cybersecurity subdomain: incident-response tags: diff --git a/skills/conducting-domain-persistence-with-dcsync/SKILL.md b/skills/conducting-domain-persistence-with-dcsync/SKILL.md index 1c84ad5d..98eeb253 100644 --- a/skills/conducting-domain-persistence-with-dcsync/SKILL.md +++ b/skills/conducting-domain-persistence-with-dcsync/SKILL.md @@ -1,8 +1,6 @@ --- name: conducting-domain-persistence-with-dcsync -description: Perform DCSync attacks to replicate Active Directory credentials and - establish domain persistence by extracting KRBTGT, Domain Admin, and service account - hashes for Golden Ticket creation. +description: Perform DCSync attacks by abusing MS-DRSR replication rights (DS-Replication-Get-Changes/-All) to impersonate a Domain Controller and extract KRBTGT, Domain Admin, and service account hashes for Golden Ticket forging, typically with Mimikatz. Use in authorized engagements after finding principals with replication rights, to establish long-term domain persistence, or to validate detections for replication abuse. domain: cybersecurity subdomain: red-teaming tags: diff --git a/skills/conducting-external-reconnaissance-with-osint/SKILL.md b/skills/conducting-external-reconnaissance-with-osint/SKILL.md index e92c6c8f..57be83ad 100644 --- a/skills/conducting-external-reconnaissance-with-osint/SKILL.md +++ b/skills/conducting-external-reconnaissance-with-osint/SKILL.md @@ -1,14 +1,6 @@ --- name: conducting-external-reconnaissance-with-osint -description: 'Conducts external reconnaissance using Open Source Intelligence (OSINT) - techniques to map an organization''s external attack surface without directly interacting - with target systems. The tester gathers information from public sources including - DNS records, certificate transparency logs, search engines, social media, code repositories, - and data breach databases to build a comprehensive target profile. Activates for - requests involving OSINT reconnaissance, external footprinting, attack surface mapping, - or passive information gathering. - - ' +description: Conduct external recon using OSINT techniques to map an organization's external attack surface without touching target systems, gathering DNS records, certificate transparency logs, search results, social media, code repositories, and breach databases into a target profile. Use for the passive info-gathering phase of a pentest, external footprinting, or collecting employee/email intel for a social engineering campaign. domain: cybersecurity subdomain: penetration-testing tags: diff --git a/skills/conducting-full-scope-red-team-engagement/SKILL.md b/skills/conducting-full-scope-red-team-engagement/SKILL.md index a1d80965..94e2fe2b 100644 --- a/skills/conducting-full-scope-red-team-engagement/SKILL.md +++ b/skills/conducting-full-scope-red-team-engagement/SKILL.md @@ -1,8 +1,6 @@ --- name: conducting-full-scope-red-team-engagement -description: Plan and execute a comprehensive red team engagement covering reconnaissance - through post-exploitation using MITRE ATT&CK-aligned TTPs to evaluate an organization's - detection and response capabilities. +description: Plan and execute a comprehensive, MITRE ATT&CK-aligned red team engagement spanning threat modeling, reconnaissance, initial access, and post-exploitation to evaluate an organization's detection, prevention, and response against APT-style behavior. Use when scoping or running a full-scope, objective-based engagement, or purple-teaming against a specific threat actor's TTPs. domain: cybersecurity subdomain: red-teaming tags: diff --git a/skills/conducting-internal-reconnaissance-with-bloodhound-ce/SKILL.md b/skills/conducting-internal-reconnaissance-with-bloodhound-ce/SKILL.md index 9c614413..1f058f39 100644 --- a/skills/conducting-internal-reconnaissance-with-bloodhound-ce/SKILL.md +++ b/skills/conducting-internal-reconnaissance-with-bloodhound-ce/SKILL.md @@ -1,8 +1,6 @@ --- name: conducting-internal-reconnaissance-with-bloodhound-ce -description: Conduct internal Active Directory reconnaissance using BloodHound Community - Edition to map attack paths, identify privilege escalation chains, and discover - misconfigurations in domain environments. +description: Conduct internal Active Directory reconnaissance using BloodHound Community Edition's graph database with the SharpHound (AD) and AzureHound (Entra ID) collectors, mapping ACLs, sessions, and group memberships into attack paths from a low-privileged foothold to Domain Admin. Use after an initial AD foothold to identify privilege escalation chains, or to validate that AD hardening closed known attack paths. domain: cybersecurity subdomain: red-teaming tags: diff --git a/skills/conducting-malware-incident-response/SKILL.md b/skills/conducting-malware-incident-response/SKILL.md index 8115336c..8cfd06df 100644 --- a/skills/conducting-malware-incident-response/SKILL.md +++ b/skills/conducting-malware-incident-response/SKILL.md @@ -1,11 +1,6 @@ --- name: conducting-malware-incident-response -description: 'Responds to malware infections across enterprise endpoints by identifying the malware family, determining infection - vectors, assessing spread, and executing eradication procedures. Covers the full lifecycle from detection through containment, - analysis, removal, and recovery. Activates for requests involving malware response, malware eradication, trojan removal, - worm containment, malware triage, or infected endpoint remediation. - - ' +description: Respond to malware infections across enterprise endpoints by identifying the malware family, determining infection vectors, assessing spread, and executing containment, analysis, eradication, and recovery procedures aligned to MITRE ATT&CK. Use when responding to a confirmed or suspected malware infection, including trojan/worm/ransomware outbreaks, malware triage, or infected endpoint remediation. domain: cybersecurity subdomain: incident-response tags: diff --git a/skills/conducting-pass-the-ticket-attack/SKILL.md b/skills/conducting-pass-the-ticket-attack/SKILL.md index 71ed0e51..a9490aa2 100644 --- a/skills/conducting-pass-the-ticket-attack/SKILL.md +++ b/skills/conducting-pass-the-ticket-attack/SKILL.md @@ -1,8 +1,6 @@ --- name: conducting-pass-the-ticket-attack -description: Pass-the-Ticket (PtT) is a lateral movement technique that uses stolen - Kerberos tickets (TGT or TGS) to authenticate to services without knowing the user's - password. By extracting Kerberos tickets fro +description: Perform Pass-the-Ticket (PtT) lateral movement by extracting Kerberos TGT/TGS tickets from LSASS memory on a compromised host and injecting them into another session to impersonate the ticket owner without knowing their password. Use during authorized post-exploitation to move laterally or escalate access via stolen Kerberos tickets, or to validate detections for Kerberos ticket theft and reuse. domain: cybersecurity subdomain: red-teaming tags: diff --git a/skills/conducting-phishing-incident-response/SKILL.md b/skills/conducting-phishing-incident-response/SKILL.md index 2025620d..6b32d48b 100644 --- a/skills/conducting-phishing-incident-response/SKILL.md +++ b/skills/conducting-phishing-incident-response/SKILL.md @@ -1,13 +1,6 @@ --- name: conducting-phishing-incident-response -description: 'Responds to phishing incidents by analyzing reported emails, extracting - indicators, assessing credential compromise, quarantining malicious messages across - the organization, and remediating affected accounts. Covers email header analysis, - URL/attachment sandboxing, and mailbox-wide purge operations. Activates for requests - involving phishing response, email incident, credential phishing, spear phishing - investigation, or phishing remediation. - - ' +description: Respond to phishing incidents by analyzing reported emails, extracting indicators, sandboxing URLs/attachments, assessing credential compromise, quarantining malicious messages organization-wide, and remediating affected accounts. Use when investigating a reported phishing or credential-phishing email, a suspected spearphishing incident, or when a mailbox-wide purge and account remediation is needed. domain: cybersecurity subdomain: incident-response tags: diff --git a/skills/conducting-social-engineering-penetration-test/SKILL.md b/skills/conducting-social-engineering-penetration-test/SKILL.md index 24f08dd6..f8fae7d9 100644 --- a/skills/conducting-social-engineering-penetration-test/SKILL.md +++ b/skills/conducting-social-engineering-penetration-test/SKILL.md @@ -1,8 +1,6 @@ --- name: conducting-social-engineering-penetration-test -description: Design and execute a social engineering penetration test including phishing, - vishing, smishing, and physical pretexting campaigns to measure human security resilience - and identify training gaps. +description: Design and execute a social engineering penetration test combining OSINT-driven target profiling with phishing, vishing, smishing, and physical pretexting campaigns using tools like GoPhish, the Social Engineer Toolkit (SET), and Evilginx to measure human security resilience. Use when scoping or running an authorized human-attack-surface test and reporting results to identify security awareness training gaps. domain: cybersecurity subdomain: penetration-testing tags: diff --git a/skills/conducting-spearphishing-simulation-campaign/SKILL.md b/skills/conducting-spearphishing-simulation-campaign/SKILL.md index d70e1f2f..ee80a795 100644 --- a/skills/conducting-spearphishing-simulation-campaign/SKILL.md +++ b/skills/conducting-spearphishing-simulation-campaign/SKILL.md @@ -1,8 +1,6 @@ --- name: conducting-spearphishing-simulation-campaign -description: Spearphishing simulation is a targeted social engineering attack vector - used by red teams to gain initial access. Unlike broad phishing campaigns, spearphishing - uses OSINT-derived intelligence to craf +description: Run a targeted spearphishing simulation for initial access by developing OSINT-derived pretexts, building payloads (HTML smuggling, macro docs, ISO/LNK, OneNote, QR codes), standing up look-alike-domain email infrastructure with SPF/DKIM/DMARC via GoPhish, and tracking results. Use in authorized engagements to gain initial access via personalized phishing against specific individuals, distinct from broad campaigns. domain: cybersecurity subdomain: red-teaming tags: diff --git a/skills/configuring-active-directory-tiered-model/SKILL.md b/skills/configuring-active-directory-tiered-model/SKILL.md index a077cbbc..3545e041 100644 --- a/skills/configuring-active-directory-tiered-model/SKILL.md +++ b/skills/configuring-active-directory-tiered-model/SKILL.md @@ -1,8 +1,11 @@ --- name: configuring-active-directory-tiered-model description: Implement Microsoft's Enhanced Security Admin Environment (ESAE) tiered - administration model for Active Directory. Covers Tier 0/1/2 separation, privileged - access workstations (PAWs), administrative f + administration model for Active Directory, covering Tier 0/1/2 separation, privileged + access workstations (PAWs), administrative forest design, and authentication policy + silos. Use when designing or hardening AD privileged-access architecture, segmenting + Domain/Enterprise Admin accounts into tiers, or containing lateral movement and + credential theft (pass-the-hash, Kerberoasting, golden tickets). domain: cybersecurity subdomain: identity-access-management tags: diff --git a/skills/configuring-aws-verified-access-for-ztna/SKILL.md b/skills/configuring-aws-verified-access-for-ztna/SKILL.md index b845c988..0bca5704 100644 --- a/skills/configuring-aws-verified-access-for-ztna/SKILL.md +++ b/skills/configuring-aws-verified-access-for-ztna/SKILL.md @@ -1,8 +1,11 @@ --- name: configuring-aws-verified-access-for-ztna description: Configure AWS Verified Access to provide VPN-less zero trust network - access to internal applications using identity and device posture verification with - Cedar policy language. + access to internal apps, combining identity trust providers (IAM Identity Center, + Okta/OIDC), device posture providers (CrowdStrike, Jamf), Cedar policy authoring, and + Terraform deployment. Use when replacing VPN access with ZTNA, writing Cedar access + policies, or deploying Verified Access instances, groups, and endpoints across AWS + accounts. domain: cybersecurity subdomain: zero-trust-architecture tags: diff --git a/skills/configuring-certificate-authority-with-openssl/SKILL.md b/skills/configuring-certificate-authority-with-openssl/SKILL.md index ea04c418..a98540e6 100644 --- a/skills/configuring-certificate-authority-with-openssl/SKILL.md +++ b/skills/configuring-certificate-authority-with-openssl/SKILL.md @@ -1,8 +1,11 @@ --- name: configuring-certificate-authority-with-openssl -description: A Certificate Authority (CA) is the trust anchor in a PKI hierarchy, - responsible for issuing, signing, and revoking digital certificates. This skill - covers building a two-tier CA hierarchy (Root CA + +description: Build a two-tier PKI Certificate Authority hierarchy (offline Root CA + plus issuing Intermediate CA) using OpenSSL and the Python cryptography library, + covering certificate extensions, CRL distribution points, OCSP responder + configuration, and certificate policy management. Use when standing up an internal + CA, issuing or revoking X.509 certificates, or designing PKI trust hierarchies for + TLS, code-signing, or client-authentication use cases. domain: cybersecurity subdomain: cryptography tags: diff --git a/skills/configuring-hsm-for-key-storage/SKILL.md b/skills/configuring-hsm-for-key-storage/SKILL.md index 9ae04955..d380d2f5 100644 --- a/skills/configuring-hsm-for-key-storage/SKILL.md +++ b/skills/configuring-hsm-for-key-storage/SKILL.md @@ -1,8 +1,10 @@ --- name: configuring-hsm-for-key-storage -description: Hardware Security Modules (HSMs) are tamper-resistant physical devices - that safeguard cryptographic keys and perform cryptographic operations in a hardened - environment. Keys stored in an HSM never lea +description: Configures Hardware Security Modules for cryptographic key storage + using the PKCS#11 standard interface, covering key generation, signing, encryption, + and key management on physical HSMs and SoftHSM2 for development. Use when protecting + cryptographic keys so they never leave a hardened device boundary, or when building + and testing PKCS#11-based key management workflows. domain: cybersecurity subdomain: cryptography tags: diff --git a/skills/configuring-identity-aware-proxy-with-google-iap/SKILL.md b/skills/configuring-identity-aware-proxy-with-google-iap/SKILL.md index 0134be1d..8bb88ef7 100644 --- a/skills/configuring-identity-aware-proxy-with-google-iap/SKILL.md +++ b/skills/configuring-identity-aware-proxy-with-google-iap/SKILL.md @@ -1,9 +1,11 @@ --- name: configuring-identity-aware-proxy-with-google-iap -description: 'Configuring Google Cloud Identity-Aware Proxy (IAP) to enforce per-request - identity verification for Compute Engine, App Engine, Cloud Run, and GKE services - using access levels, context-aware policies, and programmatic access with service - accounts. +description: 'Configures Google Cloud Identity-Aware Proxy (IAP) via gcloud to enforce + per-request identity verification on Compute Engine, App Engine, Cloud Run, and + GKE, including IAM bindings, Access Context Manager access levels, session/reauth + settings, and service-account programmatic access. Use when replacing VPN access + with identity-based access to GCP backends or configuring context-aware, zero-trust + policies for Google Cloud services. ' domain: cybersecurity diff --git a/skills/configuring-ldap-security-hardening/SKILL.md b/skills/configuring-ldap-security-hardening/SKILL.md index c5e25858..7aed9558 100644 --- a/skills/configuring-ldap-security-hardening/SKILL.md +++ b/skills/configuring-ldap-security-hardening/SKILL.md @@ -1,8 +1,10 @@ --- name: configuring-ldap-security-hardening -description: Harden LDAP directory services against common attacks including credential - harvesting, LDAP injection, anonymous binding, and channel binding bypass. Covers - LDAPS enforcement, channel binding, LDAP si +description: Hardens LDAP directory services against credential harvesting, LDAP + injection, anonymous binding, and channel-binding bypass by enforcing LDAPS, channel + binding, and LDAP signing. Use when securing an LDAP or Active Directory environment + against these attack classes or auditing directory service configurations for + these vulnerabilities. domain: cybersecurity subdomain: identity-access-management tags: diff --git a/skills/configuring-microsegmentation-for-zero-trust/SKILL.md b/skills/configuring-microsegmentation-for-zero-trust/SKILL.md index 6b430e1a..059fb146 100644 --- a/skills/configuring-microsegmentation-for-zero-trust/SKILL.md +++ b/skills/configuring-microsegmentation-for-zero-trust/SKILL.md @@ -1,8 +1,9 @@ --- name: configuring-microsegmentation-for-zero-trust -description: Configure microsegmentation policies to enforce least-privilege workload-to-workload - access using tools like VMware NSX, Illumio, and Calico, preventing lateral movement - in zero trust architectures. +description: Configures microsegmentation policies to enforce least-privilege workload-to-workload + access using tools such as VMware NSX, Illumio, and Calico, preventing lateral + movement in zero trust architectures. Use when designing or implementing network + microsegmentation as part of a zero trust architecture aligned with NIST SP 800-207. domain: cybersecurity subdomain: zero-trust-architecture tags: diff --git a/skills/configuring-multi-factor-authentication-with-duo/SKILL.md b/skills/configuring-multi-factor-authentication-with-duo/SKILL.md index ee66787b..60ae1a51 100644 --- a/skills/configuring-multi-factor-authentication-with-duo/SKILL.md +++ b/skills/configuring-multi-factor-authentication-with-duo/SKILL.md @@ -1,8 +1,10 @@ --- name: configuring-multi-factor-authentication-with-duo -description: Deploy Cisco Duo multi-factor authentication across enterprise applications, - VPN, RDP, and SSH access points. This skill covers Duo integration methods, adaptive - authentication policies, device trust +description: Deploys Cisco Duo multi-factor authentication across enterprise applications, + VPN, RDP, and SSH access points, covering Duo Authentication Proxy setup, adaptive + authentication policies, device trust assessment, and phishing-resistant WebAuthn/FIDO2 + deployment aligned with NIST 800-63B AAL2/AAL3. Use when adding or hardening MFA + for remote access, VPN, or privileged logins with Duo. domain: cybersecurity subdomain: identity-access-management tags: diff --git a/skills/configuring-network-segmentation-with-vlans/SKILL.md b/skills/configuring-network-segmentation-with-vlans/SKILL.md index e9f9210c..0898110c 100644 --- a/skills/configuring-network-segmentation-with-vlans/SKILL.md +++ b/skills/configuring-network-segmentation-with-vlans/SKILL.md @@ -1,8 +1,10 @@ --- name: configuring-network-segmentation-with-vlans -description: 'Designs and implements VLAN-based network segmentation on managed switches - to isolate network zones, enforce access control between segments, and reduce the - attack surface by limiting lateral movement paths in enterprise network environments. +description: 'Designs and implements VLAN-based (802.1Q) network segmentation on + managed switches to isolate zones such as corporate, servers, DMZ, guest, and + IoT, and to limit lateral movement paths. Use when segmenting an enterprise network + into isolated security zones, meeting compliance mandates (PCI-DSS, HIPAA, SOC + 2) for network isolation, or reducing blast radius from a security incident. ' domain: cybersecurity diff --git a/skills/configuring-oauth2-authorization-flow/SKILL.md b/skills/configuring-oauth2-authorization-flow/SKILL.md index 1e917c91..e60993bc 100644 --- a/skills/configuring-oauth2-authorization-flow/SKILL.md +++ b/skills/configuring-oauth2-authorization-flow/SKILL.md @@ -1,8 +1,10 @@ --- name: configuring-oauth2-authorization-flow -description: Configure secure OAuth 2.0 authorization flows including Authorization - Code with PKCE, Client Credentials, and Device Authorization Grant. This skill covers - flow selection, PKCE implementation, token +description: Configures secure OAuth 2.0 authorization flows, including Authorization + Code with PKCE, Client Credentials, and Device Authorization Grant, covering flow + selection, PKCE implementation, token lifecycle management, and scope design per + OAuth 2.1. Use when implementing or hardening OAuth 2.0 authentication/authorization + for web, mobile, SPA, or machine-to-machine clients. domain: cybersecurity subdomain: identity-access-management tags: diff --git a/skills/configuring-pfsense-firewall-rules/SKILL.md b/skills/configuring-pfsense-firewall-rules/SKILL.md index 12147657..10b6bd7d 100644 --- a/skills/configuring-pfsense-firewall-rules/SKILL.md +++ b/skills/configuring-pfsense-firewall-rules/SKILL.md @@ -1,8 +1,10 @@ --- name: configuring-pfsense-firewall-rules -description: 'Configures pfSense firewall rules, NAT policies, VPN tunnels, and traffic - shaping to enforce network segmentation, control traffic flow, and protect internal - network zones in enterprise and small-to-medium business environments. +description: 'Configures pfSense firewall rules, NAT policies, IPsec/OpenVPN tunnels, + and traffic shaping to enforce network segmentation and control traffic between + zones such as DMZ, internal, guest, and IoT. Use when deploying a pfSense perimeter + or internal firewall, setting up port-forwarding NAT, configuring site-to-site + or remote-access VPNs, or applying QoS/bandwidth policies. ' domain: cybersecurity diff --git a/skills/configuring-snort-ids-for-intrusion-detection/SKILL.md b/skills/configuring-snort-ids-for-intrusion-detection/SKILL.md index bdf94a43..3682a062 100644 --- a/skills/configuring-snort-ids-for-intrusion-detection/SKILL.md +++ b/skills/configuring-snort-ids-for-intrusion-detection/SKILL.md @@ -1,8 +1,10 @@ --- name: configuring-snort-ids-for-intrusion-detection -description: 'Installs, configures, and tunes Snort 3 intrusion detection system to - monitor network traffic for malicious activity using custom and community rulesets, - preprocessors, and alert output plugins on authorized network segments. +description: 'Installs, configures, and tunes Snort 3 to monitor network traffic + for malicious activity using custom and community rulesets, preprocessors, and + alert output plugins. Use when deploying network-based intrusion detection at + key boundaries, writing custom Snort rules, tuning rulesets to reduce false positives, + or integrating Snort alerts with a SIEM. ' domain: cybersecurity diff --git a/skills/configuring-suricata-for-network-monitoring/SKILL.md b/skills/configuring-suricata-for-network-monitoring/SKILL.md index 013591d2..4041ba1b 100644 --- a/skills/configuring-suricata-for-network-monitoring/SKILL.md +++ b/skills/configuring-suricata-for-network-monitoring/SKILL.md @@ -1,8 +1,10 @@ --- name: configuring-suricata-for-network-monitoring description: 'Deploys and configures Suricata IDS/IPS with Emerging Threats rulesets, - EVE JSON logging, and custom rules for real-time network traffic inspection, threat - detection, and integration with SIEM platforms for centralized security monitoring. + EVE JSON logging, and custom rules for high-throughput, protocol-aware traffic + inspection (HTTP, TLS, DNS, SMB) and SIEM integration. Use when running Suricata + in IDS or inline IPS mode to detect or block malicious traffic, or when combining + signature-based and protocol anomaly detection with file extraction. ' domain: cybersecurity diff --git a/skills/configuring-tls-1-3-for-secure-communications/SKILL.md b/skills/configuring-tls-1-3-for-secure-communications/SKILL.md index 17e8b2ed..6ab55110 100644 --- a/skills/configuring-tls-1-3-for-secure-communications/SKILL.md +++ b/skills/configuring-tls-1-3-for-secure-communications/SKILL.md @@ -1,8 +1,9 @@ --- name: configuring-tls-1-3-for-secure-communications -description: TLS 1.3 (RFC 8446) is the latest version of the Transport Layer Security - protocol, providing significant improvements over TLS 1.2 in both security and performance. - It reduces handshake latency to 1-R +description: Configures TLS 1.3 (RFC 8446) on servers, covering cipher suite and + key-exchange group selection, and validates the resulting configuration with openssl + s_client and testssl.sh. Use when deploying or hardening TLS 1.3 for secure communications, + or when testing a server for common TLS misconfigurations and vulnerabilities. domain: cybersecurity subdomain: cryptography tags: diff --git a/skills/configuring-zscaler-private-access-for-ztna/SKILL.md b/skills/configuring-zscaler-private-access-for-ztna/SKILL.md index ccf18c8e..44b4f5a1 100644 --- a/skills/configuring-zscaler-private-access-for-ztna/SKILL.md +++ b/skills/configuring-zscaler-private-access-for-ztna/SKILL.md @@ -1,9 +1,10 @@ --- name: configuring-zscaler-private-access-for-ztna -description: 'Configuring Zscaler Private Access (ZPA) to replace traditional VPN +description: 'Configures Zscaler Private Access (ZPA) to replace traditional VPN with zero trust network access by deploying App Connectors, defining application - segments, configuring access policies based on user identity and device posture, - and integrating with IdPs. + segments, configuring identity- and device-posture-based access policies, and + integrating with IdPs. Use when replacing VPN concentrators with ZTNA or providing + remote users secure access to internal applications without network-level connectivity. ' domain: cybersecurity diff --git a/skills/continuous-llm-red-teaming-with-promptfoo/SKILL.md b/skills/continuous-llm-red-teaming-with-promptfoo/SKILL.md index e02e66d8..3174f715 100644 --- a/skills/continuous-llm-red-teaming-with-promptfoo/SKILL.md +++ b/skills/continuous-llm-red-teaming-with-promptfoo/SKILL.md @@ -1,6 +1,6 @@ --- name: continuous-llm-red-teaming-with-promptfoo -description: Wire Promptfoo and DeepTeam into CI/CD for automated regression red-teaming of LLM apps against OWASP LLM Top 10 and OWASP Agentic presets, failing the build when jailbreak or injection vulnerabilities regress. +description: Wires Promptfoo and DeepTeam into CI/CD for automated, repeatable red-teaming of LLM apps against OWASP LLM Top 10, OWASP Agentic, and MITRE ATLAS presets, failing the build when jailbreak or injection vulnerabilities regress. Use for continuous adversarial testing in CI/CD, a merge-blocking security gate, or comparing model/prompt versions for compliance reporting. domain: cybersecurity subdomain: ai-security tags: diff --git a/skills/defending-llms-with-guardrails/SKILL.md b/skills/defending-llms-with-guardrails/SKILL.md index 36752c34..5d196ed4 100644 --- a/skills/defending-llms-with-guardrails/SKILL.md +++ b/skills/defending-llms-with-guardrails/SKILL.md @@ -1,6 +1,6 @@ --- name: defending-llms-with-guardrails -description: Deploy Llama Guard, NeMo Guardrails, and LLM Guard input/output scanners as runtime defenses. +description: Deploys Llama Guard 3 safety classification, NeMo Guardrails programmable dialogue rails, and LLM Guard input/output scanner pipelines as complementary runtime defenses that inspect and constrain LLM prompts and responses. Use when adding a production runtime safety layer to an LLM, RAG, or agent application to block jailbreaks, prompt injection (OWASP LLM01), toxic content, or sensitive-data leakage before it reaches or leaves the model. domain: cybersecurity subdomain: ai-security tags: diff --git a/skills/deobfuscating-javascript-malware/SKILL.md b/skills/deobfuscating-javascript-malware/SKILL.md index 70a522da..4eb3908c 100644 --- a/skills/deobfuscating-javascript-malware/SKILL.md +++ b/skills/deobfuscating-javascript-malware/SKILL.md @@ -1,12 +1,6 @@ --- name: deobfuscating-javascript-malware -description: 'Deobfuscates malicious JavaScript code used in web-based attacks, phishing - pages, and dropper scripts by reversing encoding layers, eval chains, string manipulation, - and control flow obfuscation to reveal the original malicious logic. Activates for - requests involving JavaScript malware analysis, script deobfuscation, web skimmer - analysis, or obfuscated dropper investigation. - - ' +description: Deobfuscates malicious JavaScript found in phishing pages, web skimmers, and dropper scripts by reversing encoding layers, eval chains, string manipulation, and control-flow obfuscation to reveal the original malicious logic. Use when investigating a phishing page's obfuscated JavaScript, analyzing a Magecart-style web skimmer, or deobfuscating a JavaScript dropper that fetches second-stage malware. domain: cybersecurity subdomain: malware-analysis tags: diff --git a/skills/deobfuscating-powershell-obfuscated-malware/SKILL.md b/skills/deobfuscating-powershell-obfuscated-malware/SKILL.md index 98326af7..ccb9f2db 100644 --- a/skills/deobfuscating-powershell-obfuscated-malware/SKILL.md +++ b/skills/deobfuscating-powershell-obfuscated-malware/SKILL.md @@ -1,8 +1,6 @@ --- name: deobfuscating-powershell-obfuscated-malware -description: Systematically deobfuscate multi-layer PowerShell malware using AST analysis, - dynamic tracing, and tools like PSDecode and PowerDecode to reveal hidden payloads - and C2 infrastructure. +description: Systematically deobfuscates multi-layer PowerShell malware using AST analysis, dynamic tracing, and tools like PSDecode and PowerDecode to reveal hidden payloads and C2 infrastructure. Use during incident response or malware analysis when a PowerShell script is obfuscated with encoding, string manipulation, or invocation tricks and you need to recover the underlying commands, dropped payloads, or C2 endpoints. domain: cybersecurity subdomain: malware-analysis tags: diff --git a/skills/deploying-cloudflare-access-for-zero-trust/SKILL.md b/skills/deploying-cloudflare-access-for-zero-trust/SKILL.md index 34a6d7e3..ead14e61 100644 --- a/skills/deploying-cloudflare-access-for-zero-trust/SKILL.md +++ b/skills/deploying-cloudflare-access-for-zero-trust/SKILL.md @@ -1,10 +1,6 @@ --- name: deploying-cloudflare-access-for-zero-trust -description: 'Deploying Cloudflare Access with Cloudflare Tunnel to provide zero trust - access to self-hosted and private applications, configuring identity-aware access - policies, device posture checks, and WARP client enrollment for VPN replacement. - - ' +description: Deploys Cloudflare Access with Cloudflare Tunnel for zero trust access to self-hosted apps, configuring identity-aware policies, device posture checks, and WARP client enrollment as a VPN replacement. Use when replacing VPN with Cloudflare One, exposing internal apps without open inbound ports, or securing contractor/third-party access to specific applications. domain: cybersecurity subdomain: zero-trust-architecture tags: diff --git a/skills/deploying-honeytokens-and-canarytokens/SKILL.md b/skills/deploying-honeytokens-and-canarytokens/SKILL.md index 7b94d19b..5d71f6ae 100644 --- a/skills/deploying-honeytokens-and-canarytokens/SKILL.md +++ b/skills/deploying-honeytokens-and-canarytokens/SKILL.md @@ -1,6 +1,6 @@ --- name: deploying-honeytokens-and-canarytokens -description: Plant canarytokens and honey credentials and alert on breach. +description: Plants Canarytokens-based decoy artifacts (honey credentials, DNS tokens, web-bug URLs, AWS keys, documents, kubeconfigs) using Thinkst's open-source Canarytokens project and alerts via email or webhook when a token is touched. Use for high-fidelity intrusion detection in low-telemetry areas like file shares or credential stores, or to catch credential dumping and data-theft staging. domain: cybersecurity subdomain: deception-technology tags: diff --git a/skills/deploying-palo-alto-prisma-access-zero-trust/SKILL.md b/skills/deploying-palo-alto-prisma-access-zero-trust/SKILL.md index ed2496ad..d92d0410 100644 --- a/skills/deploying-palo-alto-prisma-access-zero-trust/SKILL.md +++ b/skills/deploying-palo-alto-prisma-access-zero-trust/SKILL.md @@ -1,10 +1,6 @@ --- name: deploying-palo-alto-prisma-access-zero-trust -description: 'Deploying Palo Alto Networks Prisma Access for SASE-based zero trust - network access using GlobalProtect agents, ZTNA Connectors, security policy enforcement, - and integration with Strata Cloud Manager for unified security management. - - ' +description: Deploys Palo Alto Networks Prisma Access for SASE-based zero trust network access, configuring GlobalProtect agents, ZTNA Connectors, security policy enforcement, and Strata Cloud Manager integration for unified management. Use when implementing enterprise-grade SASE with integrated ZTNA/SWG/CASB/FWaaS, replacing both VPN and branch firewalls with cloud-delivered security, or integrating ZTNA with an existing Palo Alto NGFW estate. domain: cybersecurity subdomain: zero-trust-architecture tags: diff --git a/skills/deploying-ransomware-canary-files/SKILL.md b/skills/deploying-ransomware-canary-files/SKILL.md index c8974f5c..12af0eba 100644 --- a/skills/deploying-ransomware-canary-files/SKILL.md +++ b/skills/deploying-ransomware-canary-files/SKILL.md @@ -1,14 +1,6 @@ --- name: deploying-ransomware-canary-files -description: 'Deploys and monitors ransomware canary files across critical directories - using Python''s watchdog library for real-time filesystem event detection. Places - strategically named decoy files that mimic high-value targets (financial records, - credentials, database exports) in locations ransomware typically enumerates first. - Monitors for any read, modify, rename, or delete operations on canary files and - triggers immediate alerts via email, Slack webhook, or syslog when interaction is - detected, providing early warning before full encryption begins. - - ' +description: Deploys and monitors ransomware canary files using Python's watchdog library, placing decoy files mimicking high-value targets (financial records, credentials, database exports) where ransomware enumerates first, and alerting via email, Slack, or syslog on any read/modify/rename/delete. Use for early-warning ransomware detection on file servers, NAS, or endpoints, or to supplement EDR where agents can't be deployed. domain: cybersecurity subdomain: ransomware-defense tags: diff --git a/skills/deploying-software-defined-perimeter/SKILL.md b/skills/deploying-software-defined-perimeter/SKILL.md index ca7f1109..9c03c88c 100644 --- a/skills/deploying-software-defined-perimeter/SKILL.md +++ b/skills/deploying-software-defined-perimeter/SKILL.md @@ -1,8 +1,6 @@ --- name: deploying-software-defined-perimeter -description: Deploy a Software-Defined Perimeter using the CSA v2.0 specification - with Single Packet Authorization, mutual TLS, and SDP controller/gateway configuration - to enforce zero trust network access. +description: Deploys a Software-Defined Perimeter per the CSA v2.0 specification, configuring Single Packet Authorization, mutual TLS, and SDP controller/gateway components to enforce zero trust network access. Use when building or hardening zero trust network architecture, implementing SPA-based "invisible" infrastructure that cloaks services from unauthenticated scanning, or meeting compliance requirements for zero trust network access. domain: cybersecurity subdomain: zero-trust-architecture tags: diff --git a/skills/deploying-tailscale-for-zero-trust-vpn/SKILL.md b/skills/deploying-tailscale-for-zero-trust-vpn/SKILL.md index 33af1c90..b34aabf8 100644 --- a/skills/deploying-tailscale-for-zero-trust-vpn/SKILL.md +++ b/skills/deploying-tailscale-for-zero-trust-vpn/SKILL.md @@ -1,8 +1,6 @@ --- name: deploying-tailscale-for-zero-trust-vpn -description: Deploy and configure Tailscale as a WireGuard-based zero trust mesh VPN - with identity-aware access controls, ACLs, and exit nodes for secure peer-to-peer - connectivity. +description: Deploys and configures Tailscale (or self-hosted Headscale) as a WireGuard-based zero trust mesh VPN, setting up identity-aware ACLs, exit nodes, subnet routers, and MagicDNS for encrypted peer-to-peer connectivity. Use when replacing traditional VPN servers with an identity-authenticated mesh network or enforcing granular per-device access control lists. domain: cybersecurity subdomain: zero-trust-architecture tags: diff --git a/skills/detecting-ai-model-prompt-injection-attacks/SKILL.md b/skills/detecting-ai-model-prompt-injection-attacks/SKILL.md index bcd9759f..89f21c82 100644 --- a/skills/detecting-ai-model-prompt-injection-attacks/SKILL.md +++ b/skills/detecting-ai-model-prompt-injection-attacks/SKILL.md @@ -1,17 +1,6 @@ --- name: detecting-ai-model-prompt-injection-attacks -description: 'Detects prompt injection attacks targeting LLM-based applications using - a multi-layered defense combining regex pattern matching for known attack signatures, - heuristic scoring for structural anomalies, and transformer-based classification - with DeBERTa models. The detector analyzes user inputs before they reach the LLM, - flagging direct injections (system prompt overrides, role-play escapes, instruction - hijacking) and indirect injections (encoded payloads, multi-language obfuscation, - delimiter-based escapes). Based on the OWASP LLM Top 10 (LLM01:2025 Prompt Injection) - and Simon Willison''s prompt injection taxonomy. Activates for requests involving - prompt injection detection, LLM input sanitization, AI security scanning, or prompt - attack classification. - - ' +description: Detects prompt injection using regex signature matching, heuristic scoring for structural anomalies, and DeBERTa-based transformer classification, flagging direct injections (system-prompt overrides, role-play escapes) and indirect injections (encoded payloads, obfuscation) per OWASP LLM Top 10 (LLM01:2025). Use for input validation layers in chatbots/agents/RAG pipelines, or for retrospectively classifying injection attempts in logs or incident investigations. domain: cybersecurity subdomain: ai-security tags: diff --git a/skills/detecting-anomalies-in-industrial-control-systems/SKILL.md b/skills/detecting-anomalies-in-industrial-control-systems/SKILL.md index 50636e81..5c766d0d 100644 --- a/skills/detecting-anomalies-in-industrial-control-systems/SKILL.md +++ b/skills/detecting-anomalies-in-industrial-control-systems/SKILL.md @@ -1,13 +1,6 @@ --- name: detecting-anomalies-in-industrial-control-systems -description: 'This skill covers deploying anomaly detection systems for industrial - control environments using machine learning models trained on OT network baselines, - physics-based process models, and behavioral analysis of industrial protocol communications. - It addresses building normal behavior profiles for SCADA polling patterns, detecting - deviations in Modbus/DNP3/OPC UA traffic, identifying rogue devices, and correlating - network anomalies with physical process data from historians. - - ' +description: Deploys anomaly detection for OT/ICS environments using machine learning on OT network baselines, physics-based process models, and Modbus/DNP3/OPC UA traffic analysis to flag deviations, rogue devices, and mismatches against historian data. Use for continuous OT monitoring, baselining deterministic SCADA polling, or investigating alerts from Nozomi Guardian/Dragos needing deeper protocol analysis. domain: cybersecurity subdomain: ot-ics-security tags: diff --git a/skills/detecting-api-enumeration-attacks/SKILL.md b/skills/detecting-api-enumeration-attacks/SKILL.md index 3d957301..289851ab 100644 --- a/skills/detecting-api-enumeration-attacks/SKILL.md +++ b/skills/detecting-api-enumeration-attacks/SKILL.md @@ -1,7 +1,11 @@ --- name: detecting-api-enumeration-attacks -description: Detect and prevent API enumeration attacks including BOLA and IDOR exploitation - by monitoring sequential identifier access patterns and authorization failures. +description: Detect API enumeration attacks (BOLA/IDOR, OWASP API1:2023) by writing SIEM + detection rules that flag sequential or UUID identifier iteration, parameter tampering, + and mixed 200/401/403 response patterns from API gateway and WAF logs. Use when + investigating suspected object-level authorization abuse, building threat-hunting + queries for API access-control bypass, or hardening API logging/rate-limiting against + enumeration. domain: cybersecurity subdomain: api-security tags: diff --git a/skills/detecting-arp-poisoning-in-network-traffic/SKILL.md b/skills/detecting-arp-poisoning-in-network-traffic/SKILL.md index fb128c6d..9fac77ae 100644 --- a/skills/detecting-arp-poisoning-in-network-traffic/SKILL.md +++ b/skills/detecting-arp-poisoning-in-network-traffic/SKILL.md @@ -1,8 +1,10 @@ --- name: detecting-arp-poisoning-in-network-traffic -description: Detect and prevent ARP spoofing attacks using ARPWatch, Dynamic ARP Inspection, - Wireshark analysis, and custom monitoring scripts to protect against man-in-the-middle - interception. +description: Detect Layer 2 ARP poisoning/spoofing by deploying ARPWatch, Dynamic ARP + Inspection (DAI), Wireshark packet analysis, and custom Python monitoring scripts + that flag gratuitous ARP floods, IP-to-MAC mapping changes, and duplicate IP addresses. + Use when investigating suspected man-in-the-middle interception or session hijacking + on a local network segment, or when building layer-2 anomaly detection for a SOC. domain: cybersecurity subdomain: network-security tags: diff --git a/skills/detecting-attacks-on-historian-servers/SKILL.md b/skills/detecting-attacks-on-historian-servers/SKILL.md index 3cba3996..9a153ebb 100644 --- a/skills/detecting-attacks-on-historian-servers/SKILL.md +++ b/skills/detecting-attacks-on-historian-servers/SKILL.md @@ -1,9 +1,11 @@ --- name: detecting-attacks-on-historian-servers -description: 'Detect cyber attacks targeting OT historian servers (OSIsoft PI, Ignition, - Wonderware) that sit at the IT/OT boundary and serve as pivot points for lateral - movement between enterprise and control networks, including data manipulation, unauthorized - queries, and exploitation of historian-specific vulnerabilities. +description: 'Detect cyber attacks on OT historian servers (OSIsoft PI, Ignition, GE + Proficy, Wonderware InSQL) using a Python detector that flags unauthorized queries, + data manipulation, and lateral-movement indicators as historians pivot between IT + and OT networks. Use when monitoring historians bridging IT/OT zones for compromise, + investigating historian-specific CVE exploitation, or validating historian data integrity + after a suspected OT incident. ' domain: cybersecurity diff --git a/skills/detecting-aws-credential-exposure-with-trufflehog/SKILL.md b/skills/detecting-aws-credential-exposure-with-trufflehog/SKILL.md index efefdf76..0bba2281 100644 --- a/skills/detecting-aws-credential-exposure-with-trufflehog/SKILL.md +++ b/skills/detecting-aws-credential-exposure-with-trufflehog/SKILL.md @@ -1,8 +1,11 @@ --- name: detecting-aws-credential-exposure-with-trufflehog -description: 'Detecting exposed AWS credentials in source code repositories, CI/CD - pipelines, and configuration files using TruffleHog, git-secrets, and AWS-native - detection mechanisms to prevent credential theft and unauthorized account access. +description: 'Scan source code repositories, CI/CD pipelines, and configuration files + for exposed AWS credentials using TruffleHog, git-secrets, and AWS-native detection. + Use when integrating secrets scanning into CI/CD, auditing repositories (including + git history) for historically committed AWS keys, responding to a GuardDuty alert + about credential use from an unexpected location, or verifying credential rotation + removed all exposed keys. ' domain: cybersecurity diff --git a/skills/detecting-aws-guardduty-findings-automation/SKILL.md b/skills/detecting-aws-guardduty-findings-automation/SKILL.md index aa845410..d1438da8 100644 --- a/skills/detecting-aws-guardduty-findings-automation/SKILL.md +++ b/skills/detecting-aws-guardduty-findings-automation/SKILL.md @@ -1,8 +1,10 @@ --- name: detecting-aws-guardduty-findings-automation -description: Automate AWS GuardDuty threat detection findings processing using EventBridge - and Lambda to enable real-time incident response, automatic quarantine of compromised - resources, and security notification workflows. +description: Build automated AWS GuardDuty finding response pipelines using EventBridge + and Lambda to trigger real-time incident response, automatically quarantine compromised + resources, and route security notifications. Use when designing automated remediation + playbooks for GuardDuty findings across VPC Flow Logs, CloudTrail, DNS, EKS, or S3 + data events, or when reducing mean time to respond to cloud threats. domain: cybersecurity subdomain: cloud-security tags: diff --git a/skills/detecting-azure-service-principal-abuse/SKILL.md b/skills/detecting-azure-service-principal-abuse/SKILL.md index f014f2a1..4229ee14 100644 --- a/skills/detecting-azure-service-principal-abuse/SKILL.md +++ b/skills/detecting-azure-service-principal-abuse/SKILL.md @@ -1,8 +1,11 @@ --- name: detecting-azure-service-principal-abuse -description: Detect and investigate Azure service principal abuse including privilege - escalation, credential compromise, admin consent bypass, and unauthorized enumeration - in Microsoft Entra ID environments. +description: Detect Azure service principal abuse in Microsoft Entra ID using KQL detection + queries (Sentinel/Splunk) against Azure AD Audit and Sign-in Logs, covering added + credentials, privileged role assignment, admin consent bypass, and service principal + enumeration. Use when investigating suspected privilege escalation or persistence + via service principals, or building threat-hunting queries for Entra ID identity + abuse. domain: cybersecurity subdomain: cloud-security tags: diff --git a/skills/detecting-azure-storage-account-misconfigurations/SKILL.md b/skills/detecting-azure-storage-account-misconfigurations/SKILL.md index f9b62efd..6bd5823a 100644 --- a/skills/detecting-azure-storage-account-misconfigurations/SKILL.md +++ b/skills/detecting-azure-storage-account-misconfigurations/SKILL.md @@ -1,8 +1,11 @@ --- name: detecting-azure-storage-account-misconfigurations -description: Audit Azure Blob and ADLS storage accounts for public access exposure, - weak or long-lived SAS tokens, missing encryption at rest, disabled HTTPS-only traffic, - and outdated TLS versions using the azure-mgmt-storage Python SDK. +description: Audit Azure Blob and ADLS storage accounts for public access exposure, weak + or long-lived SAS tokens, missing encryption at rest, disabled HTTPS-only traffic, + and outdated TLS versions, using the azure-mgmt-storage Python SDK to generate a + risk-scored report. Use when assessing an Azure subscription's storage accounts for + misconfiguration, building cloud security posture checks, or investigating a suspected + data exposure via public blob access. domain: cybersecurity subdomain: cloud-security tags: diff --git a/skills/detecting-broken-object-property-level-authorization/SKILL.md b/skills/detecting-broken-object-property-level-authorization/SKILL.md index a95e7b7f..f921d0bd 100644 --- a/skills/detecting-broken-object-property-level-authorization/SKILL.md +++ b/skills/detecting-broken-object-property-level-authorization/SKILL.md @@ -1,7 +1,10 @@ --- name: detecting-broken-object-property-level-authorization description: Detect and test for OWASP API3:2023 Broken Object Property Level Authorization - vulnerabilities including excessive data exposure and mass assignment attacks. + (BOPLA), covering excessive data exposure in API responses and mass assignment via + injected request-body properties. Use when reviewing API responses/requests for + over-exposed or over-writable object fields, or building detection rules and test + cases for property-level authorization gaps that object-level checks miss. domain: cybersecurity subdomain: api-security tags: diff --git a/skills/detecting-business-email-compromise/SKILL.md b/skills/detecting-business-email-compromise/SKILL.md index f5381ddd..000bdb62 100644 --- a/skills/detecting-business-email-compromise/SKILL.md +++ b/skills/detecting-business-email-compromise/SKILL.md @@ -1,8 +1,10 @@ --- name: detecting-business-email-compromise -description: Business Email Compromise (BEC) is a sophisticated fraud scheme where - attackers impersonate executives, vendors, or trusted partners to trick employees - into transferring funds, sharing sensitive data, +description: Detect Business Email Compromise (BEC) fraud, where attackers impersonate + executives or vendors to trick employees into wire transfers or data disclosure without + malicious links, using email gateway rules, behavioral analytics, and financial process + controls. Use when investigating a suspected executive/vendor impersonation email or + building detection rules for social-engineering fund-transfer fraud. domain: cybersecurity subdomain: phishing-defense tags: diff --git a/skills/detecting-cloud-threats-with-guardduty/SKILL.md b/skills/detecting-cloud-threats-with-guardduty/SKILL.md index b7d7ed91..0de4b0dc 100644 --- a/skills/detecting-cloud-threats-with-guardduty/SKILL.md +++ b/skills/detecting-cloud-threats-with-guardduty/SKILL.md @@ -1,10 +1,10 @@ --- name: detecting-cloud-threats-with-guardduty -description: 'This skill teaches security teams how to deploy and operationalize Amazon - GuardDuty for continuous threat detection across AWS accounts and workloads. It - covers enabling protection plans for S3, EKS, EC2 runtime monitoring, and Lambda, - interpreting finding severity levels, and building automated response workflows - using EventBridge and Lambda. +description: 'Deploy and operationalize Amazon GuardDuty, covering protection plans + for S3, EKS, EC2 runtime monitoring, and Lambda, interpreting finding severity, and + building automated response with EventBridge and Lambda. Use when establishing threat + detection for AWS accounts, investigating findings on compromised instances or credential + abuse, or building automated incident-response playbooks. ' domain: cybersecurity diff --git a/skills/detecting-command-and-control-over-dns/SKILL.md b/skills/detecting-command-and-control-over-dns/SKILL.md index 5ea03970..080a64ab 100644 --- a/skills/detecting-command-and-control-over-dns/SKILL.md +++ b/skills/detecting-command-and-control-over-dns/SKILL.md @@ -1,13 +1,10 @@ --- name: detecting-command-and-control-over-dns -description: 'Detects command-and-control (C2) communications tunneled through DNS - protocol including DNS tunneling tools (Iodine, dnscat2, dns2tcp, Cobalt Strike - DNS beacon), domain generation algorithms (DGA), encoded payload delivery via TXT/CNAME - records, and DNS beaconing patterns. Covers Shannon entropy analysis of query subdomains, - statistical anomaly detection, ML-based DGA classification, passive DNS correlation, - and Zeek/Suricata signature development. Activates for requests involving DNS-based - C2 detection, DNS tunnel identification, suspicious DNS traffic investigation, or - DGA domain classification. +description: 'Detect command-and-control (C2) traffic tunneled over DNS from tools like + Iodine, dnscat2, dns2tcp, and Cobalt Strike DNS beacon, using Shannon entropy analysis + of query subdomains, ML-based DGA classification, passive DNS correlation, and Zeek/Suricata + signatures. Use when investigating suspected DNS tunneling, classifying DGA domains, + detecting DNS beaconing, or building DNS anomaly rules for a SOC/SIEM. ' domain: cybersecurity diff --git a/skills/detecting-compromised-cloud-credentials/SKILL.md b/skills/detecting-compromised-cloud-credentials/SKILL.md index 870a857a..52ffa67a 100644 --- a/skills/detecting-compromised-cloud-credentials/SKILL.md +++ b/skills/detecting-compromised-cloud-credentials/SKILL.md @@ -1,9 +1,10 @@ --- name: detecting-compromised-cloud-credentials -description: 'Detecting compromised cloud credentials across AWS, Azure, and GCP by - analyzing anomalous API activity, impossible travel patterns, unauthorized resource - provisioning, and credential abuse indicators using GuardDuty, Defender for Identity, - and SCC Event Threat Detection. +description: 'Detect compromised cloud credentials across AWS, Azure, and GCP by analyzing + anomalous API activity, impossible-travel patterns, and credential-stuffing indicators + using GuardDuty, Microsoft Defender for Identity, and Google SCC Event Threat Detection. + Use when investigating alerts about cloud API activity from unfamiliar locations, + responding to an exposed-credential notification, or scoping a credential compromise. ' domain: cybersecurity diff --git a/skills/detecting-container-drift-at-runtime/SKILL.md b/skills/detecting-container-drift-at-runtime/SKILL.md index 6198cb19..6ce0cbf1 100644 --- a/skills/detecting-container-drift-at-runtime/SKILL.md +++ b/skills/detecting-container-drift-at-runtime/SKILL.md @@ -1,8 +1,6 @@ --- name: detecting-container-drift-at-runtime -description: Detect unauthorized modifications to running containers by monitoring - for binary execution drift, file system changes, and configuration deviations from - the original container image. +description: Detect unauthorized runtime drift in containers by monitoring binary execution, file system changes, and configuration deviations from the original immutable image, using tools like Falco and Microsoft Defender for Kubernetes/container workloads. Use when investigating possible container compromise, validating immutable-infrastructure controls, or hunting for unexpected package installs and file modifications inside running containers. domain: cybersecurity subdomain: container-security tags: diff --git a/skills/detecting-container-escape-attempts/SKILL.md b/skills/detecting-container-escape-attempts/SKILL.md index 158119f4..2050a093 100644 --- a/skills/detecting-container-escape-attempts/SKILL.md +++ b/skills/detecting-container-escape-attempts/SKILL.md @@ -1,8 +1,6 @@ --- name: detecting-container-escape-attempts -description: Container escape is a critical attack technique where an adversary breaks - out of container isolation to access the host system or other containers. Detection - involves monitoring for escape indicators +description: Detect container escape attempts where an adversary breaks out of container isolation to reach the host or other containers, by monitoring namespace manipulation, capability abuse, kernel exploits, sensitive mounted paths, and anomalous syscalls with tools like Falco, Sysdig, and seccomp/audit rules. Use when hunting for privilege escalation from containerized workloads or investigating suspected breakout from a Docker/Kubernetes environment. domain: cybersecurity subdomain: container-security tags: diff --git a/skills/detecting-container-escape-with-falco-rules/SKILL.md b/skills/detecting-container-escape-with-falco-rules/SKILL.md index 1918733e..3cd278b8 100644 --- a/skills/detecting-container-escape-with-falco-rules/SKILL.md +++ b/skills/detecting-container-escape-with-falco-rules/SKILL.md @@ -1,7 +1,6 @@ --- name: detecting-container-escape-with-falco-rules -description: Detect container escape attempts in real-time using Falco runtime security - rules that monitor syscalls, file access, and privilege escalation. +description: Write and tune Falco rules that monitor Linux syscalls to detect container escape techniques in real time, including host filesystem mounts, sensitive host path access, kernel module loading, and abuse of privileged container capabilities. Use when deploying or tuning Falco for a Kubernetes/container environment, or when investigating an alert tied to syscall-level escape behavior. domain: cybersecurity subdomain: container-security tags: diff --git a/skills/detecting-credential-dumping-techniques/SKILL.md b/skills/detecting-credential-dumping-techniques/SKILL.md index 89d8c8c0..496ecc60 100644 --- a/skills/detecting-credential-dumping-techniques/SKILL.md +++ b/skills/detecting-credential-dumping-techniques/SKILL.md @@ -1,7 +1,6 @@ --- name: detecting-credential-dumping-techniques -description: Detect LSASS credential dumping, SAM database extraction, and NTDS.dit - theft using Sysmon Event ID 10, Windows Security logs, and SIEM correlation rules +description: Detect LSASS credential dumping, SAM database extraction, and NTDS.dit theft (e.g. via Mimikatz) using Sysmon Event ID 10 process-access logging, Windows Security logs, and SIEM correlation rules. Use when hunting for credential-theft activity on Windows/Active Directory hosts or triaging EDR alerts on LSASS access. domain: cybersecurity subdomain: threat-detection tags: diff --git a/skills/detecting-data-and-model-poisoning/SKILL.md b/skills/detecting-data-and-model-poisoning/SKILL.md index 6c3c491a..e92bf7b2 100644 --- a/skills/detecting-data-and-model-poisoning/SKILL.md +++ b/skills/detecting-data-and-model-poisoning/SKILL.md @@ -1,6 +1,6 @@ --- name: detecting-data-and-model-poisoning -description: Identify poisoned training data and backdoored models across the ML pipeline. +description: Identify poisoned training data and backdoored ML models across the pipeline using IBM's Adversarial Robustness Toolbox (activation clustering, spectral signatures, trigger reconstruction), Cleanlab for label-quality issues, and supply-chain checks like weight-hash verification and safetensors enforcement. Use before training or deploying on third-party/user-contributed data or downloaded checkpoints, during ML supply-chain reviews, or when investigating model misbehavior tied to specific inputs (suspected backdoor trigger). domain: cybersecurity subdomain: ai-security tags: diff --git a/skills/detecting-dcsync-attack-in-active-directory/SKILL.md b/skills/detecting-dcsync-attack-in-active-directory/SKILL.md index fed2fd89..4c79c384 100644 --- a/skills/detecting-dcsync-attack-in-active-directory/SKILL.md +++ b/skills/detecting-dcsync-attack-in-active-directory/SKILL.md @@ -1,8 +1,6 @@ --- name: detecting-dcsync-attack-in-active-directory -description: Detect DCSync attacks where adversaries abuse Active Directory replication - privileges to extract password hashes by monitoring for non-domain-controller accounts - requesting directory replication via DsGetNCChanges. +description: Detect DCSync attacks (MITRE T1003.006) where adversaries abuse Active Directory replication privileges to extract password hashes, by auditing Event ID 4662 for the DS-Replication-Get-Changes GUIDs and flagging non-domain-controller accounts issuing DsGetNCChanges RPC calls. Use when hunting for credential theft via Mimikatz lsadump::dcsync or Impacket secretsdump, investigating lateral movement with domain admin credentials, or auditing AD replication permissions. domain: cybersecurity subdomain: threat-hunting tags: diff --git a/skills/detecting-deepfake-audio-in-vishing-attacks/SKILL.md b/skills/detecting-deepfake-audio-in-vishing-attacks/SKILL.md index bbc1fb3c..d0b36577 100644 --- a/skills/detecting-deepfake-audio-in-vishing-attacks/SKILL.md +++ b/skills/detecting-deepfake-audio-in-vishing-attacks/SKILL.md @@ -1,13 +1,6 @@ --- name: detecting-deepfake-audio-in-vishing-attacks -description: 'Detects AI-generated deepfake audio used in voice phishing (vishing) - attacks by extracting spectral features (MFCC, spectral centroid, spectral contrast, - zero-crossing rate) and classifying samples with machine learning models. Supports - batch analysis of audio files, generates confidence scores, and produces forensic - reports. Activates for requests involving deepfake voice detection, vishing investigation, - AI-generated speech analysis, voice cloning detection, or audio authenticity verification. - - ' +description: Detect AI-generated deepfake audio used in voice phishing (vishing) by extracting spectral features (MFCC, spectral centroid, spectral contrast, zero-crossing rate) and classifying samples with machine learning models, supporting batch audio analysis, confidence scoring, and forensic reporting. Use for deepfake voice detection, vishing investigations, AI-generated speech analysis, voice cloning detection, or audio authenticity verification. domain: cybersecurity subdomain: social-engineering-defense tags: diff --git a/skills/detecting-dependency-confusion/SKILL.md b/skills/detecting-dependency-confusion/SKILL.md index 58277e2a..29326ce5 100644 --- a/skills/detecting-dependency-confusion/SKILL.md +++ b/skills/detecting-dependency-confusion/SKILL.md @@ -1,6 +1,6 @@ --- name: detecting-dependency-confusion -description: Detect and prevent public-over-private name resolution in npm, PyPI, and Maven. +description: Detect and prevent dependency confusion (public-over-private package name resolution) in npm, PyPI, and Maven by enumerating claimable internal package names with tools like `confused` and OWASP `dep-scan`, then enforcing source restrictions via `.npmrc`, `pip.conf`/`pyproject.toml`, and Maven `settings.xml`. Use when onboarding a repo to a supply-chain security program, auditing lockfiles/manifests for confusable dependencies, or after an incident that may have leaked internal package names. domain: cybersecurity subdomain: supply-chain-security tags: diff --git a/skills/detecting-dll-sideloading-attacks/SKILL.md b/skills/detecting-dll-sideloading-attacks/SKILL.md index accccada..0ef00dd9 100644 --- a/skills/detecting-dll-sideloading-attacks/SKILL.md +++ b/skills/detecting-dll-sideloading-attacks/SKILL.md @@ -1,7 +1,6 @@ --- name: detecting-dll-sideloading-attacks -description: Detect DLL side-loading attacks where adversaries place malicious DLLs - alongside legitimate applications to hijack execution flow for defense evasion. +description: Detect DLL side-loading and search-order hijacking (MITRE T1574) where adversaries plant malicious DLLs for legitimate signed applications to load, by analyzing Sysmon Event ID 7 DLL-load events, checking signatures/hashes against known-good versions, and flagging path anomalies with EDR tools like CrowdStrike, MDE, or SentinelOne. Use when investigating EDR alerts on unsigned DLLs, hunting for APT persistence via trojanized applications, or triaging incidents involving DLL hijacking. domain: cybersecurity subdomain: threat-hunting tags: diff --git a/skills/detecting-dnp3-protocol-anomalies/SKILL.md b/skills/detecting-dnp3-protocol-anomalies/SKILL.md index 6a046c95..a588b962 100644 --- a/skills/detecting-dnp3-protocol-anomalies/SKILL.md +++ b/skills/detecting-dnp3-protocol-anomalies/SKILL.md @@ -1,11 +1,6 @@ --- name: detecting-dnp3-protocol-anomalies -description: 'Detect anomalies in DNP3 (Distributed Network Protocol 3) communications - used in SCADA systems by monitoring for unauthorized control commands, firmware - update attempts, protocol violations, and deviations from baseline traffic patterns - using deep packet inspection and machine learning approaches. - - ' +description: Detect anomalies in DNP3 communications used in SCADA/ICS systems by monitoring unauthorized control commands, firmware update attempts, protocol violations, and deviations from baseline traffic using deep packet inspection and machine learning approaches. Use when securing energy-sector or other OT/ICS networks, investigating suspicious DNP3 master/outstation activity, or building an anomaly-based IDS for industrial control traffic. domain: cybersecurity subdomain: ot-ics-security tags: diff --git a/skills/detecting-dns-exfiltration-with-dns-query-analysis/SKILL.md b/skills/detecting-dns-exfiltration-with-dns-query-analysis/SKILL.md index a551d7e0..16c442f1 100644 --- a/skills/detecting-dns-exfiltration-with-dns-query-analysis/SKILL.md +++ b/skills/detecting-dns-exfiltration-with-dns-query-analysis/SKILL.md @@ -1,8 +1,6 @@ --- name: detecting-dns-exfiltration-with-dns-query-analysis -description: Detect data exfiltration through DNS tunneling by analyzing query entropy, - subdomain length, query volume, TXT record abuse, and response payload sizes using - passive DNS monitoring. +description: Detect data exfiltration via DNS tunneling (tools like iodine, dnscat2, dns2tcp) by analyzing query entropy, subdomain length, query volume to single domains, TXT/CNAME/NULL record abuse, and oversized response payloads using passive DNS monitoring and statistical/ML methods. Use when hunting for covert DNS-based data exfiltration or building a passive DNS anomaly detection capability. domain: cybersecurity subdomain: network-security tags: diff --git a/skills/detecting-email-account-compromise/SKILL.md b/skills/detecting-email-account-compromise/SKILL.md index abe85892..005c3686 100644 --- a/skills/detecting-email-account-compromise/SKILL.md +++ b/skills/detecting-email-account-compromise/SKILL.md @@ -1,8 +1,6 @@ --- name: detecting-email-account-compromise -description: Detect compromised O365 and Google Workspace email accounts by analyzing - inbox rule creation, suspicious sign-in locations, mail forwarding rules, and unusual - API access patterns via Microsoft Graph and audit logs. +description: Detect compromised O365 and Google Workspace email accounts by analyzing Unified Audit Logs and Azure AD sign-in logs for impossible travel, inbox rule creation/deletion (Set-InboxRule, New-InboxRule), external mail forwarding rules, and unusual Microsoft Graph API access or OAuth token use. Use when investigating suspected business email compromise (BEC), account takeover, or mailbox persistence via malicious inbox rules. domain: cybersecurity subdomain: incident-response tags: diff --git a/skills/detecting-email-forwarding-rules-attack/SKILL.md b/skills/detecting-email-forwarding-rules-attack/SKILL.md index eb525613..afdd0839 100644 --- a/skills/detecting-email-forwarding-rules-attack/SKILL.md +++ b/skills/detecting-email-forwarding-rules-attack/SKILL.md @@ -1,7 +1,9 @@ --- name: detecting-email-forwarding-rules-attack -description: Detect malicious email forwarding rules created by adversaries to maintain - persistent access to email communications for intelligence collection and BEC attacks. +description: Detect malicious inbox/mail-flow forwarding rules that adversaries create to maintain + persistent access to email communications for intelligence collection and business email + compromise. Use when hunting for suspicious auto-forwarding, hidden mailbox rules, or + T1114-style email collection persistence after a compromised account or BEC incident. domain: cybersecurity subdomain: threat-hunting tags: diff --git a/skills/detecting-entra-offensive-tools-in-graph-logs/SKILL.md b/skills/detecting-entra-offensive-tools-in-graph-logs/SKILL.md index 5560c213..9f064ba6 100644 --- a/skills/detecting-entra-offensive-tools-in-graph-logs/SKILL.md +++ b/skills/detecting-entra-offensive-tools-in-graph-logs/SKILL.md @@ -1,6 +1,6 @@ --- name: detecting-entra-offensive-tools-in-graph-logs -description: Hunt AADGraphActivityLogs and MicrosoftGraphActivityLogs in Microsoft Sentinel/Log Analytics for fingerprints of offensive Entra ID tools such as ROADtools, AADInternals, and AzureHound. +description: Hunt AADGraphActivityLogs and MicrosoftGraphActivityLogs in Microsoft Sentinel/Log Analytics using KQL to fingerprint offensive Entra ID enumeration tools such as ROADtools, AADInternals, and AzureHound, including User-Agent signatures, roadrecon endpoint sweeps, and sign-in correlation. Use when investigating suspicious Microsoft Graph API activity, Entra ID reconnaissance, or building Sentinel analytics rules to detect these tools. domain: cybersecurity subdomain: soc-operations tags: diff --git a/skills/detecting-exfiltration-over-dns-with-zeek/SKILL.md b/skills/detecting-exfiltration-over-dns-with-zeek/SKILL.md index 7943235e..ea825539 100644 --- a/skills/detecting-exfiltration-over-dns-with-zeek/SKILL.md +++ b/skills/detecting-exfiltration-over-dns-with-zeek/SKILL.md @@ -1,7 +1,9 @@ --- name: detecting-exfiltration-over-dns-with-zeek description: Detect DNS-based data exfiltration by analyzing Zeek dns.log for high-entropy - subdomains and anomalous query patterns + subdomains, oversized TXT/NULL records, and anomalous query volume or patterns. Use when + investigating suspected DNS tunneling, covert C2 over DNS, or data exfiltration hidden + in DNS queries against network traffic captured by Zeek. domain: cybersecurity subdomain: network-security tags: diff --git a/skills/detecting-fileless-malware-techniques/SKILL.md b/skills/detecting-fileless-malware-techniques/SKILL.md index df48fa41..1ac083cc 100644 --- a/skills/detecting-fileless-malware-techniques/SKILL.md +++ b/skills/detecting-fileless-malware-techniques/SKILL.md @@ -2,8 +2,8 @@ name: detecting-fileless-malware-techniques description: 'Detects and analyzes fileless malware that operates entirely in memory using PowerShell, WMI, .NET reflection, registry-resident payloads, and living-off-the-land - binaries (LOLBins) without writing traditional executable files to disk. Activates - for requests involving fileless threat detection, in-memory malware investigation, + binaries (LOLBins) without writing traditional executable files to disk. Use for + requests involving fileless threat detection, in-memory malware investigation, LOLBin abuse analysis, or WMI persistence examination. ' diff --git a/skills/detecting-golden-ticket-attacks-in-kerberos-logs/SKILL.md b/skills/detecting-golden-ticket-attacks-in-kerberos-logs/SKILL.md index d1293358..f5f17cba 100644 --- a/skills/detecting-golden-ticket-attacks-in-kerberos-logs/SKILL.md +++ b/skills/detecting-golden-ticket-attacks-in-kerberos-logs/SKILL.md @@ -1,8 +1,10 @@ --- name: detecting-golden-ticket-attacks-in-kerberos-logs -description: Detect Golden Ticket attacks in Active Directory by analyzing Kerberos - TGT anomalies including mismatched encryption types, impossible ticket lifetimes, - non-existent accounts, and forged PAC signatures in domain controller event logs. +description: Detect Golden Ticket attacks in Active Directory using Splunk and KQL queries + against domain controller event logs, looking for Kerberos TGT anomalies such as mismatched + encryption types, impossible ticket lifetimes, non-existent accounts, and forged PAC + signatures. Use when hunting for Kerberos ticket forgery or krbtgt-based persistence + (MITRE T1558.001) in AD environments. domain: cybersecurity subdomain: threat-hunting tags: diff --git a/skills/detecting-golden-ticket-forgery/SKILL.md b/skills/detecting-golden-ticket-forgery/SKILL.md index a5c21ccf..02054c4a 100644 --- a/skills/detecting-golden-ticket-forgery/SKILL.md +++ b/skills/detecting-golden-ticket-forgery/SKILL.md @@ -1,8 +1,9 @@ --- name: detecting-golden-ticket-forgery -description: Detect Kerberos Golden Ticket forgery by analyzing Windows Event ID 4769 - for RC4 encryption downgrades (0x17), abnormal ticket lifetimes, and krbtgt account - anomalies in Splunk and Elastic SIEM +description: Detect Kerberos Golden Ticket forgery (e.g. Mimikatz-forged tickets) by analyzing + Windows Event ID 4769 for RC4 encryption downgrades (0x17), abnormal ticket lifetimes, + and krbtgt account anomalies using Splunk and Elastic SIEM queries. Use when investigating + suspected forged Kerberos tickets or krbtgt credential theft in Active Directory. domain: cybersecurity subdomain: threat-detection tags: diff --git a/skills/detecting-indirect-prompt-injection/SKILL.md b/skills/detecting-indirect-prompt-injection/SKILL.md index 858d4060..8450f233 100644 --- a/skills/detecting-indirect-prompt-injection/SKILL.md +++ b/skills/detecting-indirect-prompt-injection/SKILL.md @@ -1,6 +1,10 @@ --- name: detecting-indirect-prompt-injection -description: Detect and defend against prompt injection hidden in documents, web pages, and images consumed by an agent. +description: Detect and defend against indirect prompt injection hidden in web pages, documents, + and images consumed by an agent, via content extraction (HTML/PDF/OCR), normalization, + and scanning with LLM Guard's PromptInjection scanner or Hugging Face Prompt Guard 2. + Use when an agent ingests untrusted external content and you need to screen it for + injected instructions before the LLM processes it. domain: cybersecurity subdomain: ai-security tags: diff --git a/skills/detecting-insider-threat-behaviors/SKILL.md b/skills/detecting-insider-threat-behaviors/SKILL.md index b856312b..18788fcc 100644 --- a/skills/detecting-insider-threat-behaviors/SKILL.md +++ b/skills/detecting-insider-threat-behaviors/SKILL.md @@ -2,6 +2,8 @@ name: detecting-insider-threat-behaviors description: Detect insider threat behavioral indicators including unusual data access, off-hours activity, mass file downloads, privilege abuse, and resignation-correlated + data theft. Use when proactively threat-hunting for malicious or negligent insider + activity, or when investigating a departing or disgruntled employee for potential data theft. domain: cybersecurity subdomain: threat-hunting diff --git a/skills/detecting-insider-threat-with-ueba/SKILL.md b/skills/detecting-insider-threat-with-ueba/SKILL.md index b6c0ff11..d0830ae7 100644 --- a/skills/detecting-insider-threat-with-ueba/SKILL.md +++ b/skills/detecting-insider-threat-with-ueba/SKILL.md @@ -1,9 +1,10 @@ --- name: detecting-insider-threat-with-ueba -description: Implement User and Entity Behavior Analytics using Elasticsearch/OpenSearch +description: Implement User and Entity Behavior Analytics (UEBA) using Elasticsearch/OpenSearch to build behavioral baselines, calculate anomaly scores, perform peer group analysis, - and detect insider threat indicators such as data exfiltration, privilege abuse, - and unauthorized access patterns. + and alert on insider threat indicators such as data exfiltration, privilege abuse, and + unauthorized access. Use when building or tuning a UEBA pipeline rather than a one-off + manual hunt. domain: cybersecurity subdomain: threat-detection tags: diff --git a/skills/detecting-kerberoasting-attacks/SKILL.md b/skills/detecting-kerberoasting-attacks/SKILL.md index ee1493f1..07f8c779 100644 --- a/skills/detecting-kerberoasting-attacks/SKILL.md +++ b/skills/detecting-kerberoasting-attacks/SKILL.md @@ -1,7 +1,10 @@ --- name: detecting-kerberoasting-attacks description: Detect Kerberoasting attacks by monitoring for anomalous Kerberos TGS - requests targeting service accounts with SPNs for offline password cracking. + requests (Event ID 4769) targeting service accounts with SPNs, which attackers request + offline to crack service account passwords. Use when hunting for MITRE T1558 credential + access activity or investigating suspected service account password cracking attempts + in Active Directory Kerberos logs. domain: cybersecurity subdomain: threat-hunting tags: diff --git a/skills/detecting-lateral-movement-with-splunk/SKILL.md b/skills/detecting-lateral-movement-with-splunk/SKILL.md index 77aa43bf..f217de92 100644 --- a/skills/detecting-lateral-movement-with-splunk/SKILL.md +++ b/skills/detecting-lateral-movement-with-splunk/SKILL.md @@ -1,7 +1,9 @@ --- name: detecting-lateral-movement-with-splunk description: Detect adversary lateral movement across networks using Splunk SPL queries - against Windows authentication logs, SMB traffic, and remote service abuse. + against Windows authentication logs, SMB traffic, and remote service (WMI/PsExec/RDP) + abuse. Use when hunting for MITRE ATT&CK TA0008 lateral movement activity or investigating + suspected pivoting between hosts during an incident, with Splunk as the SIEM. domain: cybersecurity subdomain: threat-hunting tags: diff --git a/skills/detecting-living-off-the-land-with-lolbas/SKILL.md b/skills/detecting-living-off-the-land-with-lolbas/SKILL.md index a999395d..a58c9c12 100644 --- a/skills/detecting-living-off-the-land-with-lolbas/SKILL.md +++ b/skills/detecting-living-off-the-land-with-lolbas/SKILL.md @@ -2,7 +2,9 @@ name: detecting-living-off-the-land-with-lolbas description: Detect Living Off the Land Binaries (LOLBins/LOLBAS) abuse including certutil, regsvr32, mshta, and rundll32 via process telemetry, Sigma rules, and - parent-child process analysis + parent-child process analysis with Sysmon endpoint data. Use when hunting for adversaries + abusing built-in Windows binaries to download, execute, or proxy malicious code while + evading traditional executable-based detection. domain: cybersecurity subdomain: threat-detection tags: diff --git a/skills/detecting-malicious-npm-packages/SKILL.md b/skills/detecting-malicious-npm-packages/SKILL.md index cd3b8df2..9e25f06c 100644 --- a/skills/detecting-malicious-npm-packages/SKILL.md +++ b/skills/detecting-malicious-npm-packages/SKILL.md @@ -1,6 +1,6 @@ --- name: detecting-malicious-npm-packages -description: Triage npm packages for install-script malware, exfiltration, and worming behavior. +description: Triage npm packages and lockfiles for install-script malware, credential exfiltration, and worming behavior using GuardDog, manual tarball inspection, and dynamic detonation with network/filesystem monitoring. Use when vetting a new dependency, reviewing a package.json/package-lock.json during code review, checking lockfiles against a supply-chain advisory's known-bad versions, or investigating a host suspected of installing a trojanized package. domain: cybersecurity subdomain: supply-chain-security tags: diff --git a/skills/detecting-mimikatz-execution-patterns/SKILL.md b/skills/detecting-mimikatz-execution-patterns/SKILL.md index 48637490..e3f32161 100644 --- a/skills/detecting-mimikatz-execution-patterns/SKILL.md +++ b/skills/detecting-mimikatz-execution-patterns/SKILL.md @@ -1,7 +1,6 @@ --- name: detecting-mimikatz-execution-patterns -description: Detect Mimikatz execution through command-line patterns, LSASS access - signatures, binary indicators, and in-memory detection of known modules. +description: Detect Mimikatz credential-dumping activity via command-line pattern matching, LSASS access signatures, binary/hash indicators, and in-memory detection of known Mimikatz modules. Use when threat hunting for T1003 credential access, triaging EDR/SIEM alerts on LSASS access, scoping compromise during incident response, or validating detection coverage in a purple team exercise. domain: cybersecurity subdomain: threat-hunting tags: diff --git a/skills/detecting-misconfigured-azure-storage/SKILL.md b/skills/detecting-misconfigured-azure-storage/SKILL.md index e304afda..ec10b0be 100644 --- a/skills/detecting-misconfigured-azure-storage/SKILL.md +++ b/skills/detecting-misconfigured-azure-storage/SKILL.md @@ -1,11 +1,6 @@ --- name: detecting-misconfigured-azure-storage -description: 'Detecting misconfigured Azure Storage accounts including publicly accessible - blob containers, missing encryption settings, overly permissive SAS tokens, disabled - logging, and network access violations using Azure CLI, PowerShell, and Microsoft - Defender for Storage. - - ' +description: Audit Azure Storage accounts for public blob containers, missing encryption, overly permissive SAS tokens, disabled logging, and network access violations using Azure CLI, PowerShell, and Microsoft Defender for Storage. Use for storage security audits across subscriptions, responding to Defender for Storage anonymous-access alerts, verifying compliance controls, or setting security baselines when onboarding a subscription. domain: cybersecurity subdomain: cloud-security tags: diff --git a/skills/detecting-modbus-command-injection-attacks/SKILL.md b/skills/detecting-modbus-command-injection-attacks/SKILL.md index 114cb432..e905083e 100644 --- a/skills/detecting-modbus-command-injection-attacks/SKILL.md +++ b/skills/detecting-modbus-command-injection-attacks/SKILL.md @@ -1,11 +1,6 @@ --- name: detecting-modbus-command-injection-attacks -description: 'Detect command injection attacks against Modbus TCP/RTU protocol in - ICS environments by monitoring for unauthorized write operations, anomalous function - codes, malformed frames, and deviations from established communication baselines - using ICS-aware IDS and protocol deep packet inspection. - - ' +description: Detect command injection against Modbus TCP/RTU in ICS/SCADA environments by monitoring unauthorized writes, anomalous function codes, malformed frames, and deviations from communication baselines using ICS-aware IDS and deep packet inspection. Use when deploying IDS for Modbus OT networks, investigating unauthorized PLC register/coil changes, or responding to FrostyGoop-style Modbus attacks. domain: cybersecurity subdomain: ot-ics-security tags: diff --git a/skills/detecting-modbus-protocol-anomalies/SKILL.md b/skills/detecting-modbus-protocol-anomalies/SKILL.md index 6dabb5d5..f0820fbe 100644 --- a/skills/detecting-modbus-protocol-anomalies/SKILL.md +++ b/skills/detecting-modbus-protocol-anomalies/SKILL.md @@ -1,13 +1,6 @@ --- name: detecting-modbus-protocol-anomalies -description: 'This skill covers detecting anomalies in Modbus/TCP and Modbus RTU communications - in industrial control systems. It addresses function code monitoring, register range - validation, timing analysis, unauthorized client detection, and deep packet inspection - for malformed Modbus frames. The skill leverages Zeek with Modbus protocol analyzers, - Suricata IDS with OT rules, and custom Python-based detection using Markov chain - models for normal Modbus transaction sequences. - - ' +description: Detect anomalies in Modbus/TCP and Modbus RTU industrial traffic via function code monitoring, register range validation, timing analysis, and deep packet inspection, using Zeek's Modbus analyzer, Suricata IDS with OT rules, and Python Markov chain models of normal transaction sequences. Use for deploying Modbus IDS in OT environments, baselining polling patterns, investigating suspicious Modbus traffic, or building function code allowlists. domain: cybersecurity subdomain: ot-ics-security tags: diff --git a/skills/detecting-model-extraction-attacks/SKILL.md b/skills/detecting-model-extraction-attacks/SKILL.md index 94e0c43a..0dadf3b8 100644 --- a/skills/detecting-model-extraction-attacks/SKILL.md +++ b/skills/detecting-model-extraction-attacks/SKILL.md @@ -1,6 +1,6 @@ --- name: detecting-model-extraction-attacks -description: Detect model stealing, model inversion, and membership inference performed through inference-API abuse by monitoring query patterns, applying output perturbation, and red-teaming your own model's extractability. +description: Detect MITRE ATLAS AML.T0024 attacks (model stealing, inversion, membership inference) performed via inference-API abuse, by monitoring per-principal query volume/distribution, rate-limiting and perturbing outputs, and red-teaming your model's extractability. Use for a public or partner inference API needing cloning/inversion/membership-inference detection, or a pre-deployment red-team exercise to measure extraction risk. domain: cybersecurity subdomain: ai-security tags: diff --git a/skills/detecting-network-anomalies-with-zeek/SKILL.md b/skills/detecting-network-anomalies-with-zeek/SKILL.md index ace22f94..c8ad311e 100644 --- a/skills/detecting-network-anomalies-with-zeek/SKILL.md +++ b/skills/detecting-network-anomalies-with-zeek/SKILL.md @@ -1,10 +1,6 @@ --- name: detecting-network-anomalies-with-zeek -description: 'Deploys and configures Zeek (formerly Bro) network security monitor - to passively analyze network traffic, generate structured logs, detect anomalous - behavior, and create custom detection scripts for threat hunting and incident response. - - ' +description: Deploy and configure Zeek (formerly Bro) to passively analyze network traffic, generate structured connection/DNS/HTTP/SSL/file logs, detect anomalous behavior, and write custom scripts for organization-specific threats. Use for passive monitoring at network choke points, feeding SIEM/threat hunting with protocol metadata, or retrospective log analysis during incident response; not a substitute for inline IDS/IPS or host agents. domain: cybersecurity subdomain: network-security tags: diff --git a/skills/detecting-ntlm-relay-with-event-correlation/SKILL.md b/skills/detecting-ntlm-relay-with-event-correlation/SKILL.md index 9e9a4d9b..82215f69 100644 --- a/skills/detecting-ntlm-relay-with-event-correlation/SKILL.md +++ b/skills/detecting-ntlm-relay-with-event-correlation/SKILL.md @@ -1,11 +1,6 @@ --- name: detecting-ntlm-relay-with-event-correlation -description: 'Detect NTLM relay attacks through Windows Security Event correlation - by analyzing Event 4624 LogonType 3 for IP-to-hostname mismatches, identifying Responder/LLMNR - poisoning artifacts, auditing SMB and LDAP signing enforcement across the domain, - and detecting NTLM downgrade attacks from NTLMv2 to NTLMv1 using event log analysis. - - ' +description: Detect NTLM relay attacks (T1557.001) by correlating Windows Event 4624 LogonType 3 for IP-to-hostname mismatches, identifying Responder/LLMNR poisoning artifacts, auditing SMB/LDAP signing, and flagging NTLMv2-to-NTLMv1 downgrades. Use for hunting credential relay in NTLM-enabled AD, investigating auth-source anomalies, building SIEM correlation rules, or responding to PetitPotam/DFSCoerce/PrinterBug alerts. domain: cybersecurity subdomain: threat-hunting tags: diff --git a/skills/detecting-oauth-token-theft/SKILL.md b/skills/detecting-oauth-token-theft/SKILL.md index d1faab82..2af3b449 100644 --- a/skills/detecting-oauth-token-theft/SKILL.md +++ b/skills/detecting-oauth-token-theft/SKILL.md @@ -1,13 +1,6 @@ --- name: detecting-oauth-token-theft -description: 'Detects and responds to OAuth token theft and replay attacks in cloud - environments, focusing on Microsoft Entra ID (Azure AD) token protection, conditional - access policies, and sign-in anomaly detection. Covers access token theft, refresh - token replay, Primary Refresh Token (PRT) abuse, and pass-the-cookie attacks. Activates - for requests involving OAuth token theft detection, token replay prevention, Azure - AD conditional access token protection, or cloud identity attack investigation. - - ' +description: Detect and respond to OAuth token theft and replay in Microsoft Entra ID (Azure AD), covering access token theft, refresh token replay, Primary Refresh Token (PRT) abuse, pass-the-cookie attacks, and Token Protection conditional access policies. Use for impossible-travel or anomalous token-usage alerts, suspected session hijacking, sign-in log analysis, or configuring token-binding defenses in Azure/M365. domain: cybersecurity subdomain: cloud-security tags: diff --git a/skills/detecting-pass-the-hash-attacks/SKILL.md b/skills/detecting-pass-the-hash-attacks/SKILL.md index bdb790fd..b6332c53 100644 --- a/skills/detecting-pass-the-hash-attacks/SKILL.md +++ b/skills/detecting-pass-the-hash-attacks/SKILL.md @@ -1,8 +1,6 @@ --- name: detecting-pass-the-hash-attacks -description: Detect Pass-the-Hash attacks by analyzing NTLM authentication patterns, - identifying Type 3 logons with NTLM where Kerberos is expected, and correlating - with credential dumping. +description: Detect Pass-the-Hash (T1550.002) attacks by analyzing NTLM authentication patterns, flagging Type 3 logons using NTLM where Kerberos would be expected, and correlating with credential-dumping indicators. Use when threat hunting for lateral movement via stolen NTLM hashes, triaging EDR/SIEM alerts on suspicious NTLM logons, scoping compromise during incident response, or validating detection coverage in a purple team exercise. domain: cybersecurity subdomain: threat-hunting tags: diff --git a/skills/detecting-pass-the-ticket-attacks/SKILL.md b/skills/detecting-pass-the-ticket-attacks/SKILL.md index cdaec04a..5757d66f 100644 --- a/skills/detecting-pass-the-ticket-attacks/SKILL.md +++ b/skills/detecting-pass-the-ticket-attacks/SKILL.md @@ -1,8 +1,6 @@ --- name: detecting-pass-the-ticket-attacks -description: Detect Kerberos Pass-the-Ticket (PtT) attacks by analyzing Windows Event - IDs 4768, 4769, and 4771 for anomalous ticket usage patterns in Splunk and Elastic - SIEM +description: Detect Kerberos Pass-the-Ticket (PtT) attacks by analyzing Windows Event IDs 4768, 4769, and 4771 for anomalous ticket usage patterns, with detection queries for Splunk and Elastic SIEM. Use when investigating incidents involving stolen or replayed Kerberos tickets, building detection rules or threat hunting queries for ticket abuse, or validating SOC monitoring coverage for credential-theft attack techniques. domain: cybersecurity subdomain: threat-detection tags: diff --git a/skills/detecting-privilege-escalation-attempts/SKILL.md b/skills/detecting-privilege-escalation-attempts/SKILL.md index d52b969a..11e39d02 100644 --- a/skills/detecting-privilege-escalation-attempts/SKILL.md +++ b/skills/detecting-privilege-escalation-attempts/SKILL.md @@ -1,8 +1,6 @@ --- name: detecting-privilege-escalation-attempts -description: Detect privilege escalation attempts including token manipulation, UAC - bypass, unquoted service paths, kernel exploits, and sudo/doas abuse across Windows - and Linux. +description: Detect privilege escalation attempts across Windows and Linux, including access token manipulation, UAC bypass, unquoted service path abuse, kernel exploits, and sudo/doas abuse. Use when threat hunting for T1068-style privilege escalation, triaging EDR/SIEM alerts on suspicious privilege changes, scoping compromise during incident response, or validating detection coverage in a purple team exercise. domain: cybersecurity subdomain: threat-hunting tags: diff --git a/skills/detecting-privilege-escalation-in-kubernetes-pods/SKILL.md b/skills/detecting-privilege-escalation-in-kubernetes-pods/SKILL.md index 91af3cd1..1914732e 100644 --- a/skills/detecting-privilege-escalation-in-kubernetes-pods/SKILL.md +++ b/skills/detecting-privilege-escalation-in-kubernetes-pods/SKILL.md @@ -1,7 +1,10 @@ --- name: detecting-privilege-escalation-in-kubernetes-pods -description: Detect and prevent privilege escalation in Kubernetes pods by monitoring - security contexts, capabilities, and syscall patterns with Falco and OPA policies. +description: Detect and prevent privilege escalation in Kubernetes pods by combining + admission control (OPA policies), runtime monitoring (Falco), and audit log + analysis of security contexts, Linux capabilities, and syscall patterns. Use + when hardening pod security policies, investigating a pod running as root or + privileged, or hunting for containers escaping their intended scope. domain: cybersecurity subdomain: container-security tags: diff --git a/skills/detecting-process-hollowing-technique/SKILL.md b/skills/detecting-process-hollowing-technique/SKILL.md index 4c2cb366..349867d2 100644 --- a/skills/detecting-process-hollowing-technique/SKILL.md +++ b/skills/detecting-process-hollowing-technique/SKILL.md @@ -1,7 +1,11 @@ --- name: detecting-process-hollowing-technique -description: Detect process hollowing (T1055.012) by analyzing memory-mapped sections, - hollowed process indicators, and parent-child process anomalies in EDR telemetry. +description: Detect process hollowing (MITRE T1055.012) by analyzing memory-mapped + sections, hollowed process indicators, and parent-child anomalies using EDR + telemetry, Volatility's malfind plugin, pe-sieve, Hollows Hunter, and Sysmon + Event ID 25. Use when investigating a legitimate-looking process (svchost.exe, + explorer.exe, rundll32.exe) suspected of hosting injected code via + NtUnmapViewOfSection. domain: cybersecurity subdomain: threat-hunting tags: diff --git a/skills/detecting-qr-code-phishing-with-email-security/SKILL.md b/skills/detecting-qr-code-phishing-with-email-security/SKILL.md index 3b40adf3..523d5647 100644 --- a/skills/detecting-qr-code-phishing-with-email-security/SKILL.md +++ b/skills/detecting-qr-code-phishing-with-email-security/SKILL.md @@ -1,7 +1,11 @@ --- name: detecting-qr-code-phishing-with-email-security -description: Detect and prevent QR code phishing (quishing) attacks that bypass traditional - email security by embedding malicious URLs in QR code images within emails. +description: Detect and prevent QR code phishing (quishing) attacks that embed + malicious URLs inside QR code images to bypass link-based email security, + using image-based threat detection, OCR/QR decoding, and mobile-side scanning + (Microsoft Defender for O365, Proofpoint TAP, Barracuda Multimodal AI). Use + when configuring gateway rules against QR phishing or investigating suspicious + emails containing QR codes. domain: cybersecurity subdomain: phishing-defense tags: diff --git a/skills/detecting-ransomware-encryption-behavior/SKILL.md b/skills/detecting-ransomware-encryption-behavior/SKILL.md index 73178fa6..a7a5f2f5 100644 --- a/skills/detecting-ransomware-encryption-behavior/SKILL.md +++ b/skills/detecting-ransomware-encryption-behavior/SKILL.md @@ -1,11 +1,11 @@ --- name: detecting-ransomware-encryption-behavior -description: 'Detects ransomware encryption activity in real time using entropy analysis, - file system I/O monitoring, and behavioral heuristics. Identifies mass file modification - patterns, abnormal entropy spikes in written data, and suspicious process behavior - characteristic of ransomware encryption routines. Activates for requests involving - ransomware behavioral detection, entropy-based file monitoring, I/O anomaly detection, - or real-time encryption activity alerting. +description: 'Detects ransomware encryption activity in real time using entropy + analysis, file system I/O monitoring (Sysmon, watchdog, psutil), and behavioral + scoring to identify mass file modification, abnormal entropy spikes in written + data, and suspicious process behavior characteristic of encryption routines. + Use when building real-time ransomware detection, tuning entropy thresholds, + or investigating suspected active encryption on an endpoint. ' domain: cybersecurity diff --git a/skills/detecting-rdp-brute-force-attacks/SKILL.md b/skills/detecting-rdp-brute-force-attacks/SKILL.md index 12922442..f01f1387 100644 --- a/skills/detecting-rdp-brute-force-attacks/SKILL.md +++ b/skills/detecting-rdp-brute-force-attacks/SKILL.md @@ -1,8 +1,11 @@ --- name: detecting-rdp-brute-force-attacks -description: Detect RDP brute force attacks by analyzing Windows Security Event Logs - for failed authentication patterns (Event ID 4625), successful logons after failures - (Event ID 4624), NLA failures, and source IP frequency analysis. +description: Detect RDP brute force attacks by parsing Windows Security Event Logs + (EVTX files, via python-evtx) for failed logon patterns (Event ID 4625, Logon + Type 10/3), correlating with successful logons (Event ID 4624), and analyzing + NLA failures and source IP frequency. Use when investigating exposed RDP endpoints, + building SIEM detection rules for credential guessing, or confirming whether + a compromised account followed a brute-force pattern. domain: cybersecurity subdomain: threat-detection tags: diff --git a/skills/detecting-rootkit-activity/SKILL.md b/skills/detecting-rootkit-activity/SKILL.md index b31fc16f..586b18fa 100644 --- a/skills/detecting-rootkit-activity/SKILL.md +++ b/skills/detecting-rootkit-activity/SKILL.md @@ -1,10 +1,10 @@ --- name: detecting-rootkit-activity description: 'Detects rootkit presence on compromised systems by identifying hidden - processes, hooked system calls, modified kernel structures, hidden files, and covert - network connections using memory forensics, cross-view detection, and integrity - checking techniques. Activates for requests involving rootkit detection, hidden - process discovery, kernel integrity checking, or system call hook analysis. + processes, hooked system calls, modified kernel structures, and covert network + connections using Volatility memory forensics, cross-view detection, and tools + like GMER, rkhunter, chkrootkit, and RootkitRevealer. Use when standard tools + (Task Manager, netstat, AV/EDR) show nothing abnormal but compromise is suspected. ' domain: cybersecurity diff --git a/skills/detecting-secure-boot-bypass/SKILL.md b/skills/detecting-secure-boot-bypass/SKILL.md index a4be227c..d384557f 100644 --- a/skills/detecting-secure-boot-bypass/SKILL.md +++ b/skills/detecting-secure-boot-bypass/SKILL.md @@ -1,6 +1,11 @@ --- name: detecting-secure-boot-bypass -description: Detect bootkits such as BlackLotus and Bootkitty and Secure Boot bypass via DBX and binary checks. +description: Detect UEFI Secure Boot bypasses and bootkits such as BlackLotus and + Bootkitty by verifying Secure Boot state, checking dbx revocation currency, and + hashing EFI boot binaries against known-bad sets using mokutil, efi-readvar/dbxtool, + CHIPSEC, sbverify/pesign, and Windows Confirm-SecureBootUEFI. Use when auditing + fleet dbx rollout after a bootkit advisory or hunting for pre-OS persistence on + a suspected-compromised endpoint. domain: cybersecurity subdomain: hardware-firmware-security tags: diff --git a/skills/detecting-service-account-abuse/SKILL.md b/skills/detecting-service-account-abuse/SKILL.md index 6b7b7af4..1c87f0c0 100644 --- a/skills/detecting-service-account-abuse/SKILL.md +++ b/skills/detecting-service-account-abuse/SKILL.md @@ -1,7 +1,11 @@ --- name: detecting-service-account-abuse -description: Detect abuse of service accounts through anomalous interactive logons, - privilege escalation, lateral movement, and unauthorized access patterns. +description: Detect abuse of service accounts by hunting for anomalous interactive + logons, privilege escalation, and lateral movement using EDR/SIEM telemetry + (CrowdStrike Falcon, Microsoft Defender, Splunk, Elastic Security, Sysmon, + Velociraptor) and Sigma detection rules. Use when hunting for service-account + misuse or investigating a service account performing unexpected interactive + logons. domain: cybersecurity subdomain: threat-hunting tags: diff --git a/skills/detecting-shadow-api-endpoints/SKILL.md b/skills/detecting-shadow-api-endpoints/SKILL.md index 986111da..dd479aed 100644 --- a/skills/detecting-shadow-api-endpoints/SKILL.md +++ b/skills/detecting-shadow-api-endpoints/SKILL.md @@ -1,7 +1,11 @@ --- name: detecting-shadow-api-endpoints -description: Discover and inventory shadow API endpoints that operate outside documented - specifications using traffic analysis, code scanning, and API discovery platforms. +description: Discover and inventory shadow API endpoints that operate outside + documented OpenAPI/Swagger specs, using traffic analysis against API gateways + (Kong, AWS API Gateway, Envoy), cloud configuration scanning, and source code + repository mining for undocumented routes. Use when assessing API attack surface, + auditing for forgotten test environments or deprecated API versions still + running, or building an API registration governance policy. domain: cybersecurity subdomain: api-security tags: diff --git a/skills/detecting-shadow-it-cloud-usage/SKILL.md b/skills/detecting-shadow-it-cloud-usage/SKILL.md index 7560a5a9..adcdfebf 100644 --- a/skills/detecting-shadow-it-cloud-usage/SKILL.md +++ b/skills/detecting-shadow-it-cloud-usage/SKILL.md @@ -1,8 +1,11 @@ --- name: detecting-shadow-it-cloud-usage -description: Detect unauthorized SaaS and cloud service usage (shadow IT) by analyzing - proxy logs, DNS query logs, and netflow data using Python pandas for traffic pattern - analysis and domain classification. +description: Detect unauthorized SaaS and cloud service usage (shadow IT) by parsing + proxy access logs, DNS query logs, and firewall/netflow data with Python pandas + to aggregate traffic by domain, classify domains against known SaaS categories, + and score risk by data volume and user count. Use when auditing an organization + for unsanctioned cloud/SaaS usage or generating a shadow IT discovery report + with remediation recommendations. domain: cybersecurity subdomain: cloud-security tags: diff --git a/skills/detecting-spearphishing-with-email-gateway/SKILL.md b/skills/detecting-spearphishing-with-email-gateway/SKILL.md index 7f7815e4..5406fc16 100644 --- a/skills/detecting-spearphishing-with-email-gateway/SKILL.md +++ b/skills/detecting-spearphishing-with-email-gateway/SKILL.md @@ -1,8 +1,11 @@ --- name: detecting-spearphishing-with-email-gateway -description: Spearphishing targets specific individuals using personalized, researched - content that bypasses generic spam filters. Email security gateways (SEGs) like - Microsoft Defender for Office 365, Proofpoint, +description: Detect and block spearphishing emails that use personalized, researched + content to evade generic spam filters, by configuring email security gateway + (SEG) impersonation protection, URL rewriting, attachment sandboxing, and + custom detection rules in Microsoft Defender for Office 365, Proofpoint, + Mimecast, or Barracuda. Use when hardening a mail gateway against targeted + phishing or investigating a suspected spearphishing campaign. domain: cybersecurity subdomain: phishing-defense tags: diff --git a/skills/detecting-stuxnet-style-attacks/SKILL.md b/skills/detecting-stuxnet-style-attacks/SKILL.md index 127f8b90..200ecb52 100644 --- a/skills/detecting-stuxnet-style-attacks/SKILL.md +++ b/skills/detecting-stuxnet-style-attacks/SKILL.md @@ -1,11 +1,11 @@ --- name: detecting-stuxnet-style-attacks -description: 'This skill covers detecting sophisticated cyber-physical attacks that - follow the Stuxnet attack pattern of modifying PLC logic while spoofing sensor readings - to hide the manipulation from operators. It addresses PLC logic integrity monitoring, - physics-based process anomaly detection, engineering workstation compromise indicators, - USB-borne attack vectors, and multi-stage attack chain detection spanning IT-to-OT - lateral movement through to process manipulation. +description: 'Detects sophisticated cyber-physical attacks that follow the Stuxnet + pattern of modifying PLC logic while spoofing sensor readings to hide the + manipulation, using PLC logic integrity monitoring (Claroty xDome, Nozomi + Guardian) and physics-based process anomaly detection. Use when hunting for + IT-to-OT lateral movement or discrepancies between PLC program state and + physical process behavior in ICS/SCADA environments. ' domain: cybersecurity diff --git a/skills/detecting-suspicious-powershell-execution/SKILL.md b/skills/detecting-suspicious-powershell-execution/SKILL.md index 809e747a..6b3668ef 100644 --- a/skills/detecting-suspicious-powershell-execution/SKILL.md +++ b/skills/detecting-suspicious-powershell-execution/SKILL.md @@ -1,7 +1,10 @@ --- name: detecting-suspicious-powershell-execution -description: Detect suspicious PowerShell execution patterns including encoded commands, - download cradles, AMSI bypass attempts, and constrained language mode evasion. +description: Hunt for suspicious PowerShell execution (T1059.001) such as encoded commands, + download cradles, AMSI bypass, and constrained language mode evasion using EDR telemetry + (CrowdStrike, Microsoft Defender for Endpoint), Sysmon, and SIEM queries (Splunk, Elastic). + Use when proactively threat hunting, triaging EDR/SIEM alerts, or scoping an incident + involving malicious PowerShell activity. domain: cybersecurity subdomain: threat-hunting tags: diff --git a/skills/detecting-t1003-credential-dumping-with-edr/SKILL.md b/skills/detecting-t1003-credential-dumping-with-edr/SKILL.md index 5d24218d..59a87cfa 100644 --- a/skills/detecting-t1003-credential-dumping-with-edr/SKILL.md +++ b/skills/detecting-t1003-credential-dumping-with-edr/SKILL.md @@ -1,8 +1,10 @@ --- name: detecting-t1003-credential-dumping-with-edr -description: Detect OS credential dumping techniques targeting LSASS memory, SAM database, - NTDS.dit, and cached credentials using EDR telemetry, Sysmon process access monitoring, - and Windows security event correlation. +description: Detect OS credential dumping (MITRE T1003) targeting LSASS memory, the SAM + database, NTDS.dit, and cached credentials by correlating EDR telemetry, Sysmon process-access + events, and Windows security event logs. Use when hunting for Mimikatz-style credential + theft, triaging an EDR alert on LSASS access, or scoping an incident after suspected + credential dumping. domain: cybersecurity subdomain: threat-hunting tags: diff --git a/skills/detecting-t1055-process-injection-with-sysmon/SKILL.md b/skills/detecting-t1055-process-injection-with-sysmon/SKILL.md index b9c2e909..5f18e461 100644 --- a/skills/detecting-t1055-process-injection-with-sysmon/SKILL.md +++ b/skills/detecting-t1055-process-injection-with-sysmon/SKILL.md @@ -1,8 +1,11 @@ --- name: detecting-t1055-process-injection-with-sysmon -description: Detect process injection techniques (T1055) including classic DLL injection, - process hollowing, and APC injection by analyzing Sysmon events for cross-process - memory operations, remote thread creation, and anomalous DLL loading patterns. +description: Detect process injection techniques (T1055) - including DLL injection, process + hollowing, and APC injection - by analyzing Sysmon Event IDs 1, 7, 8, 10, and 25 for + cross-process memory operations, remote thread creation, and anomalous DLL loads. Use + when hunting defense-evasion activity that hides code inside legitimate processes, investigating + an EDR alert on suspicious cross-process access, or validating Sysmon coverage for injection + detection. domain: cybersecurity subdomain: threat-hunting tags: diff --git a/skills/detecting-t1548-abuse-elevation-control-mechanism/SKILL.md b/skills/detecting-t1548-abuse-elevation-control-mechanism/SKILL.md index f15e246d..e7e6c681 100644 --- a/skills/detecting-t1548-abuse-elevation-control-mechanism/SKILL.md +++ b/skills/detecting-t1548-abuse-elevation-control-mechanism/SKILL.md @@ -1,8 +1,10 @@ --- name: detecting-t1548-abuse-elevation-control-mechanism -description: Detect abuse of elevation control mechanisms including UAC bypass, sudo - exploitation, and setuid/setgid manipulation by monitoring registry modifications, - process elevation flags, and unusual parent-child process relationships. +description: Detect abuse of elevation control mechanisms (T1548), including Windows UAC + bypass via auto-elevating binaries like fodhelper.exe and Linux sudo/setuid/setgid exploitation, + by monitoring registry changes, integrity-level transitions, and parent-child process + relationships via Sysmon and Windows Security events. Use when hunting privilege-escalation + activity or validating elevation-abuse detection coverage. domain: cybersecurity subdomain: threat-hunting tags: diff --git a/skills/detecting-typosquatting-packages/SKILL.md b/skills/detecting-typosquatting-packages/SKILL.md index 172f1a61..dd58f481 100644 --- a/skills/detecting-typosquatting-packages/SKILL.md +++ b/skills/detecting-typosquatting-packages/SKILL.md @@ -1,6 +1,6 @@ --- name: detecting-typosquatting-packages -description: Flag misspelled, brandjacked, and typosquatted package names across npm, PyPI, and crates.io before installation using edit-distance, keyboard-proximity, and known-target corpus matching with typomania, OSSGadget, and pypi-scan. +description: Flag misspelled, brandjacked, and typosquatted package names across npm, PyPI, and crates.io before installation, using edit-distance, keyboard-proximity, and known-target corpus matching with typomania, Microsoft OSSGadget's oss-find-squats, and pypi-scan. Use before adding a new dependency, as a CI/CD gate on pull requests, when reviewing an AI-generated ("slopsquatting") dependency list, or when auditing a lockfile diff for a swapped package. domain: cybersecurity subdomain: supply-chain-security tags: diff --git a/skills/detecting-wmi-persistence/SKILL.md b/skills/detecting-wmi-persistence/SKILL.md index 1ce586e1..2550e4a9 100644 --- a/skills/detecting-wmi-persistence/SKILL.md +++ b/skills/detecting-wmi-persistence/SKILL.md @@ -1,8 +1,10 @@ --- name: detecting-wmi-persistence -description: Detect WMI event subscription persistence by analyzing Sysmon Event IDs - 19, 20, and 21 for malicious EventFilter, EventConsumer, and FilterToConsumerBinding - creation. +description: Detect WMI event subscription persistence (MITRE T1546.003) by analyzing Sysmon + Event IDs 19, 20, and 21 for malicious EventFilter, EventConsumer, and FilterToConsumerBinding + creation, cross-referenced against root\subscription namespace contents and Sysinternals + Autoruns. Use when hunting WMI-based persistence, triaging a Sysmon alert on these event + IDs, or during incident response and purple-team validation of WMI defenses. domain: cybersecurity subdomain: threat-hunting tags: diff --git a/skills/emulating-cloud-attacks-with-stratus-red-team/SKILL.md b/skills/emulating-cloud-attacks-with-stratus-red-team/SKILL.md index ff45490d..560bafcc 100644 --- a/skills/emulating-cloud-attacks-with-stratus-red-team/SKILL.md +++ b/skills/emulating-cloud-attacks-with-stratus-red-team/SKILL.md @@ -1,7 +1,10 @@ --- name: emulating-cloud-attacks-with-stratus-red-team -description: Detonate granular AWS, Azure, GCP, and Kubernetes attack techniques to validate - detections with Stratus Red Team. +description: Install and run Stratus Red Team to detonate granular, MITRE ATT&CK-mapped + AWS, Azure, GCP, and Kubernetes attack techniques through their warmup-detonate-revert-cleanup + lifecycle, then verify the telemetry they generate. Use to validate that cloud detections + (CloudTrail, GuardDuty, Microsoft Sentinel, GCP SCC, Falco) actually fire, or to run a + repeatable purple-team exercise generating realistic attacker telemetry. domain: cybersecurity subdomain: cloud-security tags: diff --git a/skills/enumerating-cloud-with-cloudfox/SKILL.md b/skills/enumerating-cloud-with-cloudfox/SKILL.md index 366176ec..d96fc298 100644 --- a/skills/enumerating-cloud-with-cloudfox/SKILL.md +++ b/skills/enumerating-cloud-with-cloudfox/SKILL.md @@ -1,7 +1,10 @@ --- name: enumerating-cloud-with-cloudfox -description: Map AWS and Azure attack paths and find exploitable misconfigurations with - CloudFox. +description: Run CloudFox's read-only Describe/List/Get enumeration (all-checks, + role-trusts, secrets, endpoints, and permissions commands) to map AWS and Azure attack + paths and surface exploitable misconfigurations. Use immediately after obtaining a cloud + credential to build situational awareness, find exposed resources and secrets, or map + sts:AssumeRole trust relationships for lateral-movement/privilege-escalation planning. domain: cybersecurity subdomain: cloud-security tags: diff --git a/skills/eradicating-malware-from-infected-systems/SKILL.md b/skills/eradicating-malware-from-infected-systems/SKILL.md index 9d7ed4b7..f3d1ef55 100644 --- a/skills/eradicating-malware-from-infected-systems/SKILL.md +++ b/skills/eradicating-malware-from-infected-systems/SKILL.md @@ -1,7 +1,11 @@ --- name: eradicating-malware-from-infected-systems -description: Systematically remove malware, backdoors, and attacker persistence mechanisms - from infected systems while ensuring complete eradication and preventing re-infection. +description: Systematically map and remove malware, backdoors, and attacker persistence + mechanisms (registry Run keys, scheduled tasks, WMI subscriptions, services, cron/init.d) + from infected Windows and Linux systems using Autoruns, EDR/AV, and YARA, restoring a + clean state while preventing re-infection. Use after containment and forensic analysis + have identified all compromised systems and persistence mechanisms and you are ready to + eradicate and recover. domain: cybersecurity subdomain: incident-response tags: diff --git a/skills/executing-red-team-engagement-planning/SKILL.md b/skills/executing-red-team-engagement-planning/SKILL.md index 8719daf1..b7d10908 100644 --- a/skills/executing-red-team-engagement-planning/SKILL.md +++ b/skills/executing-red-team-engagement-planning/SKILL.md @@ -1,8 +1,10 @@ --- name: executing-red-team-engagement-planning -description: Red team engagement planning is the foundational phase that defines scope, - objectives, rules of engagement (ROE), threat model selection, and operational timelines - before any offensive testing begins. +description: Build the foundational red team engagement plan - scope definition, Rules + of Engagement (restrictions, communication plan, emergency stop procedures, legal authorization), + MITRE ATT&CK-aligned threat profile selection, and operational timelines - producing an + engagement brief for stakeholder approval. Use before any offensive testing begins, when + scoping a full-scope, assumed-breach, objective-based, or purple-team engagement. domain: cybersecurity subdomain: red-teaming tags: diff --git a/skills/executing-red-team-exercise/SKILL.md b/skills/executing-red-team-exercise/SKILL.md index f9852310..7b7e3d43 100644 --- a/skills/executing-red-team-exercise/SKILL.md +++ b/skills/executing-red-team-exercise/SKILL.md @@ -1,13 +1,11 @@ --- name: executing-red-team-exercise -description: 'Executes comprehensive red team exercises that simulate real-world adversary - operations against an organization''s people, processes, and technology. The red - team operates with stealth as a primary objective, employing the full attack lifecycle - from initial reconnaissance through objective completion while testing the organization''s - detection and response capabilities. This differs from penetration testing by focusing - on adversary emulation rather than vulnerability identification. Activates for requests - involving red team exercise, adversary simulation, adversary emulation, or full-scope - offensive security assessment. +description: 'Run a stealthy, MITRE ATT&CK-mapped adversary emulation against an organization''s + people, processes, and technology, using C2 infrastructure (Cobalt Strike, Sliver, Brute + Ratel, Mythic) through the full attack lifecycle to test SOC detection and response rather + than just find vulnerabilities. Use when executing a full-scope red team exercise, adversary + simulation/emulation, or a regulatory exercise (TIBER-EU, CBEST, AASE, iCAST) with executive + authorization and a signed Rules of Engagement already in place. ' domain: cybersecurity diff --git a/skills/exploiting-adcs-with-certipy/SKILL.md b/skills/exploiting-adcs-with-certipy/SKILL.md index c4df1577..57c23a63 100644 --- a/skills/exploiting-adcs-with-certipy/SKILL.md +++ b/skills/exploiting-adcs-with-certipy/SKILL.md @@ -1,6 +1,6 @@ --- name: exploiting-adcs-with-certipy -description: Enumerate and exploit Active Directory Certificate Services ESC1 through ESC16 misconfigurations with Certipy, including SAN abuse, NTLM relay to web enrollment (ESC8), and golden certificate forgery. +description: Use Certipy to enumerate AD CS certificate authorities and templates over LDAP/RPC, then exploit ESC1-ESC16 misconfigurations - SAN abuse, NTLM relay to web enrollment (ESC8), Shadow Credentials, golden certificate forgery, and PKINIT/Schannel auth. Use during authorized penetration tests to escalate a domain foothold to Domain Admin, or to validate that certificate template ACLs and CA hardening detect these attacks. domain: cybersecurity subdomain: red-teaming tags: diff --git a/skills/exploiting-api-injection-vulnerabilities/SKILL.md b/skills/exploiting-api-injection-vulnerabilities/SKILL.md index 5feb5473..9b1dab31 100644 --- a/skills/exploiting-api-injection-vulnerabilities/SKILL.md +++ b/skills/exploiting-api-injection-vulnerabilities/SKILL.md @@ -1,14 +1,12 @@ --- name: exploiting-api-injection-vulnerabilities -description: 'Tests APIs for injection vulnerabilities including SQL injection, NoSQL - injection, OS command injection, LDAP injection, and Server-Side Request Forgery - (SSRF) through API parameters, headers, and request bodies. The tester crafts malicious - payloads targeting different backend technologies and injection contexts to extract - data, execute commands, or access internal services. Maps to OWASP API8:2023 Security - Misconfiguration and API7:2023 SSRF. Activates for requests involving API injection - testing, SQLi in APIs, NoSQL injection, SSRF testing, or API input validation assessment. - - ' +description: >- + Tests API parameters, headers, and request bodies for injection flaws — SQL injection, + NoSQL injection, OS command injection, LDAP injection, and SSRF — by crafting + payloads tailored to the target backend to extract data, execute commands, or + reach internal services, mapped to OWASP API8:2023 and API7:2023 SSRF. Use when + performing SQLi, NoSQL injection, command injection, or SSRF testing against APIs, + or assessing API input validation. domain: cybersecurity subdomain: api-security tags: diff --git a/skills/exploiting-aws-with-pacu/SKILL.md b/skills/exploiting-aws-with-pacu/SKILL.md index 07bb2283..679ea26b 100644 --- a/skills/exploiting-aws-with-pacu/SKILL.md +++ b/skills/exploiting-aws-with-pacu/SKILL.md @@ -1,6 +1,12 @@ --- name: exploiting-aws-with-pacu -description: Use Pacu modules for AWS privilege escalation, persistence, and backdooring. +description: >- + Runs the Pacu AWS exploitation framework end-to-end — session and credential setup, + IAM enumeration, automated privilege-escalation scanning via iam__privesc_scan, + and persistence/backdooring modules like iam__backdoor_users_keys. Use for + authorized AWS penetration tests or red-team engagements, assessing blast radius + from a compromised IAM credential, or generating attacker telemetry for purple-team + detection testing. domain: cybersecurity subdomain: cloud-security tags: diff --git a/skills/exploiting-broken-function-level-authorization/SKILL.md b/skills/exploiting-broken-function-level-authorization/SKILL.md index 946dbcb7..ef5a6513 100644 --- a/skills/exploiting-broken-function-level-authorization/SKILL.md +++ b/skills/exploiting-broken-function-level-authorization/SKILL.md @@ -1,14 +1,11 @@ --- name: exploiting-broken-function-level-authorization -description: 'Tests APIs for Broken Function Level Authorization (BFLA) vulnerabilities - where regular users can invoke administrative functions or access privileged API - endpoints by directly calling them. The tester identifies admin and privileged endpoints, - then attempts to access them with regular user credentials by manipulating HTTP - methods, URL paths, and request parameters. Maps to OWASP API5:2023 Broken Function - Level Authorization. Activates for requests involving BFLA testing, admin endpoint - bypass, function-level access control testing, or API privilege escalation. - - ' +description: >- + Tests APIs for Broken Function Level Authorization (OWASP API5:2023) by identifying + admin and privileged endpoints, then reaching them with regular-user credentials + via HTTP method switching, URL path manipulation, and parameter tampering. Use + when testing whether low-privilege users can invoke admin API functions or + otherwise escalate privileges via function-level access control gaps. domain: cybersecurity subdomain: api-security tags: diff --git a/skills/exploiting-broken-link-hijacking/SKILL.md b/skills/exploiting-broken-link-hijacking/SKILL.md index 683436e7..7a4c38ac 100644 --- a/skills/exploiting-broken-link-hijacking/SKILL.md +++ b/skills/exploiting-broken-link-hijacking/SKILL.md @@ -1,8 +1,12 @@ --- name: exploiting-broken-link-hijacking -description: Discover and exploit broken link hijacking vulnerabilities by identifying - references to expired domains, decommissioned cloud resources, and dead external - services that can be claimed by an attacker. +description: >- + Discovers and exploits broken link hijacking by spidering a site (Burp Suite + Spider, Scrapy, curl scraping), extracting referenced external scripts/domains, + and checking DNS/CNAME records and domain registration status for expired or + unclaimed resources an attacker could register. Use for subdomain takeover + testing, supply-chain review of third-party scripts, or bug bounty hunting for + hijackable external resources. domain: cybersecurity subdomain: web-application-security tags: diff --git a/skills/exploiting-constrained-delegation-abuse/SKILL.md b/skills/exploiting-constrained-delegation-abuse/SKILL.md index ac4dabb8..a27f7ccb 100644 --- a/skills/exploiting-constrained-delegation-abuse/SKILL.md +++ b/skills/exploiting-constrained-delegation-abuse/SKILL.md @@ -1,8 +1,12 @@ --- name: exploiting-constrained-delegation-abuse -description: Exploit Kerberos Constrained Delegation misconfigurations in Active Directory - to impersonate privileged users via S4U2self and S4U2proxy extensions for lateral - movement and privilege escalation. +description: >- + Exploits Kerberos Constrained Delegation misconfigurations in Active Directory + using Impacket's findDelegation.py and getST.py (or Rubeus/Kekeo on Windows) to + abuse S4U2Self and S4U2Proxy and impersonate privileged users. Use during + authorized Active Directory penetration tests or red-team engagements for lateral + movement and privilege escalation after finding an account trusted for constrained + delegation. domain: cybersecurity subdomain: red-teaming tags: diff --git a/skills/exploiting-excessive-data-exposure-in-api/SKILL.md b/skills/exploiting-excessive-data-exposure-in-api/SKILL.md index 6231fead..6919d50b 100644 --- a/skills/exploiting-excessive-data-exposure-in-api/SKILL.md +++ b/skills/exploiting-excessive-data-exposure-in-api/SKILL.md @@ -1,14 +1,12 @@ --- name: exploiting-excessive-data-exposure-in-api -description: 'Tests APIs for excessive data exposure where endpoints return more data - than the client application needs, relying on the frontend to filter sensitive fields. - The tester intercepts API responses and analyzes them for leaked PII, internal identifiers, - debug information, or sensitive business data that the UI does not display but the - API transmits. This maps to OWASP API3:2023 Broken Object Property Level Authorization. - Activates for requests involving API data leakage testing, excessive data exposure, - response filtering bypass, or API over-fetching. - - ' +description: >- + Tests APIs for excessive data exposure (OWASP API3:2023) by intercepting raw API + responses and comparing them against what the UI actually renders, looking for + leaked PII, internal identifiers, debug data, or business-sensitive fields the + frontend filters but the API still transmits. Use when auditing REST or mobile-app + APIs for over-fetching, response filtering bypass, or unintended data leakage in + endpoint responses. domain: cybersecurity subdomain: api-security tags: diff --git a/skills/exploiting-http-request-smuggling/SKILL.md b/skills/exploiting-http-request-smuggling/SKILL.md index 6507b221..09105d56 100644 --- a/skills/exploiting-http-request-smuggling/SKILL.md +++ b/skills/exploiting-http-request-smuggling/SKILL.md @@ -1,8 +1,12 @@ --- name: exploiting-http-request-smuggling -description: Detecting and exploiting HTTP request smuggling vulnerabilities caused - by Content-Length and Transfer-Encoding parsing discrepancies between front-end - and back-end servers. +description: >- + Detects and exploits HTTP request smuggling caused by Content-Length/Transfer-Encoding + parsing discrepancies between front-end and back-end servers, using Burp Suite + Repeater (auto Content-Length disabled), the HTTP Request Smuggler extension, and + smuggler.py. Use during authorized tests of multi-tier architectures behind a + reverse proxy, load balancer, or CDN to find desync flaws and bypass front-end + controls. domain: cybersecurity subdomain: web-application-security tags: diff --git a/skills/exploiting-idor-vulnerabilities/SKILL.md b/skills/exploiting-idor-vulnerabilities/SKILL.md index 1f8f136d..1b5bc7de 100644 --- a/skills/exploiting-idor-vulnerabilities/SKILL.md +++ b/skills/exploiting-idor-vulnerabilities/SKILL.md @@ -1,8 +1,12 @@ --- name: exploiting-idor-vulnerabilities -description: Identifying and exploiting Insecure Direct Object Reference vulnerabilities - to access unauthorized resources by manipulating object identifiers in API requests - and URLs. +description: >- + Identifies and exploits Insecure Direct Object Reference (IDOR) vulnerabilities + by manipulating object identifiers (numeric IDs, UUIDs, slugs) in API requests + and URLs, using Burp Suite proxy history, Intruder, and the Authorize extension + to test object-level authorization across sessions. Use during authorized + penetration tests or bug bounty work to validate that CRUD endpoints and + multi-tenant applications enforce per-object access control. domain: cybersecurity subdomain: web-application-security tags: diff --git a/skills/exploiting-jwt-algorithm-confusion-attack/SKILL.md b/skills/exploiting-jwt-algorithm-confusion-attack/SKILL.md index 34cfbe66..e6b4f3f3 100644 --- a/skills/exploiting-jwt-algorithm-confusion-attack/SKILL.md +++ b/skills/exploiting-jwt-algorithm-confusion-attack/SKILL.md @@ -1,14 +1,11 @@ --- name: exploiting-jwt-algorithm-confusion-attack -description: 'Exploits JWT algorithm confusion vulnerabilities where the server''s - token verification library accepts the algorithm specified in the JWT header rather - than enforcing a fixed algorithm. The tester manipulates the alg header to switch - from RS256 to HS256 (using the RSA public key as the HMAC secret), sets alg to none - to bypass signature verification, or exploits kid/jku/x5u header injection to supply - attacker-controlled keys. Activates for requests involving JWT algorithm confusion, - alg none attack, key confusion attack, or JWT signature bypass. - - ' +description: >- + Exploits JWT algorithm confusion where the server's verification library trusts + the alg named in the token header, by switching RS256 to HS256 (signing with the + RSA public key as HMAC secret), setting alg to none, or injecting kid/jku/x5u + headers to supply an attacker-controlled key. Use when testing RS256 JWT auth + for algorithm downgrade, alg:none bypass, or key-confusion signature forgery. domain: cybersecurity subdomain: api-security tags: diff --git a/skills/exploiting-kerberoasting-with-impacket/SKILL.md b/skills/exploiting-kerberoasting-with-impacket/SKILL.md index a23bba7c..1adc92fc 100644 --- a/skills/exploiting-kerberoasting-with-impacket/SKILL.md +++ b/skills/exploiting-kerberoasting-with-impacket/SKILL.md @@ -1,7 +1,12 @@ --- name: exploiting-kerberoasting-with-impacket -description: Perform Kerberoasting attacks using Impacket's GetUserSPNs to extract - and crack Kerberos TGS tickets for Active Directory service accounts. +description: >- + Performs Kerberoasting (MITRE ATT&CK T1558.003) using Impacket's GetUserSPNs.py + to request Kerberos TGS tickets for SPN-registered service accounts, then cracks + the extracted RC4/AES-encrypted hashes offline to recover service account + credentials. Use during authorized Active Directory penetration tests or + red-team engagements for credential access against service accounts via + Kerberos ticket-granting-service requests. domain: cybersecurity subdomain: red-teaming tags: diff --git a/skills/exploiting-mass-assignment-in-rest-apis/SKILL.md b/skills/exploiting-mass-assignment-in-rest-apis/SKILL.md index eaa4e08b..923978d7 100644 --- a/skills/exploiting-mass-assignment-in-rest-apis/SKILL.md +++ b/skills/exploiting-mass-assignment-in-rest-apis/SKILL.md @@ -1,8 +1,12 @@ --- name: exploiting-mass-assignment-in-rest-apis -description: Discover and exploit mass assignment vulnerabilities in REST APIs to - escalate privileges, modify restricted fields, and bypass authorization controls - by injecting unexpected parameters in API requests. +description: >- + Discovers and exploits mass assignment (autobinding) in REST APIs by injecting + unexpected or hidden parameters (e.g. role, isAdmin, plan) into create/update + requests, using Burp Suite Intruder, Arjun, and param-miner to find bindable + fields on ORM-backed endpoints (Rails, Django, Laravel, Spring). Use when testing + REST APIs for privilege escalation or authorization bypass via unintended + parameter binding. domain: cybersecurity subdomain: web-application-security tags: diff --git a/skills/exploiting-ms17-010-eternalblue-vulnerability/SKILL.md b/skills/exploiting-ms17-010-eternalblue-vulnerability/SKILL.md index 18f56bbc..4b08c6e6 100644 --- a/skills/exploiting-ms17-010-eternalblue-vulnerability/SKILL.md +++ b/skills/exploiting-ms17-010-eternalblue-vulnerability/SKILL.md @@ -1,8 +1,12 @@ --- name: exploiting-ms17-010-eternalblue-vulnerability -description: MS17-010 (EternalBlue) is a critical vulnerability in Microsoft's SMBv1 - implementation that allows remote code execution. Originally discovered by the NSA - and leaked by the Shadow Brokers in 2017, it +description: >- + Detects and exploits MS17-010 (EternalBlue), a critical remote code execution + flaw in Microsoft's SMBv1 implementation, using Nmap's ms-17-010 NSE script for + detection and Metasploit's ms17_010_eternalblue/ms17_010_psexec modules for + exploitation. Use during authorized red-team engagements or penetration tests + against legacy Windows environments with unpatched SMBv1 to gain remote code + execution. domain: cybersecurity subdomain: red-teaming tags: diff --git a/skills/exploiting-nopac-cve-2021-42278-42287/SKILL.md b/skills/exploiting-nopac-cve-2021-42278-42287/SKILL.md index 3e59e40c..e4bda367 100644 --- a/skills/exploiting-nopac-cve-2021-42278-42287/SKILL.md +++ b/skills/exploiting-nopac-cve-2021-42278-42287/SKILL.md @@ -1,8 +1,10 @@ --- name: exploiting-nopac-cve-2021-42278-42287 -description: Exploit the noPac vulnerability chain (CVE-2021-42278 sAMAccountName - spoofing and CVE-2021-42287 KDC PAC confusion) to escalate from standard domain - user to Domain Admin in Active Directory environments. +description: Exploits the noPac Active Directory privilege-escalation chain (CVE-2021-42278 + sAMAccountName spoofing plus CVE-2021-42287 KDC PAC confusion) using Impacket and + secretsdump.py to escalate from a standard domain user to Domain Admin. Use when + red-teaming or pentesting Active Directory to validate machine-account impersonation + and DCSync-based credential dumping. domain: cybersecurity subdomain: red-teaming tags: diff --git a/skills/exploiting-nosql-injection-vulnerabilities/SKILL.md b/skills/exploiting-nosql-injection-vulnerabilities/SKILL.md index 05d31b4e..5294f8a0 100644 --- a/skills/exploiting-nosql-injection-vulnerabilities/SKILL.md +++ b/skills/exploiting-nosql-injection-vulnerabilities/SKILL.md @@ -1,8 +1,10 @@ --- name: exploiting-nosql-injection-vulnerabilities -description: Detect and exploit NoSQL injection vulnerabilities in MongoDB, CouchDB, - and other NoSQL databases to demonstrate authentication bypass, data extraction, - and unauthorized access risks. +description: Detects and exploits NoSQL injection vulnerabilities in MongoDB, CouchDB, + and similar databases to demonstrate authentication bypass, data extraction, and + unauthorized access via crafted query operators. Use when pentesting APIs or web + applications backed by NoSQL databases to test input validation and injection + defenses. domain: cybersecurity subdomain: web-application-security tags: diff --git a/skills/exploiting-prototype-pollution-in-javascript/SKILL.md b/skills/exploiting-prototype-pollution-in-javascript/SKILL.md index 02b462bc..89e690a7 100644 --- a/skills/exploiting-prototype-pollution-in-javascript/SKILL.md +++ b/skills/exploiting-prototype-pollution-in-javascript/SKILL.md @@ -1,8 +1,10 @@ --- name: exploiting-prototype-pollution-in-javascript -description: Detect and exploit JavaScript prototype pollution vulnerabilities on - both client-side and server-side applications to achieve XSS, RCE, and authentication - bypass through property injection. +description: Detects and exploits JavaScript prototype pollution vulnerabilities + in client-side and server-side (Node.js) applications to achieve XSS, RCE, or + authentication bypass through property injection into Object.prototype. Use when + assessing a JavaScript/Node.js application for prototype pollution, especially + where a merge, clone, or extend function accepts user-controlled keys. domain: cybersecurity subdomain: web-application-security tags: diff --git a/skills/exploiting-race-condition-vulnerabilities/SKILL.md b/skills/exploiting-race-condition-vulnerabilities/SKILL.md index 0ac1641b..beefa9f3 100644 --- a/skills/exploiting-race-condition-vulnerabilities/SKILL.md +++ b/skills/exploiting-race-condition-vulnerabilities/SKILL.md @@ -1,8 +1,10 @@ --- name: exploiting-race-condition-vulnerabilities -description: Detect and exploit race condition vulnerabilities in web applications - using Turbo Intruder's single-packet attack technique to bypass rate limits, duplicate - transactions, and exploit time-of-check-to-time-of-use flaws. +description: Detects and exploits race condition (TOCTOU) vulnerabilities in web + applications using Burp Suite's Turbo Intruder extension and its single-packet + attack technique to fire parallel requests that bypass rate limits, duplicate + transactions, or overrun usage limits. Use when pentesting endpoints with balances, + coupon redemption, or rate limiting that concurrent requests might manipulate. domain: cybersecurity subdomain: web-application-security tags: diff --git a/skills/exploiting-template-injection-vulnerabilities/SKILL.md b/skills/exploiting-template-injection-vulnerabilities/SKILL.md index 1e6d0cea..5c4474ff 100644 --- a/skills/exploiting-template-injection-vulnerabilities/SKILL.md +++ b/skills/exploiting-template-injection-vulnerabilities/SKILL.md @@ -1,8 +1,9 @@ --- name: exploiting-template-injection-vulnerabilities -description: Detecting and exploiting Server-Side Template Injection (SSTI) vulnerabilities - across Jinja2, Twig, Freemarker, and other template engines to achieve remote code - execution. +description: Detects and exploits Server-Side Template Injection (SSTI) vulnerabilities + across Jinja2, Twig, Freemarker, and other template engines to achieve remote + code execution. Use when pentesting a web application that renders user input + through a server-side template engine and you need to confirm and weaponize SSTI. domain: cybersecurity subdomain: web-application-security tags: diff --git a/skills/exploiting-type-juggling-vulnerabilities/SKILL.md b/skills/exploiting-type-juggling-vulnerabilities/SKILL.md index 6eac147f..6607fbcb 100644 --- a/skills/exploiting-type-juggling-vulnerabilities/SKILL.md +++ b/skills/exploiting-type-juggling-vulnerabilities/SKILL.md @@ -1,8 +1,10 @@ --- name: exploiting-type-juggling-vulnerabilities -description: Exploit PHP type juggling vulnerabilities caused by loose comparison - operators to bypass authentication, circumvent hash verification, and manipulate - application logic through type coercion attacks. +description: Exploits PHP type juggling vulnerabilities caused by loose (==) comparison + operators to bypass authentication, defeat hash verification via magic hashes, + and manipulate application logic through type coercion. Use when pentesting PHP + applications that compare user input with ==, in_array, or hash functions without + strict type checks. domain: cybersecurity subdomain: web-application-security tags: diff --git a/skills/exploiting-vulnerabilities-with-metasploit-framework/SKILL.md b/skills/exploiting-vulnerabilities-with-metasploit-framework/SKILL.md index 58015e98..308fc98b 100644 --- a/skills/exploiting-vulnerabilities-with-metasploit-framework/SKILL.md +++ b/skills/exploiting-vulnerabilities-with-metasploit-framework/SKILL.md @@ -1,8 +1,11 @@ --- name: exploiting-vulnerabilities-with-metasploit-framework -description: The Metasploit Framework is the world's most widely used penetration - testing platform, maintained by Rapid7. It contains over 2,300 exploits, 1,200 auxiliary - modules, and 400 post-exploitation modules +description: Uses the Metasploit Framework (msfconsole and its exploit, auxiliary, + and post-exploitation modules) to validate that identified CVEs and vulnerabilities + are actually exploitable, gather post-exploitation evidence, and confirm patch + remediation. Use when performing vulnerability management validation, penetration + testing, or post-patch verification and you need to prove real-world exploitability + rather than rely on a scanner score alone. domain: cybersecurity subdomain: vulnerability-management tags: diff --git a/skills/exploiting-zerologon-vulnerability-cve-2020-1472/SKILL.md b/skills/exploiting-zerologon-vulnerability-cve-2020-1472/SKILL.md index 1090f5c1..e017f421 100644 --- a/skills/exploiting-zerologon-vulnerability-cve-2020-1472/SKILL.md +++ b/skills/exploiting-zerologon-vulnerability-cve-2020-1472/SKILL.md @@ -1,8 +1,10 @@ --- name: exploiting-zerologon-vulnerability-cve-2020-1472 -description: Exploit the Zerologon vulnerability (CVE-2020-1472) in the Netlogon Remote - Protocol to achieve domain controller compromise by resetting the machine account - password to empty. +description: Exploits the Zerologon vulnerability (CVE-2020-1472) in the Netlogon + Remote Protocol using Impacket to reset a domain controller's machine account + password to empty, then runs DCSync via secretsdump.py to dump domain credentials. + Use when red-teaming or validating unpatched Active Directory domain controllers + for Zerologon, including restoring the machine account password afterward. domain: cybersecurity subdomain: red-teaming tags: diff --git a/skills/extracting-browser-history-artifacts/SKILL.md b/skills/extracting-browser-history-artifacts/SKILL.md index e725740b..fd8a57c6 100644 --- a/skills/extracting-browser-history-artifacts/SKILL.md +++ b/skills/extracting-browser-history-artifacts/SKILL.md @@ -1,7 +1,10 @@ --- name: extracting-browser-history-artifacts -description: Extract and analyze browser history, cookies, cache, downloads, and bookmarks - from Chrome, Firefox, and Edge for forensic evidence of user web activity. +description: Extracts and analyzes browser history, cookies, cache, downloads, and + bookmarks from Chrome, Firefox, and Edge using sqlite3, DB Browser for SQLite, + Hindsight, and NirSoft tools (BrowsingHistoryView, ChromeCacheView, MZCacheView). + Use when performing digital forensics or incident response on a disk image or + live system and you need timeline evidence of a user's web activity. domain: cybersecurity subdomain: digital-forensics tags: diff --git a/skills/extracting-config-from-agent-tesla-rat/SKILL.md b/skills/extracting-config-from-agent-tesla-rat/SKILL.md index 766f06d4..52fa0f7a 100644 --- a/skills/extracting-config-from-agent-tesla-rat/SKILL.md +++ b/skills/extracting-config-from-agent-tesla-rat/SKILL.md @@ -1,8 +1,10 @@ --- name: extracting-config-from-agent-tesla-rat -description: Extract embedded configuration from Agent Tesla RAT samples including - SMTP/FTP/Telegram exfiltration credentials, keylogger settings, and C2 endpoints - using .NET decompilation and memory analysis. +description: Extracts embedded configuration from Agent Tesla RAT samples, including + SMTP/FTP/Telegram exfiltration credentials, keylogger settings, and C2 endpoints, + via .NET decompilation and memory analysis. Use when analyzing a suspected or + confirmed Agent Tesla sample and you need to recover its exfiltration channel + and C2 configuration for threat intelligence or incident response. domain: cybersecurity subdomain: malware-analysis tags: diff --git a/skills/extracting-credentials-from-memory-dump/SKILL.md b/skills/extracting-credentials-from-memory-dump/SKILL.md index f67025bf..0d91213d 100644 --- a/skills/extracting-credentials-from-memory-dump/SKILL.md +++ b/skills/extracting-credentials-from-memory-dump/SKILL.md @@ -1,7 +1,10 @@ --- name: extracting-credentials-from-memory-dump -description: Extract cached credentials, password hashes, Kerberos tickets, and authentication - tokens from memory dumps using Volatility and Mimikatz for forensic investigation. +description: Extracts cached credentials, password hashes, Kerberos tickets, and + authentication tokens from Windows memory dumps using Volatility 3, Mimikatz, + and pypykatz. Use when performing memory forensics or incident response on an + LSASS or full memory dump and you need to recover credentials or Kerberos material + for investigation. domain: cybersecurity subdomain: digital-forensics tags: diff --git a/skills/extracting-iocs-from-malware-samples/SKILL.md b/skills/extracting-iocs-from-malware-samples/SKILL.md index 632c7e38..8b01ec68 100644 --- a/skills/extracting-iocs-from-malware-samples/SKILL.md +++ b/skills/extracting-iocs-from-malware-samples/SKILL.md @@ -1,13 +1,11 @@ --- name: extracting-iocs-from-malware-samples -description: 'Extracts indicators of compromise (IOCs) from malware samples including - file hashes, network indicators (IPs, domains, URLs), host artifacts (file paths, - registry keys, mutexes), and behavioral patterns for threat intelligence sharing - and detection rule creation. Activates for requests involving IOC extraction, threat - indicator harvesting, malware indicator collection, or building detection content - from samples. - - ' +description: Extracts indicators of compromise (IOCs) from malware samples, including + file hashes, network indicators (IPs, domains, URLs, PCAP indicators), host artifacts + (file paths, registry keys, mutexes), and behavioral patterns, using tools like + CyberChef, then defangs and exports them in standard threat-intel formats. Use + for IOC extraction, threat indicator harvesting, or building detection content + from a sample. domain: cybersecurity subdomain: malware-analysis tags: diff --git a/skills/fleet-hunting-with-velociraptor/SKILL.md b/skills/fleet-hunting-with-velociraptor/SKILL.md index a32b742c..d5600e45 100644 --- a/skills/fleet-hunting-with-velociraptor/SKILL.md +++ b/skills/fleet-hunting-with-velociraptor/SKILL.md @@ -1,6 +1,6 @@ --- name: fleet-hunting-with-velociraptor -description: Deploy a Velociraptor server and agents and write VQL hunts across a fleet. +description: Deploy a Velociraptor server and agents, then author VQL (Velociraptor Query Language) artifacts and run them as fleet-wide hunts, on-demand forensic collections, or standalone offline collectors. Use when hunting a TTP across hundreds or thousands of endpoints, collecting forensic artifacts during incident response without re-imaging, or generating collectors for unmanaged/air-gapped hosts. domain: cybersecurity subdomain: threat-hunting tags: diff --git a/skills/generating-and-analyzing-sboms/SKILL.md b/skills/generating-and-analyzing-sboms/SKILL.md index 8672f480..15b4d87c 100644 --- a/skills/generating-and-analyzing-sboms/SKILL.md +++ b/skills/generating-and-analyzing-sboms/SKILL.md @@ -1,6 +1,6 @@ --- name: generating-and-analyzing-sboms -description: Produce and ingest CycloneDX and SPDX SBOMs and correlate them to vulnerability intelligence. +description: Generate CycloneDX and SPDX SBOMs from container images and filesystems with Syft, correlate them to CVEs with Grype, and sign/attest them with Cosign. Use when you need a machine-readable dependency inventory for supply-chain risk, want to scan images or SBOMs for known vulnerabilities, or are embedding SBOM generation and vulnerability gating into CI/CD. domain: cybersecurity subdomain: supply-chain-security tags: diff --git a/skills/generating-forensic-timelines-with-hayabusa/SKILL.md b/skills/generating-forensic-timelines-with-hayabusa/SKILL.md index bb3ec377..c90e0514 100644 --- a/skills/generating-forensic-timelines-with-hayabusa/SKILL.md +++ b/skills/generating-forensic-timelines-with-hayabusa/SKILL.md @@ -1,6 +1,6 @@ --- name: generating-forensic-timelines-with-hayabusa -description: Produce Sigma-based EVTX timelines and summaries with Hayabusa. +description: Run Hayabusa against collected Windows EVTX files to apply Sigma detection rules and produce a prioritized, chronological CSV/JSON timeline with severity levels, MITRE ATT&CK mappings, and per-host/per-Event-ID metrics. Use during DFIR triage to turn raw event logs into a fast, SIEM-free incident timeline, or to export results into Timesketch or Timeline Explorer for collaborative analysis. domain: cybersecurity subdomain: digital-forensics tags: diff --git a/skills/hardening-docker-containers-for-production/SKILL.md b/skills/hardening-docker-containers-for-production/SKILL.md index 63ef441d..5d414a6a 100644 --- a/skills/hardening-docker-containers-for-production/SKILL.md +++ b/skills/hardening-docker-containers-for-production/SKILL.md @@ -1,8 +1,12 @@ --- name: hardening-docker-containers-for-production -description: Hardening Docker containers for production involves applying security - best practices aligned with CIS Docker Benchmark v1.8.0 to minimize attack surface, - prevent privilege escalation, and enforce leas +description: > + Harden Dockerfiles, images, and container runtime settings against the CIS + Docker Benchmark v1.8.0: non-root users, dropped capabilities, read-only + rootfs, seccomp/AppArmor, and minimal multi-stage images, validated with + docker-bench-security, Hadolint, and Dockle. Use when preparing a container + or Dockerfile for production, or auditing images/runtime configs against + CIS Docker controls. domain: cybersecurity subdomain: container-security tags: diff --git a/skills/hardening-docker-daemon-configuration/SKILL.md b/skills/hardening-docker-daemon-configuration/SKILL.md index f7af6bb8..c2b3039b 100644 --- a/skills/hardening-docker-daemon-configuration/SKILL.md +++ b/skills/hardening-docker-daemon-configuration/SKILL.md @@ -1,7 +1,6 @@ --- name: hardening-docker-daemon-configuration -description: Harden the Docker daemon by configuring daemon.json with user namespace - remapping, TLS authentication, rootless mode, and CIS benchmark controls. +description: Harden the Docker daemon (dockerd) by configuring /etc/docker/daemon.json with user namespace remapping, TLS client authentication, seccomp profiles, and CIS Docker Benchmark controls such as icc, no-new-privileges, and live-restore. Use when securing a Docker host's daemon configuration to prevent privilege escalation, container breakout, or lateral movement, or when auditing daemon settings against CIS benchmark requirements. domain: cybersecurity subdomain: container-security tags: diff --git a/skills/hunting-bootkits-in-efi-system-partition/SKILL.md b/skills/hunting-bootkits-in-efi-system-partition/SKILL.md index 08f398d9..1aa13c0b 100644 --- a/skills/hunting-bootkits-in-efi-system-partition/SKILL.md +++ b/skills/hunting-bootkits-in-efi-system-partition/SKILL.md @@ -1,6 +1,6 @@ --- name: hunting-bootkits-in-efi-system-partition -description: Baseline the EFI System Partition and hunt malicious EFI binaries (ESPecter, BlackLotus, Bootkitty, Glupteba) by mounting the ESP, hashing and verifying boot loaders, scanning with YARA, and detecting anomalous non-EFI files. +description: Baseline the EFI System Partition and hunt malicious EFI binaries such as ESPecter, BlackLotus, Bootkitty, and Glupteba by mounting the ESP, hashing and verifying boot loaders, scanning with YARA, and flagging anomalous non-EFI files or out-of-band bootloader changes. Use during proactive threat hunts for firmware/bootkit persistence (MITRE ATT&CK T1542.003) or when investigating suspected UEFI-level compromise that survives OS reinstall. domain: cybersecurity subdomain: hardware-firmware-security tags: diff --git a/skills/hunting-evtx-with-chainsaw/SKILL.md b/skills/hunting-evtx-with-chainsaw/SKILL.md index 18a712d5..ed9acdcb 100644 --- a/skills/hunting-evtx-with-chainsaw/SKILL.md +++ b/skills/hunting-evtx-with-chainsaw/SKILL.md @@ -1,7 +1,6 @@ --- name: hunting-evtx-with-chainsaw -description: Perform rapid Sigma and keyword hunting across Windows event logs with - Chainsaw. +description: Run Chainsaw against collected Windows EVTX files to hunt with the SigmaHQ rule corpus, built-in detection rules, and high-speed keyword/regex search, plus analyze shimcache, SRUM, and event-log gaps, outputting colorized tables, CSV, or JSON. Use during first-response triage for offline, SIEM-free detection over Windows event logs, or to quickly confirm a hunt hypothesis and produce reporting output. domain: cybersecurity subdomain: threat-hunting tags: diff --git a/skills/hunting-for-cobalt-strike-beacons/SKILL.md b/skills/hunting-for-cobalt-strike-beacons/SKILL.md index 8857d770..f08a4b15 100644 --- a/skills/hunting-for-cobalt-strike-beacons/SKILL.md +++ b/skills/hunting-for-cobalt-strike-beacons/SKILL.md @@ -1,9 +1,6 @@ --- name: hunting-for-cobalt-strike-beacons -description: Detect Cobalt Strike beacon network activity using default TLS certificate - signatures (serial 8BB00EE), JA3/JA3S/JARM fingerprints, HTTP C2 profile pattern - matching, beacon jitter analysis, and named pipe detection via Zeek, Suricata, and - Python PCAP analysis. +description: Detect Cobalt Strike beacon command-and-control traffic using default TLS certificate signatures (serial 8BB00EE), JA3/JA3S/JARM fingerprints, HTTP malleable C2 profile pattern matching, and beacon jitter/interval analysis, built with Zeek network logs, Suricata IDS rules, and Python PCAP analysis. Use when hunting for Cobalt Strike beacon callbacks in network traffic or building detection rules for this C2 framework. domain: cybersecurity subdomain: threat-hunting tags: diff --git a/skills/hunting-for-data-exfiltration-indicators/SKILL.md b/skills/hunting-for-data-exfiltration-indicators/SKILL.md index 3c14b836..de11af9e 100644 --- a/skills/hunting-for-data-exfiltration-indicators/SKILL.md +++ b/skills/hunting-for-data-exfiltration-indicators/SKILL.md @@ -1,8 +1,6 @@ --- name: hunting-for-data-exfiltration-indicators -description: Hunt for data exfiltration through network traffic analysis, detecting - unusual data flows, DNS tunneling, cloud storage uploads, and encrypted channel - abuse. +description: Hunt for data exfiltration by analyzing Zeek and Suricata network telemetry for unusual data flows, DNS tunneling via large/frequent TXT queries, uploads to personal cloud storage, and encrypted-channel abuse, correlated against threat intel on destination domains. Use when hunting for data theft in a compromised environment, investigating unusual outbound data volumes, or determining what data was stolen during incident response. domain: cybersecurity subdomain: threat-hunting tags: diff --git a/skills/hunting-for-data-staging-before-exfiltration/SKILL.md b/skills/hunting-for-data-staging-before-exfiltration/SKILL.md index 0f0f5df6..f2755414 100644 --- a/skills/hunting-for-data-staging-before-exfiltration/SKILL.md +++ b/skills/hunting-for-data-staging-before-exfiltration/SKILL.md @@ -1,8 +1,6 @@ --- name: hunting-for-data-staging-before-exfiltration -description: Detect data staging activity before exfiltration by monitoring for archive - creation with 7-Zip/RAR, unusual temp folder access, large file consolidation, and - staging directory patterns via EDR and process telemetry +description: Detect data-staging activity (MITRE ATT&CK T1074) by analyzing EDR/Sysmon process-creation and file-system telemetry (Event ID 4688, Sysmon 1/11) for 7-Zip/RAR/tar archive creation, unusual temp or hidden folder access, and anomalous consolidation of files from multiple directories. Use when hunting for pre-exfiltration staging behavior, building detection rules for archiver abuse, or validating monitoring coverage for T1074. domain: cybersecurity subdomain: threat-hunting tags: diff --git a/skills/hunting-for-dcom-lateral-movement/SKILL.md b/skills/hunting-for-dcom-lateral-movement/SKILL.md index 8b9df4a8..a021d44d 100644 --- a/skills/hunting-for-dcom-lateral-movement/SKILL.md +++ b/skills/hunting-for-dcom-lateral-movement/SKILL.md @@ -1,9 +1,10 @@ --- name: hunting-for-dcom-lateral-movement -description: 'Hunt for DCOM-based lateral movement by detecting abuse of MMC20.Application, - ShellBrowserWindow, and ShellWindows COM objects through Sysmon Event ID 1 (process - creation) and Event ID 3 (network connection) correlation, WMI event analysis, RPC - endpoint mapper traffic on port 135, and DCOM-specific parent-child process relationships. +description: 'Hunt for DCOM-based lateral movement (MITRE ATT&CK T1021.003) by detecting + abuse of MMC20.Application, ShellBrowserWindow, and ShellWindows COM objects via + Sysmon Event ID 1/3 correlation, WMI event analysis, and RPC endpoint mapper traffic + on port 135. Use when investigating suspicious mmc.exe/dllhost.exe child processes, + building T1021.003 detections, or auditing DCOM exposure during purple-team exercises. ' domain: cybersecurity diff --git a/skills/hunting-for-dcsync-attacks/SKILL.md b/skills/hunting-for-dcsync-attacks/SKILL.md index 8d13f0b2..3cf0bd99 100644 --- a/skills/hunting-for-dcsync-attacks/SKILL.md +++ b/skills/hunting-for-dcsync-attacks/SKILL.md @@ -1,7 +1,6 @@ --- name: hunting-for-dcsync-attacks -description: Detect DCSync attacks by analyzing Windows Event ID 4662 for unauthorized - DS-Replication-Get-Changes requests from non-domain-controller accounts. +description: Detect DCSync attacks (MITRE ATT&CK T1003.006) by analyzing Windows Event ID 4662 (AccessMask 0x100) for DS-Replication-Get-Changes and DS-Replication-Get-Changes-All requests issued by non-domain-controller accounts. Use when hunting for DCSync credential theft, after detecting Mimikatz-class tooling, or during incident response and purple-team exercises involving Active Directory replication abuse. domain: cybersecurity subdomain: threat-hunting tags: diff --git a/skills/hunting-for-dns-based-persistence/SKILL.md b/skills/hunting-for-dns-based-persistence/SKILL.md index 67faaa86..eeaed56f 100644 --- a/skills/hunting-for-dns-based-persistence/SKILL.md +++ b/skills/hunting-for-dns-based-persistence/SKILL.md @@ -1,8 +1,11 @@ --- name: hunting-for-dns-based-persistence -description: Hunt for DNS-based persistence mechanisms including DNS hijacking, dangling - CNAME records, wildcard DNS abuse, and unauthorized zone modifications using passive - DNS databases, SecurityTrails API, and DNS audit log analysis. +description: Hunts for DNS-based persistence mechanisms such as DNS hijacking, dangling + CNAME records enabling subdomain takeover, wildcard DNS abuse, and unauthorized zone + or NS delegation changes, using passive DNS history (SecurityTrails API), Route53/Azure + DNS/Cloudflare audit logs, and zone transfer analysis. Use when investigating suspected + DNS hijacking or subdomain takeover, or when threat hunting for DNS record tampering + that persists across credential rotations and endpoint reimaging. domain: cybersecurity subdomain: threat-hunting tags: diff --git a/skills/hunting-for-dns-tunneling-with-zeek/SKILL.md b/skills/hunting-for-dns-tunneling-with-zeek/SKILL.md index 3972d107..3be3f28a 100644 --- a/skills/hunting-for-dns-tunneling-with-zeek/SKILL.md +++ b/skills/hunting-for-dns-tunneling-with-zeek/SKILL.md @@ -1,8 +1,10 @@ --- name: hunting-for-dns-tunneling-with-zeek -description: Detect DNS tunneling and data exfiltration by analyzing Zeek dns.log - for high-entropy subdomain queries, excessive query volume, long query lengths, - and unusual DNS record types indicating covert channel communication. +description: Detects DNS tunneling and covert-channel data exfiltration by analyzing + Zeek dns.log for high-entropy subdomain queries, excessive query volume, abnormally + long query lengths, and unusual DNS record types (TXT/NULL/CNAME). Use when hunting + for DNS-based data exfiltration or C2 covert channels in network traffic, or when + triaging suspicious DNS query volume/patterns surfaced by Zeek logs. domain: cybersecurity subdomain: threat-hunting tags: diff --git a/skills/hunting-for-domain-fronting-c2-traffic/SKILL.md b/skills/hunting-for-domain-fronting-c2-traffic/SKILL.md index 99ea2aee..d071670f 100644 --- a/skills/hunting-for-domain-fronting-c2-traffic/SKILL.md +++ b/skills/hunting-for-domain-fronting-c2-traffic/SKILL.md @@ -1,8 +1,9 @@ --- name: hunting-for-domain-fronting-c2-traffic -description: Detect domain fronting C2 traffic by analyzing SNI vs HTTP Host header - mismatches in proxy logs and TLS certificate discrepancies using pyOpenSSL for certificate - inspection +description: Detects domain fronting C2 traffic by analyzing SNI-vs-HTTP-Host-header + mismatches in proxy logs and inspecting TLS certificate discrepancies with pyOpenSSL. + Use when hunting for command-and-control traffic hidden behind legitimate CDN domains, + or when investigating proxy/TLS logs for signs of domain fronting evasion. domain: cybersecurity subdomain: threat-hunting tags: diff --git a/skills/hunting-for-lateral-movement-via-wmi/SKILL.md b/skills/hunting-for-lateral-movement-via-wmi/SKILL.md index b8b0cf9b..9ceae890 100644 --- a/skills/hunting-for-lateral-movement-via-wmi/SKILL.md +++ b/skills/hunting-for-lateral-movement-via-wmi/SKILL.md @@ -1,8 +1,11 @@ --- name: hunting-for-lateral-movement-via-wmi -description: Detect WMI-based lateral movement by analyzing Windows Event ID 4688 - process creation and Sysmon Event ID 1 for WmiPrvSE.exe child process patterns, - remote process execution, and WMI event subscription persistence. +description: Detects WMI-based lateral movement (e.g. wmic process call create, + Win32_Process.Create()) by analyzing Windows Event ID 4688 and Sysmon Event ID 1 for + WmiPrvSE.exe spawning suspicious child processes like cmd.exe or powershell.exe, plus + WMI-Activity/Operational events 5857/5860/5861 for subscription-based persistence. Use + when hunting for remote code execution via WMI or investigating lateral movement across + Windows hosts. domain: cybersecurity subdomain: threat-hunting tags: diff --git a/skills/hunting-for-living-off-the-cloud-techniques/SKILL.md b/skills/hunting-for-living-off-the-cloud-techniques/SKILL.md index 0b0eae5b..29fa184e 100644 --- a/skills/hunting-for-living-off-the-cloud-techniques/SKILL.md +++ b/skills/hunting-for-living-off-the-cloud-techniques/SKILL.md @@ -1,7 +1,11 @@ --- name: hunting-for-living-off-the-cloud-techniques -description: Hunt for adversary abuse of legitimate cloud services for C2, data staging, - and exfiltration including abuse of Azure, AWS, GCP services, and SaaS platforms. +description: Hunts for adversary abuse of legitimate cloud services (Azure, AWS, GCP, + and SaaS platforms) for command-and-control, data staging, and exfiltration, i.e. + "living off the cloud" tradecraft that blends in with normal cloud API and service + activity. Use when threat hunting for cloud-native C2 channels, abnormal use of + storage/SaaS services for data staging, or exfiltration hidden in legitimate cloud + traffic. domain: cybersecurity subdomain: threat-hunting tags: diff --git a/skills/hunting-for-living-off-the-land-binaries/SKILL.md b/skills/hunting-for-living-off-the-land-binaries/SKILL.md index 21f66595..1f2fc15d 100644 --- a/skills/hunting-for-living-off-the-land-binaries/SKILL.md +++ b/skills/hunting-for-living-off-the-land-binaries/SKILL.md @@ -1,7 +1,10 @@ --- name: hunting-for-living-off-the-land-binaries -description: Proactively hunt for adversary abuse of legitimate system binaries (LOLBins) - to execute malicious payloads while evading detection. +description: Proactively hunts for adversary abuse of legitimate, signed system binaries + (LOLBins) used to execute malicious payloads, download files, or proxy execution + while evading application allowlisting and defense-evasion controls. Use when building + LOLBins detection rules for EDR/SIEM or when threat hunting for defense-evasion + activity involving trusted system binaries. domain: cybersecurity subdomain: threat-hunting tags: diff --git a/skills/hunting-for-lolbins-execution-in-endpoint-logs/SKILL.md b/skills/hunting-for-lolbins-execution-in-endpoint-logs/SKILL.md index 745d0b7f..fde23a05 100644 --- a/skills/hunting-for-lolbins-execution-in-endpoint-logs/SKILL.md +++ b/skills/hunting-for-lolbins-execution-in-endpoint-logs/SKILL.md @@ -1,8 +1,10 @@ --- name: hunting-for-lolbins-execution-in-endpoint-logs -description: Hunt for adversary abuse of Living Off the Land Binaries (LOLBins) by - analyzing endpoint process creation logs for suspicious execution patterns of legitimate - Windows system binaries used for malicious purposes. +description: Hunts for LOLBins (Living Off the Land Binaries) abuse, mapped to MITRE + T1218, by analyzing endpoint process-creation logs for suspicious execution patterns + of legitimate Windows system binaries used for malicious purposes. Use when reviewing + endpoint process telemetry for LOLBins-based defense evasion or building detections + for signed-binary proxy execution. domain: cybersecurity subdomain: threat-hunting tags: diff --git a/skills/hunting-for-ntlm-relay-attacks/SKILL.md b/skills/hunting-for-ntlm-relay-attacks/SKILL.md index f86bae30..bbb51bdb 100644 --- a/skills/hunting-for-ntlm-relay-attacks/SKILL.md +++ b/skills/hunting-for-ntlm-relay-attacks/SKILL.md @@ -1,9 +1,10 @@ --- name: hunting-for-ntlm-relay-attacks -description: Detect NTLM relay attacks by analyzing Windows Event 4624 logon type - 3 with NTLMSSP authentication, identifying IP-to-hostname mismatches, Responder - traffic signatures, SMB signing status, and suspicious authentication patterns across - the domain. +description: Detects NTLM relay attacks (MITRE T1557.001) by analyzing Windows Event + ID 4624 logon type 3 with NTLMSSP authentication, flagging IP-to-hostname mismatches, + Responder/LLMNR poisoning signatures, SMB signing status, and anomalous cross-domain + authentication patterns. Use when investigating credential-relay activity in Active + Directory or building detections for NTLM relay and coercion-based attacks. domain: cybersecurity subdomain: threat-hunting tags: diff --git a/skills/hunting-for-persistence-mechanisms-in-windows/SKILL.md b/skills/hunting-for-persistence-mechanisms-in-windows/SKILL.md index 0898f32e..62bc71e1 100644 --- a/skills/hunting-for-persistence-mechanisms-in-windows/SKILL.md +++ b/skills/hunting-for-persistence-mechanisms-in-windows/SKILL.md @@ -1,7 +1,10 @@ --- name: hunting-for-persistence-mechanisms-in-windows -description: Systematically hunt for adversary persistence mechanisms across Windows - endpoints including registry, services, startup folders, and WMI subscriptions. +description: Systematically hunts for adversary persistence mechanisms across Windows + endpoints, covering registry Run/RunOnce keys, services, startup folders, scheduled + tasks, and WMI event subscriptions. Use when performing a broad persistence sweep + during incident response or building SIEM detections that cover the full range of + Windows persistence techniques (MITRE T1547). domain: cybersecurity subdomain: threat-hunting tags: diff --git a/skills/hunting-for-persistence-via-wmi-subscriptions/SKILL.md b/skills/hunting-for-persistence-via-wmi-subscriptions/SKILL.md index e96390eb..a051c0ce 100644 --- a/skills/hunting-for-persistence-via-wmi-subscriptions/SKILL.md +++ b/skills/hunting-for-persistence-via-wmi-subscriptions/SKILL.md @@ -1,8 +1,10 @@ --- name: hunting-for-persistence-via-wmi-subscriptions -description: Hunt for adversary persistence through Windows Management Instrumentation - event subscriptions by monitoring WMI consumer, filter, and binding creation events - that execute malicious code triggered by system events. +description: Hunts for adversary persistence via WMI event subscriptions (MITRE T1546.003) + by monitoring the creation of WMI event filters, consumers, and filter-to-consumer + bindings that trigger malicious code execution on system events. Use when investigating + fileless, trigger-based persistence on Windows hosts or auditing WMI repository + contents for malicious event subscriptions. domain: cybersecurity subdomain: threat-hunting tags: diff --git a/skills/hunting-for-process-injection-techniques/SKILL.md b/skills/hunting-for-process-injection-techniques/SKILL.md index bee9005a..176a8dd3 100644 --- a/skills/hunting-for-process-injection-techniques/SKILL.md +++ b/skills/hunting-for-process-injection-techniques/SKILL.md @@ -1,8 +1,10 @@ --- name: hunting-for-process-injection-techniques -description: Detect process injection techniques (T1055) including CreateRemoteThread, - process hollowing, and DLL injection via Sysmon Event IDs 8 and 10 and EDR process - telemetry +description: Detects process injection techniques (MITRE T1055) — including + CreateRemoteThread injection, process hollowing, and DLL injection — by analyzing + Sysmon Event IDs 8 (CreateRemoteThread) and 10 (ProcessAccess) alongside EDR process + telemetry. Use when hunting for in-memory code injection or defense evasion via + legitimate process abuse on Windows endpoints. domain: cybersecurity subdomain: threat-hunting tags: diff --git a/skills/hunting-for-registry-persistence-mechanisms/SKILL.md b/skills/hunting-for-registry-persistence-mechanisms/SKILL.md index 1e820307..07011794 100644 --- a/skills/hunting-for-registry-persistence-mechanisms/SKILL.md +++ b/skills/hunting-for-registry-persistence-mechanisms/SKILL.md @@ -1,7 +1,10 @@ --- name: hunting-for-registry-persistence-mechanisms -description: Hunt for registry-based persistence mechanisms including Run keys, Winlogon - modifications, IFEO injection, and COM hijacking in Windows environments. +description: Hunts for registry-based persistence mechanisms (MITRE T1547) in Windows + environments, including Run/RunOnce keys, Winlogon Shell/Userinit modifications, Image + File Execution Options (IFEO) debugger injection, and COM hijacking via CLSID overrides. + Use when auditing the registry for persistence artifacts or building detections for + registry-based malware autostart techniques. domain: cybersecurity subdomain: threat-hunting tags: diff --git a/skills/hunting-for-scheduled-task-persistence/SKILL.md b/skills/hunting-for-scheduled-task-persistence/SKILL.md index 6207dc43..d7660ce2 100644 --- a/skills/hunting-for-scheduled-task-persistence/SKILL.md +++ b/skills/hunting-for-scheduled-task-persistence/SKILL.md @@ -1,7 +1,6 @@ --- name: hunting-for-scheduled-task-persistence -description: Hunt for adversary persistence via Windows Scheduled Tasks by analyzing - task creation events, suspicious task actions, and unusual scheduling patterns. +description: Runs a hypothesis-driven threat hunt for Windows Scheduled Task persistence (T1053), guiding SIEM/EDR queries against task creation events (e.g. Event ID 4698), suspicious task actions, and unusual scheduling patterns. Use when hunting for scheduled-task persistence, after threat intel flags related campaigns, during incident response, or when alerts fire on schtasks/at.exe activity. domain: cybersecurity subdomain: threat-hunting tags: diff --git a/skills/hunting-for-shadow-copy-deletion/SKILL.md b/skills/hunting-for-shadow-copy-deletion/SKILL.md index 0d914834..4d0c88d6 100644 --- a/skills/hunting-for-shadow-copy-deletion/SKILL.md +++ b/skills/hunting-for-shadow-copy-deletion/SKILL.md @@ -1,8 +1,6 @@ --- name: hunting-for-shadow-copy-deletion -description: Hunt for Volume Shadow Copy deletion activity that indicates ransomware - preparation or anti-forensics by monitoring vssadmin, wmic, and PowerShell shadow - copy commands. +description: Runs a hypothesis-driven threat hunt for Volume Shadow Copy deletion (T1490) by querying SIEM/EDR telemetry for vssadmin, wmic shadowcopy, and PowerShell shadow-copy-deletion commands. Use when hunting for ransomware preparation or anti-forensics activity, after threat intel flags active campaigns, or when alerts trigger on shadow-copy deletion commands. domain: cybersecurity subdomain: threat-hunting tags: diff --git a/skills/hunting-for-startup-folder-persistence/SKILL.md b/skills/hunting-for-startup-folder-persistence/SKILL.md index 4c857a7c..6cca7800 100644 --- a/skills/hunting-for-startup-folder-persistence/SKILL.md +++ b/skills/hunting-for-startup-folder-persistence/SKILL.md @@ -1,8 +1,6 @@ --- name: hunting-for-startup-folder-persistence -description: Detect T1547.001 startup folder persistence by monitoring Windows startup - directories for suspicious file creation, analyzing autoruns entries, and using - Python watchdog for real-time filesystem monitoring. +description: Detects T1547.001 startup folder persistence by monitoring Windows startup directories for suspicious file creation, cross-referencing Autoruns entries, and running a Python watchdog script for real-time filesystem monitoring. Use when hunting for malware or implants that survive reboot via startup-folder placement, or when validating autoruns/EDR findings against known-good startup baselines. domain: cybersecurity subdomain: threat-hunting tags: diff --git a/skills/hunting-for-supply-chain-compromise/SKILL.md b/skills/hunting-for-supply-chain-compromise/SKILL.md index 1d7977ea..fe6002fd 100644 --- a/skills/hunting-for-supply-chain-compromise/SKILL.md +++ b/skills/hunting-for-supply-chain-compromise/SKILL.md @@ -1,8 +1,6 @@ --- name: hunting-for-supply-chain-compromise -description: Hunt for supply chain compromise indicators including trojanized software - updates, compromised dependencies, unauthorized code modifications, and tampered - build artifacts. +description: Runs a hypothesis-driven threat hunt for supply-chain compromise (T1195) by querying SIEM/EDR logs for trojanized software updates, compromised dependencies, unauthorized code modifications, and tampered build artifacts. Use when hunting after threat intel flags a compromised vendor/dependency, scoping a build-pipeline compromise, or reviewing update/build integrity. domain: cybersecurity subdomain: threat-hunting tags: diff --git a/skills/hunting-for-suspicious-scheduled-tasks/SKILL.md b/skills/hunting-for-suspicious-scheduled-tasks/SKILL.md index 755a4f59..fcf8f6ce 100644 --- a/skills/hunting-for-suspicious-scheduled-tasks/SKILL.md +++ b/skills/hunting-for-suspicious-scheduled-tasks/SKILL.md @@ -1,8 +1,6 @@ --- name: hunting-for-suspicious-scheduled-tasks -description: Hunt for adversary persistence and execution via Windows scheduled tasks - by analyzing task creation events, suspicious task properties, and unusual execution - patterns that indicate T1053.005 abuse. +description: Hunts for adversary persistence and execution via Windows scheduled tasks (T1053.005) by analyzing Security Event ID 4698 task-creation events, suspicious task properties, and unusual execution patterns from schtasks.exe/at.exe. Use after detecting schtasks or at.exe in process creation logs, during incident response to enumerate persistence on compromised hosts, or when Event ID 4698 fires for an unusual task. domain: cybersecurity subdomain: threat-hunting tags: diff --git a/skills/hunting-for-t1098-account-manipulation/SKILL.md b/skills/hunting-for-t1098-account-manipulation/SKILL.md index ecd12994..cc577490 100644 --- a/skills/hunting-for-t1098-account-manipulation/SKILL.md +++ b/skills/hunting-for-t1098-account-manipulation/SKILL.md @@ -1,8 +1,6 @@ --- name: hunting-for-t1098-account-manipulation -description: Hunt for MITRE ATT&CK T1098 account manipulation including shadow admin - creation, SID history injection, group membership changes, and credential modifications - using Windows Security Event Logs. +description: Hunts for MITRE ATT&CK T1098 account manipulation - shadow admin creation, SID history injection, group membership changes, and credential modifications - by analyzing Windows Security Event Log IDs 4738, 4728, 4732, 4756, 4670, and 5136. Use when investigating suspected privilege persistence in Active Directory, after detecting anomalous group/credential changes, or during incident response to trace account tampering. domain: cybersecurity subdomain: threat-hunting tags: diff --git a/skills/hunting-for-unusual-network-connections/SKILL.md b/skills/hunting-for-unusual-network-connections/SKILL.md index bb907add..df6e5cec 100644 --- a/skills/hunting-for-unusual-network-connections/SKILL.md +++ b/skills/hunting-for-unusual-network-connections/SKILL.md @@ -1,8 +1,6 @@ --- name: hunting-for-unusual-network-connections -description: Hunt for unusual network connections by analyzing outbound traffic patterns, - rare destinations, non-standard ports, and anomalous connection frequencies from - endpoints. +description: Runs a hypothesis-driven threat hunt for command-and-control activity (T1071) by querying SIEM/EDR network telemetry for anomalous outbound traffic, rare destinations, non-standard ports, and unusual connection frequencies from endpoints. Use when hunting for beaconing/C2 traffic, after threat intel flags suspicious infrastructure, or when alerts fire on anomalous connections. domain: cybersecurity subdomain: threat-hunting tags: diff --git a/skills/hunting-for-unusual-service-installations/SKILL.md b/skills/hunting-for-unusual-service-installations/SKILL.md index 7963128c..ed485ff7 100644 --- a/skills/hunting-for-unusual-service-installations/SKILL.md +++ b/skills/hunting-for-unusual-service-installations/SKILL.md @@ -1,8 +1,6 @@ --- name: hunting-for-unusual-service-installations -description: Detect suspicious Windows service installations (MITRE ATT&CK T1543.003) - by parsing System event logs for Event ID 7045, analyzing service binary paths, - and identifying indicators of persistence mechanisms. +description: Detects suspicious Windows service installations (MITRE ATT&CK T1543.003) by parsing System event log Event ID 7045, analyzing service binary paths, and flagging indicators of persistence mechanisms via Sysmon/EDR telemetry. Use when hunting for new-service persistence after a suspected compromise, when Event ID 7045 fires for an unfamiliar service, or during incident response to enumerate service-based persistence on Windows hosts. domain: cybersecurity subdomain: threat-hunting tags: diff --git a/skills/hunting-for-webshell-activity/SKILL.md b/skills/hunting-for-webshell-activity/SKILL.md index 2b607be9..1d481e11 100644 --- a/skills/hunting-for-webshell-activity/SKILL.md +++ b/skills/hunting-for-webshell-activity/SKILL.md @@ -1,8 +1,6 @@ --- name: hunting-for-webshell-activity -description: Hunt for web shell deployments on internet-facing servers by analyzing - file creation in web directories, suspicious process spawning from web servers, - and anomalous HTTP patterns. +description: Runs a hypothesis-driven threat hunt for web shell deployment (T1505.003) on internet-facing servers by analyzing file creation in web directories, suspicious child-process spawning from web server processes, and anomalous HTTP request patterns. Use when hunting for web shells after a public-facing app compromise, when EDR/SIEM alerts fire on webserver process anomalies, or during incident response on internet-facing infrastructure. domain: cybersecurity subdomain: threat-hunting tags: diff --git a/skills/hunting-saas-sso-token-abuse/SKILL.md b/skills/hunting-saas-sso-token-abuse/SKILL.md index d66f000f..b36d46dd 100644 --- a/skills/hunting-saas-sso-token-abuse/SKILL.md +++ b/skills/hunting-saas-sso-token-abuse/SKILL.md @@ -1,6 +1,6 @@ --- name: hunting-saas-sso-token-abuse -description: Detect SSO and OAuth token replay and SaaS lateral movement. +description: Hunts for stolen-session and OAuth/PRT token replay (T1550.001) by correlating Microsoft Entra ID SigninLogs SessionId/UniqueTokenIdentifier fields and Okta System Log sso/session events to spot impossible travel, refresh-token reuse, and token use from anomalous ASNs. Use when hunting MFA-bypass via stolen cookies/tokens, investigating impossible-travel alerts, or scoping SaaS lateral movement after phishing. domain: cybersecurity subdomain: soc-operations tags: diff --git a/skills/implementing-aes-encryption-for-data-at-rest/SKILL.md b/skills/implementing-aes-encryption-for-data-at-rest/SKILL.md index e88ce985..682f55e1 100644 --- a/skills/implementing-aes-encryption-for-data-at-rest/SKILL.md +++ b/skills/implementing-aes-encryption-for-data-at-rest/SKILL.md @@ -1,8 +1,6 @@ --- name: implementing-aes-encryption-for-data-at-rest -description: AES (Advanced Encryption Standard) is a symmetric block cipher standardized - by NIST (FIPS 197) used to protect classified and sensitive data. This skill covers - implementing AES-256 encryption in GCM m +description: Guides implementing AES-256 encryption in GCM mode (FIPS 197) for files and data stores at rest, covering key derivation, IV/nonce management, and authenticated encryption. Use when deploying or configuring encryption for data at rest, establishing controls to meet compliance requirements, or reviewing an implementation during a security assessment. domain: cybersecurity subdomain: cryptography tags: diff --git a/skills/implementing-anti-phishing-training-program/SKILL.md b/skills/implementing-anti-phishing-training-program/SKILL.md index ead3d4bf..20e74cdb 100644 --- a/skills/implementing-anti-phishing-training-program/SKILL.md +++ b/skills/implementing-anti-phishing-training-program/SKILL.md @@ -1,8 +1,6 @@ --- name: implementing-anti-phishing-training-program -description: Security awareness training is the human layer of phishing defense. An - effective anti-phishing training program combines regular simulations, interactive - learning modules, metric tracking, and positiv +description: Guides designing, deploying, and measuring an anti-phishing security awareness program - baseline phishing simulations, interactive training modules, just-in-time learning, and metric tracking - using platforms like KnowBe4, Proofpoint Security Awareness, or Cofense. Use when building or maturing a phishing awareness program, establishing training controls for compliance, or measuring phishing susceptibility and reporting rates over time. domain: cybersecurity subdomain: phishing-defense tags: diff --git a/skills/implementing-anti-ransomware-group-policy/SKILL.md b/skills/implementing-anti-ransomware-group-policy/SKILL.md index 408b1c4f..27007216 100644 --- a/skills/implementing-anti-ransomware-group-policy/SKILL.md +++ b/skills/implementing-anti-ransomware-group-policy/SKILL.md @@ -1,13 +1,11 @@ --- name: implementing-anti-ransomware-group-policy -description: 'Configures Windows Group Policy Objects (GPO) to prevent ransomware - execution and limit its spread. Implements AppLocker rules, Software Restriction - Policies, Controlled Folder Access, attack surface reduction rules, and network - protection settings. Activates for requests involving Windows GPO hardening against - ransomware, AppLocker configuration, Controlled Folder Access setup, or endpoint - protection via Group Policy. - - ' +description: 'Configures Windows Group Policy Objects to block ransomware execution + and lateral spread, covering AppLocker rules, Software Restriction Policies, Controlled + Folder Access, attack surface reduction rules, and network protection settings. + Use when hardening Windows endpoints against ransomware via GPO, configuring AppLocker + or Controlled Folder Access, or building endpoint protection policies through Group + Policy.' domain: cybersecurity subdomain: ransomware-defense tags: diff --git a/skills/implementing-api-abuse-detection-with-rate-limiting/SKILL.md b/skills/implementing-api-abuse-detection-with-rate-limiting/SKILL.md index 826c8435..15ec8268 100644 --- a/skills/implementing-api-abuse-detection-with-rate-limiting/SKILL.md +++ b/skills/implementing-api-abuse-detection-with-rate-limiting/SKILL.md @@ -1,8 +1,10 @@ --- name: implementing-api-abuse-detection-with-rate-limiting -description: Implement API abuse detection using token bucket, sliding window, and - adaptive rate limiting algorithms to prevent DDoS, brute force, and credential stuffing - attacks. +description: Implements API abuse detection using token bucket, sliding window, and + fixed window rate-limiting algorithms backed by Redis, including adaptive limits + that tighten during detected attacks and relax during normal traffic. Use when + defending APIs against DDoS, brute force login attempts, credential stuffing, or + scraping abuse and you need to design or tune rate-limiting logic. domain: cybersecurity subdomain: api-security tags: diff --git a/skills/implementing-api-gateway-security-controls/SKILL.md b/skills/implementing-api-gateway-security-controls/SKILL.md index 2d4699d3..656013e6 100644 --- a/skills/implementing-api-gateway-security-controls/SKILL.md +++ b/skills/implementing-api-gateway-security-controls/SKILL.md @@ -1,14 +1,11 @@ --- name: implementing-api-gateway-security-controls -description: 'Implements security controls at the API gateway layer including authentication - enforcement, rate limiting, request validation, IP allowlisting, TLS termination, - and threat protection. The engineer configures API gateways (Kong, AWS API Gateway, - Azure APIM, Apigee) to act as a centralized security enforcement point that validates, - throttles, and monitors all API traffic before it reaches backend services. Activates - for requests involving API gateway security, API management security, gateway authentication, - or centralized API protection. - - ' +description: 'Configures API gateways such as Kong, AWS API Gateway, Azure APIM, + or Apigee as a centralized security enforcement point, covering authentication + enforcement, rate limiting and throttling, request validation, IP allowlisting, + TLS termination, and threat protection. Use when securing API traffic at the gateway + layer, setting up gateway-level authentication and quota management, or centralizing + API protection before requests reach backend services.' domain: cybersecurity subdomain: api-security tags: diff --git a/skills/implementing-api-key-security-controls/SKILL.md b/skills/implementing-api-key-security-controls/SKILL.md index f08ddedb..2e461d31 100644 --- a/skills/implementing-api-key-security-controls/SKILL.md +++ b/skills/implementing-api-key-security-controls/SKILL.md @@ -1,14 +1,11 @@ --- name: implementing-api-key-security-controls -description: 'Implements secure API key generation, storage, rotation, and revocation - controls to protect API authentication credentials from leakage, brute force, and - abuse. The engineer designs API key formats with sufficient entropy, implements - secure hashing for storage, enforces per-key scoping and rate limiting, monitors - for leaked keys in public repositories, and builds key rotation workflows. Activates - for requests involving API key management, API key security, key rotation policy, - or API credential protection. - - ' +description: 'Implements secure API key generation with sufficient entropy, server-side + hashing (SHA-256/bcrypt) instead of plaintext storage, per-key scoping to endpoints/IPs/rate + limits, zero-downtime rotation, and automated leak monitoring across GitHub repos, + logs, and client-side code. Use when designing API key formats, building key rotation + or revocation workflows, or protecting server-to-server API credentials from leakage, + brute force, and abuse.' domain: cybersecurity subdomain: api-security tags: diff --git a/skills/implementing-api-rate-limiting-and-throttling/SKILL.md b/skills/implementing-api-rate-limiting-and-throttling/SKILL.md index b097555c..3d1f49c8 100644 --- a/skills/implementing-api-rate-limiting-and-throttling/SKILL.md +++ b/skills/implementing-api-rate-limiting-and-throttling/SKILL.md @@ -1,14 +1,11 @@ --- name: implementing-api-rate-limiting-and-throttling -description: 'Implements API rate limiting and throttling controls using token bucket, - sliding window, and fixed window algorithms to protect against brute force attacks, - credential stuffing, resource exhaustion, and API abuse. The engineer configures - per-user, per-IP, and per-endpoint rate limits using Redis-backed counters, API - gateway plugins, or application middleware, and implements proper HTTP 429 responses - with Retry-After headers. Activates for requests involving rate limiting implementation, - API throttling setup, request quota management, or API abuse prevention. - - ' +description: 'Implements API rate limiting and throttling with token bucket, sliding + window, and fixed window algorithms, configuring per-user, per-IP, and per-endpoint + limits via Redis-backed counters, API gateway plugins, or middleware, and returning + proper HTTP 429 responses with Retry-After headers. Use when setting up request + quota management or preventing brute force, credential stuffing, and resource exhaustion + attacks against APIs.' domain: cybersecurity subdomain: api-security tags: diff --git a/skills/implementing-api-schema-validation-security/SKILL.md b/skills/implementing-api-schema-validation-security/SKILL.md index 74ed5e03..f2c29983 100644 --- a/skills/implementing-api-schema-validation-security/SKILL.md +++ b/skills/implementing-api-schema-validation-security/SKILL.md @@ -1,8 +1,10 @@ --- name: implementing-api-schema-validation-security -description: Implement API schema validation using OpenAPI specifications and JSON - Schema to enforce input/output contracts and prevent injection, data exposure, and - mass assignment attacks. +description: Implements API schema validation using OpenAPI Specification and JSON + Schema documents, enforced both at the API gateway (runtime) and during development + (shift-left), to lock down request/response contracts and reject unknown properties. + Use when preventing injection attacks (SQLi, XSS, XXE), blocking mass assignment, + or stopping data leakage through unvalidated API responses. domain: cybersecurity subdomain: api-security tags: diff --git a/skills/implementing-api-security-posture-management/SKILL.md b/skills/implementing-api-security-posture-management/SKILL.md index ac5545d3..87f9245e 100644 --- a/skills/implementing-api-security-posture-management/SKILL.md +++ b/skills/implementing-api-security-posture-management/SKILL.md @@ -1,7 +1,11 @@ --- name: implementing-api-security-posture-management -description: Implement API Security Posture Management to continuously discover, classify, - and score APIs based on risk while enforcing security policies across the API lifecycle. +description: Implements API Security Posture Management (API-SPM) to continuously + discover, classify, and risk-score APIs -- including internal, external, partner, + and shadow endpoints -- while aggregating findings from DAST, SAST, SCA, and runtime + monitoring into a unified risk view. Use when building continuous API inventory + and risk-scoring, detecting configuration drift or policy violations, or unifying + API risk visibility across an organization. domain: cybersecurity subdomain: api-security tags: diff --git a/skills/implementing-api-security-testing-with-42crunch/SKILL.md b/skills/implementing-api-security-testing-with-42crunch/SKILL.md index 76095ef6..f6c48175 100644 --- a/skills/implementing-api-security-testing-with-42crunch/SKILL.md +++ b/skills/implementing-api-security-testing-with-42crunch/SKILL.md @@ -1,7 +1,10 @@ --- name: implementing-api-security-testing-with-42crunch -description: Implement comprehensive API security testing using the 42Crunch platform - to perform static audit and dynamic conformance scanning of OpenAPI specifications. +description: Implements API security testing on the 42Crunch platform, combining + API Audit for static analysis of OpenAPI definitions, API Conformance Scan for + dynamic vulnerability testing, and API Protect for runtime threat prevention, integrated + into CI/CD pipelines and IDEs. Use when shift-left testing APIs for OWASP API Security + Top 10 vulnerabilities or setting up 42Crunch audit and conformance scanning. domain: cybersecurity subdomain: api-security tags: diff --git a/skills/implementing-api-threat-protection-with-apigee/SKILL.md b/skills/implementing-api-threat-protection-with-apigee/SKILL.md index 3d98c967..719e3cd5 100644 --- a/skills/implementing-api-threat-protection-with-apigee/SKILL.md +++ b/skills/implementing-api-threat-protection-with-apigee/SKILL.md @@ -1,8 +1,10 @@ --- name: implementing-api-threat-protection-with-apigee -description: Implement API threat protection using Google Apigee policies including - JSON/XML threat protection, OAuth 2.0, SpikeArrest, and Advanced API Security for - OWASP Top 10 defense. +description: Implements API threat protection using Google Apigee reverse-proxy + policies, including JSON/XML threat protection, OAuth 2.0 enforcement, SpikeArrest + rate limiting, regex-based threat detection, and Advanced API Security for detecting + malicious clients. Use when shielding APIs proxied through Apigee against OWASP + API Security Top 10 threats and malicious client abuse patterns. domain: cybersecurity subdomain: api-security tags: diff --git a/skills/implementing-attack-path-analysis-with-xm-cyber/SKILL.md b/skills/implementing-attack-path-analysis-with-xm-cyber/SKILL.md index b09873e7..d43a70d3 100644 --- a/skills/implementing-attack-path-analysis-with-xm-cyber/SKILL.md +++ b/skills/implementing-attack-path-analysis-with-xm-cyber/SKILL.md @@ -1,8 +1,11 @@ --- name: implementing-attack-path-analysis-with-xm-cyber -description: Deploy XM Cyber's continuous exposure management platform to map attack - paths, identify choke points, and prioritize the 2% of exposures that threaten critical - assets. +description: Deploys XM Cyber's continuous exposure management platform to build + attack graphs that chain vulnerabilities, misconfigurations, identity risks, and + credential weaknesses toward critical assets, identifying the small fraction of + exposures sitting on converging "choke points". Use when mapping attack paths + across an environment or prioritizing remediation within a continuous threat exposure + management (CTEM) program. domain: cybersecurity subdomain: vulnerability-management tags: diff --git a/skills/implementing-aws-config-rules-for-compliance/SKILL.md b/skills/implementing-aws-config-rules-for-compliance/SKILL.md index c1f025e9..5f88f4c8 100644 --- a/skills/implementing-aws-config-rules-for-compliance/SKILL.md +++ b/skills/implementing-aws-config-rules-for-compliance/SKILL.md @@ -1,11 +1,10 @@ --- name: implementing-aws-config-rules-for-compliance -description: 'Implementing AWS Config rules for continuous compliance monitoring of - AWS resources, deploying managed and custom rules aligned to CIS and PCI DSS frameworks, - configuring automatic remediation with SSM Automation, and aggregating compliance - data across accounts. - - ' +description: 'Implements AWS Config managed and custom rules for continuous compliance + monitoring of AWS resources aligned to CIS and PCI DSS, configuring automatic remediation + with SSM Automation and aggregating compliance data across accounts. Use when establishing + continuous compliance monitoring, detecting configuration drift, or building a + multi-account compliance dashboard via AWS Organizations.' domain: cybersecurity subdomain: cloud-security tags: diff --git a/skills/implementing-aws-iam-permission-boundaries/SKILL.md b/skills/implementing-aws-iam-permission-boundaries/SKILL.md index 5d6f69cd..d73a4e71 100644 --- a/skills/implementing-aws-iam-permission-boundaries/SKILL.md +++ b/skills/implementing-aws-iam-permission-boundaries/SKILL.md @@ -1,7 +1,11 @@ --- name: implementing-aws-iam-permission-boundaries -description: Configure IAM permission boundaries in AWS to delegate role creation - to developers while enforcing maximum privilege limits set by the security team. +description: Configures AWS IAM permission boundaries that cap the maximum permissions + an identity-based policy can grant to a user or role, so effective permissions + are the intersection of the identity policy and the boundary even if the policy + grants AdministratorAccess. Use when letting security teams delegate IAM role and + policy creation to developers for self-service while enforcing least-privilege + ceilings and preventing privilege escalation. domain: cybersecurity subdomain: identity-access-management tags: diff --git a/skills/implementing-aws-macie-for-data-classification/SKILL.md b/skills/implementing-aws-macie-for-data-classification/SKILL.md index 2be30af1..10acf950 100644 --- a/skills/implementing-aws-macie-for-data-classification/SKILL.md +++ b/skills/implementing-aws-macie-for-data-classification/SKILL.md @@ -1,8 +1,6 @@ --- name: implementing-aws-macie-for-data-classification -description: Implement Amazon Macie to automatically discover, classify, and protect - sensitive data in S3 buckets using machine learning and pattern matching for PII, - financial data, and credentials detection. +description: Enable and configure Amazon Macie via AWS CLI/Terraform to discover, classify, and protect sensitive data (PII, financial data, credentials) in S3 using ML and pattern matching, including discovery jobs, custom data identifiers, allow lists, and EventBridge-based remediation. Use when setting up S3 data classification, cloud DLP, or auditing S3 for unprotected sensitive data. domain: cybersecurity subdomain: cloud-security tags: diff --git a/skills/implementing-aws-nitro-enclave-security/SKILL.md b/skills/implementing-aws-nitro-enclave-security/SKILL.md index ec3da200..febfeaba 100644 --- a/skills/implementing-aws-nitro-enclave-security/SKILL.md +++ b/skills/implementing-aws-nitro-enclave-security/SKILL.md @@ -1,13 +1,10 @@ --- name: implementing-aws-nitro-enclave-security -description: 'Implements AWS Nitro Enclave-based confidential computing environments - with cryptographic attestation, KMS policy integration using PCR-based condition - keys, and secure vsock communication channels. The practitioner builds enclave images, - configures attestation-aware KMS policies, validates attestation documents against - the AWS Nitro PKI root of trust, and establishes isolated computation pipelines - for processing sensitive data such as PII, cryptographic keys, and healthcare records. - Activates for requests involving Nitro Enclave setup, enclave attestation validation, - confidential computing on AWS, or KMS enclave policy configuration. +description: 'Build AWS Nitro Enclave confidential computing environments using nitro-cli + to create enclave images, configure attestation-aware KMS policies with PCR condition + keys, validate attestation documents against the Nitro PKI root, and set up vsock/kmstool-enclave-cli + pipelines for processing PII, keys, and health records. Use for Nitro Enclave setup, + attestation validation, or scoping KMS to an enclave image hash. ' domain: cybersecurity diff --git a/skills/implementing-aws-security-hub-compliance/SKILL.md b/skills/implementing-aws-security-hub-compliance/SKILL.md index f773999b..dbff57ca 100644 --- a/skills/implementing-aws-security-hub-compliance/SKILL.md +++ b/skills/implementing-aws-security-hub-compliance/SKILL.md @@ -1,9 +1,11 @@ --- name: implementing-aws-security-hub-compliance -description: 'Implementing AWS Security Hub to aggregate security findings across - AWS accounts, enable compliance standards like CIS AWS Foundations and PCI DSS, - configure automated remediation with EventBridge and Lambda, and create custom security - insights for organizational risk management. +description: 'Deploy AWS Security Hub, backed by AWS Config, to aggregate findings + from GuardDuty, Inspector, Macie, Firewall Manager, and Prowler across multi-account + AWS Organizations, enable standards like CIS AWS Foundations and PCI DSS, and automate + remediation via EventBridge and Lambda. Use for centralizing AWS compliance monitoring + or executive compliance dashboards; not for threat detection (GuardDuty) or data + classification (Macie). ' domain: cybersecurity diff --git a/skills/implementing-aws-security-hub/SKILL.md b/skills/implementing-aws-security-hub/SKILL.md index 46d90ae6..f6693878 100644 --- a/skills/implementing-aws-security-hub/SKILL.md +++ b/skills/implementing-aws-security-hub/SKILL.md @@ -1,10 +1,10 @@ --- name: implementing-aws-security-hub -description: 'This skill covers deploying AWS Security Hub as a centralized cloud - security posture management platform that aggregates findings from GuardDuty, Inspector, - Macie, and third-party tools. It details enabling security standards like CIS AWS - Foundations Benchmark, configuring automated remediation, and building executive - dashboards for compliance tracking across multi-account AWS organizations. +description: 'Deploy AWS Security Hub as a centralized CSPM platform, backed by AWS + Config, aggregating findings from GuardDuty, Inspector, Macie, and third-party tools; + enable CIS Foundations, PCI-DSS, and NIST standards; automate remediation via EventBridge/Systems + Manager; and produce Audit Manager evidence. Use for a centralized findings dashboard + or compliance audit evidence; not for threat detection or container scanning. ' domain: cybersecurity diff --git a/skills/implementing-azure-ad-privileged-identity-management/SKILL.md b/skills/implementing-azure-ad-privileged-identity-management/SKILL.md index 5618a5e1..01bf81e8 100644 --- a/skills/implementing-azure-ad-privileged-identity-management/SKILL.md +++ b/skills/implementing-azure-ad-privileged-identity-management/SKILL.md @@ -1,8 +1,10 @@ --- name: implementing-azure-ad-privileged-identity-management -description: Configure Microsoft Entra Privileged Identity Management to enforce just-in-time - role activation, approval workflows, and access reviews for Azure AD privileged - roles. +description: Configure Microsoft Entra Privileged Identity Management (PIM) to convert + standing privileged assignments into eligible, time-bound roles requiring justification, + MFA, and approval, covering Entra roles, Azure resource roles, and PIM for Groups, + plus access reviews. Use for role-assignment audits, just-in-time admin activation, + or Zero Trust identity governance in Entra/Azure AD. domain: cybersecurity subdomain: identity-access-management tags: diff --git a/skills/implementing-azure-defender-for-cloud/SKILL.md b/skills/implementing-azure-defender-for-cloud/SKILL.md index 360d65de..9d3af9a9 100644 --- a/skills/implementing-azure-defender-for-cloud/SKILL.md +++ b/skills/implementing-azure-defender-for-cloud/SKILL.md @@ -1,9 +1,11 @@ --- name: implementing-azure-defender-for-cloud -description: 'Implementing Microsoft Defender for Cloud to enable cloud security posture - management, workload protection across VMs, containers, databases, and storage, - configure security recommendations, and set up adaptive security controls with automated - remediation. +description: 'Enable Microsoft Defender for Cloud (CSPM + CWPP) across VMs, containers, + SQL, storage, and Key Vault, using Azure Policy for evaluation, Log Analytics for + telemetry, Azure Arc for hybrid coverage, and Logic Apps for automated response. + Use for Azure security monitoring, adaptive remediation, or regulatory compliance + assessment; not for non-Azure-only protection or identity defense (Defender for + Identity). ' domain: cybersecurity diff --git a/skills/implementing-beyondcorp-zero-trust-access-model/SKILL.md b/skills/implementing-beyondcorp-zero-trust-access-model/SKILL.md index c4c746f4..2a440b1b 100644 --- a/skills/implementing-beyondcorp-zero-trust-access-model/SKILL.md +++ b/skills/implementing-beyondcorp-zero-trust-access-model/SKILL.md @@ -1,9 +1,11 @@ --- name: implementing-beyondcorp-zero-trust-access-model -description: 'Implementing Google''s BeyondCorp zero trust access model to eliminate - implicit trust from the network perimeter, enforce identity-aware access controls - using IAP, Access Context Manager, and Chrome Enterprise Premium for VPN-less secure - application access. +description: 'Implement Google''s BeyondCorp zero trust access model using Cloud + IAP, Access Context Manager, Endpoint Verification, Chrome Enterprise Premium, and + BeyondCorp Enterprise Connectors to enforce identity- and device-aware access for + VPN-less application access. Use for replacing VPN, enforcing device posture checks, + or securing remote/hybrid access to GCP-hosted or on-prem apps; not for raw network-level + protocols. ' domain: cybersecurity diff --git a/skills/implementing-bgp-security-with-rpki/SKILL.md b/skills/implementing-bgp-security-with-rpki/SKILL.md index caac9ca5..f2b16385 100644 --- a/skills/implementing-bgp-security-with-rpki/SKILL.md +++ b/skills/implementing-bgp-security-with-rpki/SKILL.md @@ -1,8 +1,11 @@ --- name: implementing-bgp-security-with-rpki -description: Implement BGP route origin validation using RPKI with Route Origin Authorizations, - RPKI-to-Router protocol, and ROV policies on Cisco and Juniper routers to prevent - route hijacking. +description: Implement RPKI-based BGP route origin validation by creating Route Origin + Authorizations (ROAs) at RIRs (ARIN, RIPE, APNIC, AFRINIC, LACNIC), deploying validator + software (Routinator, FORT, OctoRPKI), and configuring RPKI-to-Router protocol and + ROV accept/reject policies on Cisco IOS-XE and Juniper Junos routers. Use when hardening + BGP against route hijacking or leaks, or when configuring ROV filtering policy on + production routers. domain: cybersecurity subdomain: network-security tags: diff --git a/skills/implementing-cisa-zero-trust-maturity-model/SKILL.md b/skills/implementing-cisa-zero-trust-maturity-model/SKILL.md index a537680d..ef152454 100644 --- a/skills/implementing-cisa-zero-trust-maturity-model/SKILL.md +++ b/skills/implementing-cisa-zero-trust-maturity-model/SKILL.md @@ -1,8 +1,10 @@ --- name: implementing-cisa-zero-trust-maturity-model -description: Implement the CISA Zero Trust Maturity Model v2.0 across the five pillars - of identity, devices, networks, applications, and data to achieve progressive organizational - zero trust maturity. +description: Assess, gap-analyze, and progressively implement the CISA Zero Trust + Maturity Model v2.0 across five pillars (Identity, Devices, Networks, Applications + & Workloads, Data) and three cross-cutting capabilities (Visibility/Analytics, Automation/Orchestration, + Governance), from Traditional through Optimal maturity. Use for a federal/enterprise + ZTMM assessment, phased roadmap, or mapping controls to NIST SP 800-207 and EO 14028. domain: cybersecurity subdomain: zero-trust-architecture tags: diff --git a/skills/implementing-cloud-dlp-for-data-protection/SKILL.md b/skills/implementing-cloud-dlp-for-data-protection/SKILL.md index 934a46d0..b05529f7 100644 --- a/skills/implementing-cloud-dlp-for-data-protection/SKILL.md +++ b/skills/implementing-cloud-dlp-for-data-protection/SKILL.md @@ -1,8 +1,11 @@ --- name: implementing-cloud-dlp-for-data-protection -description: 'Implementing Cloud Data Loss Prevention (DLP) using Amazon Macie, Azure - Information Protection, and Google Cloud DLP API to discover, classify, and protect - sensitive data across cloud storage, databases, and data pipelines. +description: 'Implement cloud DLP using Amazon Macie, Google Cloud DLP API, Microsoft + Purview, Azure Information Protection, and Nightfall AI to discover, classify, label, + de-identify, and protect sensitive data (PII, PHI, financial data) across cloud + storage, databases, and pipelines. Use for GDPR/HIPAA/PCI DSS data-discovery, cloud + data governance, or CI/CD DLP scanning; not for endpoint, email, or network-level + DLP. ' domain: cybersecurity diff --git a/skills/implementing-cloud-security-posture-management/SKILL.md b/skills/implementing-cloud-security-posture-management/SKILL.md index 33420976..51ff2699 100644 --- a/skills/implementing-cloud-security-posture-management/SKILL.md +++ b/skills/implementing-cloud-security-posture-management/SKILL.md @@ -1,9 +1,10 @@ --- name: implementing-cloud-security-posture-management -description: 'Implementing Cloud Security Posture Management (CSPM) to continuously - monitor multi-cloud environments for misconfigurations, compliance violations, and - security risks using Prowler, ScoutSuite, AWS Security Hub, Azure Defender, and - GCP Security Command Center. +description: 'Continuously monitor multi-cloud environments (AWS, Azure, GCP) for + misconfigurations, compliance violations, and security risks using Prowler, ScoutSuite, + AWS Security Hub, Microsoft Defender for Cloud, and GCP Security Command Center. + Use for cross-cloud posture monitoring, CIS/SOC 2/PCI DSS compliance, or drift-detection + workflows; not for runtime workload protection or application security testing. ' domain: cybersecurity diff --git a/skills/implementing-cloud-vulnerability-posture-management/SKILL.md b/skills/implementing-cloud-vulnerability-posture-management/SKILL.md index 3c088115..a85a3e5e 100644 --- a/skills/implementing-cloud-vulnerability-posture-management/SKILL.md +++ b/skills/implementing-cloud-vulnerability-posture-management/SKILL.md @@ -1,8 +1,11 @@ --- name: implementing-cloud-vulnerability-posture-management -description: Implement Cloud Security Posture Management using AWS Security Hub, Azure - Defender for Cloud, and open-source tools like Prowler and ScoutSuite for multi-cloud - vulnerability detection. +description: Implement multi-cloud CSPM to detect cloud-native misconfigurations + and vulnerabilities (IAM over-permissions, exposed storage, unencrypted data, missing + network controls) using AWS Security Hub, Azure Defender for Cloud, and open-source + Prowler and ScoutSuite scans, then aggregate results across clouds. Use when auditing + multi-cloud environments for misconfiguration-driven vulnerabilities or building + a consolidated cross-cloud posture report. domain: cybersecurity subdomain: vulnerability-management tags: diff --git a/skills/implementing-cloud-waf-rules/SKILL.md b/skills/implementing-cloud-waf-rules/SKILL.md index eb499626..d7428600 100644 --- a/skills/implementing-cloud-waf-rules/SKILL.md +++ b/skills/implementing-cloud-waf-rules/SKILL.md @@ -1,10 +1,10 @@ --- name: implementing-cloud-waf-rules -description: 'This skill covers deploying and tuning Web Application Firewall rules - on AWS WAF, Azure WAF, and Cloudflare to protect cloud-hosted applications against - OWASP Top 10 attacks. It details configuring managed rule sets, creating custom - rules for business logic protection, implementing rate limiting, deploying bot management, - and reducing false positives through rule tuning and logging analysis. +description: 'Deploys and tunes Web Application Firewall rules on AWS WAF, Azure WAF, + and Cloudflare, covering managed rule sets, custom business-logic rules, rate limiting, + bot management, and false-positive reduction. Use when deploying new apps behind + a cloud WAF, when pentests reveal injection/XSS flaws, when facing bot or credential-stuffing + traffic, or when compliance (e.g. PCI-DSS) mandates a WAF. ' domain: cybersecurity diff --git a/skills/implementing-code-signing-for-artifacts/SKILL.md b/skills/implementing-code-signing-for-artifacts/SKILL.md index ada95206..5ee91320 100644 --- a/skills/implementing-code-signing-for-artifacts/SKILL.md +++ b/skills/implementing-code-signing-for-artifacts/SKILL.md @@ -1,9 +1,11 @@ --- name: implementing-code-signing-for-artifacts -description: 'This skill covers implementing code signing for build artifacts to ensure - integrity and authenticity throughout the software supply chain. It addresses signing - binaries, packages, and containers using GPG, Sigstore, and platform-specific signing - tools, establishing trust chains, and verifying signatures in deployment pipelines. +description: 'Implements code signing for build artifacts (binaries, packages, containers) + using GPG, Sigstore, and platform-specific signing tools, establishing trust chains + and verifying signatures in deployment pipelines. Use when establishing artifact + integrity checks against supply-chain tampering, proving authenticity to customers, + building zero-trust pipelines that reject unsigned artifacts, or meeting SLSA Level + 2+ provenance requirements. ' domain: cybersecurity diff --git a/skills/implementing-conditional-access-policies-azure-ad/SKILL.md b/skills/implementing-conditional-access-policies-azure-ad/SKILL.md index cf716ad5..a5115b3a 100644 --- a/skills/implementing-conditional-access-policies-azure-ad/SKILL.md +++ b/skills/implementing-conditional-access-policies-azure-ad/SKILL.md @@ -1,8 +1,11 @@ --- name: implementing-conditional-access-policies-azure-ad -description: Configure Microsoft Entra ID (Azure AD) Conditional Access policies for - zero trust access control. Covers signal-based policy design, device compliance - requirements, risk-based authentication, named l +description: Configures Microsoft Entra ID (Azure AD) Conditional Access policies for + zero trust access control, covering signal-based policy design, device compliance + requirements, risk-based authentication, named locations, and session controls aligned + to NIST SP 1800-35. Use when deploying or hardening conditional access policies, + building zero trust security architecture in Entra ID, or preparing for a security + assessment of Azure AD access controls. domain: cybersecurity subdomain: identity-access-management tags: diff --git a/skills/implementing-conduit-security-for-ot-remote-access/SKILL.md b/skills/implementing-conduit-security-for-ot-remote-access/SKILL.md index 4165aeb6..6f0af892 100644 --- a/skills/implementing-conduit-security-for-ot-remote-access/SKILL.md +++ b/skills/implementing-conduit-security-for-ot-remote-access/SKILL.md @@ -1,9 +1,10 @@ --- name: implementing-conduit-security-for-ot-remote-access -description: 'Implement secure conduit architecture for OT remote access following - IEC 62443 zones and conduits model, deploying jump servers, MFA-enabled gateways, - session recording, and approval-based workflows to control vendor and engineer access - to industrial control systems without exposing OT networks directly. +description: 'Implements secure conduit architecture for OT remote access under the + IEC 62443 zones-and-conduits model, deploying jump servers, MFA gateways, session + recording, and approval-based workflows for vendor and engineer access to ICS. Use + when replacing direct VPN access into OT networks, securing third-party vendor access + to SCADA equipment, or remediating audit findings on uncontrolled OT remote access. ' domain: cybersecurity diff --git a/skills/implementing-container-image-minimal-base-with-distroless/SKILL.md b/skills/implementing-container-image-minimal-base-with-distroless/SKILL.md index d3b6c1f1..b0f0f9b5 100644 --- a/skills/implementing-container-image-minimal-base-with-distroless/SKILL.md +++ b/skills/implementing-container-image-minimal-base-with-distroless/SKILL.md @@ -1,8 +1,11 @@ --- name: implementing-container-image-minimal-base-with-distroless -description: Reduce container attack surface by building application images on Google - distroless base images that contain only the application runtime with no shell, - package manager, or unnecessary OS utilities. +description: Reduces container attack surface by building application images on Google + distroless base images that contain only the app runtime with no shell, package + manager, or OS utilities, using multi-stage Docker build patterns and debug/scanning + techniques for distroless containers. Use when hardening container images, cutting + attack surface in a container security architecture, or responding to a security + assessment that flags bloated base images. domain: cybersecurity subdomain: container-security tags: diff --git a/skills/implementing-container-network-policies-with-calico/SKILL.md b/skills/implementing-container-network-policies-with-calico/SKILL.md index 1bb6d979..24fa05ea 100644 --- a/skills/implementing-container-network-policies-with-calico/SKILL.md +++ b/skills/implementing-container-network-policies-with-calico/SKILL.md @@ -1,8 +1,10 @@ --- name: implementing-container-network-policies-with-calico -description: Enforce Kubernetes network segmentation using Calico CNI network policies - and global network policies to control pod-to-pod traffic, restrict egress, and - implement zero-trust microsegmentation. +description: Enforces Kubernetes network segmentation by creating and auditing Calico + NetworkPolicy and GlobalNetworkPolicy resources via calicoctl and the Kubernetes + API, controlling pod-to-pod traffic, namespace isolation, egress restrictions, and + DNS-based rules. Use when implementing zero-trust microsegmentation in a Calico-CNI + cluster or hardening pod-to-pod and egress traffic controls. domain: cybersecurity subdomain: container-security tags: diff --git a/skills/implementing-continuous-security-validation-with-bas/SKILL.md b/skills/implementing-continuous-security-validation-with-bas/SKILL.md index 448c88ef..2f32ec06 100644 --- a/skills/implementing-continuous-security-validation-with-bas/SKILL.md +++ b/skills/implementing-continuous-security-validation-with-bas/SKILL.md @@ -1,8 +1,10 @@ --- name: implementing-continuous-security-validation-with-bas -description: Deploy Breach and Attack Simulation tools to continuously validate security - control effectiveness by safely emulating real-world attack techniques across the - kill chain. +description: Deploys Breach and Attack Simulation (BAS) platforms such as SafeBreach, + AttackIQ, Picus, Cymulate, Pentera, or SCYTHE to continuously validate endpoint, + network, email-gateway, SIEM, and incident-response effectiveness by safely emulating + MITRE ATT&CK techniques. Use when moving beyond point-in-time pentesting to continuous + control validation, or standing up automated adversary emulation. domain: cybersecurity subdomain: vulnerability-management tags: diff --git a/skills/implementing-data-loss-prevention-with-microsoft-purview/SKILL.md b/skills/implementing-data-loss-prevention-with-microsoft-purview/SKILL.md index 01c54c91..015a1d63 100644 --- a/skills/implementing-data-loss-prevention-with-microsoft-purview/SKILL.md +++ b/skills/implementing-data-loss-prevention-with-microsoft-purview/SKILL.md @@ -1,15 +1,11 @@ --- name: implementing-data-loss-prevention-with-microsoft-purview -description: 'Implements data loss prevention policies using Microsoft Purview to - protect sensitive information across Exchange Online, SharePoint, OneDrive, Teams, - endpoint devices, and Power BI. The analyst configures sensitivity labels with encryption - and content marking, creates DLP policies using built-in and custom sensitive information - types with regex patterns, deploys endpoint DLP rules to control file operations - on Windows and macOS devices, and monitors policy effectiveness through Activity - Explorer and DLP alert management. Uses PowerShell cmdlets and the Microsoft Graph - API for programmatic policy management. Activates for requests involving DLP policy - creation, sensitivity label configuration, data classification, endpoint data protection, - or Microsoft Purview compliance administration. +description: 'Implements DLP policies using Microsoft Purview PowerShell cmdlets and + the Graph API to protect data across Exchange Online, SharePoint, OneDrive, Teams, + endpoints, and Power BI, including sensitivity labels, custom sensitive information + types with regex, endpoint DLP rules, and Activity Explorer monitoring. Use when + stopping PII/PHI/PCI exfiltration, configuring sensitivity labels, or investigating + DLP incidents for policy tuning. ' domain: cybersecurity diff --git a/skills/implementing-deception-based-detection-with-canarytoken/SKILL.md b/skills/implementing-deception-based-detection-with-canarytoken/SKILL.md index 01aa760a..deaed571 100644 --- a/skills/implementing-deception-based-detection-with-canarytoken/SKILL.md +++ b/skills/implementing-deception-based-detection-with-canarytoken/SKILL.md @@ -1,8 +1,10 @@ --- name: implementing-deception-based-detection-with-canarytoken -description: Deploy and monitor Canary Tokens via the Thinkst Canary API for deception-based - breach detection using web bug tokens, DNS tokens, document tokens, and AWS key - tokens. +description: Deploys and monitors Canary Tokens via the Thinkst Canary REST API for + deception-based breach detection, programmatically creating web bug, DNS, MS Word + document, and AWS API key tokens and generating deception coverage reports from + triggered alerts. Use when standing up honeytoken tripwires for early breach detection + or building a deception-technology coverage report. domain: cybersecurity subdomain: deception-technology tags: diff --git a/skills/implementing-delinea-secret-server-for-pam/SKILL.md b/skills/implementing-delinea-secret-server-for-pam/SKILL.md index 4297f74c..1dd470e1 100644 --- a/skills/implementing-delinea-secret-server-for-pam/SKILL.md +++ b/skills/implementing-delinea-secret-server-for-pam/SKILL.md @@ -1,10 +1,10 @@ --- name: implementing-delinea-secret-server-for-pam -description: 'Implements Delinea Secret Server for privileged access management (PAM) - including secret vault configuration, role-based access policies, automated password - rotation, session recording, and integration with Active Directory and cloud platforms. - Activates for requests involving PAM deployment, privileged credential vaulting, - secret server administration, or password rotation automation. +description: 'Implements Delinea Secret Server for privileged access management, + covering secret vault configuration, role-based access policies, automated password + rotation, session recording, and Active Directory/cloud integration. Use when centralizing + privileged credential management, replacing spreadsheet-based secrets, automating + password rotation, or meeting PAM compliance (SOX, PCI-DSS, HIPAA, NIST 800-53). ' domain: cybersecurity diff --git a/skills/implementing-device-posture-assessment-in-zero-trust/SKILL.md b/skills/implementing-device-posture-assessment-in-zero-trust/SKILL.md index 12f7fc74..5d29d404 100644 --- a/skills/implementing-device-posture-assessment-in-zero-trust/SKILL.md +++ b/skills/implementing-device-posture-assessment-in-zero-trust/SKILL.md @@ -1,9 +1,10 @@ --- name: implementing-device-posture-assessment-in-zero-trust -description: 'Implementing device posture assessment as a zero trust access control +description: 'Implements device posture assessment as a zero trust access control by integrating endpoint health signals from CrowdStrike ZTA, Microsoft Intune, and - Jamf into conditional access policies that enforce compliance before granting resource - access. + Jamf into conditional access policies that enforce compliance before granting access. + Use when requiring device health checks before app access, wiring posture signals + into conditional access, or implementing the CISA Zero Trust device pillar. ' domain: cybersecurity diff --git a/skills/implementing-devsecops-security-scanning/SKILL.md b/skills/implementing-devsecops-security-scanning/SKILL.md index db601243..f82a4938 100644 --- a/skills/implementing-devsecops-security-scanning/SKILL.md +++ b/skills/implementing-devsecops-security-scanning/SKILL.md @@ -1,11 +1,10 @@ --- name: implementing-devsecops-security-scanning -description: 'Integrates Static Application Security Testing (SAST), Dynamic Application - Security Testing (DAST), and Software Composition Analysis (SCA) into CI/CD pipelines - using open-source tools. Covers Semgrep for SAST, Trivy for SCA and container scanning, - OWASP ZAP for DAST, and Gitleaks for secrets detection. Activates for requests involving - DevSecOps pipeline setup, automated security scanning in CI/CD, SAST/DAST/SCA integration, - or shift-left security implementation. +description: 'Integrates SAST, DAST, and SCA into CI/CD pipelines using Semgrep for + SAST, Trivy for SCA and container scanning, OWASP ZAP for DAST, and Gitleaks for + secrets detection. Use when setting up automated security scanning in CI/CD, shifting + security left, meeting compliance mandates (SOC 2, PCI-DSS, ISO 27001), or gating + deployments on critical vulnerabilities. ' domain: cybersecurity diff --git a/skills/implementing-digital-signatures-with-ed25519/SKILL.md b/skills/implementing-digital-signatures-with-ed25519/SKILL.md index 6bf1269c..393067ef 100644 --- a/skills/implementing-digital-signatures-with-ed25519/SKILL.md +++ b/skills/implementing-digital-signatures-with-ed25519/SKILL.md @@ -1,8 +1,6 @@ --- name: implementing-digital-signatures-with-ed25519 -description: Ed25519 is a high-performance digital signature algorithm using the Edwards - curve Curve25519. It provides 128-bit security with 64-byte signatures and 32-byte - keys, offering significant advantages ove +description: Implements digital signatures using the Ed25519 algorithm (Curve25519), covering key-pair generation, signing, signature verification, and security tradeoffs versus RSA and ECDSA. Use when adding message or artifact signing and authentication-integrity checks to a system, or when advising on Ed25519 key properties and validation criteria. domain: cybersecurity subdomain: cryptography tags: diff --git a/skills/implementing-dmarc-dkim-spf-email-security/SKILL.md b/skills/implementing-dmarc-dkim-spf-email-security/SKILL.md index 0924b9a2..398f4d1a 100644 --- a/skills/implementing-dmarc-dkim-spf-email-security/SKILL.md +++ b/skills/implementing-dmarc-dkim-spf-email-security/SKILL.md @@ -1,8 +1,6 @@ --- name: implementing-dmarc-dkim-spf-email-security -description: SPF, DKIM, and DMARC form the three pillars of email authentication. - Together they prevent domain spoofing, validate message integrity, and define policies - for handling unauthenticated mail. Proper im +description: Configures SPF, DKIM, and DMARC DNS TXT records to authenticate outbound email, prevent domain spoofing, and enforce a rejection/quarantine policy on unauthenticated mail, including auditing a domain's current DNS state. Use when hardening a domain's email security posture or defending against phishing and spoofing attacks. domain: cybersecurity subdomain: phishing-defense tags: diff --git a/skills/implementing-dragos-platform-for-ot-monitoring/SKILL.md b/skills/implementing-dragos-platform-for-ot-monitoring/SKILL.md index ff81c61d..6d28bde7 100644 --- a/skills/implementing-dragos-platform-for-ot-monitoring/SKILL.md +++ b/skills/implementing-dragos-platform-for-ot-monitoring/SKILL.md @@ -1,11 +1,6 @@ --- name: implementing-dragos-platform-for-ot-monitoring -description: 'Deploy and configure the Dragos Platform for OT network monitoring, - leveraging its 600+ industrial protocol parsers, intelligence-driven threat detection - analytics, and asset visibility capabilities to protect ICS environments against - threat groups like VOLTZITE, GRAPHITE, and BAUXITE. - - ' +description: Deploys and configures Dragos Platform sensors and detection analytics for OT/ICS network monitoring, using industrial protocol parsers and threat-intel packs to detect groups like VOLTZITE, CHERNOVITE, and KAMACITE. Use when standing up OT-specific network detection and response or an OT SOC, or integrating OT monitoring into an enterprise SIEM; not for IT-only or Claroty/Nozomi environments. domain: cybersecurity subdomain: ot-ics-security tags: diff --git a/skills/implementing-end-to-end-encryption-for-messaging/SKILL.md b/skills/implementing-end-to-end-encryption-for-messaging/SKILL.md index 3fe4a7d9..6c6651f3 100644 --- a/skills/implementing-end-to-end-encryption-for-messaging/SKILL.md +++ b/skills/implementing-end-to-end-encryption-for-messaging/SKILL.md @@ -1,8 +1,6 @@ --- name: implementing-end-to-end-encryption-for-messaging -description: End-to-end encryption (E2EE) ensures that only the communicating parties - can read messages, with no intermediary (including the server) able to decrypt them. - This skill implements a simplified version +description: Implements a simplified Signal Protocol-style end-to-end encryption scheme for messaging, covering key exchange, forward secrecy, and the core cryptographic components so no server or intermediary can decrypt messages. Use when designing or building E2EE messaging, or evaluating forward-secrecy and key-management tradeoffs for a messaging system. domain: cybersecurity subdomain: cryptography tags: diff --git a/skills/implementing-endpoint-detection-with-wazuh/SKILL.md b/skills/implementing-endpoint-detection-with-wazuh/SKILL.md index 6c8184ca..4af7e99d 100644 --- a/skills/implementing-endpoint-detection-with-wazuh/SKILL.md +++ b/skills/implementing-endpoint-detection-with-wazuh/SKILL.md @@ -1,8 +1,6 @@ --- name: implementing-endpoint-detection-with-wazuh -description: Deploy and configure Wazuh SIEM/XDR for endpoint detection including - agent management, custom decoder and rule XML creation, alert querying via the Wazuh - REST API, and automated response actions. +description: Deploys and configures Wazuh SIEM/XDR for endpoint detection, covering agent authentication and management, custom decoder and rule XML creation, alert querying via the Wazuh REST API, rule testing with wazuh-logtest, and automated active-response actions. Use when setting up endpoint detection and response, writing or testing custom Wazuh rules, or querying and triaging Wazuh alerts. domain: cybersecurity subdomain: security-operations tags: diff --git a/skills/implementing-envelope-encryption-with-aws-kms/SKILL.md b/skills/implementing-envelope-encryption-with-aws-kms/SKILL.md index 95cfa1da..d825293d 100644 --- a/skills/implementing-envelope-encryption-with-aws-kms/SKILL.md +++ b/skills/implementing-envelope-encryption-with-aws-kms/SKILL.md @@ -1,8 +1,6 @@ --- name: implementing-envelope-encryption-with-aws-kms -description: Envelope encryption is a strategy where data is encrypted with a data - encryption key (DEK), and the DEK itself is encrypted with a master key (KEK) managed - by AWS KMS. This approach allows encrypting +description: Implements envelope encryption with AWS KMS, encrypting data locally with a data encryption key (DEK) and protecting that DEK with a KMS-managed key (KEK), covering the encrypt/decrypt flow, KMS key types, and security validation criteria. Use when designing key management for encrypting large or numerous data objects on AWS, or when reducing direct KMS API call volume. domain: cybersecurity subdomain: cryptography tags: diff --git a/skills/implementing-epss-score-for-vulnerability-prioritization/SKILL.md b/skills/implementing-epss-score-for-vulnerability-prioritization/SKILL.md index 02dfa34e..aa839fb6 100644 --- a/skills/implementing-epss-score-for-vulnerability-prioritization/SKILL.md +++ b/skills/implementing-epss-score-for-vulnerability-prioritization/SKILL.md @@ -1,8 +1,6 @@ --- name: implementing-epss-score-for-vulnerability-prioritization -description: Integrate FIRST's Exploit Prediction Scoring System (EPSS) API to prioritize - vulnerability remediation based on real-world exploitation probability within 30 - days. +description: Queries FIRST's Exploit Prediction Scoring System (EPSS) API to fetch exploitation-probability and percentile scores for CVEs, then uses those scores to prioritize vulnerability remediation. Use when triaging or ranking a vulnerability backlog by real-world 30-day exploitation likelihood rather than CVSS severity alone. domain: cybersecurity subdomain: vulnerability-management tags: diff --git a/skills/implementing-file-integrity-monitoring-with-aide/SKILL.md b/skills/implementing-file-integrity-monitoring-with-aide/SKILL.md index 18ad1089..5513f107 100644 --- a/skills/implementing-file-integrity-monitoring-with-aide/SKILL.md +++ b/skills/implementing-file-integrity-monitoring-with-aide/SKILL.md @@ -1,8 +1,6 @@ --- name: implementing-file-integrity-monitoring-with-aide -description: Configure AIDE (Advanced Intrusion Detection Environment) for file integrity - monitoring including baseline creation, scheduled integrity checks, change detection, - and alerting +description: Configures AIDE (Advanced Intrusion Detection Environment) for file integrity monitoring on Linux, covering baseline database creation, scheduled integrity checks via cron, change detection, and alerting on unauthorized modifications. Use when setting up host-based file integrity monitoring, detecting unauthorized file changes, or meeting compliance requirements for FIM on Linux systems. domain: cybersecurity subdomain: endpoint-security tags: diff --git a/skills/implementing-fuzz-testing-in-cicd-with-aflplusplus/SKILL.md b/skills/implementing-fuzz-testing-in-cicd-with-aflplusplus/SKILL.md index e0ab520f..6c1e39ce 100644 --- a/skills/implementing-fuzz-testing-in-cicd-with-aflplusplus/SKILL.md +++ b/skills/implementing-fuzz-testing-in-cicd-with-aflplusplus/SKILL.md @@ -1,8 +1,6 @@ --- name: implementing-fuzz-testing-in-cicd-with-aflplusplus -description: Integrate AFL++ coverage-guided fuzz testing into CI/CD pipelines to - discover memory corruption, input handling, and logic vulnerabilities in C/C++ and - compiled applications. +description: Integrates AFL++ coverage-guided fuzzing into CI/CD pipelines, covering harness construction, AFL++/AddressSanitizer/CmpLog instrumentation builds, and persistent-mode fuzzing to discover memory-corruption and input-handling vulnerabilities in C/C++ code. Use when adding automated fuzz testing to a build pipeline or hunting for memory-safety bugs in native/compiled applications. domain: cybersecurity subdomain: devsecops tags: diff --git a/skills/implementing-gcp-binary-authorization/SKILL.md b/skills/implementing-gcp-binary-authorization/SKILL.md index 3eedfe3b..bc870e07 100644 --- a/skills/implementing-gcp-binary-authorization/SKILL.md +++ b/skills/implementing-gcp-binary-authorization/SKILL.md @@ -1,8 +1,6 @@ --- name: implementing-gcp-binary-authorization -description: Implement GCP Binary Authorization to enforce deploy-time security controls - that ensure only trusted, attested container images are deployed to Google Kubernetes - Engine and Cloud Run. +description: Implements GCP Binary Authorization end to end, including creating KMS-backed attestors, Container Analysis notes, deploy-time policies, and signing image attestations, so that only trusted, verified images deploy to GKE and Cloud Run. Use when enforcing container supply-chain integrity or deploy-time attestation checks on GCP. domain: cybersecurity subdomain: cloud-security tags: diff --git a/skills/implementing-gcp-organization-policy-constraints/SKILL.md b/skills/implementing-gcp-organization-policy-constraints/SKILL.md index 0e498499..36641ef3 100644 --- a/skills/implementing-gcp-organization-policy-constraints/SKILL.md +++ b/skills/implementing-gcp-organization-policy-constraints/SKILL.md @@ -1,8 +1,6 @@ --- name: implementing-gcp-organization-policy-constraints -description: Implement GCP Organization Policy constraints to enforce security guardrails - across the entire resource hierarchy, restricting risky configurations and ensuring - compliance at organization, folder, and project levels. +description: Implements GCP Organization Policy constraints via gcloud and Terraform, such as restricting external IPs, resource locations, default service accounts, and service account keys, plus dry-run testing of policy impact before enforcement. Use when enforcing security guardrails across an org's resource hierarchy, or hardening GCP config at the org, folder, or project level. domain: cybersecurity subdomain: cloud-security tags: diff --git a/skills/implementing-gcp-vpc-firewall-rules/SKILL.md b/skills/implementing-gcp-vpc-firewall-rules/SKILL.md index 710727fe..0075c4ca 100644 --- a/skills/implementing-gcp-vpc-firewall-rules/SKILL.md +++ b/skills/implementing-gcp-vpc-firewall-rules/SKILL.md @@ -1,11 +1,6 @@ --- name: implementing-gcp-vpc-firewall-rules -description: 'Implementing and auditing GCP VPC firewall rules to enforce network - segmentation, restrict ingress and egress traffic, apply hierarchical firewall policies - across the organization, and monitor firewall rule effectiveness using VPC Flow - Logs. - - ' +description: Implements and audits GCP VPC firewall rules using gcloud, covering auditing overly permissive rules, creating restrictive ingress/egress rules, hierarchical firewall policies, and monitoring rule effectiveness with VPC Flow Logs. Use when deploying GCP workloads needing network access controls, auditing firewall configs, or responding to Security Command Center findings; not for Cloud Armor or DNS-based filtering. domain: cybersecurity subdomain: cloud-security tags: diff --git a/skills/implementing-gdpr-data-protection-controls/SKILL.md b/skills/implementing-gdpr-data-protection-controls/SKILL.md index f3bb04c3..38806f2a 100644 --- a/skills/implementing-gdpr-data-protection-controls/SKILL.md +++ b/skills/implementing-gdpr-data-protection-controls/SKILL.md @@ -1,8 +1,6 @@ --- name: implementing-gdpr-data-protection-controls -description: The General Data Protection Regulation (EU) 2016/679 (GDPR) is the EU's - comprehensive data protection law governing the collection, processing, storage, - and transfer of personal data. This skill cover +description: Implements GDPR (EU 2016/679) technical and organizational measures — privacy by design/default, DPIAs, data subject rights management, 72-hour breach notification, and cross-border transfer mechanisms (SCCs, BCRs, adequacy). Use when designing or auditing GDPR controls, building a DPIA, handling data subject access/erasure requests, or assessing cross-border data transfers. domain: cybersecurity subdomain: compliance-governance tags: diff --git a/skills/implementing-github-advanced-security-for-code-scanning/SKILL.md b/skills/implementing-github-advanced-security-for-code-scanning/SKILL.md index bc984501..c5708fb4 100644 --- a/skills/implementing-github-advanced-security-for-code-scanning/SKILL.md +++ b/skills/implementing-github-advanced-security-for-code-scanning/SKILL.md @@ -1,7 +1,6 @@ --- name: implementing-github-advanced-security-for-code-scanning -description: Configure GitHub Advanced Security with CodeQL to perform automated static - analysis and vulnerability detection across repositories at enterprise scale. +description: Configures GitHub Advanced Security (code scanning with CodeQL, secret scanning, dependency review, and Dependabot alerts) to perform automated static analysis and vulnerability detection across repositories at enterprise scale, including custom CodeQL queries and CI workflow integration. Use when setting up or tuning code scanning, rolling out CodeQL across an organization, or shifting SAST left into pull request workflows. domain: cybersecurity subdomain: devsecops tags: diff --git a/skills/implementing-google-workspace-admin-security/SKILL.md b/skills/implementing-google-workspace-admin-security/SKILL.md index ce9a0182..828e15e4 100644 --- a/skills/implementing-google-workspace-admin-security/SKILL.md +++ b/skills/implementing-google-workspace-admin-security/SKILL.md @@ -1,10 +1,10 @@ --- name: implementing-google-workspace-admin-security -description: 'Implements comprehensive Google Workspace security hardening including - admin console configuration, phishing-resistant MFA enforcement, DLP policies, email - authentication (SPF/DKIM/DMARC), OAuth app control, and external sharing restrictions. - Activates for requests involving Google Workspace hardening, G Suite security configuration, - or cloud office security administration. +description: 'Hardens a Google Workspace tenant via Admin Console configuration: + phishing-resistant MFA enforcement, DLP policies, email authentication (SPF/DKIM/DMARC), + OAuth third-party app control, and external sharing restrictions. Use when hardening + a Google Workspace or G Suite tenant, enforcing MFA and OAuth app controls, or + configuring cloud office security administration. ' domain: cybersecurity diff --git a/skills/implementing-google-workspace-phishing-protection/SKILL.md b/skills/implementing-google-workspace-phishing-protection/SKILL.md index 8e8032a6..a745e02d 100644 --- a/skills/implementing-google-workspace-phishing-protection/SKILL.md +++ b/skills/implementing-google-workspace-phishing-protection/SKILL.md @@ -1,8 +1,6 @@ --- name: implementing-google-workspace-phishing-protection -description: Configure Google Workspace advanced phishing and malware protection settings - including pre-delivery scanning, attachment protection, spoofing detection, and - Enhanced Safe Browsing. +description: Configures Google Workspace advanced phishing and malware protection settings in the Admin Console — pre-delivery message scanning, attachment protection, spoofing/impersonation detection, and Enhanced Safe Browsing enforcement. Use when hardening Gmail against phishing, spoofing, and malware, or when tuning Workspace email security policies. domain: cybersecurity subdomain: phishing-defense tags: diff --git a/skills/implementing-google-workspace-sso-configuration/SKILL.md b/skills/implementing-google-workspace-sso-configuration/SKILL.md index fb2aea2c..ba8b94db 100644 --- a/skills/implementing-google-workspace-sso-configuration/SKILL.md +++ b/skills/implementing-google-workspace-sso-configuration/SKILL.md @@ -1,8 +1,10 @@ --- name: implementing-google-workspace-sso-configuration -description: Configure SAML 2.0 single sign-on for Google Workspace with a third-party - identity provider, enabling centralized authentication and enforcing organization-wide - access policies. +description: Configures SAML 2.0 single sign-on for Google Workspace against a third-party + identity provider (Okta, Azure AD/Entra ID, ADFS), with Workspace as the Service + Provider, to centralize authentication and enable immediate access revocation. + Use when setting up or troubleshooting Google Workspace SSO/SAML federation or + migrating from native Google passwords to an external IdP. domain: cybersecurity subdomain: identity-access-management tags: diff --git a/skills/implementing-hardware-security-key-authentication/SKILL.md b/skills/implementing-hardware-security-key-authentication/SKILL.md index 16e8e23d..58b24b9b 100644 --- a/skills/implementing-hardware-security-key-authentication/SKILL.md +++ b/skills/implementing-hardware-security-key-authentication/SKILL.md @@ -1,12 +1,11 @@ --- name: implementing-hardware-security-key-authentication -description: 'Implements FIDO2/WebAuthn hardware security key authentication including - registration ceremonies, authentication flows, YubiKey enrollment, and passkey migration - strategies. Builds a complete relying party server using the python-fido2 library - that supports cross-platform authenticators, resident key (discoverable credential) - workflows, and user verification policies. Activates for requests involving FIDO2 - implementation, WebAuthn registration, hardware security key enrollment, YubiKey - integration, or passkey migration from password-based authentication. +description: 'Builds a FIDO2/WebAuthn relying party server with the python-fido2 + library, covering registration and authentication ceremonies, YubiKey enrollment, + resident key (discoverable credential/passkey) workflows, and user verification + policies. Use when implementing phishing-resistant MFA with hardware security keys, + building a WebAuthn relying party, enrolling YubiKeys for a workforce, or migrating + password-based authentication to passkeys. ' domain: cybersecurity diff --git a/skills/implementing-hashicorp-vault-dynamic-secrets/SKILL.md b/skills/implementing-hashicorp-vault-dynamic-secrets/SKILL.md index ac0b979b..e6811474 100644 --- a/skills/implementing-hashicorp-vault-dynamic-secrets/SKILL.md +++ b/skills/implementing-hashicorp-vault-dynamic-secrets/SKILL.md @@ -1,10 +1,11 @@ --- name: implementing-hashicorp-vault-dynamic-secrets -description: 'Implements HashiCorp Vault dynamic secrets engines for database credentials, - AWS IAM keys, and PKI certificates with automatic generation, lease management, - and credential rotation to eliminate static secrets in application configurations. - Activates for requests involving Vault secrets engine configuration, dynamic database - credentials, ephemeral cloud credentials, or automated secret rotation. +description: 'Configures HashiCorp Vault dynamic secrets engines for database credentials, + AWS IAM keys, and PKI certificates, with automatic generation, lease management, + and rotation to eliminate static secrets in application configuration. Use when + eliminating long-lived static credentials, configuring a Vault secrets engine, + generating ephemeral database or cloud credentials, or automating credential rotation + for compliance (PCI-DSS, NIST 800-53 IA-5). ' domain: cybersecurity diff --git a/skills/implementing-ics-firewall-with-tofino/SKILL.md b/skills/implementing-ics-firewall-with-tofino/SKILL.md index e97affb3..a05d7da2 100644 --- a/skills/implementing-ics-firewall-with-tofino/SKILL.md +++ b/skills/implementing-ics-firewall-with-tofino/SKILL.md @@ -1,9 +1,11 @@ --- name: implementing-ics-firewall-with-tofino -description: 'Deploy and configure Tofino industrial firewalls from Belden/Hirschmann - to protect SCADA systems and PLCs using deep packet inspection for OT protocols - including Modbus, EtherNet/IP, OPC, and S7comm, enforcing granular access control - between ICS security zones. +description: 'Deploys and configures Tofino industrial firewalls (Belden/Hirschmann) + to protect SCADA systems and PLCs, using deep packet inspection of OT protocols + (Modbus, EtherNet/IP, OPC, S7comm) to enforce access control between ICS zones. + Use when deploying zone-level firewall protection in front of PLCs/RTUs, enforcing + IEC 62443 zone/conduit boundaries, or adding compensating controls for unpatchable + legacy PLCs. ' domain: cybersecurity diff --git a/skills/implementing-identity-governance-with-sailpoint/SKILL.md b/skills/implementing-identity-governance-with-sailpoint/SKILL.md index 3f55a1f5..e7b90586 100644 --- a/skills/implementing-identity-governance-with-sailpoint/SKILL.md +++ b/skills/implementing-identity-governance-with-sailpoint/SKILL.md @@ -1,8 +1,11 @@ --- name: implementing-identity-governance-with-sailpoint -description: Deploy SailPoint IdentityNow or IdentityIQ for identity governance and - administration. Covers identity lifecycle management, access request workflows, - certification campaigns, role mining, SOD policy +description: Deploys SailPoint IdentityNow or IdentityIQ for identity governance and + administration, covering identity lifecycle management, access request workflows, + certification campaigns, role mining, separation-of-duties (SOD) policy enforcement, + and compliance reporting. Use when standing up or tuning an identity governance + program, automating access certifications, or enforcing SOD policies across + enterprise IAM. domain: cybersecurity subdomain: identity-access-management tags: diff --git a/skills/implementing-identity-verification-for-zero-trust/SKILL.md b/skills/implementing-identity-verification-for-zero-trust/SKILL.md index 48db5f68..c57cf18a 100644 --- a/skills/implementing-identity-verification-for-zero-trust/SKILL.md +++ b/skills/implementing-identity-verification-for-zero-trust/SKILL.md @@ -1,8 +1,11 @@ --- name: implementing-identity-verification-for-zero-trust -description: Implement continuous identity verification for zero trust using phishing-resistant - MFA (FIDO2/WebAuthn), risk-based conditional access, and identity governance aligned - with the CISA Zero Trust Maturity Model. +description: Implements continuous, risk-adaptive identity verification for zero trust + using phishing-resistant MFA (FIDO2/WebAuthn), risk-based conditional access, and + identity governance aligned with NIST SP 800-207 and the CISA Zero Trust Maturity + Model Identity Pillar. Use when designing zero trust identity controls, deploying + phishing-resistant MFA, or building conditional access policies based on device + posture, behavior, and location. domain: cybersecurity subdomain: zero-trust-architecture tags: diff --git a/skills/implementing-iec-62443-security-zones/SKILL.md b/skills/implementing-iec-62443-security-zones/SKILL.md index 9f8903e5..4e83ea1f 100644 --- a/skills/implementing-iec-62443-security-zones/SKILL.md +++ b/skills/implementing-iec-62443-security-zones/SKILL.md @@ -1,11 +1,11 @@ --- name: implementing-iec-62443-security-zones -description: 'This skill covers designing and implementing security zones and conduits - for industrial automation and control systems (IACS) per IEC 62443-3-2. It addresses - zone partitioning based on risk assessment, assigning Security Level targets (SL-T), - designing conduit security controls, implementing microsegmentation with industrial - firewalls, and validating zone architecture through traffic analysis and penetration - testing against the Purdue Reference Model. +description: 'Designs security zones and conduits for industrial control systems + (IACS) per IEC 62443-3-2 — risk-based zone partitioning, Security Level target + (SL-T) assignment, conduit controls, and firewall microsegmentation validated + against the Purdue Reference Model. Use when designing OT network zones for a + new facility, retrofitting zones into a flat OT network, or upgrading VLAN-only + segmentation for IEC 62443-3-2 compliance. ' domain: cybersecurity diff --git a/skills/implementing-image-provenance-verification-with-cosign/SKILL.md b/skills/implementing-image-provenance-verification-with-cosign/SKILL.md index 3f1046d4..9ca04e7c 100644 --- a/skills/implementing-image-provenance-verification-with-cosign/SKILL.md +++ b/skills/implementing-image-provenance-verification-with-cosign/SKILL.md @@ -1,7 +1,11 @@ --- name: implementing-image-provenance-verification-with-cosign -description: Sign and verify container image provenance using Sigstore Cosign with - keyless OIDC-based signing, attestations, and Kubernetes admission enforcement. +description: Signs and verifies container image provenance using Sigstore Cosign, + covering key-based and keyless OIDC-based signing (Fulcio, Rekor transparency log), + SLSA attestations, and enforcing signature verification via Kubernetes admission + control. Use when signing container images for supply chain security, setting + up keyless OIDC signing, attaching attestations, or enforcing verified-image-only + policies at admission in a Kubernetes cluster. domain: cybersecurity subdomain: container-security tags: diff --git a/skills/implementing-immutable-backup-with-restic/SKILL.md b/skills/implementing-immutable-backup-with-restic/SKILL.md index a5a3ca7e..5b9f6aa6 100644 --- a/skills/implementing-immutable-backup-with-restic/SKILL.md +++ b/skills/implementing-immutable-backup-with-restic/SKILL.md @@ -1,11 +1,10 @@ --- name: implementing-immutable-backup-with-restic -description: 'Implements immutable backup strategy using restic with S3-compatible - storage and object lock for ransomware-resistant data protection. Automates backup - creation, integrity verification via restic check --read-data, snapshot retention - policy enforcement, and restore testing. Integrates with AWS S3 Object Lock, MinIO, - and Backblaze B2 for WORM (Write Once Read Many) storage that prevents backup deletion - or encryption by ransomware actors. +description: 'Implements ransomware-resistant backups using restic with S3-compatible + Object Lock (AWS S3, MinIO, Backblaze B2), automating backup creation, integrity + checks via restic check --read-data, retention enforcement, and restore testing. + Use when building immutable backup infrastructure, adding a WORM copy to a + 3-2-1-1-0 strategy, or automating scheduled backup-verification workflows. ' domain: cybersecurity diff --git a/skills/implementing-infrastructure-as-code-security-scanning/SKILL.md b/skills/implementing-infrastructure-as-code-security-scanning/SKILL.md index 06837d35..f1b0b97d 100644 --- a/skills/implementing-infrastructure-as-code-security-scanning/SKILL.md +++ b/skills/implementing-infrastructure-as-code-security-scanning/SKILL.md @@ -1,10 +1,10 @@ --- name: implementing-infrastructure-as-code-security-scanning -description: 'This skill covers implementing automated security scanning for Infrastructure - as Code (IaC) templates using tools like Checkov, tfsec, and KICS. It addresses - detecting misconfigurations in Terraform, CloudFormation, Kubernetes manifests, - and Helm charts before deployment, establishing policy-based governance, and integrating - IaC scanning into CI/CD pipelines to prevent insecure cloud resource provisioning. +description: 'Implements automated security scanning for Infrastructure as Code using + Checkov, tfsec, and KICS to detect misconfigurations in Terraform, CloudFormation, + Kubernetes manifests, and Helm charts, plus policy-based governance and CI/CD + integration. Use when validating cloud infrastructure before deployment or blocking + insecure changes (public S3 buckets, open security groups) in pull requests. ' domain: cybersecurity diff --git a/skills/implementing-iso-27001-information-security-management/SKILL.md b/skills/implementing-iso-27001-information-security-management/SKILL.md index 3e271f95..aae159df 100644 --- a/skills/implementing-iso-27001-information-security-management/SKILL.md +++ b/skills/implementing-iso-27001-information-security-management/SKILL.md @@ -1,8 +1,12 @@ --- name: implementing-iso-27001-information-security-management -description: ISO/IEC 27001:2022 is the international standard for establishing, implementing, - maintaining, and continually improving an Information Security Management System - (ISMS). This skill covers the complete +description: >- + Guides implementation of an ISO/IEC 27001:2022 Information Security Management + System (ISMS) end to end: gap analysis and scoping, risk assessment methodology, + Annex A control selection, Statement of Applicability (SoA) creation, and + continuous improvement. Use when scoping a new ISMS, preparing for ISO 27001 + certification or audit, or selecting and documenting Annex A controls for a + compliance program. domain: cybersecurity subdomain: compliance-governance tags: diff --git a/skills/implementing-just-in-time-access-provisioning/SKILL.md b/skills/implementing-just-in-time-access-provisioning/SKILL.md index a96f1e96..a0e4d5da 100644 --- a/skills/implementing-just-in-time-access-provisioning/SKILL.md +++ b/skills/implementing-just-in-time-access-provisioning/SKILL.md @@ -1,8 +1,11 @@ --- name: implementing-just-in-time-access-provisioning -description: Implement Just-In-Time (JIT) access provisioning to eliminate standing - privileges by granting temporary, time-bound access only when needed. This skill - covers JIT architecture design, approval workflo +description: >- + Implements Just-In-Time (JIT) access provisioning to eliminate standing + privileges by granting temporary, time-bound access, covering approval + workflows, automatic expiration/revocation, and PAM/IGA integration. Use when + designing access approval workflows or replacing standing privileged accounts + with time-bound, zero-trust-aligned grants. domain: cybersecurity subdomain: identity-access-management tags: diff --git a/skills/implementing-jwt-signing-and-verification/SKILL.md b/skills/implementing-jwt-signing-and-verification/SKILL.md index ccba0440..2f06db3d 100644 --- a/skills/implementing-jwt-signing-and-verification/SKILL.md +++ b/skills/implementing-jwt-signing-and-verification/SKILL.md @@ -1,8 +1,11 @@ --- name: implementing-jwt-signing-and-verification -description: JSON Web Tokens (JWT) defined in RFC 7519 are compact, URL-safe tokens - used for authentication and authorization in web applications. This skill covers - implementing secure JWT signing with HMAC-SHA256 +description: >- + Implements secure JWT (RFC 7519) signing and verification using HMAC-SHA256, + RSA-PSS, ES256, and EdDSA, including token expiration, claims validation, and + defenses against algorithm-confusion, none-algorithm, and key-injection + attacks. Use when adding or hardening JWT-based authentication/authorization, + or when auditing token verification code for common JWT vulnerabilities. domain: cybersecurity subdomain: cryptography tags: diff --git a/skills/implementing-kubernetes-network-policy-with-calico/SKILL.md b/skills/implementing-kubernetes-network-policy-with-calico/SKILL.md index 35e4b3f1..7977315d 100644 --- a/skills/implementing-kubernetes-network-policy-with-calico/SKILL.md +++ b/skills/implementing-kubernetes-network-policy-with-calico/SKILL.md @@ -1,7 +1,12 @@ --- name: implementing-kubernetes-network-policy-with-calico -description: Implement Kubernetes network segmentation using Calico NetworkPolicy - and GlobalNetworkPolicy for zero-trust pod-to-pod communication. +description: >- + Implements Kubernetes network segmentation using Calico's Kubernetes + NetworkPolicy and GlobalNetworkPolicy resources, including default-deny rules, + policy ordering, and service-account-based selectors for zero-trust + pod-to-pod communication. Use when installing Calico CNI and writing or + auditing network policies to restrict east-west traffic within a Kubernetes + cluster. domain: cybersecurity subdomain: container-security tags: diff --git a/skills/implementing-kubernetes-pod-security-standards/SKILL.md b/skills/implementing-kubernetes-pod-security-standards/SKILL.md index be3fee9b..a7820196 100644 --- a/skills/implementing-kubernetes-pod-security-standards/SKILL.md +++ b/skills/implementing-kubernetes-pod-security-standards/SKILL.md @@ -1,8 +1,12 @@ --- name: implementing-kubernetes-pod-security-standards -description: Pod Security Standards (PSS) define three levels of security policies - -- Privileged, Baseline, and Restricted -- enforced by the Pod Security Admission - (PSA) controller built into Kubernetes 1.25+. PS +description: >- + Configures Kubernetes Pod Security Standards (Privileged, Baseline, Restricted) + enforced via the built-in Pod Security Admission (PSA) controller (Kubernetes + 1.25+), including namespace labeling and enforce/audit/warn modes. Use when + hardening pod configurations against privilege escalation, migrating off + deprecated PodSecurityPolicy, or setting namespace-level pod security + enforcement. domain: cybersecurity subdomain: container-security tags: diff --git a/skills/implementing-llm-guardrails-for-security/SKILL.md b/skills/implementing-llm-guardrails-for-security/SKILL.md index 6503c603..d756eb8f 100644 --- a/skills/implementing-llm-guardrails-for-security/SKILL.md +++ b/skills/implementing-llm-guardrails-for-security/SKILL.md @@ -1,15 +1,11 @@ --- name: implementing-llm-guardrails-for-security -description: 'Implements input and output validation guardrails for LLM-powered applications - to prevent prompt injection, data leakage, toxic content generation, and hallucinated - outputs. Builds a security validation pipeline using NVIDIA NeMo Guardrails Colang - definitions, custom Python validators for PII detection and content policy enforcement, - and the Guardrails AI framework for structured output validation. The guardrails - system intercepts both user inputs (blocking injection attempts, stripping PII, - enforcing topic boundaries) and model outputs (detecting hallucinations, filtering - toxic content, validating JSON schema compliance). Activates for requests involving - LLM output validation, AI content filtering, guardrail implementation, or LLM safety - enforcement. +description: 'Implements input/output validation guardrails for LLM applications using + NVIDIA NeMo Guardrails (Colang), custom Python validators for PII detection, and + the Guardrails AI framework, intercepting user inputs (prompt injection, PII, + off-topic queries) and model outputs (hallucinations, toxic content, schema + compliance). Use when adding safety controls to an LLM app/chatbot/RAG pipeline + or validating outputs conform to expected schemas. ' domain: cybersecurity diff --git a/skills/implementing-log-forwarding-with-fluentd/SKILL.md b/skills/implementing-log-forwarding-with-fluentd/SKILL.md index 1d7b0c17..fb30efb0 100644 --- a/skills/implementing-log-forwarding-with-fluentd/SKILL.md +++ b/skills/implementing-log-forwarding-with-fluentd/SKILL.md @@ -1,7 +1,12 @@ --- name: implementing-log-forwarding-with-fluentd -description: Configure Fluentd and Fluent Bit for centralized log aggregation, routing, - filtering, and enrichment across distributed infrastructure +description: >- + Configures Fluent Bit as an endpoint log forwarder and Fluentd as the central + aggregator for centralized log collection, routing, filtering, and enrichment, + covering input plugins for syslog/file-tailing/application logs and output + routing to Elasticsearch, S3, and Splunk. Use when setting up centralized log + aggregation across distributed infrastructure or generating Fluent Bit/Fluentd + configuration files for a new log pipeline. domain: cybersecurity subdomain: security-operations tags: diff --git a/skills/implementing-log-integrity-with-blockchain/SKILL.md b/skills/implementing-log-integrity-with-blockchain/SKILL.md index e44a2eec..42a4460c 100644 --- a/skills/implementing-log-integrity-with-blockchain/SKILL.md +++ b/skills/implementing-log-integrity-with-blockchain/SKILL.md @@ -1,10 +1,12 @@ --- name: implementing-log-integrity-with-blockchain -description: Build an append-only log integrity chain using SHA-256 hash chaining - for tamper detection. Each log entry is hashed with the previous entry's hash to - create a blockchain-like structure where modifying any entry invalidates all subsequent - hashes. Implements log ingestion, chain verification, tamper detection with pinpoint - identification, and periodic checkpoint anchoring to external timestamping services. +description: >- + Builds an append-only log integrity chain using SHA-256 hash chaining, where + each entry incorporates the previous entry's hash so tampering invalidates all + subsequent hashes; covers log ingestion (syslog/JSON/plain text), chain + verification, pinpoint tamper detection, and checkpoint anchoring to external + timestamping services. Use for tamper-evident log storage for compliance or + forensics, or to verify whether log entries were altered. domain: cybersecurity subdomain: security-operations tags: diff --git a/skills/implementing-microsegmentation-with-guardicore/SKILL.md b/skills/implementing-microsegmentation-with-guardicore/SKILL.md index 40e438c1..b71ec394 100644 --- a/skills/implementing-microsegmentation-with-guardicore/SKILL.md +++ b/skills/implementing-microsegmentation-with-guardicore/SKILL.md @@ -1,9 +1,10 @@ --- name: implementing-microsegmentation-with-guardicore -description: 'Implementing microsegmentation using Akamai Guardicore Segmentation - to map application dependencies, create granular network policies, visualize east-west - traffic flows, and enforce least-privilege communication between workloads across - data centers and cloud. +description: 'Implements microsegmentation with Akamai Guardicore Segmentation to map + application dependencies, visualize east-west traffic flows, and create granular, + least-privilege network policies across VMs, containers, bare metal, and cloud. + Use when blocking lateral movement in a data center or when PCI DSS/HIPAA + compliance requires validated network segmentation. ' domain: cybersecurity diff --git a/skills/implementing-mimecast-targeted-attack-protection/SKILL.md b/skills/implementing-mimecast-targeted-attack-protection/SKILL.md index a77f8978..a9abfbf7 100644 --- a/skills/implementing-mimecast-targeted-attack-protection/SKILL.md +++ b/skills/implementing-mimecast-targeted-attack-protection/SKILL.md @@ -1,8 +1,12 @@ --- name: implementing-mimecast-targeted-attack-protection -description: Deploy Mimecast Targeted Threat Protection including URL Protect, Attachment - Protect, Impersonation Protect, and Internal Email Protect to defend against advanced - phishing and spearphishing attacks. +description: >- + Deploys and configures Mimecast Targeted Threat Protection (TTP) modules -- + URL Protect (click-time URL rewriting/analysis), Attachment Protect (sandbox + detonation), Impersonation Protect (BEC/whaling detection), and Internal Email + Protect -- for Microsoft 365 or Google Workspace. Use when defending against + phishing, spearphishing, or business email compromise, or configuring TTP + policies in the Mimecast Administration Console. domain: cybersecurity subdomain: phishing-defense tags: diff --git a/skills/implementing-nerc-cip-compliance-controls/SKILL.md b/skills/implementing-nerc-cip-compliance-controls/SKILL.md index 7ac34e1b..d84f0fef 100644 --- a/skills/implementing-nerc-cip-compliance-controls/SKILL.md +++ b/skills/implementing-nerc-cip-compliance-controls/SKILL.md @@ -1,11 +1,11 @@ --- name: implementing-nerc-cip-compliance-controls -description: 'This skill covers implementing North American Electric Reliability Corporation - Critical Infrastructure Protection (NERC CIP) compliance controls for Bulk Electric - System (BES) cyber systems. It addresses asset categorization (CIP-002), electronic - security perimeters (CIP-005), system security management (CIP-007), configuration - management (CIP-010), supply chain risk management (CIP-013), and the 2025 updates - including mandatory MFA for remote access and expanded low-impact asset requirements. +description: 'Implements NERC CIP controls for Bulk Electric System (BES) cyber systems: asset + categorization (CIP-002), electronic security perimeters (CIP-005), system security + management (CIP-007), configuration management (CIP-010), and supply chain risk + (CIP-013), including 2025 MFA updates. Use when a registered entity must achieve + or maintain NERC CIP compliance, prepare for a Regional Entity audit, or categorize + newly commissioned BES cyber systems. ' domain: cybersecurity diff --git a/skills/implementing-network-access-control-with-cisco-ise/SKILL.md b/skills/implementing-network-access-control-with-cisco-ise/SKILL.md index a2abf039..d89202de 100644 --- a/skills/implementing-network-access-control-with-cisco-ise/SKILL.md +++ b/skills/implementing-network-access-control-with-cisco-ise/SKILL.md @@ -1,8 +1,11 @@ --- name: implementing-network-access-control-with-cisco-ise -description: Deploy Cisco Identity Services Engine for 802.1X wired and wireless authentication, - MAC Authentication Bypass, posture assessment, and dynamic VLAN assignment for network - access control. +description: Deploys Cisco Identity Services Engine (ISE) as a RADIUS policy server for 802.1X + wired and wireless authentication, MAC Authentication Bypass, posture assessment, + dynamic VLAN assignment, downloadable ACLs, and TrustSec Security Group Tags. Use + when deploying enterprise NAC with ISE and Active Directory integration, enforcing + endpoint posture compliance, or segmenting access with TrustSec instead of a + generic 802.1X/PacketFence setup. domain: cybersecurity subdomain: network-security tags: diff --git a/skills/implementing-network-access-control/SKILL.md b/skills/implementing-network-access-control/SKILL.md index ac31ea8d..c7c8ac6b 100644 --- a/skills/implementing-network-access-control/SKILL.md +++ b/skills/implementing-network-access-control/SKILL.md @@ -1,8 +1,11 @@ --- name: implementing-network-access-control description: 'Implements 802.1X port-based network access control using RADIUS authentication, - PacketFence NAC, and switch configurations to enforce identity-based access policies, - posture assessment, and automatic VLAN assignment for authorized devices. + PacketFence NAC, and switch configuration to enforce identity-based access policies, + posture assessment, and automatic VLAN assignment for authorized devices. Use when + enforcing zero-trust access at the network edge, quarantining non-compliant endpoints, + meeting PCI-DSS/HIPAA/SOC 2 access requirements, or onboarding BYOD devices with + automated provisioning. ' domain: cybersecurity diff --git a/skills/implementing-network-intrusion-prevention-with-suricata/SKILL.md b/skills/implementing-network-intrusion-prevention-with-suricata/SKILL.md index 431c0054..633d9c8b 100644 --- a/skills/implementing-network-intrusion-prevention-with-suricata/SKILL.md +++ b/skills/implementing-network-intrusion-prevention-with-suricata/SKILL.md @@ -1,8 +1,10 @@ --- name: implementing-network-intrusion-prevention-with-suricata -description: Deploy and configure Suricata as a network intrusion prevention system - with custom rules, Emerging Threats rulesets, and inline traffic inspection for - real-time threat blocking. +description: Deploys and configures Suricata as an inline network intrusion prevention system, + covering IPS mode setup (NFQueue), custom rule writing, Emerging Threats ruleset + management, performance tuning, and logging integration. Use when deploying real-time + inline traffic inspection to actively block malicious traffic, or when tuning + Suricata rules and performance for production IDS/IPS deployment. domain: cybersecurity subdomain: network-security tags: diff --git a/skills/implementing-network-policies-for-kubernetes/SKILL.md b/skills/implementing-network-policies-for-kubernetes/SKILL.md index 1127073b..978a361f 100644 --- a/skills/implementing-network-policies-for-kubernetes/SKILL.md +++ b/skills/implementing-network-policies-for-kubernetes/SKILL.md @@ -1,8 +1,10 @@ --- name: implementing-network-policies-for-kubernetes -description: Kubernetes NetworkPolicies provide pod-level network segmentation by - defining ingress and egress rules that control traffic flow between pods, namespaces, - and external endpoints. Combined with CNI plu +description: Writes Kubernetes NetworkPolicy YAML (default-deny-all, DNS egress, namespace/pod + selector rules) enforced via CNI plugins like Calico or Cilium to control ingress + and egress traffic between pods, namespaces, and external endpoints. Use when + implementing zero-trust microsegmentation inside a Kubernetes cluster to prevent + lateral movement between workloads or namespaces. domain: cybersecurity subdomain: container-security tags: diff --git a/skills/implementing-network-segmentation-for-ot/SKILL.md b/skills/implementing-network-segmentation-for-ot/SKILL.md index e28f1784..592a2aab 100644 --- a/skills/implementing-network-segmentation-for-ot/SKILL.md +++ b/skills/implementing-network-segmentation-for-ot/SKILL.md @@ -1,11 +1,10 @@ --- name: implementing-network-segmentation-for-ot -description: 'This skill covers implementing network segmentation in Operational Technology - environments using VLANs, industrial firewalls, data diodes, and software-defined - networking. It addresses the Purdue Model-based segmentation strategy, migration - from flat networks to segmented architectures without disrupting operations, configuring - OT-aware firewalls with industrial protocol deep packet inspection, and validating - segmentation effectiveness through traffic analysis. +description: 'Implements OT network segmentation using VLANs, OT-aware firewalls, data diodes, + and IEC 62443 zone/conduit architecture, with a traffic-baseline-driven design + tool for migrating flat Purdue-model networks without disrupting operations. Use + when segmenting a flat OT network into Purdue levels, deploying an IT/OT DMZ, or + isolating safety instrumented systems from basic process control systems. ' domain: cybersecurity diff --git a/skills/implementing-network-segmentation-with-firewall-zones/SKILL.md b/skills/implementing-network-segmentation-with-firewall-zones/SKILL.md index 55ad59c3..8d41a24a 100644 --- a/skills/implementing-network-segmentation-with-firewall-zones/SKILL.md +++ b/skills/implementing-network-segmentation-with-firewall-zones/SKILL.md @@ -1,8 +1,10 @@ --- name: implementing-network-segmentation-with-firewall-zones -description: Design and implement network segmentation using firewall security zones, - VLANs, ACLs, and microsegmentation policies to restrict lateral movement and enforce - least-privilege network access. +description: Designs and implements network segmentation using firewall security zones, VLANs, + inter-zone ACLs, and workload-level microsegmentation to restrict east-west lateral + movement and enforce least-privilege access. Use when architecting security zones, + writing inter-zone firewall policies, or meeting PCI DSS/HIPAA/NIST 800-53/zero-trust + segmentation requirements for dynamic or traditional network environments. domain: cybersecurity subdomain: network-security tags: diff --git a/skills/implementing-network-traffic-analysis-with-arkime/SKILL.md b/skills/implementing-network-traffic-analysis-with-arkime/SKILL.md index 587dbe1a..583f1d25 100644 --- a/skills/implementing-network-traffic-analysis-with-arkime/SKILL.md +++ b/skills/implementing-network-traffic-analysis-with-arkime/SKILL.md @@ -1,10 +1,10 @@ --- name: implementing-network-traffic-analysis-with-arkime -description: Deploy and query Arkime (formerly Moloch) for full packet capture network - traffic analysis. Uses the Arkime API v3 to search sessions, download PCAPs, analyze - connection patterns, detect beaconing behavior, and identify suspicious network - flows. Monitors DNS queries, HTTP traffic, and TLS certificate anomalies across - captured traffic. +description: Queries Arkime (formerly Moloch) full packet capture via its API to search sessions, + download PCAPs, detect C2 beaconing through connection interval/jitter stats, + spot DNS tunneling via query-length analysis, and flag known-bad TLS certificate + issuers, using the bundled scripts/agent.py. Use when investigating suspicious + network flows or doing full-packet-capture forensics against an Arkime deployment. domain: cybersecurity subdomain: network-security tags: diff --git a/skills/implementing-network-traffic-baselining/SKILL.md b/skills/implementing-network-traffic-baselining/SKILL.md index da1ad6b5..7fc5f6a7 100644 --- a/skills/implementing-network-traffic-baselining/SKILL.md +++ b/skills/implementing-network-traffic-baselining/SKILL.md @@ -1,8 +1,11 @@ --- name: implementing-network-traffic-baselining -description: Build network traffic baselines from NetFlow/IPFIX data using Python - pandas for statistical analysis, z-score anomaly detection, and hourly/daily traffic - pattern profiling +description: Builds network traffic baselines from NetFlow/IPFIX CSV or JSON exports using Python + pandas, computing hourly/daily volume distributions, per-host and protocol/port + statistics, and top-talker profiles, then flags outliers via z-score and IQR anomaly + detection. Use when a SOC analyst needs to establish normal traffic patterns and + surface deviations such as data exfiltration spikes, beaconing, or unusual port + usage from historical flow data. domain: cybersecurity subdomain: network-security tags: diff --git a/skills/implementing-next-generation-firewall-with-palo-alto/SKILL.md b/skills/implementing-next-generation-firewall-with-palo-alto/SKILL.md index 14e6d839..986a9bdc 100644 --- a/skills/implementing-next-generation-firewall-with-palo-alto/SKILL.md +++ b/skills/implementing-next-generation-firewall-with-palo-alto/SKILL.md @@ -1,8 +1,11 @@ --- name: implementing-next-generation-firewall-with-palo-alto -description: Configure and deploy Palo Alto Networks next-generation firewalls with - App-ID, User-ID, zone-based policies, SSL decryption, and threat prevention profiles - for enterprise network security. +description: Configures and deploys Palo Alto Networks next-generation firewalls end-to-end, + covering App-ID application-aware policies, User-ID identity-based enforcement, + zone-based security rules, SSL decryption for encrypted traffic visibility, and + Content-ID threat prevention profiles. Use when moving an enterprise from + port-based firewall rules to application- and identity-aware NGFW policy on + Palo Alto hardware. domain: cybersecurity subdomain: network-security tags: diff --git a/skills/implementing-opa-gatekeeper-for-policy-enforcement/SKILL.md b/skills/implementing-opa-gatekeeper-for-policy-enforcement/SKILL.md index ce9139eb..00293607 100644 --- a/skills/implementing-opa-gatekeeper-for-policy-enforcement/SKILL.md +++ b/skills/implementing-opa-gatekeeper-for-policy-enforcement/SKILL.md @@ -1,7 +1,10 @@ --- name: implementing-opa-gatekeeper-for-policy-enforcement -description: Enforce Kubernetes admission policies using OPA Gatekeeper with ConstraintTemplates, - Rego rules, and the Gatekeeper policy library. +description: Deploys OPA Gatekeeper via Helm as a Kubernetes admission controller and writes + ConstraintTemplates with Rego rules plus instantiated Constraints to validate, + mutate, or deny resource requests at admission time. Use when enforcing policy-as-code + admission control in a Kubernetes cluster (v1.24+), such as blocking non-compliant + workloads before they are scheduled. domain: cybersecurity subdomain: container-security tags: diff --git a/skills/implementing-ot-incident-response-playbook/SKILL.md b/skills/implementing-ot-incident-response-playbook/SKILL.md index 23a32313..ebc90b04 100644 --- a/skills/implementing-ot-incident-response-playbook/SKILL.md +++ b/skills/implementing-ot-incident-response-playbook/SKILL.md @@ -1,9 +1,11 @@ --- name: implementing-ot-incident-response-playbook -description: 'Develop and implement OT-specific incident response playbooks aligned - with SANS PICERL framework, IEC 62443, and NIST SP 800-82 that address unique ICS - challenges including safety-critical systems, limited downtime tolerance, and coordination - between IT SOC, OT engineering, and plant operations teams. +description: 'Develops OT-specific incident response playbooks using a SANS PICERL-based Python + engine that classifies incident severity (safety, process, access, recon) and + coordinates IT SOC, OT engineering, and plant operations, aligned with IEC 62443 + and NIST SP 800-82. Use when building ICS/SCADA incident response procedures for + the first time, preparing for OT ransomware scenarios, or aligning IR with IEC + 62443/NERC CIP reporting requirements. ' domain: cybersecurity diff --git a/skills/implementing-ot-network-traffic-analysis-with-nozomi/SKILL.md b/skills/implementing-ot-network-traffic-analysis-with-nozomi/SKILL.md index cfa0d8ce..af4f7907 100644 --- a/skills/implementing-ot-network-traffic-analysis-with-nozomi/SKILL.md +++ b/skills/implementing-ot-network-traffic-analysis-with-nozomi/SKILL.md @@ -1,9 +1,11 @@ --- name: implementing-ot-network-traffic-analysis-with-nozomi description: 'Deploy Nozomi Networks Guardian sensors for passive OT network traffic - analysis to achieve comprehensive asset visibility, real-time threat detection, - and vulnerability assessment across industrial control systems without disrupting - operations, leveraging behavioral anomaly detection and protocol-aware monitoring. + analysis, providing asset visibility, behavioral anomaly detection, protocol-aware + monitoring, and vulnerability assessment across industrial control systems without + disrupting operations. Use when deploying OT/ICS network monitoring, configuring + Guardian sensors, or building real-time threat detection for SCADA and industrial + environments. ' domain: cybersecurity diff --git a/skills/implementing-pam-for-database-access/SKILL.md b/skills/implementing-pam-for-database-access/SKILL.md index 99b4fd3c..a2b9e4d7 100644 --- a/skills/implementing-pam-for-database-access/SKILL.md +++ b/skills/implementing-pam-for-database-access/SKILL.md @@ -1,8 +1,10 @@ --- name: implementing-pam-for-database-access description: Deploy privileged access management for database systems including Oracle, - SQL Server, PostgreSQL, and MySQL. Covers session proxy configuration, credential - vaulting, query auditing, dynamic credentia + SQL Server, PostgreSQL, and MySQL, covering session proxy configuration, credential + vaulting, query auditing, dynamic credential generation, and least-privilege database + roles. Use when securing DBA access, implementing database PAM controls, or auditing + privileged database sessions. domain: cybersecurity subdomain: identity-access-management tags: diff --git a/skills/implementing-passwordless-auth-with-microsoft-entra/SKILL.md b/skills/implementing-passwordless-auth-with-microsoft-entra/SKILL.md index 03fa6eb0..1bc4869c 100644 --- a/skills/implementing-passwordless-auth-with-microsoft-entra/SKILL.md +++ b/skills/implementing-passwordless-auth-with-microsoft-entra/SKILL.md @@ -2,9 +2,9 @@ name: implementing-passwordless-auth-with-microsoft-entra description: 'Implements passwordless authentication using Microsoft Entra ID with FIDO2 security keys, Windows Hello for Business, Microsoft Authenticator passkeys, - and certificate-based authentication to eliminate password-based attacks. Activates - for requests involving passwordless deployment, FIDO2 passkey configuration, phishing-resistant - MFA, or Microsoft Entra authentication method policies. + and certificate-based authentication to eliminate password-based attacks. Use when + deploying passwordless sign-in, configuring FIDO2 passkeys, enforcing phishing-resistant + MFA, or setting Microsoft Entra authentication method policies. ' domain: cybersecurity diff --git a/skills/implementing-passwordless-authentication-with-fido2/SKILL.md b/skills/implementing-passwordless-authentication-with-fido2/SKILL.md index 80a27283..995beb15 100644 --- a/skills/implementing-passwordless-authentication-with-fido2/SKILL.md +++ b/skills/implementing-passwordless-authentication-with-fido2/SKILL.md @@ -1,8 +1,11 @@ --- name: implementing-passwordless-authentication-with-fido2 description: Deploy FIDO2/WebAuthn passwordless authentication using security keys - and platform authenticators. Covers WebAuthn API integration, FIDO2 server configuration, - passkey enrollment, biometric authentica + and platform authenticators, covering WebAuthn API integration, FIDO2 server configuration, + passkey enrollment, biometric authentication, and migration from password-based + systems aligned with NIST SP 800-63B AAL3. Use when implementing passkey login, + configuring a FIDO2/WebAuthn server, or replacing passwords with phishing-resistant + authentication. domain: cybersecurity subdomain: identity-access-management tags: diff --git a/skills/implementing-patch-management-for-ot-systems/SKILL.md b/skills/implementing-patch-management-for-ot-systems/SKILL.md index f22cef30..d9d4ee88 100644 --- a/skills/implementing-patch-management-for-ot-systems/SKILL.md +++ b/skills/implementing-patch-management-for-ot-systems/SKILL.md @@ -1,11 +1,11 @@ --- name: implementing-patch-management-for-ot-systems -description: 'This skill covers implementing a structured patch management program - for OT/ICS environments where traditional IT patching approaches can cause process - disruption or safety hazards. It addresses vendor compatibility testing, risk-based - patch prioritization, staged deployment through test environments, maintenance window - coordination, rollback procedures, and compensating controls when patches cannot - be applied due to operational constraints or vendor restrictions. +description: 'Implements a structured patch management program for OT/ICS environments + where IT-style patching can cause process disruption or safety hazards, covering + vendor compatibility testing, risk-based prioritization, staged test deployment, + maintenance window coordination, rollback procedures, and compensating controls. + Use when planning or auditing patching for SCADA, PLCs, or other industrial control + systems. ' domain: cybersecurity diff --git a/skills/implementing-pci-dss-compliance-controls/SKILL.md b/skills/implementing-pci-dss-compliance-controls/SKILL.md index b97144f8..83d87bd1 100644 --- a/skills/implementing-pci-dss-compliance-controls/SKILL.md +++ b/skills/implementing-pci-dss-compliance-controls/SKILL.md @@ -1,8 +1,11 @@ --- name: implementing-pci-dss-compliance-controls -description: PCI DSS 4.0.1 establishes 12 requirements across 6 control objectives - for organizations that store, process, or transmit cardholder data. With PCI DSS - 3.2.1 retiring April 2024 and 51 new requirements +description: Implements PCI DSS 4.0.1's 12 requirements across 6 control objectives + for organizations that store, process, or transmit cardholder data, including the + customized validation approach, enhanced authentication, and continuous monitoring + controls introduced by the 51 requirements mandatory since March 2025. Use when + scoping a cardholder data environment, building PCI DSS 4.0.1 compliance controls, + or preparing for a PCI assessment. domain: cybersecurity subdomain: compliance-governance tags: diff --git a/skills/implementing-pod-security-admission-controller/SKILL.md b/skills/implementing-pod-security-admission-controller/SKILL.md index c0b9b63a..4ba4b95e 100644 --- a/skills/implementing-pod-security-admission-controller/SKILL.md +++ b/skills/implementing-pod-security-admission-controller/SKILL.md @@ -1,7 +1,10 @@ --- name: implementing-pod-security-admission-controller -description: Implement Kubernetes Pod Security Admission to enforce baseline and restricted - security profiles at namespace level using built-in admission controller. +description: Implement Kubernetes Pod Security Admission (PSA), the built-in admission + controller stable since v1.25, to enforce Privileged, Baseline, and Restricted + Pod Security Standards at the namespace level with enforce, audit, and warn modes, + replacing the deprecated PodSecurityPolicy. Use when hardening Kubernetes namespaces, + migrating off PodSecurityPolicy, or enforcing pod-level security baselines. domain: cybersecurity subdomain: container-security tags: diff --git a/skills/implementing-policy-as-code-with-open-policy-agent/SKILL.md b/skills/implementing-policy-as-code-with-open-policy-agent/SKILL.md index 17189af5..c160c377 100644 --- a/skills/implementing-policy-as-code-with-open-policy-agent/SKILL.md +++ b/skills/implementing-policy-as-code-with-open-policy-agent/SKILL.md @@ -1,9 +1,11 @@ --- name: implementing-policy-as-code-with-open-policy-agent -description: 'This skill covers implementing Open Policy Agent (OPA) and Gatekeeper - for policy-as-code enforcement in Kubernetes and CI/CD pipelines. It addresses writing - Rego policies, deploying OPA Gatekeeper as a Kubernetes admission controller, testing - policies in development, and integrating policy evaluation into deployment pipelines. +description: 'Implements policy-as-code enforcement with Open Policy Agent (OPA) + and Gatekeeper for Kubernetes and CI/CD pipelines, covering writing Rego policies, + deploying OPA Gatekeeper as a Kubernetes admission controller, testing policies + in development, and integrating policy evaluation into deployment pipelines. Use + when writing Rego policies, deploying Gatekeeper admission control, or gating + CI/CD pipelines with policy-as-code checks. ' domain: cybersecurity diff --git a/skills/implementing-privileged-access-management-with-cyberark/SKILL.md b/skills/implementing-privileged-access-management-with-cyberark/SKILL.md index 8c7cdfbe..a321f846 100644 --- a/skills/implementing-privileged-access-management-with-cyberark/SKILL.md +++ b/skills/implementing-privileged-access-management-with-cyberark/SKILL.md @@ -1,8 +1,10 @@ --- name: implementing-privileged-access-management-with-cyberark description: Deploy CyberArk Privileged Access Management to discover, vault, rotate, - and monitor privileged credentials across enterprise infrastructure. This skill - covers vault architecture, session isolation, c + and monitor privileged credentials across enterprise infrastructure, covering + vault architecture, session isolation, credential rotation policies, and integration + with NIST 800-53 access control requirements. Use when standing up CyberArk PAM, + vaulting privileged credentials, or designing credential rotation policies. domain: cybersecurity subdomain: identity-access-management tags: diff --git a/skills/implementing-privileged-access-workstation/SKILL.md b/skills/implementing-privileged-access-workstation/SKILL.md index 448ef466..d208aae8 100644 --- a/skills/implementing-privileged-access-workstation/SKILL.md +++ b/skills/implementing-privileged-access-workstation/SKILL.md @@ -1,8 +1,11 @@ --- name: implementing-privileged-access-workstation -description: Design and implement Privileged Access Workstations (PAWs) with device - hardening, just-in-time access, and integration with CyberArk or BeyondTrust for - secure administrative operations. +description: Design and implement Privileged Access Workstations (PAWs) using the + tiered administration model, with device hardening, device compliance enforcement + via Microsoft Intune or Group Policy, just-in-time (JIT) access provisioning, and + integration with PAM platforms like CyberArk or BeyondTrust. Use when hardening + admin endpoints, designing a tiered administration model, or securing privileged + administrative operations. domain: cybersecurity subdomain: identity-and-access-management tags: diff --git a/skills/implementing-privileged-session-monitoring/SKILL.md b/skills/implementing-privileged-session-monitoring/SKILL.md index 1b7dd8d4..fc539f6a 100644 --- a/skills/implementing-privileged-session-monitoring/SKILL.md +++ b/skills/implementing-privileged-session-monitoring/SKILL.md @@ -1,12 +1,11 @@ --- name: implementing-privileged-session-monitoring -description: 'Implements privileged session monitoring and recording using Privileged - Access Management (PAM) solutions, focusing on CyberArk Privileged Session Manager - (PSM) and open-source alternatives. Covers session recording configuration, keystroke - logging, real-time monitoring, risk-based session analysis, and compliance audit - trail generation. Activates for requests involving privileged session recording, - PAM session monitoring, CyberArk PSM configuration, administrator activity monitoring, - or compliance session auditing. +description: 'Implements privileged session monitoring and recording using PAM + solutions, focusing on CyberArk Privileged Session Manager (PSM) and open-source + alternatives, covering session recording configuration, keystroke logging, real-time + monitoring, risk-based session analysis, and compliance audit trail generation. + Use when configuring CyberArk PSM, recording administrator sessions, or building + compliance audit trails for privileged access. ' domain: cybersecurity diff --git a/skills/implementing-purdue-model-network-segmentation/SKILL.md b/skills/implementing-purdue-model-network-segmentation/SKILL.md index 82e785a7..10e186ba 100644 --- a/skills/implementing-purdue-model-network-segmentation/SKILL.md +++ b/skills/implementing-purdue-model-network-segmentation/SKILL.md @@ -1,9 +1,10 @@ --- name: implementing-purdue-model-network-segmentation description: 'Implement network segmentation based on the Purdue Enterprise Reference - Architecture (PERA) model to separate industrial control system networks into hierarchical - security zones from Level 0 physical process through Level 5 enterprise, enforcing - strict traffic control between OT and IT domains. + Architecture (PERA) model, separating ICS networks into hierarchical security + zones from Level 0 physical process through Level 5 enterprise and enforcing strict + traffic control through IEC 62443-aligned DMZs between OT and IT domains. Use when + designing ICS/SCADA network zones or segmenting OT from IT networks. ' domain: cybersecurity diff --git a/skills/implementing-ransomware-backup-strategy/SKILL.md b/skills/implementing-ransomware-backup-strategy/SKILL.md index ef7036b7..525199dc 100644 --- a/skills/implementing-ransomware-backup-strategy/SKILL.md +++ b/skills/implementing-ransomware-backup-strategy/SKILL.md @@ -1,12 +1,10 @@ --- name: implementing-ransomware-backup-strategy -description: 'Designs and implements a ransomware-resilient backup strategy following - the 3-2-1-1-0 methodology (3 copies, 2 media types, 1 offsite, 1 immutable/air-gapped, - 0 errors on restore verification). Configures backup schedules aligned to RPO/RTO - requirements, implements backup credential isolation to prevent ransomware from - compromising backup infrastructure, and establishes automated restore testing. Activates - for requests involving ransomware backup planning, backup resilience, air-gapped - backup design, or backup recovery point objective configuration. +description: 'Designs a ransomware-resilient backup strategy using the 3-2-1-1-0 + methodology (3 copies, 2 media types, 1 offsite, 1 immutable/air-gapped, 0 restore + errors), configuring RPO/RTO-aligned schedules, isolating backup credentials, and + automating restore testing. Use when planning ransomware backup resilience or air-gapped/immutable + backup architecture. ' domain: cybersecurity diff --git a/skills/implementing-ransomware-kill-switch-detection/SKILL.md b/skills/implementing-ransomware-kill-switch-detection/SKILL.md index 5befb56e..61292342 100644 --- a/skills/implementing-ransomware-kill-switch-detection/SKILL.md +++ b/skills/implementing-ransomware-kill-switch-detection/SKILL.md @@ -1,11 +1,10 @@ --- name: implementing-ransomware-kill-switch-detection -description: 'Detects and exploits ransomware kill switch mechanisms including mutex-based - execution guards, domain-based kill switches, and registry-based termination checks. - Implements proactive mutex vaccination and kill switch domain monitoring to prevent - ransomware from executing. Activates for requests involving ransomware kill switch - analysis, mutex vaccination, WannaCry-style domain kill switches, or malware execution - guard detection. +description: 'Analyzes ransomware kill switch mechanisms, including mutex-based execution + guards, domain-based kill switches (e.g. WannaCry-style), and registry termination + checks, then implements mutex vaccination and kill switch domain monitoring to stop + ransomware before it runs. Use when analyzing a sample''s execution guards or deploying + vaccination/monitoring as a defensive control. ' domain: cybersecurity diff --git a/skills/implementing-rapid7-insightvm-for-scanning/SKILL.md b/skills/implementing-rapid7-insightvm-for-scanning/SKILL.md index 6c2b9d63..52b6a0ba 100644 --- a/skills/implementing-rapid7-insightvm-for-scanning/SKILL.md +++ b/skills/implementing-rapid7-insightvm-for-scanning/SKILL.md @@ -1,7 +1,10 @@ --- name: implementing-rapid7-insightvm-for-scanning -description: Deploy and configure Rapid7 InsightVM Security Console and Scan Engines - for authenticated and unauthenticated vulnerability scanning across enterprise environments. +description: Deploy and configure Rapid7 InsightVM Security Console and Scan Engines, + including scan templates, credentialed scanning, and Insight Agent integration, for + authenticated and unauthenticated vulnerability scanning across enterprise environments. + Use when standing up InsightVM infrastructure, configuring credentialed vulnerability + scans, or integrating continuous asset assessment via the Insight Agent. domain: cybersecurity subdomain: vulnerability-management tags: diff --git a/skills/implementing-rbac-hardening-for-kubernetes/SKILL.md b/skills/implementing-rbac-hardening-for-kubernetes/SKILL.md index b4dc6657..d9908688 100644 --- a/skills/implementing-rbac-hardening-for-kubernetes/SKILL.md +++ b/skills/implementing-rbac-hardening-for-kubernetes/SKILL.md @@ -1,8 +1,10 @@ --- name: implementing-rbac-hardening-for-kubernetes -description: Harden Kubernetes Role-Based Access Control by implementing least-privilege - policies, auditing role bindings, eliminating cluster-admin sprawl, and integrating - external identity providers. +description: Harden Kubernetes RBAC by implementing least-privilege Roles and ClusterRoles, + auditing RoleBindings, eliminating cluster-admin sprawl, separating service accounts, + and integrating external identity providers (OIDC). Use when reviewing or tightening + Kubernetes access control, removing excessive ClusterRoleBindings, or hardening + service-account permissions against privilege escalation and lateral movement. domain: cybersecurity subdomain: container-security tags: diff --git a/skills/implementing-rsa-key-pair-management/SKILL.md b/skills/implementing-rsa-key-pair-management/SKILL.md index 3ab165fc..b701b01e 100644 --- a/skills/implementing-rsa-key-pair-management/SKILL.md +++ b/skills/implementing-rsa-key-pair-management/SKILL.md @@ -1,8 +1,10 @@ --- name: implementing-rsa-key-pair-management -description: RSA (Rivest-Shamir-Adleman) is the most widely deployed asymmetric cryptographic - algorithm, used for digital signatures, key exchange, and encryption. This skill - covers generating, storing, rotating, +description: Generates, stores, rotates, and manages RSA key pairs following NIST + SP 800-57 guidelines, covering serialization formats (PEM, DER, PKCS#8), passphrase + protection, and key strength validation. Use when creating or rotating RSA keys + for signatures, key exchange, or encryption, or when auditing existing keys for + proper storage and NIST-compliant strength. domain: cybersecurity subdomain: cryptography tags: diff --git a/skills/implementing-runtime-security-with-tetragon/SKILL.md b/skills/implementing-runtime-security-with-tetragon/SKILL.md index fe9e41f5..2d5903d2 100644 --- a/skills/implementing-runtime-security-with-tetragon/SKILL.md +++ b/skills/implementing-runtime-security-with-tetragon/SKILL.md @@ -1,8 +1,10 @@ --- name: implementing-runtime-security-with-tetragon description: Implement eBPF-based runtime security observability and enforcement in - Kubernetes clusters using Cilium Tetragon for kernel-level threat detection and - policy enforcement. + Kubernetes clusters using Cilium Tetragon, monitoring process execution, file access, + network connections, and syscalls at the kernel level. Use when deploying Tetragon + to detect or block dangerous syscalls (ptrace, mount, unshare), enforce kernel-level + Kubernetes security policy, or add low-overhead runtime threat detection to a cluster. domain: cybersecurity subdomain: container-security tags: diff --git a/skills/implementing-saml-sso-with-okta/SKILL.md b/skills/implementing-saml-sso-with-okta/SKILL.md index aabec15f..a09bdf2a 100644 --- a/skills/implementing-saml-sso-with-okta/SKILL.md +++ b/skills/implementing-saml-sso-with-okta/SKILL.md @@ -1,8 +1,10 @@ --- name: implementing-saml-sso-with-okta -description: Implement SAML 2.0 Single Sign-On (SSO) using Okta as the Identity Provider - (IdP). This skill covers end-to-end configuration of SAML authentication flows, - attribute mapping, certificate management, a +description: Implement SAML 2.0 Single Sign-On using Okta as the Identity Provider, + covering SP-initiated and IdP-initiated flows, attribute mapping, certificate management, + SHA-256 signature enforcement, and Single Logout. Use when configuring Okta SAML SSO + for an application, hardening SAML certificate rotation and signing, or testing and + troubleshooting SAML assertion flows with a tracer tool. domain: cybersecurity subdomain: identity-access-management tags: diff --git a/skills/implementing-scim-provisioning-with-okta/SKILL.md b/skills/implementing-scim-provisioning-with-okta/SKILL.md index 91289aaa..e4753054 100644 --- a/skills/implementing-scim-provisioning-with-okta/SKILL.md +++ b/skills/implementing-scim-provisioning-with-okta/SKILL.md @@ -1,7 +1,9 @@ --- name: implementing-scim-provisioning-with-okta -description: Implement automated user provisioning and deprovisioning using SCIM 2.0 - protocol with Okta as the identity provider. +description: Implement automated user lifecycle provisioning and deprovisioning using + the SCIM 2.0 protocol with Okta as the identity provider. Use when automating account + creation, attribute sync, or deactivation across downstream applications through + Okta SCIM integration, or when troubleshooting SCIM provisioning failures. domain: cybersecurity subdomain: identity-access-management tags: diff --git a/skills/implementing-secrets-management-with-vault/SKILL.md b/skills/implementing-secrets-management-with-vault/SKILL.md index bc91e957..909e4b23 100644 --- a/skills/implementing-secrets-management-with-vault/SKILL.md +++ b/skills/implementing-secrets-management-with-vault/SKILL.md @@ -1,10 +1,11 @@ --- name: implementing-secrets-management-with-vault -description: 'This skill covers deploying HashiCorp Vault for centralized secrets - management across cloud environments, including dynamic secret generation for databases - and cloud providers, transit encryption, PKI certificate management, and Kubernetes - integration. It addresses eliminating hardcoded credentials from application code - and CI/CD pipelines by implementing short-lived, automatically rotated secrets. +description: 'Deploy HashiCorp Vault for centralized secrets management, covering dynamic + secret generation for databases and cloud providers, transit encryption, PKI certificate + management, and Kubernetes integration. Use when eliminating hardcoded credentials + from application code or CI/CD pipelines, migrating to short-lived auto-rotated + secrets, or giving Kubernetes workloads secure access to database or cloud provider + credentials. ' domain: cybersecurity diff --git a/skills/implementing-security-information-sharing-with-stix2/SKILL.md b/skills/implementing-security-information-sharing-with-stix2/SKILL.md index 9e555775..5365daf1 100644 --- a/skills/implementing-security-information-sharing-with-stix2/SKILL.md +++ b/skills/implementing-security-information-sharing-with-stix2/SKILL.md @@ -1,8 +1,10 @@ --- name: implementing-security-information-sharing-with-stix2 -description: 'Create, validate, and share STIX 2.1 threat intelligence objects using - the stix2 Python library. Covers indicators, malware, campaigns, relationships, - bundles, and TAXII 2.1 publishing. +description: 'Create, validate, and share STIX 2.1 threat intelligence objects (indicators, + malware, campaigns, relationships, bundles) using the stix2 Python library, and + publish them over TAXII 2.1. Use when building or exchanging structured threat + intelligence, modeling relationships between threat objects, or publishing/consuming + a TAXII 2.1 feed. ' domain: cybersecurity diff --git a/skills/implementing-siem-correlation-rules-for-apt/SKILL.md b/skills/implementing-siem-correlation-rules-for-apt/SKILL.md index f1a223ce..6c451683 100644 --- a/skills/implementing-siem-correlation-rules-for-apt/SKILL.md +++ b/skills/implementing-siem-correlation-rules-for-apt/SKILL.md @@ -1,10 +1,11 @@ --- name: implementing-siem-correlation-rules-for-apt -description: Write multi-event correlation rules that detect APT lateral movement - by chaining Windows authentication events, process execution telemetry, and network - connection logs across hosts. Uses Splunk SPL and Sigma rule format to correlate - Event IDs 4624, 4648, 4688, and Sysmon Events 1/3 within sliding time windows to - surface attack sequences invisible to single-event detections. +description: Write multi-event correlation rules in Splunk SPL and Sigma format that + detect APT lateral movement by chaining Windows authentication events (4624, 4648), + process execution (4688, Sysmon Event 1), and network connections (Sysmon Event 3) + across hosts within sliding time windows. Use when building SIEM correlation searches + to surface multi-stage attack sequences that single-event detections miss, such + as pass-the-hash or lateral movement chains. domain: cybersecurity subdomain: security-operations tags: diff --git a/skills/implementing-siem-use-case-tuning/SKILL.md b/skills/implementing-siem-use-case-tuning/SKILL.md index a5488c7c..926d1347 100644 --- a/skills/implementing-siem-use-case-tuning/SKILL.md +++ b/skills/implementing-siem-use-case-tuning/SKILL.md @@ -1,8 +1,11 @@ --- name: implementing-siem-use-case-tuning -description: Tune SIEM detection rules to reduce false positives by analyzing alert - volumes, creating whitelists, adjusting thresholds, and measuring detection efficacy - metrics in Splunk and Elastic +description: Tune SIEM detection rules in Splunk and Elastic to reduce false positives + by analyzing alert volumes, creating context-aware exclusion lists, adjusting + thresholds against environmental baselines, and measuring precision/recall efficacy + metrics. Use when a SOC is drowning in noisy alerts and needs to tune correlation + searches or detection rules, or when measuring and reporting alert-to-incident + conversion rates. domain: cybersecurity subdomain: security-operations tags: diff --git a/skills/implementing-sigstore-for-software-signing/SKILL.md b/skills/implementing-sigstore-for-software-signing/SKILL.md index 85d5fca8..6c7f7186 100644 --- a/skills/implementing-sigstore-for-software-signing/SKILL.md +++ b/skills/implementing-sigstore-for-software-signing/SKILL.md @@ -3,11 +3,10 @@ name: implementing-sigstore-for-software-signing description: 'Implements Sigstore-based software signing and verification using Cosign keyless signing, Rekor transparency log verification, and Fulcio certificate authority integration to establish cryptographic provenance for container images, binaries, - and software artifacts. The practitioner configures OIDC-based identity binding, - verifies signing events against the Rekor transparency log, and integrates signing - workflows into CI/CD pipelines. Activates for requests involving software supply - chain signing, keyless container signing, Sigstore deployment, or artifact provenance - verification. + and software artifacts, including OIDC-based identity binding and CI/CD pipeline + integration. Use when setting up keyless container/artifact signing, verifying + signatures against the Rekor transparency log, or deploying Sigstore in a supply-chain + security workflow. ' domain: cybersecurity diff --git a/skills/implementing-soar-playbook-for-phishing/SKILL.md b/skills/implementing-soar-playbook-for-phishing/SKILL.md index a5ee8521..58e3e23b 100644 --- a/skills/implementing-soar-playbook-for-phishing/SKILL.md +++ b/skills/implementing-soar-playbook-for-phishing/SKILL.md @@ -1,7 +1,10 @@ --- name: implementing-soar-playbook-for-phishing -description: Automate phishing incident response using Splunk SOAR REST API to create - containers, add artifacts, and trigger playbooks +description: Automates phishing incident response by calling the Splunk SOAR (Phantom) + REST API to create containers, attach artifacts (emails, URLs, attachments), and + trigger response playbooks. Use when building or wiring up a Splunk SOAR phishing + playbook, ingesting a suspected phishing report into SOAR, or automating containment + and triage for phishing incidents. domain: cybersecurity subdomain: security-operations tags: diff --git a/skills/implementing-soar-playbook-with-palo-alto-xsoar/SKILL.md b/skills/implementing-soar-playbook-with-palo-alto-xsoar/SKILL.md index 084af7f4..22ebdafe 100644 --- a/skills/implementing-soar-playbook-with-palo-alto-xsoar/SKILL.md +++ b/skills/implementing-soar-playbook-with-palo-alto-xsoar/SKILL.md @@ -1,7 +1,11 @@ --- name: implementing-soar-playbook-with-palo-alto-xsoar -description: Implement automated incident response playbooks in Cortex XSOAR to orchestrate - security workflows across SOC tools and reduce manual response time. +description: Build automated incident response playbooks in Cortex XSOAR (Demisto) + using its YAML playbook structure, integration commands, and task types to orchestrate + phishing, malware, account-compromise, and DDoS response workflows across SOC tools. + Use when authoring or wiring up an XSOAR playbook, adding custom XSOAR integration + commands or Python automation scripts, or reducing manual SOC response time via + orchestration. domain: cybersecurity subdomain: soc-operations tags: diff --git a/skills/implementing-stix-taxii-feed-integration/SKILL.md b/skills/implementing-stix-taxii-feed-integration/SKILL.md index 99e12000..1f62b249 100644 --- a/skills/implementing-stix-taxii-feed-integration/SKILL.md +++ b/skills/implementing-stix-taxii-feed-integration/SKILL.md @@ -1,8 +1,10 @@ --- name: implementing-stix-taxii-feed-integration -description: STIX (Structured Threat Information eXpression) and TAXII (Trusted Automated - eXchange of Intelligence Information) are OASIS open standards for representing - and transporting cyber threat intelligence. +description: Implements a STIX 2.1/TAXII 2.1 threat-intelligence feed consumer and + producer in Python, covering TAXII server discovery, collection polling, parsing + STIX bundles with the stix2 library, and standing up a local TAXII server with Medallion. + Use when integrating a STIX/TAXII CTI feed into a SIEM or TIP, writing a TAXII client + to poll for new indicators, or setting up TAXII collections for indicator exchange. domain: cybersecurity subdomain: threat-intelligence tags: diff --git a/skills/implementing-supply-chain-security-with-in-toto/SKILL.md b/skills/implementing-supply-chain-security-with-in-toto/SKILL.md index dea89671..4f73c3dd 100644 --- a/skills/implementing-supply-chain-security-with-in-toto/SKILL.md +++ b/skills/implementing-supply-chain-security-with-in-toto/SKILL.md @@ -1,8 +1,12 @@ --- name: implementing-supply-chain-security-with-in-toto description: Implement software supply chain integrity verification for container - builds using the in-toto framework to create cryptographically signed attestations - across CI/CD pipeline steps. + builds using the in-toto framework, covering signing-key generation, defining a + supply chain layout, recording pipeline steps as signed link metadata, verifying + before deployment, Kubernetes admission control, and SLSA integration. Use when + generating in-toto attestations for CI/CD pipeline steps, verifying that a container + image followed an approved build process, or enforcing supply chain provenance + at admission time. domain: cybersecurity subdomain: container-security tags: diff --git a/skills/implementing-syslog-centralization-with-rsyslog/SKILL.md b/skills/implementing-syslog-centralization-with-rsyslog/SKILL.md index a7230256..903ef267 100644 --- a/skills/implementing-syslog-centralization-with-rsyslog/SKILL.md +++ b/skills/implementing-syslog-centralization-with-rsyslog/SKILL.md @@ -1,9 +1,11 @@ --- name: implementing-syslog-centralization-with-rsyslog description: Configure rsyslog for centralized log collection with TLS encryption, - custom templates, and log rotation. Generates server and client configuration files - with GnuTLS stream drivers, x509 certificate authentication, per-host log segregation, - and reliable queue settings for high-availability syslog infrastructure. + custom templates, and log rotation, generating server and client configuration + files with GnuTLS stream drivers, x509 certificate authentication, per-host log + segregation, and reliable queue settings. Use when building a centralized, encrypted + syslog pipeline, hardening rsyslog client/server configs for high-availability log + infrastructure, or troubleshooting TLS-based syslog forwarding. domain: cybersecurity subdomain: security-operations tags: diff --git a/skills/implementing-taxii-server-with-opentaxii/SKILL.md b/skills/implementing-taxii-server-with-opentaxii/SKILL.md index 1a654237..7cf8b57f 100644 --- a/skills/implementing-taxii-server-with-opentaxii/SKILL.md +++ b/skills/implementing-taxii-server-with-opentaxii/SKILL.md @@ -1,8 +1,10 @@ --- name: implementing-taxii-server-with-opentaxii -description: Deploy and configure an OpenTAXII server to share and consume STIX-formatted - cyber threat intelligence using the TAXII 2.1 protocol for automated indicator exchange - between organizations. +description: Deploy and configure a TAXII 2.1 server (Medallion) with Docker, publish + and consume STIX 2.1 bundles across collections, and integrate the feed with SIEM/SOAR + platforms for automated indicator exchange between organizations. Use when standing + up a TAXII server to share threat intel, configuring collections for CTI feeds, + or automating STIX indicator ingestion into a SIEM/SOAR. domain: cybersecurity subdomain: threat-intelligence tags: diff --git a/skills/implementing-threat-intelligence-lifecycle-management/SKILL.md b/skills/implementing-threat-intelligence-lifecycle-management/SKILL.md index 92961fa0..b51eb49a 100644 --- a/skills/implementing-threat-intelligence-lifecycle-management/SKILL.md +++ b/skills/implementing-threat-intelligence-lifecycle-management/SKILL.md @@ -1,8 +1,11 @@ --- name: implementing-threat-intelligence-lifecycle-management -description: Implement a structured threat intelligence lifecycle encompassing planning, - collection, processing, analysis, dissemination, and feedback stages to produce - actionable intelligence for organizational decision-making. +description: Build out a full CTI program around the six-phase threat intelligence + lifecycle (direction, collection, processing, analysis, dissemination, feedback), + including defining intelligence requirements, building a collection pipeline, normalizing + data, and tracking dissemination feedback. Use when standing up or maturing a threat + intelligence program, defining intelligence requirements, or designing collection-to-dissemination + workflows for a CTI team. domain: cybersecurity subdomain: threat-intelligence tags: diff --git a/skills/implementing-vulnerability-management-with-greenbone/SKILL.md b/skills/implementing-vulnerability-management-with-greenbone/SKILL.md index ac6684f7..384df600 100644 --- a/skills/implementing-vulnerability-management-with-greenbone/SKILL.md +++ b/skills/implementing-vulnerability-management-with-greenbone/SKILL.md @@ -1,8 +1,11 @@ --- name: implementing-vulnerability-management-with-greenbone description: Deploy and operate Greenbone/OpenVAS vulnerability management using the - python-gvm library to create scan targets, execute vulnerability scans, and parse - scan reports via GMP protocol. + python-gvm library over the Greenbone Management Protocol (GMP) to connect via + Unix socket or TLS, create scan targets and configs, execute scans, and parse the + XML scan reports into actionable findings. Use when automating OpenVAS/GVM scan + creation and execution, or programmatically retrieving and parsing vulnerability + scan reports. domain: cybersecurity subdomain: vulnerability-management tags: diff --git a/skills/implementing-vulnerability-remediation-sla/SKILL.md b/skills/implementing-vulnerability-remediation-sla/SKILL.md index 4004a6c8..ddb89922 100644 --- a/skills/implementing-vulnerability-remediation-sla/SKILL.md +++ b/skills/implementing-vulnerability-remediation-sla/SKILL.md @@ -1,8 +1,10 @@ --- name: implementing-vulnerability-remediation-sla -description: Vulnerability remediation SLAs define mandatory timeframes for patching - or mitigating identified vulnerabilities based on severity, asset criticality, and - exploit availability. Effective SLA programs +description: Design a vulnerability remediation SLA program covering asset tiering, + a severity-based SLA matrix, exception processes, escalation chains, ticketing-system + integration, and remediation KPIs/trending metrics. Use when defining mandatory + patching timeframes by severity and asset criticality, building an SLA policy document, + or setting up escalation and KPI tracking for vulnerability remediation. domain: cybersecurity subdomain: vulnerability-management tags: diff --git a/skills/implementing-vulnerability-sla-breach-alerting/SKILL.md b/skills/implementing-vulnerability-sla-breach-alerting/SKILL.md index 9f25b71f..952fd988 100644 --- a/skills/implementing-vulnerability-sla-breach-alerting/SKILL.md +++ b/skills/implementing-vulnerability-sla-breach-alerting/SKILL.md @@ -1,7 +1,10 @@ --- name: implementing-vulnerability-sla-breach-alerting -description: Build automated alerting for vulnerability remediation SLA breaches with - severity-based timelines, escalation workflows, and compliance reporting dashboards. +description: Build an automated SLA breach alerting system for vulnerability remediation, + including a database schema for SLA tracking, breach detection logic, notification + dispatch, a scheduled check runner, and a KPI/compliance metrics dashboard. Use + when implementing severity-based SLA timelines (critical/high/medium/low), detecting + and escalating SLA breaches, or building vulnerability remediation compliance reporting. domain: cybersecurity subdomain: vulnerability-management tags: diff --git a/skills/implementing-web-application-logging-with-modsecurity/SKILL.md b/skills/implementing-web-application-logging-with-modsecurity/SKILL.md index 7ba0d2cd..18f7851f 100644 --- a/skills/implementing-web-application-logging-with-modsecurity/SKILL.md +++ b/skills/implementing-web-application-logging-with-modsecurity/SKILL.md @@ -1,13 +1,10 @@ --- name: implementing-web-application-logging-with-modsecurity -description: 'Configure ModSecurity WAF with OWASP Core Rule Set (CRS) for web application - logging, tune rules to reduce false positives, analyze audit logs for attack detection, - and implement custom SecRules for application-specific threats. The analyst configures - SecRuleEngine, SecAuditEngine, and CRS paranoia levels to balance security coverage - with operational stability. Activates for requests involving WAF configuration, - ModSecurity rule tuning, web application audit logging, or CRS deployment. - - ' +description: Configure ModSecurity WAF with the OWASP Core Rule Set (CRS) for web + application audit logging, tuning SecRuleEngine, SecAuditEngine, and CRS paranoia + levels to reduce false positives, and writing custom SecRules for application-specific + threats. Use when deploying or tuning a ModSecurity WAF, analyzing audit logs for + attack detection, or reducing CRS false positives. domain: cybersecurity subdomain: web-application-security tags: diff --git a/skills/implementing-zero-knowledge-proof-for-authentication/SKILL.md b/skills/implementing-zero-knowledge-proof-for-authentication/SKILL.md index 43096957..2dea73a1 100644 --- a/skills/implementing-zero-knowledge-proof-for-authentication/SKILL.md +++ b/skills/implementing-zero-knowledge-proof-for-authentication/SKILL.md @@ -1,8 +1,6 @@ --- name: implementing-zero-knowledge-proof-for-authentication -description: Zero-Knowledge Proofs (ZKPs) allow a prover to demonstrate knowledge - of a secret (such as a password or private key) without revealing the secret itself. - This skill implements the Schnorr identificati +description: Implements the Schnorr identification protocol and a simplified Zero-Knowledge Password Proof (ZKPP) over the discrete logarithm problem, letting a prover authenticate by demonstrating knowledge of a secret without ever revealing it to the server. Use when designing or building password-less or password-secret-free authentication, or when a server must verify a user's credential without learning or storing the underlying secret. domain: cybersecurity subdomain: cryptography tags: diff --git a/skills/implementing-zero-standing-privilege-with-cyberark/SKILL.md b/skills/implementing-zero-standing-privilege-with-cyberark/SKILL.md index 023fc088..9acabab6 100644 --- a/skills/implementing-zero-standing-privilege-with-cyberark/SKILL.md +++ b/skills/implementing-zero-standing-privilege-with-cyberark/SKILL.md @@ -1,8 +1,6 @@ --- name: implementing-zero-standing-privilege-with-cyberark -description: Deploy CyberArk Secure Cloud Access to eliminate standing privileges - in hybrid and multi-cloud environments using just-in-time access with time, entitlement, - and approval controls. +description: Deploy CyberArk Secure Cloud Access (SCA) to eliminate standing privileges in AWS, Azure, and GCP by provisioning ephemeral, scoped roles on a just-in-time basis governed by the TEA framework (Time, Entitlements, Approvals). Use when designing or implementing zero standing privilege / just-in-time privileged access models with CyberArk, or when replacing persistent cloud admin roles with time-bound, approval-gated sessions. domain: cybersecurity subdomain: identity-access-management tags: diff --git a/skills/implementing-zero-trust-dns-with-nextdns/SKILL.md b/skills/implementing-zero-trust-dns-with-nextdns/SKILL.md index 782dcaf6..43ba1b84 100644 --- a/skills/implementing-zero-trust-dns-with-nextdns/SKILL.md +++ b/skills/implementing-zero-trust-dns-with-nextdns/SKILL.md @@ -1,8 +1,6 @@ --- name: implementing-zero-trust-dns-with-nextdns -description: Implement NextDNS as a zero trust DNS filtering layer with encrypted - resolution, threat intelligence blocking, privacy protection, and organizational - policy enforcement across all endpoints. +description: Configure NextDNS as an encrypted (DoH/DoT) zero trust DNS resolver that blocks malicious, phishing, and cryptojacking domains via real-time threat intelligence, detects DNS rebinding and CNAME cloaking, and enforces organizational DNS policy across endpoints. Use when deploying DNS-layer threat blocking and acceptable-use enforcement, or when extending zero trust controls (including Windows 11 Zero Trust DNS) to the DNS resolution path. domain: cybersecurity subdomain: zero-trust-architecture tags: diff --git a/skills/implementing-zero-trust-for-saas-applications/SKILL.md b/skills/implementing-zero-trust-for-saas-applications/SKILL.md index c621fe86..6c0f2806 100644 --- a/skills/implementing-zero-trust-for-saas-applications/SKILL.md +++ b/skills/implementing-zero-trust-for-saas-applications/SKILL.md @@ -1,11 +1,6 @@ --- name: implementing-zero-trust-for-saas-applications -description: 'Implementing zero trust access controls for SaaS applications using - CASB, SSPM, conditional access policies, OAuth app governance, and session controls - to enforce identity verification, device compliance, and data protection for cloud-hosted - services. - - ' +description: Secures SaaS apps (Microsoft 365, Google Workspace, Salesforce, Slack) via CASB/SSPM deployment, conditional access policies, OAuth app governance, and session-level DLP controls enforcing identity verification and device compliance. Use when adding MFA/device-compliance conditional access, discovering shadow IT, governing OAuth consent grants, or applying session controls to sensitive SaaS data. domain: cybersecurity subdomain: zero-trust-architecture tags: diff --git a/skills/implementing-zero-trust-in-cloud/SKILL.md b/skills/implementing-zero-trust-in-cloud/SKILL.md index cfda2a7d..edb6ee51 100644 --- a/skills/implementing-zero-trust-in-cloud/SKILL.md +++ b/skills/implementing-zero-trust-in-cloud/SKILL.md @@ -1,12 +1,6 @@ --- name: implementing-zero-trust-in-cloud -description: 'This skill guides organizations through implementing zero trust architecture - in cloud environments following NIST SP 800-207 and Google BeyondCorp principles. - It covers identity-centric access controls, micro-segmentation, continuous verification, - device trust assessment, and deploying Identity-Aware Proxy to eliminate implicit - network trust in AWS, Azure, and GCP environments. - - ' +description: Guides zero trust implementation across AWS, Azure, and GCP per NIST SP 800-207 and BeyondCorp principles, covering identity-centric access, micro-segmentation, continuous verification, device trust assessment, and Identity-Aware Proxy deployment. Use when migrating from perimeter security to identity-centric access, removing VPN dependency, or designing micro-segmentation for multi-cloud workloads. domain: cybersecurity subdomain: cloud-security tags: diff --git a/skills/implementing-zero-trust-network-access-with-zscaler/SKILL.md b/skills/implementing-zero-trust-network-access-with-zscaler/SKILL.md index 057eada6..bd1c5a5b 100644 --- a/skills/implementing-zero-trust-network-access-with-zscaler/SKILL.md +++ b/skills/implementing-zero-trust-network-access-with-zscaler/SKILL.md @@ -1,8 +1,6 @@ --- name: implementing-zero-trust-network-access-with-zscaler -description: Implement Zero Trust Network Access using Zscaler Private Access (ZPA) - to replace traditional VPN with identity-based, context-aware access to private - applications through the Zscaler Zero Trust Exchange. +description: Configures Zero Trust Network Access using Zscaler Private Access (ZPA) to broker identity-based, context-aware connections between authenticated users and internal applications through the Zscaler Zero Trust Exchange, without placing users on the corporate network. Use when replacing traditional VPN architectures with ZTNA, or when brokering secure per-application access for remote and hybrid users via Zscaler. domain: cybersecurity subdomain: zero-trust-architecture tags: diff --git a/skills/implementing-zero-trust-network-access/SKILL.md b/skills/implementing-zero-trust-network-access/SKILL.md index a8816639..2f96cafa 100644 --- a/skills/implementing-zero-trust-network-access/SKILL.md +++ b/skills/implementing-zero-trust-network-access/SKILL.md @@ -1,11 +1,6 @@ --- name: implementing-zero-trust-network-access -description: 'Implementing Zero Trust Network Access (ZTNA) in cloud environments - by configuring identity-aware proxies, micro-segmentation, continuous verification - with conditional access policies, and replacing traditional VPN-based access with - BeyondCorp-style architectures across AWS, Azure, and GCP. - - ' +description: Configures Zero Trust Network Access (ZTNA) in AWS, Azure, and GCP using identity-aware proxies, micro-segmentation, and continuous verification with conditional access policies, replacing VPN-based access with BeyondCorp-style architectures. Use when replacing VPN remote access with identity-based controls, limiting lateral movement via micro-segmentation, or exposing cloud workloads to authenticated users without public internet exposure. domain: cybersecurity subdomain: cloud-security tags: diff --git a/skills/implementing-zero-trust-with-beyondcorp/SKILL.md b/skills/implementing-zero-trust-with-beyondcorp/SKILL.md index 71ac8c27..8943a385 100644 --- a/skills/implementing-zero-trust-with-beyondcorp/SKILL.md +++ b/skills/implementing-zero-trust-with-beyondcorp/SKILL.md @@ -1,9 +1,6 @@ --- name: implementing-zero-trust-with-beyondcorp -description: Deploy Google BeyondCorp Enterprise zero trust access controls using - Identity-Aware Proxy (IAP), context-aware access policies, device trust validation, - and Access Context Manager to enforce identity and posture-based access to GCP resources - and internal applications. +description: Configures Google BeyondCorp Enterprise Identity-Aware Proxy (IAP) as the access enforcement point for web applications, defining Access Context Manager access levels from device trust and network attributes, and auditing the resulting policies for compliance. Use when eliminating perimeter/VPN trust for GCP resources or internal apps, or when setting up identity- and device-posture-based access controls on Google Cloud. domain: cybersecurity subdomain: zero-trust tags: diff --git a/skills/implementing-zero-trust-with-hashicorp-boundary/SKILL.md b/skills/implementing-zero-trust-with-hashicorp-boundary/SKILL.md index 8a8887a7..c506d249 100644 --- a/skills/implementing-zero-trust-with-hashicorp-boundary/SKILL.md +++ b/skills/implementing-zero-trust-with-hashicorp-boundary/SKILL.md @@ -1,8 +1,6 @@ --- name: implementing-zero-trust-with-hashicorp-boundary -description: Implement HashiCorp Boundary for identity-aware zero trust infrastructure - access management with dynamic credential brokering, session recording, and Vault - integration. +description: Installs and configures HashiCorp Boundary as a default-deny, identity-aware proxy for infrastructure access, including controller/worker setup, Vault-backed credential brokering, session recording, and OIDC/LDAP auth across an org/project scope hierarchy. Use when replacing VPN or direct network access with just-in-time, credential-less Boundary sessions, or standing up Boundary controllers and workers. domain: cybersecurity subdomain: zero-trust-architecture tags: diff --git a/skills/integrating-dast-with-owasp-zap-in-pipeline/SKILL.md b/skills/integrating-dast-with-owasp-zap-in-pipeline/SKILL.md index f1d7d16d..d24cc100 100644 --- a/skills/integrating-dast-with-owasp-zap-in-pipeline/SKILL.md +++ b/skills/integrating-dast-with-owasp-zap-in-pipeline/SKILL.md @@ -1,12 +1,6 @@ --- name: integrating-dast-with-owasp-zap-in-pipeline -description: 'This skill covers integrating OWASP ZAP (Zed Attack Proxy) for Dynamic - Application Security Testing in CI/CD pipelines. It addresses configuring baseline, - full, and API scans against running applications, interpreting ZAP findings, tuning - scan policies, and establishing DAST quality gates in GitHub Actions and GitLab - CI. - - ' +description: Integrates OWASP ZAP (Zed Attack Proxy) into GitHub Actions and GitLab CI pipelines, covering baseline, full, and API scan configuration against running applications, ZAP finding interpretation, scan policy tuning, and DAST quality gates. Use when testing running web apps or REST/GraphQL APIs for XSS, SQLi, CSRF, and auth/authz flaws, or when SAST alone is insufficient and runtime DAST is required for compliance or release gating. domain: cybersecurity subdomain: devsecops tags: diff --git a/skills/integrating-sast-into-github-actions-pipeline/SKILL.md b/skills/integrating-sast-into-github-actions-pipeline/SKILL.md index 95f0690a..a69d125c 100644 --- a/skills/integrating-sast-into-github-actions-pipeline/SKILL.md +++ b/skills/integrating-sast-into-github-actions-pipeline/SKILL.md @@ -1,12 +1,6 @@ --- name: integrating-sast-into-github-actions-pipeline -description: 'This skill covers integrating Static Application Security Testing (SAST) - tools—CodeQL and Semgrep—into GitHub Actions CI/CD pipelines. It addresses configuring - automated code scanning on pull requests and pushes, tuning rules to reduce false - positives, uploading SARIF results to GitHub Advanced Security, and establishing - quality gates that block merges when high-severity vulnerabilities are detected. - - ' +description: Integrates CodeQL and Semgrep SAST scanning into GitHub Actions, covering scans on pull requests/pushes, rule tuning to cut false positives, SARIF upload to GitHub Advanced Security, and merge-blocking quality gates for high-severity findings. Use when adding automated code vulnerability detection to CI, enforcing consistent SAST org-wide, or producing SOC 2/PCI DSS/NIST SSDF compliance evidence. domain: cybersecurity subdomain: devsecops tags: diff --git a/skills/investigating-ransomware-attack-artifacts/SKILL.md b/skills/investigating-ransomware-attack-artifacts/SKILL.md index fe56073d..ac1951a4 100644 --- a/skills/investigating-ransomware-attack-artifacts/SKILL.md +++ b/skills/investigating-ransomware-attack-artifacts/SKILL.md @@ -1,7 +1,6 @@ --- name: investigating-ransomware-attack-artifacts -description: Identify, collect, and analyze ransomware attack artifacts to determine - the variant, initial access vector, encryption scope, and recovery options. +description: Forensically preserve memory and disk, collect ransom notes and encrypted file samples, and identify the ransomware variant using tools such as ID Ransomware, Volatility, and Chainsaw/Hayabusa to determine the initial access vector and recovery options. Use immediately after discovering ransomware encryption, when scoping the incident forensically, or when documenting evidence for law enforcement and insurance claims. domain: cybersecurity subdomain: digital-forensics tags: diff --git a/skills/managing-cloud-identity-with-okta/SKILL.md b/skills/managing-cloud-identity-with-okta/SKILL.md index 1b54e78f..1db06555 100644 --- a/skills/managing-cloud-identity-with-okta/SKILL.md +++ b/skills/managing-cloud-identity-with-okta/SKILL.md @@ -1,12 +1,11 @@ --- name: managing-cloud-identity-with-okta -description: 'This skill covers implementing Okta as a centralized identity provider - for cloud environments, configuring SSO integration with AWS, Azure, and GCP, deploying - phishing- resistant MFA with Okta FastPass, managing lifecycle automation for user - provisioning and deprovisioning, and enforcing adaptive access policies based on - device posture and risk signals. - - ' +description: >- + Implement Okta as a centralized cloud identity provider: configure SSO with AWS, + Azure, and GCP, deploy phishing-resistant MFA with Okta FastPass, automate user + provisioning/deprovisioning, and enforce adaptive access policies on device posture + and risk signals. Use when standing up Okta SSO, rolling out FastPass MFA, automating + identity lifecycle, or building risk-based conditional access for cloud environments. domain: cybersecurity subdomain: cloud-security tags: diff --git a/skills/managing-third-party-vendor-risk/SKILL.md b/skills/managing-third-party-vendor-risk/SKILL.md index 07487805..d16520b0 100644 --- a/skills/managing-third-party-vendor-risk/SKILL.md +++ b/skills/managing-third-party-vendor-risk/SKILL.md @@ -1,18 +1,12 @@ --- name: managing-third-party-vendor-risk description: >- - Build and run a third-party / vendor risk management (TPRM) program aligned to NIST - SP 800-161 C-SCRM and NIST CSF 2.0 GV.SC: inventory and tier vendors by risk, send the - right due-diligence questionnaire (SIG, CAIQ), review evidence (SOC 2, ISO 27001, - pen-test reports), set contractual security and right-to-audit clauses, monitor vendors - continuously, manage Nth-party / subcontractor risk, and offboard securely. Use when an - organization needs to assess a new vendor before onboarding, when standing up or maturing - a vendor-risk program, when tiering a vendor portfolio, when reviewing a SOC 2 or CAIQ, - when writing security requirements into a contract or DPA, when a vendor suffers a breach, - or when managing supply-chain / software supply-chain risk. Keywords: third-party risk, - vendor risk management, TPRM, supply chain risk, C-SCRM, NIST 800-161, vendor tiering, - SIG questionnaire, CAIQ, SOC 2, ISO 27001, right to audit, continuous monitoring, security - ratings, fourth-party risk, Nth-party, vendor offboarding, due diligence. + Build and run a third-party/vendor risk management (TPRM) program aligned to NIST SP + 800-161 C-SCRM: inventory and tier vendors, issue SIG/CAIQ questionnaires, review + SOC 2/ISO 27001 evidence, set contractual right-to-audit clauses, monitor vendors + continuously, and offboard securely. Use when assessing a new vendor, standing up a + vendor-risk program, tiering a portfolio, reviewing a SOC 2/CAIQ, or writing security + terms into a contract. domain: cybersecurity subdomain: compliance-governance tags: diff --git a/skills/mapping-attack-paths-with-bloodhound-ce/SKILL.md b/skills/mapping-attack-paths-with-bloodhound-ce/SKILL.md index 84166509..ad26d237 100644 --- a/skills/mapping-attack-paths-with-bloodhound-ce/SKILL.md +++ b/skills/mapping-attack-paths-with-bloodhound-ce/SKILL.md @@ -1,6 +1,6 @@ --- name: mapping-attack-paths-with-bloodhound-ce -description: Collect Active Directory data with SharpHound and Entra ID data with AzureHound, ingest into BloodHound Community Edition, and analyze on-prem, cloud, and hybrid attack paths with built-in queries and custom Cypher. +description: Collect Active Directory data with SharpHound and Entra ID data with AzureHound, ingest into BloodHound Community Edition, and analyze on-prem, cloud, and hybrid attack paths using built-in queries and custom Cypher. Use during authorized red-team or penetration-test engagements to map privilege-escalation chains toward domain/tenant compromise. domain: cybersecurity subdomain: red-teaming tags: diff --git a/skills/migrating-to-post-quantum-cryptography/SKILL.md b/skills/migrating-to-post-quantum-cryptography/SKILL.md index 8ed8b9f5..46a9f4da 100644 --- a/skills/migrating-to-post-quantum-cryptography/SKILL.md +++ b/skills/migrating-to-post-quantum-cryptography/SKILL.md @@ -1,6 +1,6 @@ --- name: migrating-to-post-quantum-cryptography -description: Inventory cryptography, deploy hybrid X25519 and ML-KEM, and prioritize harvest-now-decrypt-later data. +description: Build a cryptographic inventory/CBOM with OpenSSL 3.5+, deploy hybrid post-quantum key exchange (X25519MLKEM768) on TLS/VPN/SSH endpoints, generate ML-KEM/ML-DSA keys and PQC/hybrid certificates, and prioritize migration by harvest-now-decrypt-later (HNDL) exposure per NIST SP 1800-38. Use when inventorying enterprise cryptography for quantum-readiness, enabling hybrid PQC key exchange, or issuing and verifying PQC/hybrid certificates. domain: cybersecurity subdomain: cryptography tags: diff --git a/skills/modeling-threats-with-opencti/SKILL.md b/skills/modeling-threats-with-opencti/SKILL.md index 75df5ce9..711070e2 100644 --- a/skills/modeling-threats-with-opencti/SKILL.md +++ b/skills/modeling-threats-with-opencti/SKILL.md @@ -1,6 +1,6 @@ --- name: modeling-threats-with-opencti -description: Model threat actors, intrusion sets, campaigns, and TTPs as a STIX 2.1 knowledge graph in OpenCTI (Filigran) using the pycti Python client, connectors, and import workers for structured cyber threat intelligence. +description: Deploy OpenCTI (Filigran) via Docker Compose and use the pycti Python client to model threat actors, intrusion sets, campaigns, and indicators as a STIX 2.1 knowledge graph with relationships (uses, attributed-to, targets). Use when building a centralized threat-intel knowledge base, correlating IOCs from multiple feeds into one adversary graph, or producing STIX bundles for detection engineering. domain: cybersecurity subdomain: threat-intelligence tags: diff --git a/skills/moving-laterally-with-netexec/SKILL.md b/skills/moving-laterally-with-netexec/SKILL.md index 501b3b83..d37449f5 100644 --- a/skills/moving-laterally-with-netexec/SKILL.md +++ b/skills/moving-laterally-with-netexec/SKILL.md @@ -1,7 +1,6 @@ --- name: moving-laterally-with-netexec -description: Use NetExec for SMB, WinRM, LDAP, and MSSQL enumeration, password spraying, - and execution. +description: Use NetExec (nxc) to validate credentials, enumerate SMB shares/users/policy, password-spray safely across lockout thresholds, execute commands, and dump SAM/LSA/NTDS credentials across SMB, WinRM, LDAP, MSSQL, SSH, and other protocol modules. Use during authorized internal penetration tests to find lateral-movement paths after obtaining credentials or hashes, or to conduct controlled password spraying and post-exploitation on in-scope hosts. domain: cybersecurity subdomain: penetration-testing tags: diff --git a/skills/operating-havoc-c2/SKILL.md b/skills/operating-havoc-c2/SKILL.md index f449f467..1d643125 100644 --- a/skills/operating-havoc-c2/SKILL.md +++ b/skills/operating-havoc-c2/SKILL.md @@ -1,6 +1,6 @@ --- name: operating-havoc-c2 -description: Deploy a Havoc team server with Yaotl profiles, generate evasive Demon agents with indirect syscalls and sleep obfuscation, and run post-exploitation and pivoting for adversary emulation. +description: Deploy a Havoc C2 team server with Yaotl malleable profiles, generate evasive Demon agents using indirect syscalls and sleep obfuscation, and run post-exploitation and pivoting operations. Use during authorized, rules-of-engagement-bound red-team engagements for adversary emulation requiring a full C2 lifecycle (server setup, evasive implant generation, tasking, and lateral pivoting). domain: cybersecurity subdomain: red-teaming tags: diff --git a/skills/operating-sliver-c2/SKILL.md b/skills/operating-sliver-c2/SKILL.md index 551defad..3aa91ad7 100644 --- a/skills/operating-sliver-c2/SKILL.md +++ b/skills/operating-sliver-c2/SKILL.md @@ -1,6 +1,6 @@ --- name: operating-sliver-c2 -description: Stand up a Sliver C2 server and listeners, generate cross-platform implants and beacons, and run post-exploitation, pivoting, and BOF/.NET tooling via the armory for adversary emulation. +description: Stand up a Sliver C2 server and mTLS listeners, generate cross-platform implants and beacons, and run post-exploitation, pivoting, and BOF/.NET tooling via the Armory for adversary emulation. Use during authorized, rules-of-engagement-bound red-team engagements that need a full open-source C2 lifecycle spanning server setup, implant generation, and post-exploitation tradecraft. domain: cybersecurity subdomain: red-teaming tags: diff --git a/skills/operationalizing-misp-threat-feeds/SKILL.md b/skills/operationalizing-misp-threat-feeds/SKILL.md index a531f969..5fcb94cf 100644 --- a/skills/operationalizing-misp-threat-feeds/SKILL.md +++ b/skills/operationalizing-misp-threat-feeds/SKILL.md @@ -1,6 +1,6 @@ --- name: operationalizing-misp-threat-feeds -description: Run MISP, curate feeds, and auto-generate detections for Wazuh, Sigma, and Suricata. +description: Stand up MISP, enable and cache curated threat feeds (CIRCL, abuse.ch, Feodo Tracker), apply warninglists to suppress false positives, query indicators with PyMISP, and export attributes as auto-generated Suricata/Sigma/Wazuh detection rules. Use when maturing a MISP instance to actively drive detection, curating threat feeds with quality controls, or automating IOC-to-detection pipelines for the SIEM/IDS. domain: cybersecurity subdomain: threat-intelligence tags: diff --git a/skills/orchestrating-llm-attacks-with-pyrit/SKILL.md b/skills/orchestrating-llm-attacks-with-pyrit/SKILL.md index 3646e632..2721ae2e 100644 --- a/skills/orchestrating-llm-attacks-with-pyrit/SKILL.md +++ b/skills/orchestrating-llm-attacks-with-pyrit/SKILL.md @@ -1,6 +1,6 @@ --- name: orchestrating-llm-attacks-with-pyrit -description: Build multi-turn, Crescendo, and Tree-of-Attacks-with-Pruning (TAP) automated attack chains against conversational LLM agents using Microsoft PyRIT, with adversarial chat and scorer feedback loops. +description: Build automated multi-turn adversarial attacks against conversational LLM targets using Microsoft PyRIT's RedTeamingOrchestrator, CrescendoOrchestrator (gradual escalation), and TreeOfAttacksWithPruningOrchestrator (adaptive branching), with scorer feedback loops and persisted conversation memory. Use when single-shot LLM scanning is insufficient and you need multi-turn, scorer-driven AI red-team campaigns against a chatbot or agent. domain: cybersecurity subdomain: ai-security tags: diff --git a/skills/parsing-artifacts-with-eric-zimmerman-tools/SKILL.md b/skills/parsing-artifacts-with-eric-zimmerman-tools/SKILL.md index 2a3b91e4..f563e0a9 100644 --- a/skills/parsing-artifacts-with-eric-zimmerman-tools/SKILL.md +++ b/skills/parsing-artifacts-with-eric-zimmerman-tools/SKILL.md @@ -1,6 +1,6 @@ --- name: parsing-artifacts-with-eric-zimmerman-tools -description: Parse registry, prefetch, shellbags, and MFT with EZ Tools and Timeline Explorer. +description: Parse Windows forensic artifacts—$MFT/$J (MFTECmd), Prefetch (PECmd), registry hives (RECmd), shellbags, and Amcache—into normalized CSV/JSON with Eric Zimmerman's EZ Tools, then load results into Timeline Explorer for analysis. Use during DFIR/incident-response investigations, after triage collection (e.g. with KAPE), to establish program execution, file/folder access, and persistence evidence from acquired forensic images. domain: cybersecurity subdomain: digital-forensics tags: diff --git a/skills/performing-access-recertification-with-saviynt/SKILL.md b/skills/performing-access-recertification-with-saviynt/SKILL.md index 11038f5d..cf72398e 100644 --- a/skills/performing-access-recertification-with-saviynt/SKILL.md +++ b/skills/performing-access-recertification-with-saviynt/SKILL.md @@ -2,7 +2,9 @@ name: performing-access-recertification-with-saviynt description: Configure and execute access recertification campaigns in Saviynt Enterprise Identity Cloud to validate user entitlements, revoke excessive access, and maintain - compliance with SOX, SOC2, and HIPAA. + compliance with SOX, SOC 2, and HIPAA. Use when launching or managing certification + campaigns for users/entitlements, remediating access review findings, or documenting + identity governance evidence for an audit. domain: cybersecurity subdomain: identity-access-management tags: diff --git a/skills/performing-access-review-and-certification/SKILL.md b/skills/performing-access-review-and-certification/SKILL.md index 16c2eeeb..5f59e111 100644 --- a/skills/performing-access-review-and-certification/SKILL.md +++ b/skills/performing-access-review-and-certification/SKILL.md @@ -1,8 +1,10 @@ --- name: performing-access-review-and-certification -description: Conduct systematic access reviews and certifications to ensure users - have appropriate access rights aligned with their roles. This skill covers review - campaign design, reviewer selection, risk-based p +description: Designs and runs access review and certification campaigns-scoping, + reviewer selection, risk-based prioritization, micro-certification, and remediation + tracking-to verify user access matches job roles for SOX, HIPAA, and PCI DSS compliance. + Use when planning or executing periodic access recertification or preparing evidence + for an IAM compliance audit. domain: cybersecurity subdomain: identity-access-management tags: diff --git a/skills/performing-active-directory-bloodhound-analysis/SKILL.md b/skills/performing-active-directory-bloodhound-analysis/SKILL.md index 8d01376a..1352f88f 100644 --- a/skills/performing-active-directory-bloodhound-analysis/SKILL.md +++ b/skills/performing-active-directory-bloodhound-analysis/SKILL.md @@ -1,7 +1,9 @@ --- name: performing-active-directory-bloodhound-analysis -description: Use BloodHound and SharpHound to enumerate Active Directory relationships - and identify attack paths from compromised users to Domain Admin. +description: Use BloodHound and SharpHound (or AzureHound) to enumerate Active Directory + relationships and graph attack paths from a compromised user to Domain Admin. Use + when performing AD red-team reconnaissance, mapping privilege-escalation chains + from group memberships, ACLs, and trusts, or auditing AD for exploitable misconfigurations. domain: cybersecurity subdomain: red-teaming tags: diff --git a/skills/performing-active-directory-forest-trust-attack/SKILL.md b/skills/performing-active-directory-forest-trust-attack/SKILL.md index 5a6729f1..ecfe5143 100644 --- a/skills/performing-active-directory-forest-trust-attack/SKILL.md +++ b/skills/performing-active-directory-forest-trust-attack/SKILL.md @@ -1,8 +1,10 @@ --- name: performing-active-directory-forest-trust-attack description: Enumerate and audit Active Directory forest trust relationships using - impacket for SID filtering analysis, trust key extraction, cross-forest SID history - abuse detection, and inter-realm Kerberos ticket assessment. + Impacket for SID filtering analysis, trust key extraction, cross-forest SID history + abuse detection, and inter-realm Kerberos ticket assessment. Use when red-teaming + multi-forest AD environments or auditing forest trusts for cross-forest privilege + escalation and trust ticket forgery exposure. domain: cybersecurity subdomain: red-team tags: diff --git a/skills/performing-active-directory-penetration-test/SKILL.md b/skills/performing-active-directory-penetration-test/SKILL.md index 2f36f02f..a333d55a 100644 --- a/skills/performing-active-directory-penetration-test/SKILL.md +++ b/skills/performing-active-directory-penetration-test/SKILL.md @@ -1,8 +1,10 @@ --- name: performing-active-directory-penetration-test -description: Conduct a focused Active Directory penetration test to enumerate domain - objects, discover attack paths with BloodHound, exploit Kerberos weaknesses, escalate - privileges via ADCS/DCSync, and demonstrate domain compromise. +description: Conduct a focused Active Directory penetration test using BloodHound, + Impacket, Certipy, Rubeus, and NetExec to enumerate domain objects, discover attack + paths, exploit Kerberos weaknesses, escalate privileges via ADCS/DCSync, and demonstrate + domain compromise. Use when running an authorized AD pentest from a standard domain + user foothold toward Domain Admin or Enterprise Admin. domain: cybersecurity subdomain: penetration-testing tags: diff --git a/skills/performing-adversary-in-the-middle-phishing-detection/SKILL.md b/skills/performing-adversary-in-the-middle-phishing-detection/SKILL.md index 51f4b6d1..078bfc95 100644 --- a/skills/performing-adversary-in-the-middle-phishing-detection/SKILL.md +++ b/skills/performing-adversary-in-the-middle-phishing-detection/SKILL.md @@ -2,7 +2,10 @@ name: performing-adversary-in-the-middle-phishing-detection description: Detect and respond to Adversary-in-the-Middle (AiTM) phishing attacks that use reverse proxy kits like EvilProxy, Evilginx, and Tycoon 2FA to bypass MFA - and steal session tokens. + and steal session tokens, correlating Azure AD/Entra sign-in logs, SIEM alerts, + and EDR telemetry. Use when investigating suspected MFA-bypass phishing or session + token theft, or building detection and response playbooks against reverse-proxy + phishing kits. domain: cybersecurity subdomain: phishing-defense tags: diff --git a/skills/performing-ai-driven-osint-correlation/SKILL.md b/skills/performing-ai-driven-osint-correlation/SKILL.md index 52184851..fe9481a1 100644 --- a/skills/performing-ai-driven-osint-correlation/SKILL.md +++ b/skills/performing-ai-driven-osint-correlation/SKILL.md @@ -1,9 +1,10 @@ --- name: performing-ai-driven-osint-correlation -description: Use AI and LLM-based reasoning to correlate findings across multiple - OSINT sources—username enumeration, email lookups, social media profiles, domain - records, breach databases, and dark-web mentions—into unified intelligence profiles - with confidence scoring and link analysis. +description: Use AI/LLM-based reasoning with Sherlock, theHarvester, and SpiderFoot + to correlate OSINT findings—usernames, emails, social profiles, domain records, + breach databases, and dark-web mentions—into unified, confidence-scored intelligence + profiles with link analysis. Use when raw OSINT data from multiple sources needs + merging into one target profile or resolving identity linkage across platforms. domain: cybersecurity subdomain: threat-intelligence tags: diff --git a/skills/performing-alert-triage-with-elastic-siem/SKILL.md b/skills/performing-alert-triage-with-elastic-siem/SKILL.md index ad211d2d..e9332610 100644 --- a/skills/performing-alert-triage-with-elastic-siem/SKILL.md +++ b/skills/performing-alert-triage-with-elastic-siem/SKILL.md @@ -1,7 +1,10 @@ --- name: performing-alert-triage-with-elastic-siem -description: Perform systematic alert triage in Elastic Security SIEM to rapidly classify, - prioritize, and investigate security alerts for SOC operations. +description: Perform systematic alert triage in Elastic Security SIEM—classifying, + prioritizing, and investigating alerts using Kibana, ES|QL queries, and ECS-normalized + data—to drive SOC analyst workflows. Use when triaging incoming Elastic Security + detections, prioritizing an analyst's alert queue, or investigating alerts during + SOC operations. domain: cybersecurity subdomain: soc-operations tags: diff --git a/skills/performing-api-fuzzing-with-restler/SKILL.md b/skills/performing-api-fuzzing-with-restler/SKILL.md index 6b6b4b53..af7bb226 100644 --- a/skills/performing-api-fuzzing-with-restler/SKILL.md +++ b/skills/performing-api-fuzzing-with-restler/SKILL.md @@ -1,13 +1,11 @@ --- name: performing-api-fuzzing-with-restler -description: 'Uses Microsoft RESTler to perform stateful REST API fuzzing by automatically - generating and executing test sequences that exercise API endpoints, discover producer-consumer - dependencies between requests, and find security and reliability bugs. The tester - compiles an OpenAPI specification into a RESTler fuzzing grammar, configures authentication, - runs test/fuzz-lean/fuzz modes, and analyzes results for 500 errors, authentication - bypasses, resource leaks, and payload injection vulnerabilities. Activates for requests - involving API fuzzing, RESTler testing, stateful API testing, or automated API security - scanning. +description: 'Uses Microsoft RESTler to perform stateful REST API fuzzing: compiles + an OpenAPI/Swagger spec into a RESTler grammar, configures authentication, and runs + test/fuzz-lean/fuzz modes that generate request sequences exercising producer-consumer + dependencies, then flags 500 errors, auth bypasses, resource leaks, and injection + bugs. Use when fuzzing REST APIs for stateful bugs or running RESTler-based automated + API security testing. ' domain: cybersecurity diff --git a/skills/performing-api-rate-limiting-bypass/SKILL.md b/skills/performing-api-rate-limiting-bypass/SKILL.md index f548576b..ba8abec6 100644 --- a/skills/performing-api-rate-limiting-bypass/SKILL.md +++ b/skills/performing-api-rate-limiting-bypass/SKILL.md @@ -1,13 +1,11 @@ --- name: performing-api-rate-limiting-bypass -description: 'Tests API rate limiting implementations for bypass vulnerabilities by - manipulating request headers, IP addresses, HTTP methods, API versions, and encoding - schemes to circumvent request throttling controls. The tester identifies rate limit - headers, determines enforcement mechanisms, and attempts bypasses including X-Forwarded-For - spoofing, parameter pollution, case variation, and endpoint path manipulation. Maps - to OWASP API4:2023 Unrestricted Resource Consumption. Activates for requests involving - rate limit bypass, API throttling evasion, brute force protection testing, or API - abuse prevention assessment. +description: 'Tests API rate limiting for bypass vulnerabilities using Python (requests/aiohttp) + and Burp Suite Turbo Intruder to manipulate headers (e.g. X-Forwarded-For spoofing), + IPs, HTTP methods, API versions, and encodings, mapping findings to OWASP API4:2023 + Unrestricted Resource Consumption. Use when assessing, under written authorization, + whether rate limits can be bypassed to enable brute force or resource-exhaustion + attacks. ' domain: cybersecurity diff --git a/skills/performing-api-security-testing-with-postman/SKILL.md b/skills/performing-api-security-testing-with-postman/SKILL.md index 6b0465a0..aa873a67 100644 --- a/skills/performing-api-security-testing-with-postman/SKILL.md +++ b/skills/performing-api-security-testing-with-postman/SKILL.md @@ -1,12 +1,10 @@ --- name: performing-api-security-testing-with-postman -description: 'Uses Postman to perform structured API security testing by building - collections that test for OWASP API Security Top 10 vulnerabilities including authentication - bypass, authorization flaws, injection, and data exposure. The tester creates environments - with multiple user roles, writes test scripts for automated security validation, - and integrates Postman with OWASP ZAP and Newman for CI/CD security testing. Activates - for requests involving Postman security testing, API security collection, automated - API testing, or OWASP API testing with Postman. +description: 'Uses Postman to build structured API security test collections covering + the OWASP API Security Top 10—authentication bypass, authorization flaws, injection, + and data exposure—with multi-role environments, automated test scripts, and OWASP + ZAP/Newman integration for CI/CD. Use when building repeatable Postman-based API + security regression tests or automating OWASP API Top 10 coverage in a pipeline. ' domain: cybersecurity diff --git a/skills/performing-arp-spoofing-attack-simulation/SKILL.md b/skills/performing-arp-spoofing-attack-simulation/SKILL.md index 59da79c5..0755f179 100644 --- a/skills/performing-arp-spoofing-attack-simulation/SKILL.md +++ b/skills/performing-arp-spoofing-attack-simulation/SKILL.md @@ -1,8 +1,11 @@ --- name: performing-arp-spoofing-attack-simulation -description: 'Simulates ARP spoofing attacks in authorized lab or pentest environments - using arpspoof, Ettercap, and Scapy to demonstrate man-in-the-middle risks, test - network detection capabilities, and validate ARP inspection countermeasures. +description: 'Simulates ARP spoofing/cache-poisoning attacks in authorized lab or + pentest environments using arpspoof, Ettercap, and Scapy to demonstrate man-in-the-middle + risk and validate Dynamic ARP Inspection, port security, and network monitoring + detections. Use when testing whether switches, IDS/IPS, or a SIEM detect ARP spoofing + under written authorization; do not use on production networks without explicit + approval. ' domain: cybersecurity diff --git a/skills/performing-asset-criticality-scoring-for-vulns/SKILL.md b/skills/performing-asset-criticality-scoring-for-vulns/SKILL.md index 508338b0..c36fc96f 100644 --- a/skills/performing-asset-criticality-scoring-for-vulns/SKILL.md +++ b/skills/performing-asset-criticality-scoring-for-vulns/SKILL.md @@ -1,8 +1,10 @@ --- name: performing-asset-criticality-scoring-for-vulns -description: Develop and apply a multi-factor asset criticality scoring model to weight - vulnerability prioritization based on business impact, data sensitivity, and operational - importance. +description: Build a multi-factor asset criticality scoring model—incorporating data + sensitivity, business function dependency, regulatory scope, network exposure, and + recoverability—to produce a 1-5 criticality tier that weights vulnerability prioritization + and remediation SLAs. Use when prioritizing vulnerability remediation by business + impact or aligning CMDB asset data with risk-based patching timelines. domain: cybersecurity subdomain: vulnerability-management tags: diff --git a/skills/performing-authenticated-scan-with-openvas/SKILL.md b/skills/performing-authenticated-scan-with-openvas/SKILL.md index 9bab85b3..1d3a96d1 100644 --- a/skills/performing-authenticated-scan-with-openvas/SKILL.md +++ b/skills/performing-authenticated-scan-with-openvas/SKILL.md @@ -1,8 +1,10 @@ --- name: performing-authenticated-scan-with-openvas -description: Configure and execute authenticated vulnerability scans using OpenVAS/Greenbone - Vulnerability Management with SSH and SMB credentials for comprehensive host-level - assessment. +description: Configure and execute authenticated (credentialed) vulnerability scans using OpenVAS/Greenbone + Vulnerability Management (GVM) with SSH, SMB, or ESXi credentials to detect local + vulnerabilities, missing patches, and misconfigurations on target hosts. Use when + a host-level scan needs to log into systems for deep inspection, since authenticated + scans typically surface 10-50x more findings than unauthenticated scans. domain: cybersecurity subdomain: vulnerability-management tags: diff --git a/skills/performing-authenticated-vulnerability-scan/SKILL.md b/skills/performing-authenticated-vulnerability-scan/SKILL.md index cc715de1..2e944f6e 100644 --- a/skills/performing-authenticated-vulnerability-scan/SKILL.md +++ b/skills/performing-authenticated-vulnerability-scan/SKILL.md @@ -1,8 +1,10 @@ --- name: performing-authenticated-vulnerability-scan -description: Authenticated (credentialed) vulnerability scanning uses valid system - credentials to log into target hosts and perform deep inspection of installed software, - patches, configurations, and security sett +description: Plan and run authenticated (credentialed) vulnerability scans with scanners such as + Nessus, Qualys, OpenVAS, or Rapid7 InsightVM, using SSH, SMB, WinRM, or SNMPv3 credentials + to inspect installed software, patches, and configurations on Linux, Windows, and network + devices. Use when a scan must catch vulnerabilities unauthenticated scanning misses, or when + choosing and managing credential types for a credentialed scan. domain: cybersecurity subdomain: vulnerability-management tags: diff --git a/skills/performing-automated-malware-analysis-with-cape/SKILL.md b/skills/performing-automated-malware-analysis-with-cape/SKILL.md index 81afccd4..df0e64b1 100644 --- a/skills/performing-automated-malware-analysis-with-cape/SKILL.md +++ b/skills/performing-automated-malware-analysis-with-cape/SKILL.md @@ -1,8 +1,10 @@ --- name: performing-automated-malware-analysis-with-cape -description: Deploy and operate CAPEv2 sandbox for automated malware analysis with - behavioral monitoring, payload extraction, configuration parsing, and anti-evasion - capabilities. +description: Deploy and operate the CAPEv2 malware sandbox (a Cuckoo derivative) to run samples in a + monitored Windows guest VM, capturing behavioral signatures, dropped files, PCAP network traffic, + and family-specific configuration extraction (e.g. Emotet, TrickBot, Cobalt Strike) via + cape-parsers. Use when a suspicious file or payload needs automated dynamic analysis, anti-evasion + debugger tricks, or config/payload extraction. domain: cybersecurity subdomain: malware-analysis tags: diff --git a/skills/performing-aws-account-enumeration-with-scout-suite/SKILL.md b/skills/performing-aws-account-enumeration-with-scout-suite/SKILL.md index 29b0167b..7fc0f9bb 100644 --- a/skills/performing-aws-account-enumeration-with-scout-suite/SKILL.md +++ b/skills/performing-aws-account-enumeration-with-scout-suite/SKILL.md @@ -1,8 +1,10 @@ --- name: performing-aws-account-enumeration-with-scout-suite -description: Perform comprehensive security posture assessment of AWS accounts using - ScoutSuite to enumerate resources, identify misconfigurations, and generate actionable - security reports. +description: Run the agentless, open-source ScoutSuite tool (via pip install and the `scout` CLI) + against an AWS account to enumerate resources across services, identify misconfigurations, + and generate an interactive HTML security report. Use when assessing an AWS account's overall + security posture with read-only IAM credentials, such as during a cloud security audit or + compliance review. domain: cybersecurity subdomain: cloud-security tags: diff --git a/skills/performing-bandwidth-throttling-attack-simulation/SKILL.md b/skills/performing-bandwidth-throttling-attack-simulation/SKILL.md index 65987ecf..6a62097c 100644 --- a/skills/performing-bandwidth-throttling-attack-simulation/SKILL.md +++ b/skills/performing-bandwidth-throttling-attack-simulation/SKILL.md @@ -1,9 +1,10 @@ --- name: performing-bandwidth-throttling-attack-simulation -description: 'Simulates bandwidth throttling and network degradation attacks using - tc, iperf3, and Scapy in authorized environments to test quality-of-service controls, - application resilience, and network monitoring detection of traffic manipulation - attacks. +description: 'Simulate bandwidth throttling and network degradation attacks using tc, + iperf3, and Scapy in authorized lab environments to test QoS controls, application + resilience, and monitoring detection of traffic manipulation. Use when validating + how VoIP, video, or other real-time applications and network monitoring tools respond + to degraded bandwidth or slowloris-style throttling attacks. ' domain: cybersecurity diff --git a/skills/performing-binary-exploitation-analysis/SKILL.md b/skills/performing-binary-exploitation-analysis/SKILL.md index cff90b5a..256d00f1 100644 --- a/skills/performing-binary-exploitation-analysis/SKILL.md +++ b/skills/performing-binary-exploitation-analysis/SKILL.md @@ -1,8 +1,9 @@ --- name: performing-binary-exploitation-analysis -description: 'Analyze binary exploitation techniques including buffer overflows and - ROP chains using pwntools Python library. Covers checksec analysis, gadget discovery - with ROPgadget, and exploit development for CTF and authorized security assessments. +description: 'Analyze ELF binaries for memory-corruption vulnerabilities and build proof-of-concept + exploits using pwntools, checksec, and ROPgadget for buffer overflows and ROP chains. Use + when a penetration test or CTF challenge requires evaluating compiler mitigations (NX, ASLR, + stack canaries, PIE, RELRO) or developing a working exploit to demonstrate impact. ' domain: cybersecurity diff --git a/skills/performing-blind-ssrf-exploitation/SKILL.md b/skills/performing-blind-ssrf-exploitation/SKILL.md index 7444e8be..5c886338 100644 --- a/skills/performing-blind-ssrf-exploitation/SKILL.md +++ b/skills/performing-blind-ssrf-exploitation/SKILL.md @@ -1,8 +1,10 @@ --- name: performing-blind-ssrf-exploitation -description: Detect and exploit blind Server-Side Request Forgery vulnerabilities - using out-of-band techniques, DNS interactions, and timing analysis to access internal - services and cloud metadata endpoints. +description: Detect and exploit blind Server-Side Request Forgery (SSRF) using out-of-band + techniques such as Burp Collaborator DNS interactions and timing analysis, to reach internal + services and cloud metadata endpoints even when server responses are not reflected. Use when + testing URL/webhook parameters, PDF generators, image processors, or import/preview features + where SSRF output cannot be observed directly. domain: cybersecurity subdomain: web-application-security tags: diff --git a/skills/performing-bluetooth-security-assessment/SKILL.md b/skills/performing-bluetooth-security-assessment/SKILL.md index 82b2c181..26d7e47a 100644 --- a/skills/performing-bluetooth-security-assessment/SKILL.md +++ b/skills/performing-bluetooth-security-assessment/SKILL.md @@ -1,7 +1,10 @@ --- name: performing-bluetooth-security-assessment -description: Assess Bluetooth Low Energy device security by scanning, enumerating - GATT services, and detecting vulnerabilities +description: Assess Bluetooth Low Energy (BLE) device security using Python's bleak asyncio + library to discover nearby devices, enumerate GATT services and characteristics, and flag + unencrypted or unauthenticated read/write access to sensitive data. Use when auditing IoT, + healthcare, fitness, or smart-home BLE devices for weak pairing configurations or known + vulnerable device fingerprints. domain: cybersecurity subdomain: wireless-security tags: diff --git a/skills/performing-cloud-asset-inventory-with-cartography/SKILL.md b/skills/performing-cloud-asset-inventory-with-cartography/SKILL.md index c2de2b24..342a2d8e 100644 --- a/skills/performing-cloud-asset-inventory-with-cartography/SKILL.md +++ b/skills/performing-cloud-asset-inventory-with-cartography/SKILL.md @@ -1,8 +1,9 @@ --- name: performing-cloud-asset-inventory-with-cartography -description: Perform comprehensive cloud asset inventory and relationship mapping - using Cartography to build a Neo4j security graph of infrastructure assets, IAM - permissions, and attack paths across AWS, GCP, and Azure. +description: Run Cartography to sync AWS, GCP, or Azure resources into a Neo4j graph database, + mapping relationships such as IAM permission chains, network paths, and cross-account trust. + Use when building a cloud asset inventory, querying the graph to identify attack paths, or + generating security reports across multi-cloud infrastructure. domain: cybersecurity subdomain: cloud-security tags: diff --git a/skills/performing-cloud-forensics-investigation/SKILL.md b/skills/performing-cloud-forensics-investigation/SKILL.md index 3e3fb235..340e2550 100644 --- a/skills/performing-cloud-forensics-investigation/SKILL.md +++ b/skills/performing-cloud-forensics-investigation/SKILL.md @@ -1,7 +1,10 @@ --- name: performing-cloud-forensics-investigation -description: Conduct forensic investigations in cloud environments by collecting and - analyzing logs, snapshots, and metadata from AWS, Azure, and GCP services. +description: Collect and analyze cloud forensic evidence using AWS CLI, Azure CLI, or gcloud + to snapshot volumes, capture instance metadata and security group configurations, and preserve + cloud-native logs (CloudTrail, Activity Log, Audit Log). Use when investigating a suspected + breach in AWS, Azure, or GCP, tracing unauthorized access through API logs, or analyzing a + compromised VM, container, or serverless function. domain: cybersecurity subdomain: digital-forensics tags: diff --git a/skills/performing-cloud-forensics-with-aws-cloudtrail/SKILL.md b/skills/performing-cloud-forensics-with-aws-cloudtrail/SKILL.md index 1db5be02..0e656eff 100644 --- a/skills/performing-cloud-forensics-with-aws-cloudtrail/SKILL.md +++ b/skills/performing-cloud-forensics-with-aws-cloudtrail/SKILL.md @@ -1,8 +1,10 @@ --- name: performing-cloud-forensics-with-aws-cloudtrail -description: Perform forensic investigation of AWS environments using CloudTrail logs - to reconstruct attacker activity, identify compromised credentials, and analyze - API call patterns. +description: Investigate AWS account compromise by querying CloudTrail with boto3's LookupEvents + or AWS Athena SQL over S3-delivered logs, filtering on suspicious user agents, source IPs, and + event names to reconstruct an attacker timeline. Use when tracing unauthorized API calls, S3 + data exfiltration, IAM privilege escalation, or credential exposure, and building a forensic + report of findings and remediation steps. domain: cybersecurity subdomain: cloud-security tags: diff --git a/skills/performing-cloud-incident-containment-procedures/SKILL.md b/skills/performing-cloud-incident-containment-procedures/SKILL.md index 3485f234..c89efcb6 100644 --- a/skills/performing-cloud-incident-containment-procedures/SKILL.md +++ b/skills/performing-cloud-incident-containment-procedures/SKILL.md @@ -1,8 +1,10 @@ --- name: performing-cloud-incident-containment-procedures -description: Execute cloud-native incident containment across AWS, Azure, and GCP - by isolating compromised resources, revoking credentials, preserving forensic evidence, - and applying security group restrictions to prevent lateral movement. +description: Execute cloud-native incident containment across AWS, Azure, and GCP using platform + CLIs to revoke or disable compromised IAM credentials, isolate resources with security groups + and network ACLs, and preserve forensic evidence via snapshots. Use when responding to a cloud + security incident that requires stopping lateral movement while keeping evidence intact for + later investigation. domain: cybersecurity subdomain: incident-response tags: diff --git a/skills/performing-cloud-native-threat-hunting-with-aws-detective/SKILL.md b/skills/performing-cloud-native-threat-hunting-with-aws-detective/SKILL.md index 3dd39c36..8e4fd7c1 100644 --- a/skills/performing-cloud-native-threat-hunting-with-aws-detective/SKILL.md +++ b/skills/performing-cloud-native-threat-hunting-with-aws-detective/SKILL.md @@ -1,8 +1,10 @@ --- name: performing-cloud-native-threat-hunting-with-aws-detective -description: Hunt for threats in AWS environments using Detective behavior graphs, - entity investigation timelines, GuardDuty finding correlation, and automated entity - profiling across IAM users, EC2 instances, and IP addresses. +description: Investigate AWS security incidents using Amazon Detective's behavior graphs, + built from CloudTrail, VPC Flow Logs, GuardDuty, and EKS audit logs, to trace entity + timelines and profile IAM users, roles, EC2 instances, and IP addresses for lateral + movement. Use when triaging GuardDuty findings, investigating a suspected AWS compromise, + or reconstructing an attacker's activity timeline across AWS accounts. domain: cybersecurity subdomain: cloud-security tags: diff --git a/skills/performing-cloud-penetration-testing-with-pacu/SKILL.md b/skills/performing-cloud-penetration-testing-with-pacu/SKILL.md index 57228336..8eca0500 100644 --- a/skills/performing-cloud-penetration-testing-with-pacu/SKILL.md +++ b/skills/performing-cloud-penetration-testing-with-pacu/SKILL.md @@ -1,9 +1,10 @@ --- name: performing-cloud-penetration-testing-with-pacu -description: 'Performing authorized AWS penetration testing using Pacu, the open-source - AWS exploitation framework, to enumerate IAM configurations, discover privilege - escalation paths, test credential harvesting, and validate security controls through - systematic attack simulation. +description: 'Run authorized AWS penetration tests with Pacu, the open-source AWS exploitation + framework, to enumerate IAM configuration, scan for privilege escalation paths, and + test data access and lateral movement using compromised credentials. Use when conducting + authorized red-team assessments of AWS environments, validating IAM policies and + SCPs, or determining the blast radius of compromised AWS credentials. ' domain: cybersecurity diff --git a/skills/performing-cloud-storage-forensic-acquisition/SKILL.md b/skills/performing-cloud-storage-forensic-acquisition/SKILL.md index bb486670..94e82267 100644 --- a/skills/performing-cloud-storage-forensic-acquisition/SKILL.md +++ b/skills/performing-cloud-storage-forensic-acquisition/SKILL.md @@ -1,8 +1,11 @@ --- name: performing-cloud-storage-forensic-acquisition -description: Perform forensic acquisition and analysis of cloud storage services including - Google Drive, OneDrive, Dropbox, and Box by collecting both API-based remote data - and local sync client artifacts from endpoint devices. +description: Perform forensic acquisition of cloud storage services including Google + Drive, OneDrive, Dropbox, and Box by pulling API-based remote data such as revision + history and audit logs, and collecting local sync-client artifacts including KAPE + targets and OneDrive databases from endpoints. Use during incident response or e-discovery + when evidence resides in cloud-synced storage and both cloud-side and endpoint-side + artifacts must be preserved. domain: cybersecurity subdomain: digital-forensics tags: diff --git a/skills/performing-container-image-hardening/SKILL.md b/skills/performing-container-image-hardening/SKILL.md index 124a4401..62de5476 100644 --- a/skills/performing-container-image-hardening/SKILL.md +++ b/skills/performing-container-image-hardening/SKILL.md @@ -1,9 +1,11 @@ --- name: performing-container-image-hardening -description: 'This skill covers hardening container images by minimizing attack surface, - removing unnecessary packages, implementing multi-stage builds, configuring non-root - users, and applying CIS Docker Benchmark recommendations to produce secure production-ready - images. +description: 'Harden container images by minimizing attack surface, stripping unnecessary + packages, implementing multi-stage builds, configuring non-root users, and applying + CIS Docker Benchmark recommendations to produce secure, production-ready images. + Use when building production container images, when compliance requires CIS Docker + Benchmark adherence, or when shrinking image size to reduce vulnerability exposure + from unused packages. ' domain: cybersecurity diff --git a/skills/performing-container-security-scanning-with-trivy/SKILL.md b/skills/performing-container-security-scanning-with-trivy/SKILL.md index f398f706..f69cbb10 100644 --- a/skills/performing-container-security-scanning-with-trivy/SKILL.md +++ b/skills/performing-container-security-scanning-with-trivy/SKILL.md @@ -1,8 +1,10 @@ --- name: performing-container-security-scanning-with-trivy -description: Scan container images, filesystems, and Kubernetes manifests for vulnerabilities, - misconfigurations, exposed secrets, and license compliance issues using Aqua Security - Trivy with SBOM generation and CI/CD integration. +description: Scan container images, filesystems, Git repositories, and Kubernetes manifests + for OS and language-dependency vulnerabilities, IaC misconfigurations, exposed secrets, + and license issues using Aqua Security's Trivy, generating CycloneDX/SPDX SBOMs. Use + when integrating vulnerability scanning into CI/CD pipelines, deploying the Trivy + Kubernetes operator, or triaging scan results for security operations. domain: cybersecurity subdomain: container-security tags: diff --git a/skills/performing-content-security-policy-bypass/SKILL.md b/skills/performing-content-security-policy-bypass/SKILL.md index 8d1336c9..0fc20eb5 100644 --- a/skills/performing-content-security-policy-bypass/SKILL.md +++ b/skills/performing-content-security-policy-bypass/SKILL.md @@ -1,8 +1,11 @@ --- name: performing-content-security-policy-bypass -description: Analyze and bypass Content Security Policy implementations to achieve - cross-site scripting by exploiting misconfigurations, JSONP endpoints, unsafe directives, - and policy injection techniques. +description: Analyze Content-Security-Policy headers and bypass them to achieve cross-site + scripting by exploiting unsafe-inline/unsafe-eval, whitelisted JSONP endpoints, base-uri + and form-action gaps, and nonce/hash weaknesses, then exfiltrate data even without + script-src control. Use during web application security assessments or bug bounty + hunting when XSS is found but blocked by CSP, or when auditing CSP header configuration + for weaknesses. domain: cybersecurity subdomain: web-application-security tags: diff --git a/skills/performing-cve-prioritization-with-kev-catalog/SKILL.md b/skills/performing-cve-prioritization-with-kev-catalog/SKILL.md index e2718c84..3b3cb8f6 100644 --- a/skills/performing-cve-prioritization-with-kev-catalog/SKILL.md +++ b/skills/performing-cve-prioritization-with-kev-catalog/SKILL.md @@ -1,7 +1,10 @@ --- name: performing-cve-prioritization-with-kev-catalog -description: Leverage the CISA Known Exploited Vulnerabilities catalog alongside EPSS - and CVSS to prioritize CVE remediation based on real-world exploitation evidence. +description: Fetch and parse the CISA Known Exploited Vulnerabilities (KEV) catalog, + enrich it with EPSS scores and CVSS metrics, and build a multi-factor prioritization + engine and report that ranks CVE remediation by real-world exploitation evidence and + BOD 22-01 deadlines. Use when triaging a vulnerability backlog, deciding patch order + across many CVEs, or building an automated KEV+EPSS prioritization workflow. domain: cybersecurity subdomain: vulnerability-management tags: diff --git a/skills/performing-directory-traversal-testing/SKILL.md b/skills/performing-directory-traversal-testing/SKILL.md index 13ce5523..040f988c 100644 --- a/skills/performing-directory-traversal-testing/SKILL.md +++ b/skills/performing-directory-traversal-testing/SKILL.md @@ -1,7 +1,11 @@ --- name: performing-directory-traversal-testing -description: Testing web applications for path traversal vulnerabilities that allow - reading or writing arbitrary files on the server by manipulating file path parameters. +description: Test web applications for path traversal and Local/Remote File Inclusion + vulnerabilities by manipulating file path parameters, applying encoding and filter-bypass + techniques, automating discovery with ffuf and dotdotpwn, and reading high-value files + or achieving code execution. Use during authorized penetration tests of file download, + view, or include functionality, or when assessing APIs that accept file names or file + paths as parameters. domain: cybersecurity subdomain: web-application-security tags: diff --git a/skills/performing-disk-forensics-investigation/SKILL.md b/skills/performing-disk-forensics-investigation/SKILL.md index 8c9dd611..dc7164a1 100644 --- a/skills/performing-disk-forensics-investigation/SKILL.md +++ b/skills/performing-disk-forensics-investigation/SKILL.md @@ -1,11 +1,10 @@ --- name: performing-disk-forensics-investigation -description: 'Conducts disk forensics investigations using forensic imaging, file - system analysis, artifact recovery, and timeline reconstruction to support incident - response cases. Utilizes tools such as FTK Imager, Autopsy, and The Sleuth Kit for - evidence acquisition, deleted file recovery, and artifact examination. Activates - for requests involving disk forensics, hard drive analysis, forensic imaging, file - recovery, evidence acquisition, or digital forensic investigation. +description: 'Conduct disk forensics investigations using forensic imaging, file system + analysis, and timeline reconstruction, with tools such as FTK Imager, Autopsy, and + The Sleuth Kit, for evidence acquisition, deleted file recovery, and artifact examination. + Use when a security incident requires forensic analysis of persistent storage or + when evidence must be preserved for legal or HR proceedings. ' domain: cybersecurity diff --git a/skills/performing-dmarc-policy-enforcement-rollout/SKILL.md b/skills/performing-dmarc-policy-enforcement-rollout/SKILL.md index d5bc3c82..f582ee30 100644 --- a/skills/performing-dmarc-policy-enforcement-rollout/SKILL.md +++ b/skills/performing-dmarc-policy-enforcement-rollout/SKILL.md @@ -1,8 +1,11 @@ --- name: performing-dmarc-policy-enforcement-rollout -description: Execute a phased DMARC rollout from p=none monitoring through p=quarantine - to p=reject enforcement, ensuring all legitimate email sources are authenticated - before blocking unauthorized senders. +description: Execute a phased DMARC rollout by inventorying sending sources, configuring + SPF/DKIM alignment, and progressing DNS policy from p=none monitoring through p=quarantine + to p=reject enforcement, ensuring all legitimate email sources authenticate before + unauthorized senders are blocked. Use when deploying or advancing an organization's + DMARC anti-spoofing posture, or when meeting bulk-sender authentication requirements + from Google and Yahoo. domain: cybersecurity subdomain: phishing-defense tags: diff --git a/skills/performing-docker-bench-security-assessment/SKILL.md b/skills/performing-docker-bench-security-assessment/SKILL.md index ff40380c..c5e21477 100644 --- a/skills/performing-docker-bench-security-assessment/SKILL.md +++ b/skills/performing-docker-bench-security-assessment/SKILL.md @@ -1,8 +1,11 @@ --- name: performing-docker-bench-security-assessment -description: Docker Bench for Security is an open-source script that checks dozens - of common best practices around deploying Docker containers in production. Based - on the CIS Docker Benchmark, it audits host confi +description: Run Docker Bench for Security, the open-source CIS Docker Benchmark audit + script, to check host configuration, Docker daemon settings, container images, and + runtime configurations, then interpret pass/fail/warn results and remediate common + failures. Use when auditing Docker hosts for CIS Benchmark compliance, scheduling + recurring container security assessments, or validating container runtime hardening + controls. domain: cybersecurity subdomain: container-security tags: diff --git a/skills/performing-dynamic-analysis-with-any-run/SKILL.md b/skills/performing-dynamic-analysis-with-any-run/SKILL.md index 76118f23..6dfb714b 100644 --- a/skills/performing-dynamic-analysis-with-any-run/SKILL.md +++ b/skills/performing-dynamic-analysis-with-any-run/SKILL.md @@ -1,10 +1,10 @@ --- name: performing-dynamic-analysis-with-any-run -description: 'Performs interactive dynamic malware analysis using the ANY.RUN cloud - sandbox to observe real-time execution behavior, interact with malware prompts, - and capture process trees, network traffic, and system changes. Activates for requests - involving interactive sandbox analysis, cloud-based malware detonation, real-time - behavioral observation, or ANY.RUN usage. +description: 'Perform interactive dynamic malware analysis using the ANY.RUN cloud sandbox + to detonate samples, observe real-time execution behavior, interact with malware prompts + such as dialogs and CAPTCHAs, and capture process trees, network traffic, and system + changes. Use when a suspicious file or URL needs live, interactive behavioral detonation + in a cloud sandbox rather than static analysis alone. ' domain: cybersecurity diff --git a/skills/performing-entitlement-review-with-sailpoint-iiq/SKILL.md b/skills/performing-entitlement-review-with-sailpoint-iiq/SKILL.md index e242f3cd..6ae16696 100644 --- a/skills/performing-entitlement-review-with-sailpoint-iiq/SKILL.md +++ b/skills/performing-entitlement-review-with-sailpoint-iiq/SKILL.md @@ -1,12 +1,10 @@ --- name: performing-entitlement-review-with-sailpoint-iiq -description: 'Performs entitlement review and access certification campaigns using - SailPoint IdentityIQ including manager certifications, targeted entitlement reviews, - role-based access validation, SOD violation remediation, and automated revocation - workflows. Activates for requests involving access reviews, entitlement certifications, - SailPoint IIQ governance, or periodic user access recertification. - - ' +description: 'Runs entitlement review and access certification campaigns in SailPoint + IdentityIQ, covering manager certifications, targeted entitlement reviews, role-based + access validation, segregation-of-duties violation remediation, and automated + revocation workflows. Use when performing periodic user access recertification, + auditing SailPoint IIQ access governance, or investigating SOD violations.' domain: cybersecurity subdomain: identity-access-management tags: diff --git a/skills/performing-false-positive-reduction-in-siem/SKILL.md b/skills/performing-false-positive-reduction-in-siem/SKILL.md index 328c9fc5..a1c6a54c 100644 --- a/skills/performing-false-positive-reduction-in-siem/SKILL.md +++ b/skills/performing-false-positive-reduction-in-siem/SKILL.md @@ -1,8 +1,9 @@ --- name: performing-false-positive-reduction-in-siem -description: Perform systematic SIEM false positive reduction through rule tuning, - threshold adjustment, correlation refinement, and threat intelligence enrichment - to combat alert fatigue. +description: Reduces SIEM false positives through systematic rule tuning, threshold + adjustment, correlation logic refinement, allowlisting, and threat intelligence + enrichment. Use when SOC analysts are overwhelmed by alert noise, when tuning noisy + detection rules, or during a quarterly SIEM rule review to cut alert fatigue. domain: cybersecurity subdomain: soc-operations tags: diff --git a/skills/performing-file-carving-with-foremost/SKILL.md b/skills/performing-file-carving-with-foremost/SKILL.md index 7a4f57e3..7df4c426 100644 --- a/skills/performing-file-carving-with-foremost/SKILL.md +++ b/skills/performing-file-carving-with-foremost/SKILL.md @@ -1,7 +1,10 @@ --- name: performing-file-carving-with-foremost -description: Recover files from disk images and unallocated space using Foremost's - header-footer signature carving to extract evidence regardless of file system state. +description: Recovers files from disk images and unallocated space using Foremost's + header-footer signature carving, extracting evidence independent of the file system's + state. Use during digital forensics investigations to carve deleted or fragmented + files, such as documents, images, and archives, from raw disk images or unallocated + space. domain: cybersecurity subdomain: digital-forensics tags: diff --git a/skills/performing-firmware-malware-analysis/SKILL.md b/skills/performing-firmware-malware-analysis/SKILL.md index 8b591da2..b2ad633b 100644 --- a/skills/performing-firmware-malware-analysis/SKILL.md +++ b/skills/performing-firmware-malware-analysis/SKILL.md @@ -1,10 +1,10 @@ --- name: performing-firmware-malware-analysis description: 'Analyzes firmware images for embedded malware, backdoors, and unauthorized - modifications targeting routers, IoT devices, UEFI/BIOS, and embedded systems. Covers + modifications in routers, IoT devices, UEFI/BIOS, and embedded systems, covering firmware extraction, filesystem analysis, binary reverse engineering, and bootkit - detection. Activates for requests involving firmware security analysis, IoT malware - investigation, UEFI rootkit detection, or embedded device compromise assessment. + detection. Use for firmware security analysis, IoT malware investigation, UEFI + rootkit detection, or embedded device compromise assessment. ' domain: cybersecurity diff --git a/skills/performing-fuzzing-with-aflplusplus/SKILL.md b/skills/performing-fuzzing-with-aflplusplus/SKILL.md index c20a0de3..d36a88c4 100644 --- a/skills/performing-fuzzing-with-aflplusplus/SKILL.md +++ b/skills/performing-fuzzing-with-aflplusplus/SKILL.md @@ -1,11 +1,10 @@ --- name: performing-fuzzing-with-aflplusplus -description: 'Perform coverage-guided fuzzing of compiled binaries using AFL++ (American - Fuzzy Lop Plus Plus) to discover memory corruption, crashes, and security vulnerabilities. - The tester instruments target binaries with afl-cc/afl-clang-fast, manages input - corpora with afl-cmin and afl-tmin, runs parallel fuzzing campaigns with afl-fuzz, - and triages crashes using CASR or GDB scripts. Activates for requests involving - binary fuzzing, crash discovery, coverage-guided testing, or AFL++ fuzzing campaigns. +description: 'Performs coverage-guided fuzzing of compiled binaries with AFL++, instrumenting + targets via afl-cc/afl-clang-fast, minimizing corpora with afl-cmin and afl-tmin, + running parallel campaigns with afl-fuzz, and triaging crashes with CASR or GDB + scripts. Use for binary fuzzing, crash and memory-corruption discovery, coverage-guided + testing, or running AFL++ fuzzing campaigns. ' domain: cybersecurity diff --git a/skills/performing-gcp-penetration-testing-with-gcpbucketbrute/SKILL.md b/skills/performing-gcp-penetration-testing-with-gcpbucketbrute/SKILL.md index 79cc96ae..54c9e230 100644 --- a/skills/performing-gcp-penetration-testing-with-gcpbucketbrute/SKILL.md +++ b/skills/performing-gcp-penetration-testing-with-gcpbucketbrute/SKILL.md @@ -1,8 +1,10 @@ --- name: performing-gcp-penetration-testing-with-gcpbucketbrute -description: Perform GCP security testing using GCPBucketBrute for storage bucket - enumeration, gcloud IAM privilege escalation path analysis, and service account - permission auditing +description: Performs authorized GCP security testing using GCPBucketBrute to enumerate + publicly accessible storage buckets, combined with gcloud CLI IAM enumeration to + find privilege escalation paths and audit service account permissions. Use when + penetration testing a GCP project for exposed buckets, overly permissive IAM bindings, + or service account key exposure. domain: cybersecurity subdomain: cloud-security tags: diff --git a/skills/performing-graphql-introspection-attack/SKILL.md b/skills/performing-graphql-introspection-attack/SKILL.md index a11fa7d4..5db5b826 100644 --- a/skills/performing-graphql-introspection-attack/SKILL.md +++ b/skills/performing-graphql-introspection-attack/SKILL.md @@ -1,12 +1,10 @@ --- name: performing-graphql-introspection-attack -description: 'Performs GraphQL introspection attacks to extract the full API schema - including types, queries, mutations, subscriptions, and field definitions from GraphQL - endpoints. The tester uses introspection queries to map the attack surface, identifies - sensitive fields and mutations, tests for query depth and complexity limits, and - exploits GraphQL-specific vulnerabilities including batching attacks, alias-based - brute force, and nested query DoS. Activates for requests involving GraphQL security - testing, introspection attack, GraphQL enumeration, or GraphQL API penetration testing. +description: 'Performs GraphQL introspection attacks that extract the full API schema + (types, queries, mutations, subscriptions, field definitions), map the attack surface, + test query depth/complexity limits, and exploit GraphQL-specific weaknesses such + as batching attacks, alias-based brute force, and nested query DoS. Use for GraphQL + security testing, schema enumeration, or GraphQL API penetration testing. ' domain: cybersecurity diff --git a/skills/performing-hardware-security-module-integration/SKILL.md b/skills/performing-hardware-security-module-integration/SKILL.md index 0595b1d3..2bc06aa7 100644 --- a/skills/performing-hardware-security-module-integration/SKILL.md +++ b/skills/performing-hardware-security-module-integration/SKILL.md @@ -1,8 +1,9 @@ --- name: performing-hardware-security-module-integration -description: Integrate Hardware Security Modules (HSMs) using PKCS#11 interface for - cryptographic key management, signing operations, and secure key storage with python-pkcs11, - AWS CloudHSM, and YubiHSM2. +description: Integrates Hardware Security Modules (HSMs) via the PKCS#11 interface + using python-pkcs11, performing key generation, signing, encryption, verification, + and token/slot queries against SoftHSM2, AWS CloudHSM, or YubiHSM2. Use when implementing + HSM-backed key management or validating HSM configuration for FIPS 140-2/3 compliance. domain: cybersecurity subdomain: cryptography tags: diff --git a/skills/performing-hash-cracking-with-hashcat/SKILL.md b/skills/performing-hash-cracking-with-hashcat/SKILL.md index 06206579..0232830d 100644 --- a/skills/performing-hash-cracking-with-hashcat/SKILL.md +++ b/skills/performing-hash-cracking-with-hashcat/SKILL.md @@ -1,8 +1,9 @@ --- name: performing-hash-cracking-with-hashcat -description: Hash cracking is an essential skill for penetration testers and security - auditors to evaluate password strength. Hashcat is the world's fastest password - recovery tool, supporting over 300 hash types w +description: Cracks password hashes with Hashcat, covering hash-type identification, + dictionary/brute-force/rule-based attack modes, custom rule creation, GPU benchmarking, + and password-strength/compliance reporting. Use for authorized penetration testing + or security audits that need to evaluate password strength or crack captured hashes. domain: cybersecurity subdomain: cryptography tags: diff --git a/skills/performing-http-parameter-pollution-attack/SKILL.md b/skills/performing-http-parameter-pollution-attack/SKILL.md index 5ca10291..a865605d 100644 --- a/skills/performing-http-parameter-pollution-attack/SKILL.md +++ b/skills/performing-http-parameter-pollution-attack/SKILL.md @@ -1,8 +1,10 @@ --- name: performing-http-parameter-pollution-attack -description: Execute HTTP Parameter Pollution attacks to bypass input validation, - WAF rules, and security controls by injecting duplicate parameters that are processed - differently by front-end and back-end systems. +description: Executes HTTP Parameter Pollution attacks that inject duplicate request + parameters to bypass input validation, WAF rules, and other security controls when + front-end and back-end systems parse duplicate parameters differently. Use during + web application penetration testing to test for parameter parsing inconsistencies + or WAF/validation bypass. domain: cybersecurity subdomain: web-application-security tags: diff --git a/skills/performing-ics-asset-discovery-with-claroty/SKILL.md b/skills/performing-ics-asset-discovery-with-claroty/SKILL.md index 90fabb46..72b30eb0 100644 --- a/skills/performing-ics-asset-discovery-with-claroty/SKILL.md +++ b/skills/performing-ics-asset-discovery-with-claroty/SKILL.md @@ -1,9 +1,10 @@ --- name: performing-ics-asset-discovery-with-claroty -description: 'Perform comprehensive ICS/OT asset discovery using Claroty xDome platform, - leveraging passive monitoring, Claroty Edge active queries, and integration ecosystem - to gain full visibility into industrial control system assets including PLCs, RTUs, - HMIs, and network infrastructure across Purdue Model levels. +description: 'Performs ICS/OT asset discovery with Claroty xDome, combining passive + monitoring and Claroty Edge active queries to inventory PLCs, RTUs, HMIs, and network + infrastructure across Purdue Model levels. Use when gaining visibility into an + undocumented OT environment, preparing an IEC 62443 asset inventory, or onboarding + Claroty xDome; not for IT-only discovery. ' domain: cybersecurity diff --git a/skills/performing-indicator-lifecycle-management/SKILL.md b/skills/performing-indicator-lifecycle-management/SKILL.md index ada081fb..6d086606 100644 --- a/skills/performing-indicator-lifecycle-management/SKILL.md +++ b/skills/performing-indicator-lifecycle-management/SKILL.md @@ -1,8 +1,10 @@ --- name: performing-indicator-lifecycle-management -description: Indicator lifecycle management tracks IOCs from initial discovery through - validation, enrichment, deployment, monitoring, and eventual retirement. This skill - covers implementing systematic processes f +description: Tracks IOCs through discovery, enrichment/validation (VirusTotal, Shodan, + passive DNS), deployment to SIEM/IDS watchlists, hit-rate and false-positive monitoring, + confidence-score decay, and automated expiration using MISP/OpenCTI and STIX. Use + when building or maintaining a threat intelligence indicator lifecycle process, + aging out stale IOCs, or reducing analyst fatigue from low-quality indicators. domain: cybersecurity subdomain: threat-intelligence tags: diff --git a/skills/performing-insider-threat-investigation/SKILL.md b/skills/performing-insider-threat-investigation/SKILL.md index f57a8ae0..2285b372 100644 --- a/skills/performing-insider-threat-investigation/SKILL.md +++ b/skills/performing-insider-threat-investigation/SKILL.md @@ -2,10 +2,11 @@ name: performing-insider-threat-investigation description: 'Investigates insider threat incidents involving employees, contractors, or trusted partners who misuse authorized access to steal data, sabotage systems, - or violate security policies. Combines digital forensics, user behavior analytics, - and HR/legal coordination to build an evidence-based case. Activates for requests - involving insider threat investigation, employee data theft, privilege misuse, user - behavior anomaly, or internal threat detection. + or violate security policies, combining digital forensics, user behavior analytics, + and HR/legal coordination to build an evidence-based case. Use when DLP alerts flag + large data transfers to personal cloud storage or USB devices, when UBA detects + anomalous access patterns for a user account, or when investigating employee data + theft, privilege misuse, or internal threat detection requests. ' domain: cybersecurity diff --git a/skills/performing-jwt-none-algorithm-attack/SKILL.md b/skills/performing-jwt-none-algorithm-attack/SKILL.md index bc7dec33..3ea2741b 100644 --- a/skills/performing-jwt-none-algorithm-attack/SKILL.md +++ b/skills/performing-jwt-none-algorithm-attack/SKILL.md @@ -1,7 +1,10 @@ --- name: performing-jwt-none-algorithm-attack -description: Execute and test the JWT none algorithm attack to bypass signature verification - by manipulating the alg header field in JSON Web Tokens. +description: Execute and test the JWT none algorithm attack, crafting tokens with + the alg header set to none using PyJWT and an intercepting proxy (Burp Suite/mitmproxy) + to bypass signature verification and forge arbitrary claims. Use during authorized + penetration tests or security assessments of applications that use JWT for authentication + or authorization, to validate that the server rejects unsigned tokens. domain: cybersecurity subdomain: api-security tags: diff --git a/skills/performing-kerberoasting-attack/SKILL.md b/skills/performing-kerberoasting-attack/SKILL.md index 33b6e0bc..fd732f5e 100644 --- a/skills/performing-kerberoasting-attack/SKILL.md +++ b/skills/performing-kerberoasting-attack/SKILL.md @@ -1,8 +1,11 @@ --- name: performing-kerberoasting-attack -description: Kerberoasting is a post-exploitation technique that targets service accounts - in Active Directory by requesting Kerberos TGS (Ticket Granting Service) tickets - for accounts with Service Principal Names +description: Perform Kerberoasting, a post-exploitation technique that enumerates + Active Directory service accounts with Service Principal Names (SPNs), requests + their Kerberos TGS tickets, and cracks the NTLM-encrypted tickets offline to recover + service account credentials. Use during authorized red team engagements or penetration + tests to assess AD privilege escalation and credential access risk from weak service + account passwords. domain: cybersecurity subdomain: red-teaming tags: diff --git a/skills/performing-kubernetes-cis-benchmark-with-kube-bench/SKILL.md b/skills/performing-kubernetes-cis-benchmark-with-kube-bench/SKILL.md index b7eb791b..6c5c5771 100644 --- a/skills/performing-kubernetes-cis-benchmark-with-kube-bench/SKILL.md +++ b/skills/performing-kubernetes-cis-benchmark-with-kube-bench/SKILL.md @@ -1,7 +1,10 @@ --- name: performing-kubernetes-cis-benchmark-with-kube-bench -description: Audit Kubernetes cluster security posture against CIS benchmarks using - kube-bench with automated checks for control plane, worker nodes, and RBAC. +description: Audit Kubernetes cluster security posture against the CIS Kubernetes + Benchmark using kube-bench, running automated pass/fail/warn checks against the + control plane, etcd, worker nodes, and RBAC/policy configuration. Use when performing + compliance audits, cluster hardening reviews, or scheduled security assessments + of a Kubernetes environment. domain: cybersecurity subdomain: container-security tags: diff --git a/skills/performing-kubernetes-etcd-security-assessment/SKILL.md b/skills/performing-kubernetes-etcd-security-assessment/SKILL.md index 44b50d19..ba42a8b4 100644 --- a/skills/performing-kubernetes-etcd-security-assessment/SKILL.md +++ b/skills/performing-kubernetes-etcd-security-assessment/SKILL.md @@ -1,8 +1,10 @@ --- name: performing-kubernetes-etcd-security-assessment description: Assess the security posture of Kubernetes etcd clusters by evaluating - encryption at rest, TLS configuration, access controls, backup encryption, and network - isolation. + encryption at rest, TLS transport configuration, access controls, backup encryption, + and network isolation for the cluster's backing key-value store. Use when auditing + or hardening a Kubernetes control plane, since etcd holds Secrets, RBAC policies, + and ConfigMaps in plaintext by default and is a high-value target if left unassessed. domain: cybersecurity subdomain: container-security tags: diff --git a/skills/performing-kubernetes-penetration-testing/SKILL.md b/skills/performing-kubernetes-penetration-testing/SKILL.md index 69c21f9b..7df25256 100644 --- a/skills/performing-kubernetes-penetration-testing/SKILL.md +++ b/skills/performing-kubernetes-penetration-testing/SKILL.md @@ -1,8 +1,10 @@ --- name: performing-kubernetes-penetration-testing -description: Kubernetes penetration testing systematically evaluates cluster security - by simulating attacker techniques against the API server, kubelet, etcd, pods, RBAC, - network policies, and secrets. Using tools +description: Systematically evaluate Kubernetes cluster security by simulating attacker + techniques against the API server, kubelet, etcd, pods, RBAC, network policies, and + secrets, using tools like kube-hunter, Kubescape, peirates, and manual kubectl exploitation + to identify misconfigurations leading to cluster compromise. Use for authorized + penetration tests or hands-on validation of Kubernetes security controls. domain: cybersecurity subdomain: container-security tags: diff --git a/skills/performing-lateral-movement-detection/SKILL.md b/skills/performing-lateral-movement-detection/SKILL.md index 3a82bc16..ce365778 100644 --- a/skills/performing-lateral-movement-detection/SKILL.md +++ b/skills/performing-lateral-movement-detection/SKILL.md @@ -1,9 +1,13 @@ --- name: performing-lateral-movement-detection description: 'Detects lateral movement techniques including Pass-the-Hash, PsExec, - WMI execution, RDP pivoting, and SMB-based spreading using SIEM correlation of Windows - event logs, network flow data, and endpoint telemetry mapped to MITRE ATT&CK Lateral - Movement (TA0008) techniques. + WMI execution, RDP pivoting, and SMB-based spreading by correlating Windows Security/Sysmon + event logs, network flow data (NetFlow/Zeek), and endpoint telemetry in a SIEM, + mapped to MITRE ATT&CK Lateral Movement (TA0008) techniques with sample SPL detection + queries. Use when a SOC team needs to detect attackers pivoting between internal + systems after initial compromise, trace an attacker''s movement path during an + incident investigation, or build detection engineering rules for TA0008; not for + detecting initial access or external attacks. ' domain: cybersecurity diff --git a/skills/performing-linux-log-forensics-investigation/SKILL.md b/skills/performing-linux-log-forensics-investigation/SKILL.md index d89fd909..a4925c83 100644 --- a/skills/performing-linux-log-forensics-investigation/SKILL.md +++ b/skills/performing-linux-log-forensics-investigation/SKILL.md @@ -1,8 +1,11 @@ --- name: performing-linux-log-forensics-investigation description: Perform forensic investigation of Linux system logs including syslog, - auth.log, systemd journal, kern.log, and application logs to reconstruct user activity, - detect unauthorized access, and establish event timelines on compromised Linux systems. + auth.log, systemd journal (via journalctl), kern.log, auditd, and application logs + to reconstruct user sessions, identify unauthorized access and privilege escalation, + trace lateral movement, and establish event timelines. Use when investigating a + suspected compromise of a Linux system and needing to analyze SSH, sudo, cron, or + kernel-level activity from plain-text or systemd journal logs. domain: cybersecurity subdomain: digital-forensics tags: diff --git a/skills/performing-log-source-onboarding-in-siem/SKILL.md b/skills/performing-log-source-onboarding-in-siem/SKILL.md index 2dc4eb0a..afc44a60 100644 --- a/skills/performing-log-source-onboarding-in-siem/SKILL.md +++ b/skills/performing-log-source-onboarding-in-siem/SKILL.md @@ -1,7 +1,11 @@ --- name: performing-log-source-onboarding-in-siem -description: Perform structured log source onboarding into SIEM platforms by configuring - collectors, parsers, normalization, and validation for complete security visibility. +description: Perform structured log source onboarding into SIEM platforms (Splunk, + Elastic, Sentinel, QRadar, or similar) by prioritizing sources with a tiered value + framework, configuring collectors, building parsers, normalizing fields to a common + schema (e.g. CIM), and validating data quality. Use when planning or executing + the integration of new log sources — such as Active Directory, firewalls, EDR, + VPN, DNS, or cloud audit logs — into a SIEM for security monitoring and detection. domain: cybersecurity subdomain: soc-operations tags: diff --git a/skills/performing-malware-hash-enrichment-with-virustotal/SKILL.md b/skills/performing-malware-hash-enrichment-with-virustotal/SKILL.md index 25e1ddc3..aa7cbe64 100644 --- a/skills/performing-malware-hash-enrichment-with-virustotal/SKILL.md +++ b/skills/performing-malware-hash-enrichment-with-virustotal/SKILL.md @@ -1,8 +1,10 @@ --- name: performing-malware-hash-enrichment-with-virustotal -description: Enrich malware file hashes using the VirusTotal API to retrieve detection - rates, behavioral analysis, YARA matches, and contextual threat intelligence for - incident triage and IOC validation. +description: Enrich malware file hashes (MD5, SHA-1, SHA-256) using the VirusTotal + API v3 to retrieve multi-engine detection rates, sandbox behavioral analysis, YARA + rule matches, related indicators, and community threat intelligence. Use during + SOC triage, incident response, or threat intelligence workflows to validate whether + a file hash is malicious and gather context for IOC enrichment. domain: cybersecurity subdomain: threat-intelligence tags: diff --git a/skills/performing-malware-triage-with-yara/SKILL.md b/skills/performing-malware-triage-with-yara/SKILL.md index 9ca12d98..ba2f23db 100644 --- a/skills/performing-malware-triage-with-yara/SKILL.md +++ b/skills/performing-malware-triage-with-yara/SKILL.md @@ -1,11 +1,11 @@ --- name: performing-malware-triage-with-yara -description: 'Performs rapid malware triage and classification using YARA rules to +description: 'Performs rapid malware triage and classification using YARA rules that match file patterns, strings, byte sequences, and structural characteristics against - known malware families and suspicious indicators. Covers rule writing, scanning, - and integration with analysis pipelines. Activates for requests involving YARA rule - creation, malware classification, pattern matching, sample triage, or signature-based - detection. + known malware families and suspicious indicators, covering rule writing, scanning, + and integration into analysis pipelines. Use when classifying a batch of malware + samples against known family signatures, writing detection rules for a newly + analyzed malware family, or performing signature-based malware triage. ' domain: cybersecurity diff --git a/skills/performing-memory-forensics-with-volatility3/SKILL.md b/skills/performing-memory-forensics-with-volatility3/SKILL.md index 2a4cfe7a..c9f8b612 100644 --- a/skills/performing-memory-forensics-with-volatility3/SKILL.md +++ b/skills/performing-memory-forensics-with-volatility3/SKILL.md @@ -1,7 +1,11 @@ --- name: performing-memory-forensics-with-volatility3 -description: Analyze volatile memory dumps using Volatility 3 to extract running processes, - network connections, loaded modules, and evidence of malicious activity. +description: Analyze volatile memory (RAM) dumps using the Volatility 3 framework + to extract running processes, network connections, loaded modules, credentials, + and encryption keys, and to detect process hollowing, DLL injection, or hidden + processes/rootkits. Use during incident response on a compromised or suspect system + when disk-based forensics alone is insufficient and volatile evidence of malware + or intrusion must be recovered from memory. domain: cybersecurity subdomain: digital-forensics tags: diff --git a/skills/performing-mobile-device-forensics-with-cellebrite/SKILL.md b/skills/performing-mobile-device-forensics-with-cellebrite/SKILL.md index a91fc769..e669ef32 100644 --- a/skills/performing-mobile-device-forensics-with-cellebrite/SKILL.md +++ b/skills/performing-mobile-device-forensics-with-cellebrite/SKILL.md @@ -1,7 +1,6 @@ --- name: performing-mobile-device-forensics-with-cellebrite -description: Acquire and analyze mobile device data using Cellebrite UFED and open-source - tools to extract communications, location data, and application artifacts. +description: Acquire and analyze mobile device data using Cellebrite UFED Touch/4PC, UFED Physical Analyzer, and open-source alternatives (ALEAPP, iLEAPP, MEAT, libimobiledevice) to extract communications, call logs, location data, and application artifacts. Use when extracting or recovering deleted evidence from smartphones or tablets during criminal, corporate, or employee-misuse investigations. domain: cybersecurity subdomain: digital-forensics tags: diff --git a/skills/performing-network-forensics-with-wireshark/SKILL.md b/skills/performing-network-forensics-with-wireshark/SKILL.md index 9e22523a..4d9d654e 100644 --- a/skills/performing-network-forensics-with-wireshark/SKILL.md +++ b/skills/performing-network-forensics-with-wireshark/SKILL.md @@ -1,7 +1,6 @@ --- name: performing-network-forensics-with-wireshark -description: Capture and analyze network traffic using Wireshark and tshark to reconstruct - network events, extract artifacts, and identify malicious communications. +description: Capture and analyze network traffic using Wireshark and tshark to reconstruct network events from PCAP/PCAPNG files, extract transferred files and credentials, and identify command-and-control communications. Use when analyzing captured traffic from a security incident, reconstructing data exfiltration, or finding network indicators of compromise during malware analysis. domain: cybersecurity subdomain: digital-forensics tags: diff --git a/skills/performing-network-packet-capture-analysis/SKILL.md b/skills/performing-network-packet-capture-analysis/SKILL.md index b420106d..5f1dcdf4 100644 --- a/skills/performing-network-packet-capture-analysis/SKILL.md +++ b/skills/performing-network-packet-capture-analysis/SKILL.md @@ -1,9 +1,6 @@ --- name: performing-network-packet-capture-analysis -description: Perform forensic analysis of network packet captures (PCAP/PCAPNG) using - Wireshark, tshark, and tcpdump to reconstruct network communications, extract transferred - files, identify malicious traffic, and establish evidence of data exfiltration or - command-and-control activity. +description: Perform forensic analysis of network packet captures (PCAP/PCAPNG) using Wireshark, tshark, and tcpdump to reconstruct network communications, extract transferred files, identify malicious traffic, and establish evidence of data exfiltration or command-and-control activity. Use when a PCAP file from an incident needs to be examined to prove lateral movement, malware delivery, or unauthorized access. domain: cybersecurity subdomain: digital-forensics tags: diff --git a/skills/performing-network-traffic-analysis-with-tshark/SKILL.md b/skills/performing-network-traffic-analysis-with-tshark/SKILL.md index 1579f9df..8a4edfbf 100644 --- a/skills/performing-network-traffic-analysis-with-tshark/SKILL.md +++ b/skills/performing-network-traffic-analysis-with-tshark/SKILL.md @@ -1,8 +1,6 @@ --- name: performing-network-traffic-analysis-with-tshark -description: Automate network traffic analysis using tshark and pyshark for protocol - statistics, suspicious flow detection, DNS anomaly identification, and IOC extraction - from PCAP files +description: Automate network traffic analysis using tshark (Wireshark CLI) and pyshark to compute protocol distribution statistics, detect suspicious flows such as port scans and beaconing, extract IOCs (IPs, domains, URLs), and identify DNS tunneling patterns from PCAP files. Use when scripted or repeatable analysis of packet captures is needed rather than interactive inspection. domain: cybersecurity subdomain: network-security tags: diff --git a/skills/performing-network-traffic-analysis-with-zeek/SKILL.md b/skills/performing-network-traffic-analysis-with-zeek/SKILL.md index 51ac7aa8..a9198af3 100644 --- a/skills/performing-network-traffic-analysis-with-zeek/SKILL.md +++ b/skills/performing-network-traffic-analysis-with-zeek/SKILL.md @@ -1,7 +1,6 @@ --- name: performing-network-traffic-analysis-with-zeek -description: Deploy Zeek network security monitor to capture, parse, and analyze network - traffic metadata for threat detection, anomaly identification, and forensic investigation. +description: Deploy Zeek (formerly Bro) as a passive network security monitor to generate structured logs of protocol metadata (HTTP, DNS, TLS, SSH, SMTP, FTP, and more), write custom detection scripts, and integrate outputs with SIEM platforms. Use when standing up continuous, high-fidelity network traffic monitoring for threat detection, anomaly identification, or forensic investigation beyond what raw PCAP analysis provides. domain: cybersecurity subdomain: network-security tags: diff --git a/skills/performing-nist-csf-maturity-assessment/SKILL.md b/skills/performing-nist-csf-maturity-assessment/SKILL.md index 4b52f9e6..27e5eead 100644 --- a/skills/performing-nist-csf-maturity-assessment/SKILL.md +++ b/skills/performing-nist-csf-maturity-assessment/SKILL.md @@ -1,10 +1,6 @@ --- name: performing-nist-csf-maturity-assessment -description: The NIST Cybersecurity Framework (CSF) 2.0, released in February 2024, - provides a comprehensive taxonomy for managing cybersecurity risk through six core - Functions - Govern, Identify, Protect, Detect, Respond, and Recover. This skill - covers conducting a maturity assessment against the CSF using Implementation Tiers - to measure organizational cybersecurity posture and create improvement roadmaps. +description: Conduct a NIST Cybersecurity Framework (CSF) 2.0 maturity assessment across the six core Functions (Govern, Identify, Protect, Detect, Respond, Recover), scoring organizational posture against the four Implementation Tiers (Partial, Risk-Informed, Repeatable, Adaptive) and producing an improvement roadmap. Use when benchmarking an organization's cybersecurity program maturity or preparing a CSF-based gap analysis and remediation plan. domain: cybersecurity subdomain: compliance-governance tags: diff --git a/skills/performing-oil-gas-cybersecurity-assessment/SKILL.md b/skills/performing-oil-gas-cybersecurity-assessment/SKILL.md index 7722664d..05d47659 100644 --- a/skills/performing-oil-gas-cybersecurity-assessment/SKILL.md +++ b/skills/performing-oil-gas-cybersecurity-assessment/SKILL.md @@ -1,14 +1,6 @@ --- name: performing-oil-gas-cybersecurity-assessment -description: 'This skill covers conducting cybersecurity assessments specific to oil - and gas facilities including upstream (exploration/production), midstream (pipeline/transport), - and downstream (refining/distribution) operations. It addresses SCADA systems controlling - pipeline operations, DCS for refinery process control, safety instrumented systems - for hazardous processes, remote terminal units at unmanned wellhead sites, and compliance - with API 1164, TSA Pipeline Security Directives, IEC 62443, and NIST Cybersecurity - Framework for critical infrastructure. - - ' +description: Conduct cybersecurity assessments of upstream, midstream, and downstream oil and gas operations, covering pipeline SCADA, refinery DCS, safety instrumented systems, and remote wellhead RTUs, and evaluate compliance with API 1164, TSA Pipeline Security Directives, and IEC 62443. Use when assessing a refinery, pipeline, or production facility or preparing for TSA/API compliance audits; not for IT-only or purely physical-security assessments. domain: cybersecurity subdomain: ot-ics-security tags: diff --git a/skills/performing-osint-with-spiderfoot/SKILL.md b/skills/performing-osint-with-spiderfoot/SKILL.md index 23b0b8ea..3733abb5 100644 --- a/skills/performing-osint-with-spiderfoot/SKILL.md +++ b/skills/performing-osint-with-spiderfoot/SKILL.md @@ -1,8 +1,6 @@ --- name: performing-osint-with-spiderfoot -description: Automate OSINT collection using SpiderFoot REST API and CLI for target - profiling, module-based reconnaissance, and structured result analysis across 200+ - data sources +description: Automate OSINT collection with the SpiderFoot REST API and CLI (sf.py/spiderfoot-cli) across 200+ modules, selecting scan modes (footprint, investigate, passive) and parsing results for domains, IPs, emails, leaked credentials, and DNS records into a target intelligence profile. Use when mapping an organization's attack surface or profiling a target for threat intelligence. domain: cybersecurity subdomain: threat-intelligence tags: diff --git a/skills/performing-ot-vulnerability-assessment-with-claroty/SKILL.md b/skills/performing-ot-vulnerability-assessment-with-claroty/SKILL.md index 8cda0591..2574cb67 100644 --- a/skills/performing-ot-vulnerability-assessment-with-claroty/SKILL.md +++ b/skills/performing-ot-vulnerability-assessment-with-claroty/SKILL.md @@ -1,13 +1,6 @@ --- name: performing-ot-vulnerability-assessment-with-claroty -description: 'This skill covers performing vulnerability assessments in OT environments - using the Claroty xDome platform for comprehensive asset discovery, risk scoring, - vulnerability correlation, and remediation prioritization. It addresses passive - vulnerability identification through traffic analysis, active safe querying of OT - devices, integration with CVE databases and ICS-CERT advisories, and risk-based - prioritization that accounts for operational impact and compensating controls. - - ' +description: Perform OT vulnerability assessments using the Claroty xDome platform for asset discovery, risk scoring, and vulnerability correlation, combining passive traffic-based identification and active safe device querying with CVE/ICS-CERT advisory correlation for remediation prioritization. Use for scheduled IEC 62443 or NERC CIP OT vulnerability assessments, initial xDome deployment, or generating CIP-010-4 compliance evidence; not for active PLC scanning or penetration testing. domain: cybersecurity subdomain: ot-ics-security tags: diff --git a/skills/performing-phishing-simulation-with-gophish/SKILL.md b/skills/performing-phishing-simulation-with-gophish/SKILL.md index a80041d5..51a898fd 100644 --- a/skills/performing-phishing-simulation-with-gophish/SKILL.md +++ b/skills/performing-phishing-simulation-with-gophish/SKILL.md @@ -1,8 +1,6 @@ --- name: performing-phishing-simulation-with-gophish -description: GoPhish is an open-source phishing simulation framework used by security - teams to conduct authorized phishing awareness campaigns. It provides campaign management, - email template creation, landing pag +description: Deploy and run authorized phishing awareness campaigns with GoPhish, covering admin panel setup, SMTP sending profiles, email template and landing page creation, target user groups, and campaign reporting to measure click and credential-submission rates. Use when planning or executing a phishing simulation for employee security-awareness testing or measuring susceptibility to social engineering. domain: cybersecurity subdomain: phishing-defense tags: diff --git a/skills/performing-physical-intrusion-assessment/SKILL.md b/skills/performing-physical-intrusion-assessment/SKILL.md index c704cded..bd08735d 100644 --- a/skills/performing-physical-intrusion-assessment/SKILL.md +++ b/skills/performing-physical-intrusion-assessment/SKILL.md @@ -1,8 +1,6 @@ --- name: performing-physical-intrusion-assessment -description: Conduct authorized physical penetration testing using tailgating, badge - cloning, lock bypassing, and rogue device deployment to evaluate facility security - controls. +description: Conduct authorized physical penetration testing against facilities, server rooms, and restricted areas using tailgating, RFID badge cloning, lock bypassing, rogue network device deployment, and security-guard procedure testing. Use as part of a full-scope red team engagement to evaluate physical security controls and their path to network access, always under signed client authorization. domain: cybersecurity subdomain: red-teaming tags: diff --git a/skills/performing-power-grid-cybersecurity-assessment/SKILL.md b/skills/performing-power-grid-cybersecurity-assessment/SKILL.md index a725a1c2..f06a8b25 100644 --- a/skills/performing-power-grid-cybersecurity-assessment/SKILL.md +++ b/skills/performing-power-grid-cybersecurity-assessment/SKILL.md @@ -1,13 +1,6 @@ --- name: performing-power-grid-cybersecurity-assessment -description: 'This skill covers conducting cybersecurity assessments of electric power - grid infrastructure including generation facilities, transmission substations, distribution - systems, and energy management system (EMS) control centers. It addresses NERC CIP - compliance verification, substation automation security, IEC 61850 protocol analysis, - synchrophasor (PMU) network security, and the unique threat landscape targeting - power grid operations as demonstrated by Industroyer/CrashOverride and related attacks. - - ' +description: Conduct cybersecurity assessments of power grid infrastructure spanning generation, transmission substations, distribution, and EMS control centers, covering NERC CIP compliance verification, IEC 61850 (GOOSE/MMS) substation protocol analysis, and synchrophasor (PMU) network security against threats like Industroyer/CrashOverride. Use for periodic NERC CIP assessments, substation automation or EMS/SCADA security reviews, or regional entity compliance audits; not for non-BES systems or generic OT assessments without power grid specifics. domain: cybersecurity subdomain: ot-ics-security tags: diff --git a/skills/performing-privilege-escalation-on-linux/SKILL.md b/skills/performing-privilege-escalation-on-linux/SKILL.md index 7928be37..b67fd86f 100644 --- a/skills/performing-privilege-escalation-on-linux/SKILL.md +++ b/skills/performing-privilege-escalation-on-linux/SKILL.md @@ -1,8 +1,10 @@ --- name: performing-privilege-escalation-on-linux -description: Linux privilege escalation involves elevating from a low-privilege user - account to root access on a compromised system. Red teams exploit misconfigurations, - vulnerable services, kernel exploits, and w +description: Guides manual enumeration and automated tooling to escalate from a low-privilege + Linux user to root by exploiting misconfigurations, vulnerable services, kernel exploits, + and weak permissions, mapped to MITRE ATT&CK. Use during authorized red team engagements + or penetration tests once initial low-privilege access on a Linux host is obtained + and root-level access is needed. domain: cybersecurity subdomain: red-teaming tags: diff --git a/skills/performing-privileged-account-access-review/SKILL.md b/skills/performing-privileged-account-access-review/SKILL.md index 209ff45b..7f6bdb4a 100644 --- a/skills/performing-privileged-account-access-review/SKILL.md +++ b/skills/performing-privileged-account-access-review/SKILL.md @@ -1,7 +1,10 @@ --- name: performing-privileged-account-access-review -description: Conduct systematic reviews of privileged accounts to validate access - rights, identify excessive permissions, and enforce least privilege across PAM infrastructure. +description: Conducts systematic reviews of privileged accounts to validate access + rights, identify excessive or stale permissions, and enforce least privilege across + PAM infrastructure. Use when auditing privileged access for compliance, periodic + access recertification, or investigating whether privileged entitlements are still + justified. domain: cybersecurity subdomain: identity-access-management tags: diff --git a/skills/performing-privileged-account-discovery/SKILL.md b/skills/performing-privileged-account-discovery/SKILL.md index 5e781e14..0a786676 100644 --- a/skills/performing-privileged-account-discovery/SKILL.md +++ b/skills/performing-privileged-account-discovery/SKILL.md @@ -1,8 +1,10 @@ --- name: performing-privileged-account-discovery -description: Discover and inventory all privileged accounts across enterprise infrastructure +description: Discovers and inventories privileged accounts across enterprise infrastructure, including domain admins, local admins, service accounts, database admins, cloud - IAM roles, and application admin account + IAM roles, and application admin accounts, using automated scanning and risk classification. + Use when building a privileged account inventory, onboarding accounts to a PAM + solution, or scoping which accounts need privileged-access controls. domain: cybersecurity subdomain: identity-access-management tags: diff --git a/skills/performing-purple-team-atomic-testing/SKILL.md b/skills/performing-purple-team-atomic-testing/SKILL.md index 32ce8d02..c6bce520 100644 --- a/skills/performing-purple-team-atomic-testing/SKILL.md +++ b/skills/performing-purple-team-atomic-testing/SKILL.md @@ -1,12 +1,10 @@ --- name: performing-purple-team-atomic-testing -description: 'Executes Atomic Red Team tests mapped to MITRE ATT&CK techniques, performs - coverage gap analysis across the ATT&CK matrix, and runs detection validation loops - to measure blue team visibility. Covers Invoke-AtomicRedTeam PowerShell execution, - ATT&CK Navigator layer generation for heatmaps, Sigma rule correlation, and continuous - atomic testing pipelines. Activates for requests involving purple team exercises, - atomic test execution, ATT&CK coverage assessment, detection engineering validation, - or adversary emulation testing. +description: 'Executes Atomic Red Team tests mapped to MITRE ATT&CK via Invoke-AtomicRedTeam + PowerShell, generates ATT&CK Navigator coverage heatmaps, correlates results against + Sigma rules, and runs detection validation loops to measure blue team visibility. + Use for purple team exercises, atomic test execution, ATT&CK coverage assessment, + or detection engineering validation. ' domain: cybersecurity diff --git a/skills/performing-ransomware-response/SKILL.md b/skills/performing-ransomware-response/SKILL.md index efbbe421..958dc6ac 100644 --- a/skills/performing-ransomware-response/SKILL.md +++ b/skills/performing-ransomware-response/SKILL.md @@ -1,11 +1,10 @@ --- name: performing-ransomware-response -description: 'Executes a structured ransomware incident response from initial detection - through containment, forensic analysis, decryption assessment, recovery, and post-incident - hardening. Addresses ransom negotiation considerations, backup integrity verification, - and regulatory notification requirements. Activates for requests involving ransomware - response, ransomware recovery, crypto-ransomware, data encryption attack, ransom - payment decision, or ransomware containment. +description: 'Executes a structured ransomware incident response from detection through + containment, forensic analysis, decryption assessment, recovery, and post-incident + hardening, covering ransom negotiation, backup integrity verification, and regulatory + notification. Use when actively responding to a ransomware outbreak or crypto-ransomware + infection, or deciding on ransom payment and containment steps. ' domain: cybersecurity diff --git a/skills/performing-ransomware-tabletop-exercise/SKILL.md b/skills/performing-ransomware-tabletop-exercise/SKILL.md index de648b95..97a2b1e4 100644 --- a/skills/performing-ransomware-tabletop-exercise/SKILL.md +++ b/skills/performing-ransomware-tabletop-exercise/SKILL.md @@ -1,12 +1,10 @@ --- name: performing-ransomware-tabletop-exercise -description: 'Plans and facilitates tabletop exercises simulating ransomware incidents - to test organizational readiness, decision-making, and communication procedures. - Designs realistic scenarios based on current ransomware threat actors (LockBit, - ALPHV/BlackCat, Cl0p), injects covering double extortion, backup destruction, and - regulatory notification requirements. Evaluates participant responses against NIST - CSF and CISA guidelines. Activates for requests involving ransomware tabletop, incident - response exercise, or ransomware readiness drill. +description: 'Plans and facilitates tabletop exercises simulating ransomware incidents, + using realistic scenarios based on threat actors like LockBit and ALPHV/BlackCat + with injects covering double extortion and backup destruction, then evaluates responses + against NIST CSF and CISA guidelines. Use when planning or running a ransomware + tabletop exercise or incident response readiness drill. ' domain: cybersecurity diff --git a/skills/performing-red-team-phishing-with-gophish/SKILL.md b/skills/performing-red-team-phishing-with-gophish/SKILL.md index e96d66c3..08148776 100644 --- a/skills/performing-red-team-phishing-with-gophish/SKILL.md +++ b/skills/performing-red-team-phishing-with-gophish/SKILL.md @@ -1,10 +1,10 @@ --- name: performing-red-team-phishing-with-gophish -description: Automate GoPhish phishing simulation campaigns using the Python gophish - library. Creates email templates with tracking pixels, configures SMTP sending profiles, - builds target groups from CSV, launches campaigns, and analyzes results including - open rates, click rates, and credential submission statistics for security awareness - assessment. +description: Automates GoPhish phishing simulation campaigns using the Python gophish + library, creating email templates with tracking pixels, configuring SMTP sending + profiles, building target groups from CSV, launching campaigns, and analyzing results + such as open rates, click rates, and credential submission statistics. Use when + running an authorized phishing simulation or security awareness assessment via GoPhish. domain: cybersecurity subdomain: security-operations tags: diff --git a/skills/performing-red-team-with-covenant/SKILL.md b/skills/performing-red-team-with-covenant/SKILL.md index 17a27bc4..d6f055e4 100644 --- a/skills/performing-red-team-with-covenant/SKILL.md +++ b/skills/performing-red-team-with-covenant/SKILL.md @@ -1,8 +1,9 @@ --- name: performing-red-team-with-covenant -description: Conduct red team operations using the Covenant C2 framework for authorized - adversary simulation, including listener setup, grunt deployment, task execution, - and lateral movement tracking. +description: Conducts red team operations using the Covenant C2 framework for authorized + adversary simulation, covering listener setup, grunt deployment, task execution, + and lateral movement tracking. Use when standing up or operating a Covenant command-and-control + server for an authorized red team engagement. domain: cybersecurity subdomain: red-team tags: diff --git a/skills/performing-service-account-credential-rotation/SKILL.md b/skills/performing-service-account-credential-rotation/SKILL.md index eb39279b..6b52f3b4 100644 --- a/skills/performing-service-account-credential-rotation/SKILL.md +++ b/skills/performing-service-account-credential-rotation/SKILL.md @@ -1,8 +1,9 @@ --- name: performing-service-account-credential-rotation -description: Automate credential rotation for service accounts across Active Directory, +description: Automates credential rotation for service accounts across Active Directory, cloud platforms, and application databases to eliminate stale secrets and reduce - compromise risk. + compromise risk. Use when rotating or automating rotation of service account passwords, + API keys, or secrets stored in a vault. domain: cybersecurity subdomain: identity-access-management tags: diff --git a/skills/performing-soap-web-service-security-testing/SKILL.md b/skills/performing-soap-web-service-security-testing/SKILL.md index ad4106c4..0030dc52 100644 --- a/skills/performing-soap-web-service-security-testing/SKILL.md +++ b/skills/performing-soap-web-service-security-testing/SKILL.md @@ -1,7 +1,9 @@ --- name: performing-soap-web-service-security-testing -description: Perform security testing of SOAP web services by analyzing WSDL definitions - and testing for XML injection, XXE, WS-Security bypass, and SOAPAction spoofing. +description: Performs security testing of SOAP web services by analyzing WSDL definitions + and testing for XML injection, XXE, WS-Security bypass, SOAPAction spoofing, and + XPath injection. Use when assessing a SOAP/WSDL-based API endpoint for XML-related + vulnerabilities during a penetration test. domain: cybersecurity subdomain: api-security tags: diff --git a/skills/performing-sqlite-database-forensics/SKILL.md b/skills/performing-sqlite-database-forensics/SKILL.md index da954b99..5f111e92 100644 --- a/skills/performing-sqlite-database-forensics/SKILL.md +++ b/skills/performing-sqlite-database-forensics/SKILL.md @@ -1,8 +1,11 @@ --- name: performing-sqlite-database-forensics -description: Perform forensic analysis of SQLite databases to recover deleted records - from freelists and WAL files, decode encoded timestamps, and extract evidence from - browser history, messaging apps, and mobile device databases. +description: Performs forensic analysis of SQLite databases by examining B-tree page + structures, recovering deleted records from freelist pages and Write-Ahead Log (WAL) + files, decoding encoded timestamps, and extracting evidence from browser history, + messaging apps, and mobile device databases. Use when recovering deleted or unallocated + data from a SQLite database during digital forensics or mobile/browser evidence + analysis. domain: cybersecurity subdomain: digital-forensics tags: diff --git a/skills/performing-ssl-certificate-lifecycle-management/SKILL.md b/skills/performing-ssl-certificate-lifecycle-management/SKILL.md index 33ab7281..c8d7071d 100644 --- a/skills/performing-ssl-certificate-lifecycle-management/SKILL.md +++ b/skills/performing-ssl-certificate-lifecycle-management/SKILL.md @@ -1,8 +1,10 @@ --- name: performing-ssl-certificate-lifecycle-management -description: SSL/TLS certificate lifecycle management encompasses the full process - of requesting, issuing, deploying, monitoring, renewing, and revoking X.509 certificates. - Poor certificate management is a leading +description: Automates the full SSL/TLS certificate lifecycle, including generating + Certificate Signing Requests, issuing, deploying, monitoring, renewing, and revoking + X.509 certificates, using Python and ACME protocol tools. Use when managing certificate + issuance or renewal, preventing certificate-expiry outages, or building automated + PKI/ACME workflows. domain: cybersecurity subdomain: cryptography tags: diff --git a/skills/performing-ssl-stripping-attack/SKILL.md b/skills/performing-ssl-stripping-attack/SKILL.md index 443f6877..8e8c6887 100644 --- a/skills/performing-ssl-stripping-attack/SKILL.md +++ b/skills/performing-ssl-stripping-attack/SKILL.md @@ -1,11 +1,12 @@ --- name: performing-ssl-stripping-attack -description: 'Simulates SSL stripping attacks using sslstrip, Bettercap, and mitmproxy - in authorized environments to test HSTS enforcement, certificate validation, and - HTTPS upgrade mechanisms that protect users from downgrade attacks on encrypted - connections. - - ' +description: >- + Simulates SSL stripping / HTTPS downgrade attacks using sslstrip, Bettercap, + and mitmproxy in authorized lab environments to test HSTS enforcement, + certificate validation, and HTTPS upgrade mechanisms. Use when performing an + authorized penetration test to validate HSTS preloading and TLS certificate + handling, demonstrate downgrade-attack risk to stakeholders, or train SOC + teams to detect SSL stripping indicators in network traffic. domain: cybersecurity subdomain: network-security tags: diff --git a/skills/performing-ssl-tls-inspection-configuration/SKILL.md b/skills/performing-ssl-tls-inspection-configuration/SKILL.md index 9bf32d85..02a0454f 100644 --- a/skills/performing-ssl-tls-inspection-configuration/SKILL.md +++ b/skills/performing-ssl-tls-inspection-configuration/SKILL.md @@ -1,8 +1,12 @@ --- name: performing-ssl-tls-inspection-configuration -description: Configure SSL/TLS inspection on network security devices to decrypt, - inspect, and re-encrypt HTTPS traffic for threat detection while managing certificates, - exemptions, and privacy compliance. +description: >- + Configure SSL/TLS break-and-inspect on next-generation firewalls and forward + proxies to decrypt, inspect, and re-encrypt HTTPS traffic for malware and + exfiltration detection, including deploying trusted CA certificates, + managing exemptions for certificate-pinned apps, and privacy compliance. Use + when setting up or auditing TLS inspection on network security devices to + close the encrypted-traffic blind spot. domain: cybersecurity subdomain: network-security tags: diff --git a/skills/performing-ssl-tls-security-assessment/SKILL.md b/skills/performing-ssl-tls-security-assessment/SKILL.md index e6db9928..151c46e7 100644 --- a/skills/performing-ssl-tls-security-assessment/SKILL.md +++ b/skills/performing-ssl-tls-security-assessment/SKILL.md @@ -1,8 +1,12 @@ --- name: performing-ssl-tls-security-assessment -description: Assess SSL/TLS server configurations using the sslyze Python library - to evaluate cipher suites, certificate chains, protocol versions, HSTS headers, - and known vulnerabilities like Heartbleed and ROBOT. +description: >- + Assess SSL/TLS server configurations using the sslyze Python scanning + library to evaluate supported protocol versions, cipher suite strength, + certificate chain validation, HSTS enforcement, OCSP stapling, and known + vulnerabilities such as Heartbleed and ROBOT. Use when conducting a security + assessment of a server's TLS configuration or verifying remediation of + cipher/certificate weaknesses. domain: cybersecurity subdomain: network-security tags: diff --git a/skills/performing-ssrf-vulnerability-exploitation/SKILL.md b/skills/performing-ssrf-vulnerability-exploitation/SKILL.md index 73e107bd..805d5f21 100644 --- a/skills/performing-ssrf-vulnerability-exploitation/SKILL.md +++ b/skills/performing-ssrf-vulnerability-exploitation/SKILL.md @@ -1,9 +1,12 @@ --- name: performing-ssrf-vulnerability-exploitation -description: Test for Server-Side Request Forgery vulnerabilities by probing cloud - metadata endpoints, internal network services, and protocol handlers through user-controllable - URL parameters. Tests AWS/GCP/Azure metadata APIs (169.254.169.254), internal port - scanning via HTTP, URL scheme bypass techniques, and DNS rebinding detection. +description: >- + Tests web application URL parameters for Server-Side Request Forgery by + probing cloud metadata endpoints (AWS/GCP/Azure at 169.254.169.254), + internal network services, and protocol handlers (file://, gopher://, + dict://) using a Python script, including IP-encoding bypass and DNS + rebinding checks. Use during authorized penetration testing to confirm SSRF + in a URL-fetching parameter and generate a vulnerability report. domain: cybersecurity subdomain: security-operations tags: diff --git a/skills/performing-static-malware-analysis-with-pe-studio/SKILL.md b/skills/performing-static-malware-analysis-with-pe-studio/SKILL.md index ee2c605c..07b571c6 100644 --- a/skills/performing-static-malware-analysis-with-pe-studio/SKILL.md +++ b/skills/performing-static-malware-analysis-with-pe-studio/SKILL.md @@ -1,13 +1,11 @@ --- name: performing-static-malware-analysis-with-pe-studio -description: 'Performs static analysis of Windows PE (Portable Executable) malware - samples using PEStudio to examine file headers, imports, strings, resources, and - indicators without executing the binary. Identifies suspicious characteristics including - packing, anti-analysis techniques, and malicious imports. Activates for requests - involving static malware analysis, PE file inspection, Windows executable analysis, - or pre-execution malware triage. - - ' +description: >- + Performs static analysis of Windows PE malware samples using PEStudio to + examine file headers, imports, strings, and resources without executing + the binary, identifying packing, anti-analysis tricks, and malicious + imports. Use for pre-execution triage of a suspicious Windows executable + before sandbox detonation. domain: cybersecurity subdomain: malware-analysis tags: diff --git a/skills/performing-steganography-detection/SKILL.md b/skills/performing-steganography-detection/SKILL.md index 63e2a9ff..8ae3e76d 100644 --- a/skills/performing-steganography-detection/SKILL.md +++ b/skills/performing-steganography-detection/SKILL.md @@ -1,7 +1,12 @@ --- name: performing-steganography-detection -description: Detect and extract hidden data embedded in images, audio, and other media - files using steganalysis tools to uncover covert communication channels. +description: >- + Detects and extracts hidden data embedded in images, audio, and other media + files using steganalysis tools such as StegDetect, zsteg, stegsolve, + binwalk, steghide, and OpenStego to uncover covert communication channels. + Use when investigating suspected data hiding or exfiltration via media + files, espionage/insider-threat cases, or anomalies in media file + properties found during standard file analysis. domain: cybersecurity subdomain: digital-forensics tags: diff --git a/skills/performing-supply-chain-attack-simulation/SKILL.md b/skills/performing-supply-chain-attack-simulation/SKILL.md index 99adc7b3..4c652e76 100644 --- a/skills/performing-supply-chain-attack-simulation/SKILL.md +++ b/skills/performing-supply-chain-attack-simulation/SKILL.md @@ -1,9 +1,12 @@ --- name: performing-supply-chain-attack-simulation -description: Simulate and detect software supply chain attacks including typosquatting - detection via Levenshtein distance, dependency confusion testing against private - registries, package hash verification with pip, and known vulnerability scanning - with pip-audit. +description: >- + Simulates and detects software supply chain attacks: typosquatting + detection via Levenshtein distance against popular PyPI package names, + dependency confusion testing against private registries, SHA-256 package + hash verification, and known-CVE scanning with pip-audit. Use when auditing + a project's dependencies for malicious or confused packages, or when + assessing package-registry supply-chain risk. domain: cybersecurity subdomain: application-security tags: diff --git a/skills/performing-threat-intelligence-sharing-with-misp/SKILL.md b/skills/performing-threat-intelligence-sharing-with-misp/SKILL.md index e265ffdb..ae2ad8b7 100644 --- a/skills/performing-threat-intelligence-sharing-with-misp/SKILL.md +++ b/skills/performing-threat-intelligence-sharing-with-misp/SKILL.md @@ -1,8 +1,12 @@ --- name: performing-threat-intelligence-sharing-with-misp -description: Use PyMISP to create, enrich, and share threat intelligence events on - a MISP platform, including IOC management, feed integration, STIX export, and community - sharing workflows. +description: >- + Uses PyMISP (the official MISP REST API library) to create events with + structured IOCs (IPs, domains, hashes, URLs), enrich them with MITRE ATT&CK + tags and galaxy clusters, manage sharing groups and distribution levels, + search existing intelligence, and export in STIX 2.1 format. Use when + creating, enriching, or sharing threat intelligence events on a MISP + instance, or integrating IOC feeds with other platforms. domain: cybersecurity subdomain: threat-intelligence tags: diff --git a/skills/performing-threat-landscape-assessment-for-sector/SKILL.md b/skills/performing-threat-landscape-assessment-for-sector/SKILL.md index b9c6811e..5db9bbb0 100644 --- a/skills/performing-threat-landscape-assessment-for-sector/SKILL.md +++ b/skills/performing-threat-landscape-assessment-for-sector/SKILL.md @@ -1,8 +1,12 @@ --- name: performing-threat-landscape-assessment-for-sector -description: Conduct a sector-specific threat landscape assessment by analyzing threat - actor targeting patterns, common attack vectors, and industry-specific vulnerabilities - to inform organizational risk management. +description: >- + Conducts a sector-specific threat landscape assessment (financial, + healthcare, energy, government, etc.) by profiling targeting threat actors, + mapping attack vectors and MITRE ATT&CK TTPs with the attackcti/pandas + Python stack, and analyzing exploited CVEs and incident trends from ISAC + and vendor reports. Use when producing CTI for risk management or + board-level reporting on an industry's threat exposure. domain: cybersecurity subdomain: threat-intelligence tags: diff --git a/skills/performing-threat-modeling-with-owasp-threat-dragon/SKILL.md b/skills/performing-threat-modeling-with-owasp-threat-dragon/SKILL.md index a5dcda65..dea40797 100644 --- a/skills/performing-threat-modeling-with-owasp-threat-dragon/SKILL.md +++ b/skills/performing-threat-modeling-with-owasp-threat-dragon/SKILL.md @@ -1,8 +1,11 @@ --- name: performing-threat-modeling-with-owasp-threat-dragon -description: Use OWASP Threat Dragon to create data flow diagrams, identify threats - using STRIDE and LINDDUN methodologies, and generate threat model reports for secure - design review. +description: >- + Uses OWASP Threat Dragon (web or desktop) to build data flow diagrams, + identify threats with STRIDE, LINDDUN, CIA, DIE, or PLOT4ai methodologies + via its auto-generation rule engine, and produce PDF threat model reports. + Use during secure design review of an application architecture to build a + formal threat model and document mitigations for GRC compliance. domain: cybersecurity subdomain: devsecops tags: diff --git a/skills/performing-timeline-reconstruction-with-plaso/SKILL.md b/skills/performing-timeline-reconstruction-with-plaso/SKILL.md index 90c2a35e..5f5d7906 100644 --- a/skills/performing-timeline-reconstruction-with-plaso/SKILL.md +++ b/skills/performing-timeline-reconstruction-with-plaso/SKILL.md @@ -1,8 +1,12 @@ --- name: performing-timeline-reconstruction-with-plaso -description: Build comprehensive forensic super-timelines using Plaso (log2timeline) - to correlate events across file systems, logs, and artifacts into a unified chronological - view. +description: >- + Builds comprehensive forensic super-timelines using Plaso (log2timeline and + psort) to correlate events across file system metadata, event logs, browser + history, and registry artifacts into a unified chronological view. Use + during complex forensic investigations that need cross-source event + correlation, or when standard log analysis is insufficient to establish the + sequence of activities for reporting findings. domain: cybersecurity subdomain: digital-forensics tags: diff --git a/skills/performing-vlan-hopping-attack/SKILL.md b/skills/performing-vlan-hopping-attack/SKILL.md index 8773ea34..4d7dd996 100644 --- a/skills/performing-vlan-hopping-attack/SKILL.md +++ b/skills/performing-vlan-hopping-attack/SKILL.md @@ -1,10 +1,12 @@ --- name: performing-vlan-hopping-attack -description: 'Simulates VLAN hopping attacks using switch spoofing and double tagging - techniques in authorized environments to test VLAN segmentation effectiveness and - validate switch port security configurations against Layer 2 bypass attacks. - - ' +description: >- + Simulates VLAN hopping attacks using switch spoofing and 802.1Q double + tagging techniques in authorized lab environments to test VLAN segmentation + effectiveness and switch port security. Use during an authorized + penetration test to validate trunk port hardening, confirm DTP is disabled + on access ports, and demonstrate Layer 2 segmentation bypass risk to + network teams. domain: cybersecurity subdomain: network-security tags: diff --git a/skills/performing-web-application-firewall-bypass/SKILL.md b/skills/performing-web-application-firewall-bypass/SKILL.md index b54ff882..c381130f 100644 --- a/skills/performing-web-application-firewall-bypass/SKILL.md +++ b/skills/performing-web-application-firewall-bypass/SKILL.md @@ -1,8 +1,11 @@ --- name: performing-web-application-firewall-bypass -description: Bypass Web Application Firewall protections using encoding techniques, - HTTP method manipulation, parameter pollution, and payload obfuscation to deliver - SQL injection, XSS, and other attack payloads past WAF detection rules. +description: Bypasses Web Application Firewall protections using encoding tricks, + HTTP method manipulation, parameter pollution, and payload obfuscation to smuggle + SQL injection, XSS, and other exploit payloads past WAF detection rules. Use when + a confirmed vulnerability is blocked by a WAF, during penetration tests or red + team engagements requiring bypass of perimeter security controls, or when evaluating + WAF rule effectiveness and bypass resistance. domain: cybersecurity subdomain: web-application-security tags: diff --git a/skills/performing-web-application-scanning-with-nikto/SKILL.md b/skills/performing-web-application-scanning-with-nikto/SKILL.md index df179bdb..7ed8cee7 100644 --- a/skills/performing-web-application-scanning-with-nikto/SKILL.md +++ b/skills/performing-web-application-scanning-with-nikto/SKILL.md @@ -1,8 +1,11 @@ --- name: performing-web-application-scanning-with-nikto -description: Nikto is an open-source web server and web application scanner that tests - against over 7,000 potentially dangerous files/programs, checks for outdated versions - of over 1,250 servers, and identifies ve +description: Runs Nikto, an open-source web server and web application scanner, + to test over 7,000 potentially dangerous files/programs, check for outdated versions + across 1,250+ servers, and identify XSS, SQL injection, misconfigurations, default + credentials, and vulnerable CGI scripts. Use when performing web application vulnerability + scanning, security assessments, scheduled security testing, or validating web + server security controls. domain: cybersecurity subdomain: vulnerability-management tags: diff --git a/skills/performing-web-application-vulnerability-triage/SKILL.md b/skills/performing-web-application-vulnerability-triage/SKILL.md index 2e74ce8c..2b6f2937 100644 --- a/skills/performing-web-application-vulnerability-triage/SKILL.md +++ b/skills/performing-web-application-vulnerability-triage/SKILL.md @@ -1,8 +1,10 @@ --- name: performing-web-application-vulnerability-triage -description: Triage web application vulnerability findings from DAST/SAST scanners - using OWASP risk rating methodology to separate true positives from false positives - and prioritize remediation. +description: Triages web application vulnerability findings from DAST/SAST scanners + such as Burp Suite and ZAP, using the OWASP Risk Rating Methodology to confirm + true positives, dismiss false positives, and prioritize remediation. Use when + reviewing scanner output to reduce alert fatigue and rank vulnerabilities for + development teams to fix. domain: cybersecurity subdomain: vulnerability-management tags: diff --git a/skills/performing-web-cache-deception-attack/SKILL.md b/skills/performing-web-cache-deception-attack/SKILL.md index 55d6b486..cad7a195 100644 --- a/skills/performing-web-cache-deception-attack/SKILL.md +++ b/skills/performing-web-cache-deception-attack/SKILL.md @@ -1,8 +1,11 @@ --- name: performing-web-cache-deception-attack -description: Execute web cache deception attacks by exploiting path normalization - discrepancies between CDN caching layers and origin servers to cache and retrieve - sensitive authenticated content. +description: Executes web cache deception attacks by exploiting path normalization + discrepancies between CDN/reverse-proxy caching layers (Cloudflare, Akamai, Varnish, + Nginx) and origin servers to cache and retrieve sensitive authenticated content. + Use when testing applications behind CDNs for cache-key misconfigurations, during + bug bounty hunting on aggressively cached sites, or when assessing sensitive data + exposure through cache layer misconfiguration. domain: cybersecurity subdomain: web-application-security tags: diff --git a/skills/performing-windows-artifact-analysis-with-eric-zimmerman-tools/SKILL.md b/skills/performing-windows-artifact-analysis-with-eric-zimmerman-tools/SKILL.md index 454bb060..17e19d8d 100644 --- a/skills/performing-windows-artifact-analysis-with-eric-zimmerman-tools/SKILL.md +++ b/skills/performing-windows-artifact-analysis-with-eric-zimmerman-tools/SKILL.md @@ -1,9 +1,10 @@ --- name: performing-windows-artifact-analysis-with-eric-zimmerman-tools -description: Perform comprehensive Windows forensic artifact analysis using Eric Zimmerman's - open-source EZ Tools suite including KAPE, MFTECmd, PECmd, LECmd, JLECmd, and Timeline - Explorer for parsing registry hives, prefetch files, event logs, and file system - metadata. +description: Performs comprehensive Windows forensic artifact analysis using Eric + Zimmerman's open-source EZ Tools suite (KAPE, MFTECmd, PECmd, LECmd, JLECmd, Timeline + Explorer) to parse registry hives, prefetch files, event logs, and file system + metadata. Use during DFIR investigations that need a timeline of program execution, + file access, and persistence built from Windows artifacts. domain: cybersecurity subdomain: digital-forensics tags: diff --git a/skills/performing-yara-rule-development-for-detection/SKILL.md b/skills/performing-yara-rule-development-for-detection/SKILL.md index 1ddc3f40..224f0f3d 100644 --- a/skills/performing-yara-rule-development-for-detection/SKILL.md +++ b/skills/performing-yara-rule-development-for-detection/SKILL.md @@ -1,8 +1,10 @@ --- name: performing-yara-rule-development-for-detection -description: Develop precise YARA rules for malware detection by identifying unique - byte patterns, strings, and behavioral indicators in executable files while minimizing - false positives. +description: Develops precise YARA and YARA-X rules for malware detection by identifying + unique strings, byte sequences, PE header traits, and behavioral indicators in + unpacked malware artifacts while minimizing false positives. Use when building + detection signatures for threat hunting, classifying malware families, or authoring + rules from IOCs such as C2 URLs, mutex names, and encryption constants. domain: cybersecurity subdomain: malware-analysis tags: diff --git a/skills/post-exploiting-microsoft-graph-with-graphrunner/SKILL.md b/skills/post-exploiting-microsoft-graph-with-graphrunner/SKILL.md index 0e36533b..5879c664 100644 --- a/skills/post-exploiting-microsoft-graph-with-graphrunner/SKILL.md +++ b/skills/post-exploiting-microsoft-graph-with-graphrunner/SKILL.md @@ -1,6 +1,11 @@ --- name: post-exploiting-microsoft-graph-with-graphrunner -description: Perform recon, persistence, privilege escalation, and data search via the Microsoft Graph API using GraphRunner. +description: Runs GraphRunner, a PowerShell post-exploitation toolset built on + the Microsoft Graph API, to perform tenant recon, establish persistence (OAuth + app injection, inbox rules), escalate privilege via group manipulation, and pillage + mailboxes, SharePoint, and Teams data from a foothold Graph token. Use during + authorized red-team engagements against Microsoft 365/Entra ID tenants once you + hold a Graph token. domain: cybersecurity subdomain: identity-access-management tags: diff --git a/skills/recovering-deleted-files-with-photorec/SKILL.md b/skills/recovering-deleted-files-with-photorec/SKILL.md index 6c4e8cc8..0a061d36 100644 --- a/skills/recovering-deleted-files-with-photorec/SKILL.md +++ b/skills/recovering-deleted-files-with-photorec/SKILL.md @@ -1,7 +1,9 @@ --- name: recovering-deleted-files-with-photorec -description: Recover deleted files from disk images and storage media using PhotoRec's - file signature-based carving engine regardless of file system damage. +description: Recovers deleted files from disk images and storage media using PhotoRec's + file signature-based carving engine, which works regardless of file system damage + or corruption. Use when recovering deleted or lost files from a forensic disk + image, damaged storage device, or corrupted file system during evidence recovery. domain: cybersecurity subdomain: digital-forensics tags: diff --git a/skills/recovering-from-ransomware-attack/SKILL.md b/skills/recovering-from-ransomware-attack/SKILL.md index ddc6c01c..a6ee1aec 100644 --- a/skills/recovering-from-ransomware-attack/SKILL.md +++ b/skills/recovering-from-ransomware-attack/SKILL.md @@ -1,12 +1,11 @@ --- name: recovering-from-ransomware-attack -description: 'Executes structured recovery from a ransomware incident following NIST - and CISA frameworks, including environment isolation, forensic evidence preservation, - clean infrastructure rebuild, prioritized system restoration from verified backups, - credential reset, and validation against re-infection. Covers Active Directory recovery, - database restoration, and application stack rebuild in dependency order. Activates - for requests involving ransomware recovery, post-encryption restoration, or disaster - recovery from ransomware. +description: 'Executes structured ransomware incident recovery following NIST/CISA + frameworks: environment isolation, forensic evidence preservation, clean infrastructure + rebuild, prioritized restoration from verified backups, credential reset, and + Active Directory/database recovery in dependency order. Use when recovering from + a ransomware attack, performing post-encryption restoration, or executing disaster + recovery after ransomware encryption. ' domain: cybersecurity diff --git a/skills/red-teaming-llms-with-garak/SKILL.md b/skills/red-teaming-llms-with-garak/SKILL.md index 9693a477..ccfe522a 100644 --- a/skills/red-teaming-llms-with-garak/SKILL.md +++ b/skills/red-teaming-llms-with-garak/SKILL.md @@ -1,6 +1,11 @@ --- name: red-teaming-llms-with-garak -description: Run NVIDIA garak probe suites against an LLM endpoint to test for jailbreaks, prompt injection, data leakage, and toxic generation, then interpret the hit-rate report for triage and reporting. +description: Runs NVIDIA garak probe suites (jailbreak, prompt injection, data + leakage, toxicity, and more) against an LLM endpoint - Hugging Face models, OpenAI-compatible + APIs, or Bedrock - then interprets the resulting hit-rate report for triage. Use + when baselining LLM security before/after deployment, validating that a guardrail + or fine-tune reduces jailbreak/injection success rates, or producing evidence + for an AI risk assessment. domain: cybersecurity subdomain: ai-security tags: diff --git a/skills/relaying-ntlm-for-adcs-esc8/SKILL.md b/skills/relaying-ntlm-for-adcs-esc8/SKILL.md index fb5436ce..3f61f6ca 100644 --- a/skills/relaying-ntlm-for-adcs-esc8/SKILL.md +++ b/skills/relaying-ntlm-for-adcs-esc8/SKILL.md @@ -1,6 +1,10 @@ --- name: relaying-ntlm-for-adcs-esc8 -description: Run ntlmrelayx into ADCS web enrollment to obtain a domain controller certificate via ESC8. +description: Uses Impacket's ntlmrelayx.py with a coercion tool (PetitPotam, Coercer, + printerbug) to relay NTLM authentication from a coerced domain controller into + the AD CS HTTP web-enrollment endpoint (ESC8), obtaining a DC certificate usable + via Certipy for PKINIT/DCSync. Use during internal AD penetration tests or purple-team + exercises when AD CS Web Enrollment lacks Extended Protection for Authentication. domain: cybersecurity subdomain: red-teaming tags: diff --git a/skills/remediating-s3-bucket-misconfiguration/SKILL.md b/skills/remediating-s3-bucket-misconfiguration/SKILL.md index 7fe68828..d65625b1 100644 --- a/skills/remediating-s3-bucket-misconfiguration/SKILL.md +++ b/skills/remediating-s3-bucket-misconfiguration/SKILL.md @@ -1,10 +1,11 @@ --- name: remediating-s3-bucket-misconfiguration -description: 'This skill provides step-by-step procedures for identifying and remediating - Amazon S3 bucket misconfigurations that expose sensitive data to unauthorized access. - It covers enabling S3 Block Public Access at account and bucket levels, auditing - bucket policies and ACLs, enforcing encryption, configuring access logging, and - deploying automated remediation using AWS Config and Lambda. +description: 'Provides step-by-step procedures for remediating Amazon S3 bucket + misconfigurations that expose sensitive data: enabling S3 Block Public Access, + auditing bucket policies and ACLs, enforcing encryption, configuring access logging, + and deploying automated remediation with AWS Config and Lambda. Use when AWS Config + or Security Hub flags public or unencrypted S3 buckets, or preparing audit evidence + for storage security controls. ' domain: cybersecurity diff --git a/skills/reverse-engineering-android-malware-with-jadx/SKILL.md b/skills/reverse-engineering-android-malware-with-jadx/SKILL.md index 79488890..d1068d5f 100644 --- a/skills/reverse-engineering-android-malware-with-jadx/SKILL.md +++ b/skills/reverse-engineering-android-malware-with-jadx/SKILL.md @@ -1,11 +1,11 @@ --- name: reverse-engineering-android-malware-with-jadx -description: 'Reverse engineers malicious Android APK files using JADX decompiler - to analyze Java/Kotlin source code, identify malicious functionality including data - theft, C2 communication, privilege escalation, and overlay attacks. Examines manifest - permissions, receivers, services, and native libraries. Activates for requests involving - Android malware analysis, APK reverse engineering, mobile malware investigation, - or Android threat analysis. +description: 'Reverse engineers malicious Android APK files using the JADX decompiler + to read Java/Kotlin source, inspect manifest permissions, receivers, services, and + native libraries, and identify data theft, C2 communication, privilege escalation, + or overlay-attack behavior. Use when analyzing a suspected Android banking trojan, + spyware, SMS stealer, or other flagged APK, or when investigating mobile malware + or Android threats generally. ' domain: cybersecurity diff --git a/skills/reverse-engineering-dotnet-malware-with-dnspy/SKILL.md b/skills/reverse-engineering-dotnet-malware-with-dnspy/SKILL.md index e0027082..d0bf209a 100644 --- a/skills/reverse-engineering-dotnet-malware-with-dnspy/SKILL.md +++ b/skills/reverse-engineering-dotnet-malware-with-dnspy/SKILL.md @@ -1,10 +1,10 @@ --- name: reverse-engineering-dotnet-malware-with-dnspy -description: 'Reverse engineers .NET malware using dnSpy decompiler and debugger to - analyze C#/VB.NET source code, identify obfuscation techniques, extract configurations, - and understand malicious functionality including stealers, RATs, and loaders. Activates - for requests involving .NET malware analysis, C# malware decompilation, managed - code reverse engineering, or .NET obfuscation analysis. +description: 'Reverse engineers .NET malware samples using the dnSpy decompiler and + debugger to read C#/VB.NET source, deobfuscate code protected by tools like ConfuserEx + or SmartAssembly, and extract hardcoded C2 configurations, keys, and credentials. + Use when a sample is identified as a .NET assembly (e.g. AgentTesla, AsyncRAT, RedLine + Stealer, Quasar RAT) and needs decompilation, deobfuscation, or config extraction. ' domain: cybersecurity diff --git a/skills/reverse-engineering-malware-with-ghidra/SKILL.md b/skills/reverse-engineering-malware-with-ghidra/SKILL.md index c67ed481..97e6e5ab 100644 --- a/skills/reverse-engineering-malware-with-ghidra/SKILL.md +++ b/skills/reverse-engineering-malware-with-ghidra/SKILL.md @@ -1,10 +1,10 @@ --- name: reverse-engineering-malware-with-ghidra -description: 'Reverse engineers malware binaries using NSA''s Ghidra disassembler - and decompiler to understand internal logic, cryptographic routines, C2 protocols, - and evasion techniques at the assembly and pseudo-C level. Activates for requests - involving malware reverse engineering, disassembly analysis, decompilation, binary - analysis, or understanding malware internals. +description: 'Reverse engineers malware binaries using NSA''s Ghidra disassembler and + decompiler to study internal logic, cryptographic routines, C2 protocols, and evasion + techniques at the assembly and pseudo-C level. Use when static or dynamic analysis + flags suspicious functionality needing deeper code review, such as reversing C2 + protocols, encryption algorithms, custom obfuscation, or a sample''s exploit mechanism. ' domain: cybersecurity diff --git a/skills/reverse-engineering-rust-malware/SKILL.md b/skills/reverse-engineering-rust-malware/SKILL.md index ab74e33c..ea1242e6 100644 --- a/skills/reverse-engineering-rust-malware/SKILL.md +++ b/skills/reverse-engineering-rust-malware/SKILL.md @@ -1,8 +1,11 @@ --- name: reverse-engineering-rust-malware -description: Reverse engineer Rust-compiled malware using IDA Pro and Ghidra with - techniques for handling non-null-terminated strings, crate dependency extraction, - and Rust-specific control flow analysis. +description: Reverse engineers Rust-compiled malware using IDA Pro and Ghidra, covering + techniques for non-null-terminated fat-pointer strings, monomorphized/duplicated + generic code, Result/Option unwrap chains, crate dependency extraction, and Rust-specific + control flow and calling conventions. Use when analyzing Rust-based malware samples + (e.g. BlackCat/ALPHV, Hive, Buer Loader) or attack artifacts in an authorized, controlled + environment. domain: cybersecurity subdomain: malware-analysis tags: diff --git a/skills/scanning-container-images-with-grype/SKILL.md b/skills/scanning-container-images-with-grype/SKILL.md index 8442d042..d868fe24 100644 --- a/skills/scanning-container-images-with-grype/SKILL.md +++ b/skills/scanning-container-images-with-grype/SKILL.md @@ -1,7 +1,10 @@ --- name: scanning-container-images-with-grype -description: Scan container images for known vulnerabilities using Anchore Grype with - SBOM-based matching and configurable severity thresholds. +description: Scans container images, filesystems, and SBOMs for known CVEs using Anchore + Grype, matching Syft-generated SBOM packages against NVD, GitHub Advisories, and + OS-specific vulnerability feeds with configurable severity thresholds. Use when running + a security assessment or incident-response check that requires scanning container + images for known vulnerabilities with Grype. domain: cybersecurity subdomain: container-security tags: diff --git a/skills/scanning-containers-with-trivy-in-cicd/SKILL.md b/skills/scanning-containers-with-trivy-in-cicd/SKILL.md index 144fcccd..06a29486 100644 --- a/skills/scanning-containers-with-trivy-in-cicd/SKILL.md +++ b/skills/scanning-containers-with-trivy-in-cicd/SKILL.md @@ -1,10 +1,11 @@ --- name: scanning-containers-with-trivy-in-cicd -description: 'This skill covers integrating Aqua Security''s Trivy scanner into CI/CD - pipelines for comprehensive container image vulnerability detection. It addresses - scanning Docker images for OS package and application dependency CVEs, detecting - misconfigurations in Dockerfiles, scanning filesystem and git repositories, and - establishing severity-based quality gates that block deployment of vulnerable images. +description: 'Integrates Aqua Security''s Trivy scanner into CI/CD pipelines to detect + OS package and application dependency CVEs, Dockerfile misconfigurations, and issues + in filesystems or git repositories, and to enforce severity-based quality gates that + block vulnerable images from being deployed. Use when building Docker images in + CI/CD and needing automated vulnerability scanning and pass/fail gates before registry + push or production deployment. ' domain: cybersecurity diff --git a/skills/scanning-docker-images-with-trivy/SKILL.md b/skills/scanning-docker-images-with-trivy/SKILL.md index 0253aa20..92f2fbea 100644 --- a/skills/scanning-docker-images-with-trivy/SKILL.md +++ b/skills/scanning-docker-images-with-trivy/SKILL.md @@ -1,8 +1,11 @@ --- name: scanning-docker-images-with-trivy -description: Trivy is a comprehensive open-source vulnerability scanner by Aqua Security - that detects vulnerabilities in OS packages, language-specific dependencies, misconfigurations, - secrets, and license violati +description: Scans Docker container images with Trivy, Aqua Security's open-source + scanner, to detect vulnerabilities in OS packages and language-specific dependencies, + misconfigurations, exposed secrets, and license violations, outputting results in + formats like SARIF, CycloneDX, or SPDX. Use when assessing, auditing, or scheduling + a security scan of Docker images, including as part of CI/CD or incident-response + investigations. domain: cybersecurity subdomain: container-security tags: diff --git a/skills/scanning-iac-and-images-with-trivy/SKILL.md b/skills/scanning-iac-and-images-with-trivy/SKILL.md index f0140a9a..8882d0e3 100644 --- a/skills/scanning-iac-and-images-with-trivy/SKILL.md +++ b/skills/scanning-iac-and-images-with-trivy/SKILL.md @@ -1,6 +1,10 @@ --- name: scanning-iac-and-images-with-trivy -description: Scan container images, IaC, and SBOMs for vulnerabilities and misconfigurations in CI/CD with Trivy. +description: Scans container images, Infrastructure-as-Code (Terraform, CloudFormation, + Kubernetes manifests, Dockerfile, Helm), filesystems, git repos, and SBOMs with Trivy's + vuln, misconfig, secret, and license scanners. Use when building a CI/CD security + gate that scans images before push, IaC before apply, or SBOMs for supply-chain + weaknesses, and fails the build on policy violations. domain: cybersecurity subdomain: devsecops tags: diff --git a/skills/scanning-network-with-nmap-advanced/SKILL.md b/skills/scanning-network-with-nmap-advanced/SKILL.md index e074b9cc..56b2a460 100644 --- a/skills/scanning-network-with-nmap-advanced/SKILL.md +++ b/skills/scanning-network-with-nmap-advanced/SKILL.md @@ -1,9 +1,11 @@ --- name: scanning-network-with-nmap-advanced -description: 'Performs advanced network reconnaissance using Nmap''s scripting engine, - timing controls, evasion techniques, and output parsing to discover hosts, enumerate - services, detect vulnerabilities, and fingerprint operating systems across authorized - target networks. +description: 'Performs advanced network recon using Nmap''s Scripting Engine (NSE), + timing controls, firewall/IDS evasion, and structured output parsing to discover + hosts, enumerate service versions, detect vulnerabilities, and fingerprint OSes. + Use during authorized penetration tests or enterprise asset-discovery assessments + needing scan evasion, NSE vulnerability checks, or output fed into a vulnerability + management pipeline. ' domain: cybersecurity diff --git a/skills/securing-agentic-ai-tool-invocation/SKILL.md b/skills/securing-agentic-ai-tool-invocation/SKILL.md index 9b4365f2..d973c885 100644 --- a/skills/securing-agentic-ai-tool-invocation/SKILL.md +++ b/skills/securing-agentic-ai-tool-invocation/SKILL.md @@ -1,6 +1,11 @@ --- name: securing-agentic-ai-tool-invocation -description: Apply least-privilege tool allowlisting, identity binding, and human-in-the-loop controls for agent tool calls. +description: Implements defense-in-depth controls at an AI agent's tool-invocation + boundary using tool allowlisting, least-privilege identity binding, NeMo Guardrails + policy enforcement, human-in-the-loop approval, and audit logging. Use when hardening + an agent that calls tools with real side effects (email, payments, file writes, + code execution), mapping OWASP Agentic AI Top 10 controls, or bounding prompt-injection + blast radius. domain: cybersecurity subdomain: ai-security tags: diff --git a/skills/securing-api-gateway-with-aws-waf/SKILL.md b/skills/securing-api-gateway-with-aws-waf/SKILL.md index 8176864b..048e4370 100644 --- a/skills/securing-api-gateway-with-aws-waf/SKILL.md +++ b/skills/securing-api-gateway-with-aws-waf/SKILL.md @@ -1,9 +1,10 @@ --- name: securing-api-gateway-with-aws-waf -description: 'Securing API Gateway endpoints with AWS WAF by configuring managed rule - groups for OWASP Top 10 protection, creating custom rate limiting rules, implementing - bot control, setting up IP reputation filtering, and monitoring WAF metrics for - security effectiveness. +description: 'Secures AWS API Gateway endpoints with AWS WAF by configuring managed + rule groups for OWASP Top 10 protection, custom rate-limiting rules, bot control, + IP reputation filtering, and WAF metric monitoring. Use when deploying API Gateway + endpoints that need protection against common web attacks, or when implementing + rate limiting and throttling to prevent API abuse and DDoS. ' domain: cybersecurity diff --git a/skills/securing-aws-iam-permissions/SKILL.md b/skills/securing-aws-iam-permissions/SKILL.md index 3cefdd1e..fec1c45f 100644 --- a/skills/securing-aws-iam-permissions/SKILL.md +++ b/skills/securing-aws-iam-permissions/SKILL.md @@ -1,9 +1,10 @@ --- name: securing-aws-iam-permissions -description: 'This skill guides practitioners through hardening AWS Identity and Access - Management configurations to enforce least privilege access across cloud accounts. - It covers IAM policy scoping, permission boundaries, Access Analyzer integration, - and credential rotation strategies to reduce the blast radius of compromised identities. +description: 'Hardens AWS IAM configurations to enforce least-privilege access, covering + IAM policy scoping, permission boundaries, IAM Access Analyzer integration, and credential + rotation strategies. Use when reducing the blast radius of compromised AWS identities, + auditing overly permissive IAM policies, or setting up permission boundaries and + Access Analyzer findings review across cloud accounts. ' domain: cybersecurity diff --git a/skills/securing-aws-lambda-execution-roles/SKILL.md b/skills/securing-aws-lambda-execution-roles/SKILL.md index dfda15b4..b53c2d3e 100644 --- a/skills/securing-aws-lambda-execution-roles/SKILL.md +++ b/skills/securing-aws-lambda-execution-roles/SKILL.md @@ -1,9 +1,11 @@ --- name: securing-aws-lambda-execution-roles -description: 'Securing AWS Lambda execution roles by implementing least-privilege - IAM policies, applying permission boundaries, restricting resource-based policies, - using IAM Access Analyzer to validate permissions, and enforcing role scoping through - SCPs. +description: 'Hardens AWS Lambda execution roles by writing least-privilege IAM policies, + applying permission boundaries, restricting resource-based policies, validating + permissions with IAM Access Analyzer, and enforcing role scoping through SCPs. Use + when deploying new Lambda functions, remediating overly permissive Lambda roles found + in an audit, or building reusable least-privilege IAM role templates for serverless + teams. ' domain: cybersecurity diff --git a/skills/securing-azure-with-microsoft-defender/SKILL.md b/skills/securing-azure-with-microsoft-defender/SKILL.md index 01ec90d6..6ec4c83e 100644 --- a/skills/securing-azure-with-microsoft-defender/SKILL.md +++ b/skills/securing-azure-with-microsoft-defender/SKILL.md @@ -1,10 +1,10 @@ --- name: securing-azure-with-microsoft-defender -description: 'This skill instructs security practitioners on deploying Microsoft Defender - for Cloud as a cloud-native application protection platform for Azure, multi-cloud, - and hybrid environments. It covers enabling Defender plans for servers, containers, - storage, and databases, configuring security recommendations, managing Secure Score, - and integrating with the unified Defender portal for centralized threat management. +description: 'Deploys and configures Microsoft Defender for Cloud as a CNAPP for + Azure, multi-cloud, and hybrid environments: enabling Defender plans for servers, + containers, storage, and databases, configuring recommendations, and managing Secure + Score via the unified Defender portal. Use when onboarding workloads to Defender + for Cloud or setting up cloud workload protection and threat monitoring. ' domain: cybersecurity diff --git a/skills/securing-container-registry-images/SKILL.md b/skills/securing-container-registry-images/SKILL.md index ef667ae6..c0bb17be 100644 --- a/skills/securing-container-registry-images/SKILL.md +++ b/skills/securing-container-registry-images/SKILL.md @@ -1,9 +1,10 @@ --- name: securing-container-registry-images -description: 'Securing container registry images by implementing vulnerability scanning - with Trivy and Grype, enforcing image signing with Cosign and Sigstore, configuring - registry access controls, and building CI/CD pipelines that prevent deploying unscanned - or unsigned images. +description: 'Secures container registry images (ECR, ACR, GCR, Docker Hub) by scanning + with Trivy and Grype, signing with Cosign and Sigstore, configuring registry access + controls, and building CI/CD pipelines that block unscanned or unsigned images. + Use when establishing registry security controls or enforcing scan/signature checks + before image promotion. ' domain: cybersecurity diff --git a/skills/securing-container-registry-with-harbor/SKILL.md b/skills/securing-container-registry-with-harbor/SKILL.md index 705a54eb..a61fb6b7 100644 --- a/skills/securing-container-registry-with-harbor/SKILL.md +++ b/skills/securing-container-registry-with-harbor/SKILL.md @@ -1,8 +1,11 @@ --- name: securing-container-registry-with-harbor -description: Harbor is an open-source container registry that provides security features - including vulnerability scanning (integrated Trivy), image signing (Notary/Cosign), - RBAC, content trust policies, replicatio +description: Configures the Harbor open-source container registry's security features + — integrated Trivy vulnerability scanning, Notary/Cosign image signing and content + trust policies, project-level RBAC, immutable tag retention rules, and OIDC authentication + — to enforce image provenance and block vulnerable image deployment. Use when deploying + or hardening a Harbor registry, or when access control and compliance requirements + call for signed, scanned images. domain: cybersecurity subdomain: container-security tags: diff --git a/skills/securing-github-actions-workflows/SKILL.md b/skills/securing-github-actions-workflows/SKILL.md index 9b7b2e61..23b70a9c 100644 --- a/skills/securing-github-actions-workflows/SKILL.md +++ b/skills/securing-github-actions-workflows/SKILL.md @@ -1,10 +1,10 @@ --- name: securing-github-actions-workflows -description: 'This skill covers hardening GitHub Actions workflows against supply - chain attacks, credential theft, and privilege escalation. It addresses pinning - actions to SHA digests, minimizing GITHUB_TOKEN permissions, protecting secrets - from exfiltration, preventing script injection in workflow expressions, and implementing - required reviewers for workflow changes. +description: 'Hardens GitHub Actions workflows against supply chain attacks, credential + theft, and privilege escalation: pinning actions to SHA digests, minimizing GITHUB_TOKEN + permissions, protecting secrets, preventing script injection in workflow expressions, + and requiring reviewers for workflow changes. Use when hardening GitHub Actions + workflows that handle secrets, deploy to production, or run with elevated permissions. ' domain: cybersecurity diff --git a/skills/securing-helm-chart-deployments/SKILL.md b/skills/securing-helm-chart-deployments/SKILL.md index 1d4451bf..b3f226d1 100644 --- a/skills/securing-helm-chart-deployments/SKILL.md +++ b/skills/securing-helm-chart-deployments/SKILL.md @@ -1,7 +1,11 @@ --- name: securing-helm-chart-deployments -description: Secure Helm chart deployments by validating chart integrity, scanning - templates for misconfigurations, and enforcing security contexts in Kubernetes releases. +description: Secures Helm chart deployments by verifying chart signatures and provenance, + rendering and scanning templates for misconfigurations with helm lint, enforcing + pod security contexts in values.yaml, managing secrets via external stores instead + of Helm values, and scoping RBAC for Helm operations in a CI/CD pipeline. Use when + deploying Helm charts to Kubernetes or when a security review of chart provenance, + templates, or release RBAC is needed. domain: cybersecurity subdomain: container-security tags: diff --git a/skills/securing-historian-server-in-ot-environment/SKILL.md b/skills/securing-historian-server-in-ot-environment/SKILL.md index 1ffc6997..47584594 100644 --- a/skills/securing-historian-server-in-ot-environment/SKILL.md +++ b/skills/securing-historian-server-in-ot-environment/SKILL.md @@ -1,11 +1,10 @@ --- name: securing-historian-server-in-ot-environment -description: 'This skill covers hardening and securing process historian servers (OSIsoft - PI, Honeywell PHD, GE Proficy, AVEVA Historian) in OT environments. It addresses - network placement across Purdue levels, access control for historian interfaces, - data replication through DMZ using data diodes or PI-to-PI connectors, SQL injection - prevention in historian queries, and integrity protection of process data used for - safety analysis, regulatory reporting, and process optimization. +description: 'Audits and hardens process historian servers (OSIsoft PI, Honeywell PHD, + GE Proficy, AVEVA Historian) in OT environments: Purdue-level network placement, + interface access control, secure DMZ replication via data diodes or PI-to-PI connectors, + SQL injection prevention, and process data integrity. Use when auditing or hardening + a historian server, or designing secure OT-to-IT data replication through a DMZ. ' domain: cybersecurity diff --git a/skills/securing-kubernetes-on-cloud/SKILL.md b/skills/securing-kubernetes-on-cloud/SKILL.md index f64bc96d..a2b1cd4d 100644 --- a/skills/securing-kubernetes-on-cloud/SKILL.md +++ b/skills/securing-kubernetes-on-cloud/SKILL.md @@ -1,10 +1,11 @@ --- name: securing-kubernetes-on-cloud -description: 'This skill covers hardening managed Kubernetes clusters on EKS, AKS, - and GKE by implementing Pod Security Standards, network policies, workload identity, - RBAC scoping, image admission controls, and runtime security monitoring. It addresses - cloud-specific security features including IRSA for EKS, Workload Identity for GKE, - and Managed Identities for AKS. +description: 'Hardens managed Kubernetes clusters on EKS, AKS, and GKE by implementing + Pod Security Standards, network policies, workload identity (IRSA for EKS, Workload + Identity for GKE, Managed Identities for AKS), RBAC scoping, image admission controls, + and runtime security monitoring. Use when deploying a new managed Kubernetes cluster + with security requirements or hardening an existing EKS, AKS, or GKE cluster after + an audit or pentest finding. ' domain: cybersecurity diff --git a/skills/securing-remote-access-to-ot-environment/SKILL.md b/skills/securing-remote-access-to-ot-environment/SKILL.md index 0a53e97e..95ac0d9d 100644 --- a/skills/securing-remote-access-to-ot-environment/SKILL.md +++ b/skills/securing-remote-access-to-ot-environment/SKILL.md @@ -1,10 +1,10 @@ --- name: securing-remote-access-to-ot-environment -description: 'This skill covers implementing secure remote access to OT/ICS environments - for operators, engineers, and vendors while preventing unauthorized access that - could compromise industrial operations. It addresses jump server architecture, multi-factor - authentication, session recording, privileged access management, vendor remote access - controls, and compliance with IEC 62443 and NERC CIP-005 remote access requirements. +description: 'Designs and configures secure remote access to OT/ICS environments for + operators, engineers, and vendors: jump server architecture, multi-factor authentication, + session recording, privileged access management, vendor access controls, and IEC + 62443 / NERC CIP-005 compliance. Use when designing OT remote access architecture + or configuring a jump server with privileged access management. ' domain: cybersecurity diff --git a/skills/securing-serverless-functions/SKILL.md b/skills/securing-serverless-functions/SKILL.md index ffb5ad5b..2ffadbd4 100644 --- a/skills/securing-serverless-functions/SKILL.md +++ b/skills/securing-serverless-functions/SKILL.md @@ -1,10 +1,10 @@ --- name: securing-serverless-functions -description: 'This skill covers security hardening for serverless compute platforms - including AWS Lambda, Azure Functions, and Google Cloud Functions. It addresses - least privilege IAM roles, dependency vulnerability scanning, secrets management - integration, input validation, function URL authentication, and runtime monitoring - to protect against injection attacks, credential theft, and supply chain compromises. +description: 'Hardens serverless compute platforms (AWS Lambda, Azure Functions, Google + Cloud Functions): least-privilege IAM roles, dependency vulnerability scanning, + secrets management integration, input validation, function URL authentication, and + runtime monitoring. Use when deploying serverless functions with sensitive access, + auditing for overly permissive roles, or adding functions to a DevSecOps pipeline. ' domain: cybersecurity diff --git a/skills/testing-api-for-broken-object-level-authorization/SKILL.md b/skills/testing-api-for-broken-object-level-authorization/SKILL.md index ca0bcaca..45ea6799 100644 --- a/skills/testing-api-for-broken-object-level-authorization/SKILL.md +++ b/skills/testing-api-for-broken-object-level-authorization/SKILL.md @@ -1,13 +1,11 @@ --- name: testing-api-for-broken-object-level-authorization -description: 'Tests REST and GraphQL APIs for Broken Object Level Authorization (BOLA/IDOR) - vulnerabilities where an authenticated user can access or modify resources belonging - to other users by manipulating object identifiers in API requests. The tester intercepts - API calls, identifies object ID parameters (numeric IDs, UUIDs, slugs), and systematically - replaces them with IDs belonging to other users to determine if the server enforces - per-object authorization. This is OWASP API Security Top 10 2023 risk API1. Activates - for requests involving BOLA testing, IDOR in APIs, object-level authorization testing, - or API access control bypass. +description: 'Tests REST and GraphQL APIs for Broken Object Level Authorization (BOLA/IDOR, + OWASP API1:2023) by intercepting API calls, identifying object ID parameters (numeric + IDs, UUIDs, slugs), and systematically substituting IDs belonging to other users + to check whether the server enforces per-object authorization. Use when asked to + test BOLA or IDOR in an API, verify object-level authorization, or assess an API + for access control bypass. ' domain: cybersecurity diff --git a/skills/testing-api-for-mass-assignment-vulnerability/SKILL.md b/skills/testing-api-for-mass-assignment-vulnerability/SKILL.md index 001a8b5f..4ef033f1 100644 --- a/skills/testing-api-for-mass-assignment-vulnerability/SKILL.md +++ b/skills/testing-api-for-mass-assignment-vulnerability/SKILL.md @@ -1,13 +1,10 @@ --- name: testing-api-for-mass-assignment-vulnerability -description: 'Tests APIs for mass assignment (auto-binding) vulnerabilities where - clients can modify object properties they should not have access to by including - additional parameters in API requests. The tester identifies writable endpoints, - adds undocumented fields to request bodies (role, isAdmin, price, balance), and - checks if the server binds these to the data model without filtering. Part of OWASP - API3:2023 Broken Object Property Level Authorization. Activates for requests involving - mass assignment testing, parameter binding abuse, auto-binding vulnerability, or - API over-posting. +description: 'Tests APIs for mass assignment (auto-binding), OWASP API3:2023, by identifying + writable endpoints, adding undocumented fields to request bodies (role, isAdmin, + price, balance), and checking whether the server binds them to the data model without + filtering. Use when testing an API for mass assignment, parameter binding abuse, + or over-posting on profile, registration, or object-creation endpoints. ' domain: cybersecurity diff --git a/skills/testing-api-security-with-owasp-top-10/SKILL.md b/skills/testing-api-security-with-owasp-top-10/SKILL.md index c4ccdea0..08506899 100644 --- a/skills/testing-api-security-with-owasp-top-10/SKILL.md +++ b/skills/testing-api-security-with-owasp-top-10/SKILL.md @@ -1,7 +1,9 @@ --- name: testing-api-security-with-owasp-top-10 -description: Systematically assessing REST and GraphQL API endpoints against the OWASP - API Security Top 10 risks using automated and manual testing techniques. +description: Systematically assesses REST, GraphQL, and gRPC API endpoints against the OWASP + API Security Top 10 (2023) using Burp Suite and Postman for automated and manual testing. + Use during authorized API penetration tests, before deploying new endpoints to production, + or when validating API gateway controls and rate limiting. domain: cybersecurity subdomain: web-application-security tags: diff --git a/skills/testing-for-broken-access-control/SKILL.md b/skills/testing-for-broken-access-control/SKILL.md index 6d25e828..37f68837 100644 --- a/skills/testing-for-broken-access-control/SKILL.md +++ b/skills/testing-for-broken-access-control/SKILL.md @@ -1,8 +1,10 @@ --- name: testing-for-broken-access-control -description: Systematically testing web applications for broken access control vulnerabilities - including privilege escalation, missing function-level checks, and insecure direct - object references. +description: Systematically tests web applications and APIs for broken access control + (OWASP A01:2021), including privilege escalation, missing function-level checks, insecure + direct object references, and multi-tenant data leakage, using Burp Suite with the + Authorize extension. Use during authorized penetration tests or RBAC/multi-tenant + authorization audits. domain: cybersecurity subdomain: web-application-security tags: diff --git a/skills/testing-for-business-logic-vulnerabilities/SKILL.md b/skills/testing-for-business-logic-vulnerabilities/SKILL.md index a76f079e..aefd361b 100644 --- a/skills/testing-for-business-logic-vulnerabilities/SKILL.md +++ b/skills/testing-for-business-logic-vulnerabilities/SKILL.md @@ -1,8 +1,10 @@ --- name: testing-for-business-logic-vulnerabilities -description: Identifying flaws in application business logic that allow price manipulation, - workflow bypass, and privilege escalation beyond what technical vulnerability scanners - can detect. +description: Manually identifies flaws in application business logic - price manipulation, + multi-step workflow bypass, and privilege escalation - by intercepting and modifying + requests with Burp Suite, going beyond what automated vulnerability scanners detect. + Use for e-commerce checkout/cart flows, voucher and rewards systems, or any assessment + where scanners find little but business rules need scrutiny. domain: cybersecurity subdomain: web-application-security tags: diff --git a/skills/testing-for-email-header-injection/SKILL.md b/skills/testing-for-email-header-injection/SKILL.md index a7564704..90c8c76d 100644 --- a/skills/testing-for-email-header-injection/SKILL.md +++ b/skills/testing-for-email-header-injection/SKILL.md @@ -1,8 +1,10 @@ --- name: testing-for-email-header-injection -description: Test web application email functionality for SMTP header injection vulnerabilities - that allow attackers to inject additional email headers, modify recipients, and - abuse contact forms for spam relay. +description: Tests web application email functionality (contact forms, password reset, + newsletter subscriptions) for CRLF/SMTP header injection using Burp Suite and OWASP ZAP, + checking whether attackers can inject headers, modify recipients, or abuse forms for + spam relay. Use when testing any user-input-driven email-sending feature during a + penetration test. domain: cybersecurity subdomain: web-application-security tags: diff --git a/skills/testing-for-json-web-token-vulnerabilities/SKILL.md b/skills/testing-for-json-web-token-vulnerabilities/SKILL.md index 16f5dc61..435bb99c 100644 --- a/skills/testing-for-json-web-token-vulnerabilities/SKILL.md +++ b/skills/testing-for-json-web-token-vulnerabilities/SKILL.md @@ -1,8 +1,10 @@ --- name: testing-for-json-web-token-vulnerabilities -description: Test JWT implementations for critical vulnerabilities including algorithm - confusion, none algorithm bypass, kid parameter injection, and weak secret exploitation - to achieve authentication bypass and privilege escalation. +description: Tests JWT implementations for algorithm confusion, "none" algorithm bypass, + kid/jku parameter injection, and weak secret exploitation using jwt_tool and Burp Suite's + JWT Editor extension, aiming to achieve authentication bypass and privilege escalation. + Use when assessing JWT-based auth/session management, OAuth2/OIDC token handling, or + SSO systems during a security engagement. domain: cybersecurity subdomain: web-application-security tags: diff --git a/skills/testing-for-open-redirect-vulnerabilities/SKILL.md b/skills/testing-for-open-redirect-vulnerabilities/SKILL.md index ea6ba065..49ab5d60 100644 --- a/skills/testing-for-open-redirect-vulnerabilities/SKILL.md +++ b/skills/testing-for-open-redirect-vulnerabilities/SKILL.md @@ -1,8 +1,10 @@ --- name: testing-for-open-redirect-vulnerabilities -description: Identify and test open redirect vulnerabilities in web applications by - analyzing URL redirection parameters, bypass techniques, and exploitation chains - for phishing and token theft. +description: Identifies and exploits open redirect vulnerabilities by analyzing URL + redirection parameters (next, url, redirect, return, goto), applying bypass techniques, + and chaining findings into phishing or token-theft exploits, using Burp Suite/OWASP ZAP + and Burp Collaborator. Use when testing login/logout flows, OAuth redirect_uri handling, + or SSO redirect validation. domain: cybersecurity subdomain: web-application-security tags: diff --git a/skills/testing-for-system-prompt-leakage/SKILL.md b/skills/testing-for-system-prompt-leakage/SKILL.md index 790b4e49..07af4e22 100644 --- a/skills/testing-for-system-prompt-leakage/SKILL.md +++ b/skills/testing-for-system-prompt-leakage/SKILL.md @@ -1,6 +1,10 @@ --- name: testing-for-system-prompt-leakage -description: Extract and defend system prompts plus embedded secrets and routing logic. +description: Extracts LLM system prompts using direct requests, jailbreak/instruction-override + framing, translation/encoding tricks, and few-shot replay, combining manual payloads with + automated garak and Promptfoo scanners to surface embedded secrets, routing logic, and + policy leakage (OWASP LLM07:2025). Use during LLM application red-team engagements or + when validating that no credentials or authorization logic live in the system prompt. domain: cybersecurity subdomain: ai-security tags: diff --git a/skills/testing-for-xss-vulnerabilities/SKILL.md b/skills/testing-for-xss-vulnerabilities/SKILL.md index f13f7cc8..eaa0b561 100644 --- a/skills/testing-for-xss-vulnerabilities/SKILL.md +++ b/skills/testing-for-xss-vulnerabilities/SKILL.md @@ -1,14 +1,10 @@ --- name: testing-for-xss-vulnerabilities -description: 'Tests web applications for Cross-Site Scripting (XSS) vulnerabilities - by injecting JavaScript payloads into reflected, stored, and DOM-based contexts - to demonstrate client-side code execution, session hijacking, and user impersonation. - The tester identifies all injection points and output contexts, crafts context-appropriate - payloads, and bypasses sanitization and CSP protections. Activates for requests - involving XSS testing, cross-site scripting assessment, client-side injection testing, - or JavaScript injection vulnerability testing. - - ' +description: Tests web applications for reflected, stored, and DOM-based Cross-Site + Scripting by injecting JavaScript payloads with Burp Suite (XSS extensions, Active + Scan++) and browser tools, then bypassing sanitization and CSP to demonstrate session + hijacking and user impersonation. Use for OWASP WSTG client-side injection testing or + when evaluating input sanitization and output encoding coverage. domain: cybersecurity subdomain: penetration-testing tags: diff --git a/skills/testing-oauth2-implementation-flaws/SKILL.md b/skills/testing-oauth2-implementation-flaws/SKILL.md index f3adac87..51935fcb 100644 --- a/skills/testing-oauth2-implementation-flaws/SKILL.md +++ b/skills/testing-oauth2-implementation-flaws/SKILL.md @@ -1,14 +1,10 @@ --- name: testing-oauth2-implementation-flaws -description: 'Tests OAuth 2.0 and OpenID Connect implementations for security flaws - including authorization code interception, redirect URI manipulation, CSRF in OAuth - flows, token leakage, scope escalation, and PKCE bypass. The tester evaluates the - authorization server, client application, and token handling for common misconfigurations - that enable account takeover or unauthorized access. Activates for requests involving - OAuth security testing, OIDC vulnerability assessment, OAuth2 redirect bypass, or - authorization code flow testing. - - ' +description: Tests OAuth 2.0 and OpenID Connect implementations for authorization code + interception, redirect URI manipulation, CSRF in OAuth flows, token leakage, scope + escalation, and PKCE bypass, using Burp Suite Professional and the EsPReSSO extension + to probe the authorization server, client, and token handling. Use when assessing OAuth2/OIDC + flows or SSO systems for misconfigurations enabling account takeover. domain: cybersecurity subdomain: api-security tags: diff --git a/skills/testing-prompt-injection-in-rag-pipelines/SKILL.md b/skills/testing-prompt-injection-in-rag-pipelines/SKILL.md index 7420263c..fb194df3 100644 --- a/skills/testing-prompt-injection-in-rag-pipelines/SKILL.md +++ b/skills/testing-prompt-injection-in-rag-pipelines/SKILL.md @@ -1,6 +1,10 @@ --- name: testing-prompt-injection-in-rag-pipelines -description: Probe RAG applications for prompt injection via poisoned retrieved context and embedding manipulation. +description: Probes Retrieval-Augmented Generation pipelines for indirect prompt injection + via poisoned retrieved documents and embedding-space manipulation, using NVIDIA garak, + Promptfoo red-team plugins, and Microsoft PyRIT against vector stores like FAISS, + Chroma, Pinecone, or pgvector. Use when security-testing a RAG chatbot or document-Q&A + system, validating retrieval guardrails, or gating CI/CD on prompt-template/retriever changes. domain: cybersecurity subdomain: ai-security tags: diff --git a/skills/testing-ransomware-recovery-procedures/SKILL.md b/skills/testing-ransomware-recovery-procedures/SKILL.md index 20ff123b..5b119de6 100644 --- a/skills/testing-ransomware-recovery-procedures/SKILL.md +++ b/skills/testing-ransomware-recovery-procedures/SKILL.md @@ -1,8 +1,10 @@ --- name: testing-ransomware-recovery-procedures -description: Test and validate ransomware recovery procedures including backup restore - operations, RTO/RPO target verification, recovery sequencing, and clean restore - validation to ensure organizational resilience against destructive ransomware attacks. +description: Tests and validates ransomware recovery procedures - backup restore operations + (e.g. with Restic), RTO/RPO target verification, recovery sequencing, and clean-restore + validation - to confirm organizational resilience against destructive ransomware attacks. + Use when validating that recovery plans work under realistic conditions, measuring + RTO/RPO against business requirements, or testing restore integrity after simulated encryption. domain: cybersecurity subdomain: incident-response tags: diff --git a/skills/testing-websocket-api-security/SKILL.md b/skills/testing-websocket-api-security/SKILL.md index 0ed5a6c2..416c327a 100644 --- a/skills/testing-websocket-api-security/SKILL.md +++ b/skills/testing-websocket-api-security/SKILL.md @@ -1,15 +1,10 @@ --- name: testing-websocket-api-security -description: 'Tests WebSocket API implementations for security vulnerabilities including - missing authentication on WebSocket upgrade, Cross-Site WebSocket Hijacking (CSWSH), - injection attacks through WebSocket messages, insufficient input validation, denial-of-service - via message flooding, and information leakage through WebSocket frames. The tester - intercepts WebSocket handshakes and messages using Burp Suite, crafts malicious - payloads, and tests for authorization bypass on WebSocket channels. Activates for - requests involving WebSocket security testing, WS penetration testing, CSWSH attack, - or real-time API security assessment. - - ' +description: Tests WebSocket API implementations for missing upgrade-handshake authentication, + Cross-Site WebSocket Hijacking (CSWSH), message injection, insufficient input validation, + message-flooding DoS, and information leakage, using Burp Suite's WebSocket interception + and the wscat CLI to craft malicious payloads. Use for real-time API penetration testing + or CSWSH/authorization-bypass assessments on WebSocket channels. domain: cybersecurity subdomain: api-security tags: diff --git a/skills/tracking-threat-actor-infrastructure/SKILL.md b/skills/tracking-threat-actor-infrastructure/SKILL.md index 3ba48ec1..2be9ee95 100644 --- a/skills/tracking-threat-actor-infrastructure/SKILL.md +++ b/skills/tracking-threat-actor-infrastructure/SKILL.md @@ -1,8 +1,11 @@ --- name: tracking-threat-actor-infrastructure -description: Threat actor infrastructure tracking involves monitoring and mapping - adversary-controlled assets including command-and-control (C2) servers, phishing - domains, exploit kit hosts, bulletproof hosting, a +description: Discovers and maps adversary-controlled infrastructure (C2 servers, + phishing domains, exploit-kit hosts, bulletproof hosting) by pivoting across passive + DNS, certificate transparency logs, Shodan/Censys scans, WHOIS records, and network + fingerprints (JARM/JA3S). Use when tracking threat actor infrastructure, expanding + a known IOC into related assets, or producing STIX-based threat intelligence during + a CTI investigation. domain: cybersecurity subdomain: threat-intelligence tags: diff --git a/skills/triaging-security-incident-with-ir-playbook/SKILL.md b/skills/triaging-security-incident-with-ir-playbook/SKILL.md index 0c7c3c69..83b3e299 100644 --- a/skills/triaging-security-incident-with-ir-playbook/SKILL.md +++ b/skills/triaging-security-incident-with-ir-playbook/SKILL.md @@ -1,8 +1,10 @@ --- name: triaging-security-incident-with-ir-playbook -description: Classify and prioritize security incidents using structured IR playbooks - to determine severity, assign response teams, and initiate appropriate response - procedures. +description: Classifies and prioritizes security incidents using structured IR + playbooks and SIEM/case-management queries (Splunk, TheHive) to determine severity, + assign response teams, and initiate the appropriate response procedures. Use when + a new SOC alert needs triage, multiple concurrent incidents require prioritization, + or automated triage rules need validation or tuning. domain: cybersecurity subdomain: incident-response tags: diff --git a/skills/triaging-security-incident/SKILL.md b/skills/triaging-security-incident/SKILL.md index 86f851a0..e628169f 100644 --- a/skills/triaging-security-incident/SKILL.md +++ b/skills/triaging-security-incident/SKILL.md @@ -1,13 +1,10 @@ --- name: triaging-security-incident -description: 'Performs initial triage of security incidents to determine severity, - scope, and required response actions using the NIST SP 800-61r3 and SANS PICERL - frameworks. Classifies incidents by type, assigns priority based on business impact, - and routes to appropriate response teams. Activates for requests involving incident - triage, security alert classification, severity assessment, incident prioritization, - or initial incident analysis. - - ' +description: 'Performs initial triage of security incidents using the NIST SP + 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority + by business impact, and routing to the appropriate response team. Use when a + SIEM/EDR alert needs human classification, concurrent alerts must be prioritized, + or a user report or threat-intel IOC match requires initial incident categorization.' domain: cybersecurity subdomain: incident-response tags: diff --git a/skills/triaging-vulnerabilities-with-ssvc-framework/SKILL.md b/skills/triaging-vulnerabilities-with-ssvc-framework/SKILL.md index 282256fc..996d574a 100644 --- a/skills/triaging-vulnerabilities-with-ssvc-framework/SKILL.md +++ b/skills/triaging-vulnerabilities-with-ssvc-framework/SKILL.md @@ -1,8 +1,11 @@ --- name: triaging-vulnerabilities-with-ssvc-framework -description: Triage and prioritize vulnerabilities using CISA's Stakeholder-Specific - Vulnerability Categorization (SSVC) decision tree framework to produce actionable - remediation priorities. +description: Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific + Vulnerability Categorization (SSVC) decision tree, weighing exploitation status + (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, + and mission prevalence to output Track/Track*/Attend/Act decisions. Use when + prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation + planning beyond raw CVSS scores. domain: cybersecurity subdomain: vulnerability-management tags: diff --git a/skills/triaging-windows-with-kape/SKILL.md b/skills/triaging-windows-with-kape/SKILL.md index 55fd57a0..8fdc1650 100644 --- a/skills/triaging-windows-with-kape/SKILL.md +++ b/skills/triaging-windows-with-kape/SKILL.md @@ -1,6 +1,11 @@ --- name: triaging-windows-with-kape -description: Run targeted forensic artifact collection and module parsing with KAPE. +description: Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted + forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) + via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, + MFTECmd, RECmd). Use during early incident containment/triage when full disk + imaging is impractical but a defensible, parseable Windows artifact set is needed + quickly, including at-scale remote collection. domain: cybersecurity subdomain: digital-forensics tags: diff --git a/skills/validating-backup-integrity-for-recovery/SKILL.md b/skills/validating-backup-integrity-for-recovery/SKILL.md index 62e14089..3de7c5df 100644 --- a/skills/validating-backup-integrity-for-recovery/SKILL.md +++ b/skills/validating-backup-integrity-for-recovery/SKILL.md @@ -1,8 +1,11 @@ --- name: validating-backup-integrity-for-recovery -description: Validate backup integrity through cryptographic hash verification, automated - restore testing, corruption detection, and recoverability checks to ensure backups - are reliable for disaster recovery and ransomware response scenarios. +description: Validates backup integrity through cryptographic hash verification, + automated restore testing, corruption detection, and recoverability checks to + confirm backups are reliable for disaster recovery and ransomware response. Use + before relying on backups for recovery, when building post-backup validation + pipelines, auditing backup infrastructure for compliance, or checking immutable/air-gapped + backups for silent corruption or tampering. domain: cybersecurity subdomain: incident-response tags: diff --git a/skills/validating-tpm-measured-boot-attestation/SKILL.md b/skills/validating-tpm-measured-boot-attestation/SKILL.md index 07f4268c..b4329e5e 100644 --- a/skills/validating-tpm-measured-boot-attestation/SKILL.md +++ b/skills/validating-tpm-measured-boot-attestation/SKILL.md @@ -1,6 +1,11 @@ --- name: validating-tpm-measured-boot-attestation -description: Verify TPM PCRs and measured-boot and remote-attestation integrity. +description: Verifies TPM 2.0 measured-boot integrity and remote attestation with + tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating + and checking signed quotes (tpm2_quote/tpm2_checkquote), and sealing secrets to + a PCR policy. Use to confirm a system booted trusted firmware/kernel for Zero + Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value + baseline for fleet attestation. domain: cybersecurity subdomain: hardware-firmware-security tags: diff --git a/skills/verifying-build-provenance-with-slsa-sigstore/SKILL.md b/skills/verifying-build-provenance-with-slsa-sigstore/SKILL.md index 03b54c0c..0b78d706 100644 --- a/skills/verifying-build-provenance-with-slsa-sigstore/SKILL.md +++ b/skills/verifying-build-provenance-with-slsa-sigstore/SKILL.md @@ -1,6 +1,11 @@ --- name: verifying-build-provenance-with-slsa-sigstore -description: Verify signed artifacts and SLSA build provenance with Sigstore cosign and slsa-verifier, enforce keyless OIDC identity, and apply SLSA Build levels to harden the software supply chain. +description: Verifies artifact signatures and SLSA provenance using Sigstore's + cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier + (verify-artifact), enforcing keyless OIDC builder identity and source repo against + SLSA Build levels. Use in CI/CD before deploying artifacts, when consuming third-party + attestations, establishing a SLSA Build L3 pipeline, or confirming provenance + during incident response or admission control. domain: cybersecurity subdomain: supply-chain-security tags: