Rewrite 548 skill descriptions to the activation rubric

Each rewritten description now states both what the skill does (concrete
capability, named tools/artifacts) and an explicit when-to-use trigger,
improving agent discovery/activation. Grounded in each skill's own body;
changes confined to the `description` field only (bodies and all other
frontmatter untouched). Produced by a gated audit->rewrite->recheck loop
(548 -> 0 flagged) with a sampled anti-invention check (0 ungrounded).

Schema: 817/817 pass. Framework-ID gate: 0 defects.

skills/abusing-dpapi-for-credential-access/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: abusing-dpapi-for-credential-access
-description: Extract DPAPI-protected secrets such as credentials and browser data offline and online.
+description: Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys) online or offline using SharpDPAPI, SharpChrome, Mimikatz, or Impacket's dpapi.py, including domain-wide decryption via the DPAPI backup key. Use during authorized red-team credential-access engagements after gaining a foothold or when triaging DPAPI blobs pulled from a host.
 domain: cybersecurity
 subdomain: red-teaming
 tags:

skills/abusing-shadow-credentials-for-privesc/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: abusing-shadow-credentials-for-privesc
-description: Take over Active Directory user and computer accounts by writing alternate certificate keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, and Certipy, then authenticate via PKINIT.
+description: Take over Active Directory accounts by writing attacker-controlled public keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, or Certipy, then authenticate via PKINIT to recover the target's NT hash without a password reset. Use when BloodHound shows GenericWrite/GenericAll/AddKeyCredentialLink over a target, as a stealthier alternative to ForceChangePassword, during authorized red-team engagements.
 domain: cybersecurity
 subdomain: red-teaming
 tags:

skills/acquiring-disk-image-with-dd-and-dcfldd/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: acquiring-disk-image-with-dd-and-dcfldd
-description: Create forensically sound bit-for-bit disk images using dd and dcfldd
+description: Create forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash verification (MD5/SHA) during acquisition. Use when imaging a suspect drive, USB device, or memory card for investigation, preserving volatile disk evidence during incident response, or producing a verified copy for legal or law-enforcement proceedings before any destructive analysis.
-  while preserving evidence integrity through hash verification.
 domain: cybersecurity
 subdomain: digital-forensics
 tags:

skills/analyzing-android-malware-with-apktool/SKILL.md

@@ -1,8 +1,6 @@
 ---
 name: analyzing-android-malware-with-apktool
-description: Perform static analysis of Android APK malware samples using apktool
+description: Perform static analysis of Android APK malware using apktool for resource decompilation, jadx for Java source recovery, and androguard for manifest inspection, dangerous permission-combination detection, and identification of obfuscated code, dynamic code loading, and reflection-based API calls. Use to statically triage a suspicious APK without executing it or to build mobile malware detection rules.
-  for decompilation, jadx for Java source recovery, and androguard for permission
-  analysis, manifest inspection, and suspicious API call detection.
 domain: cybersecurity
 subdomain: malware-analysis
 tags:

skills/analyzing-apt-group-with-mitre-navigator/SKILL.md

@@ -1,8 +1,6 @@
 ---
 name: analyzing-apt-group-with-mitre-navigator
-description: Analyze advanced persistent threat (APT) group techniques using MITRE
+description: Query ATT&CK data with attackcti, mitreattack-python, and stix2, then build MITRE ATT&CK Navigator layers and multi-layer heatmap overlays mapping one or more APT groups' TTPs for detection-gap analysis. Use to compare threat-actor technique coverage, find gaps in detection engineering, or produce Navigator visualizations for threat-intel reporting.
-  ATT&CK Navigator to create layered heatmaps of adversary TTPs for detection gap
-  analysis and threat-informed defense.
 domain: cybersecurity
 subdomain: threat-intelligence
 tags:

skills/analyzing-bootkit-and-rootkit-samples/SKILL.md

@@ -1,11 +1,10 @@
 ---
 name: analyzing-bootkit-and-rootkit-samples
-description: 'Analyzes bootkit and advanced rootkit malware that infects the Master
+description: 'Analyzes bootkit and advanced rootkit malware infecting the Master
-  Boot Record (MBR), Volume Boot Record (VBR), or UEFI firmware to gain persistence
+  Boot Record (MBR), Volume Boot Record (VBR), or UEFI firmware for below-OS persistence,
-  below the operating system. Covers boot sector analysis, UEFI module inspection,
+  covering boot sector analysis, UEFI module inspection, and anti-rootkit detection.
-  and anti-rootkit detection techniques. Activates for requests involving bootkit
+  Use when compromise survives OS reinstallation or antivirus/EDR fails to detect
-  analysis, MBR malware investigation, UEFI persistence analysis, or pre-OS malware
+  malware despite clear infection signs.
-  detection.
 
   '
 domain: cybersecurity

skills/analyzing-browser-forensics-with-hindsight/SKILL.md

@@ -1,8 +1,6 @@
 ---
 name: analyzing-browser-forensics-with-hindsight
-description: Analyze Chromium-based browser artifacts using Hindsight to extract browsing
+description: Parse Chromium-based browser databases with Hindsight to extract and correlate browsing history, downloads, cookies, cached content, autofill data, saved passwords, and extensions from Chrome, Edge, Brave, Opera, and Vivaldi into a unified timeline (XLSX, JSON, or SQLite output). Use during incident response, insider-threat investigations, or criminal cases when you need to reconstruct a user's web activity from a browser profile.
-  history, downloads, cookies, cached content, autofill data, saved passwords, and
-  browser extensions from Chrome, Edge, Brave, and Opera for forensic investigation.
 domain: cybersecurity
 subdomain: digital-forensics
 tags:

skills/analyzing-campaign-attribution-evidence/SKILL.md

@@ -1,8 +1,6 @@
 ---
 name: analyzing-campaign-attribution-evidence
-description: Campaign attribution analysis involves systematically evaluating evidence
+description: Systematically evaluate cyber-campaign evidence to attribute an operation to a threat actor, using the Diamond Model and Analysis of Competing Hypotheses (ACH) to weigh infrastructure overlaps, TTP consistency, malware code similarity, and timing/language artifacts into confidence-weighted attribution assessments. Use when an incident investigation needs a defensible attribution confidence level.
-  to determine which threat actor or group is responsible for a cyber operation. This
-  skill covers collecting and weighting attr
 domain: cybersecurity
 subdomain: threat-intelligence
 tags:

skills/analyzing-cloud-storage-access-patterns/SKILL.md

@@ -1,10 +1,6 @@
 ---
 name: analyzing-cloud-storage-access-patterns
-description: Detect abnormal access patterns in AWS S3, GCS, and Azure Blob Storage
+description: Detect abnormal access in AWS S3, GCS, and Azure Blob Storage by analyzing CloudTrail Data Events, GCS audit logs, and Azure Storage Analytics for after-hours bulk downloads, new-IP access, and API-call spikes (e.g. GetObject) via statistical baselines and time-series anomaly detection. Use when investigating suspected cloud data exfiltration or building related detection rules.
-  by analyzing CloudTrail Data Events, GCS audit logs, and Azure Storage Analytics.
-  Identifies after-hours bulk downloads, access from new IP addresses, unusual API
-  calls (GetObject spikes), and potential data exfiltration using statistical baselines
-  and time-series anomaly detection.
 domain: cybersecurity
 subdomain: cloud-security
 tags:

skills/analyzing-cobaltstrike-malleable-c2-profiles/SKILL.md

@@ -1,8 +1,6 @@
 ---
 name: analyzing-cobaltstrike-malleable-c2-profiles
-description: Parse and analyze Cobalt Strike Malleable C2 profiles using dissect.cobaltstrike
+description: Parse and analyze Cobalt Strike Malleable C2 profiles with dissect.cobaltstrike (profiles and beacon-payload configs) and pyMalleableC2 (AST parsing) to extract HTTP/DNS transforms, URIs, headers, sleep/jitter, and injection behavior, then generate network detection signatures. Use when reverse-engineering a captured malleable profile or building detections against Cobalt Strike Beacon traffic.
-  and pyMalleableC2 to extract C2 indicators, detect evasion techniques, and generate
-  network detection signatures.
 domain: cybersecurity
 subdomain: malware-analysis
 tags:

skills/analyzing-command-and-control-communication/SKILL.md

@@ -1,10 +1,11 @@
 ---
 name: analyzing-command-and-control-communication
-description: 'Analyzes malware command-and-control (C2) communication protocols to
+description: 'Analyzes malware C2 communication over HTTP, HTTPS, DNS, and custom
-  understand beacon patterns, command structures, data encoding, and infrastructure.
+  protocols to reverse-engineer beacon patterns, command structures, data encoding,
-  Covers HTTP, HTTPS, DNS, and custom protocol C2 analysis for detection development
+  and infrastructure (primary servers, fallback domains, dead drops). Use after
-  and threat intelligence. Activates for requests involving C2 analysis, beacon detection,
+  reverse engineering reveals network traffic needing protocol analysis or when
-  C2 protocol reverse engineering, or command-and-control infrastructure mapping.
+  building detection signatures for a framework like Cobalt Strike, Metasploit,
+  or Sliver.
 
   '
 domain: cybersecurity

skills/analyzing-disk-image-with-autopsy/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: analyzing-disk-image-with-autopsy
-description: Perform comprehensive forensic analysis of disk images using Autopsy
+description: Perform comprehensive forensic analysis of raw (dd), E01, or AFF disk images with Autopsy and The Sleuth Kit, recovering deleted files, examining metadata and embedded artifacts, keyword searching, and building investigation timelines with visual reports. Use for structured analysis of a forensic disk image or when stakeholders need visual reports from evidence.
-  to recover files, examine artifacts, and build investigation timelines.
 domain: cybersecurity
 subdomain: digital-forensics
 tags:

skills/analyzing-email-headers-for-phishing-investigation/SKILL.md

@@ -1,7 +1,10 @@
 ---
 name: analyzing-email-headers-for-phishing-investigation
-description: Parse and analyze email headers to trace the origin of phishing emails,
+description: Parse and analyze email headers (Received chain, Return-Path, Message-ID)
-  verify sender authenticity, and identify spoofing through SPF, DKIM, and DMARC validation.
+  to trace the true origin of a phishing email and validate SPF, DKIM, and DMARC
+  results to confirm or rule out sender spoofing. Use when triaging a suspicious or
+  reported email, investigating a phishing incident, or verifying whether a message's
+  sender domain was spoofed.
 domain: cybersecurity
 subdomain: digital-forensics
 tags:

skills/analyzing-golang-malware-with-ghidra/SKILL.md

@@ -1,8 +1,11 @@
 ---
 name: analyzing-golang-malware-with-ghidra
-description: Reverse engineer Go-compiled malware using Ghidra with specialized scripts
+description: Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo
-  for function recovery, string extraction, and type reconstruction in stripped Go
+  and pclntab structures, recovering stripped/obfuscated function names (e.g. via
-  binaries.
+  GoResolver), and extracting embedded module/dependency strings and types from Go
+  binaries. Use when analyzing a Go-language malware sample, deobfuscating a garble-packed
+  Go binary, or recovering function names and third-party dependencies from a stripped
+  Go executable.
 domain: cybersecurity
 subdomain: malware-analysis
 tags:

skills/analyzing-linux-elf-malware/SKILL.md

@@ -1,11 +1,10 @@
 ---
 name: analyzing-linux-elf-malware
-description: 'Analyzes malicious Linux ELF (Executable and Linkable Format) binaries
+description: 'Analyze malicious Linux ELF binaries — botnets, cryptominers, ransomware,
-  including botnets, cryptominers, ransomware, and rootkits targeting Linux servers,
+  and rootkits targeting Linux servers, containers, and cloud infrastructure — through
-  containers, and cloud infrastructure. Covers static analysis, dynamic tracing, and
+  static analysis, dynamic tracing, and reverse engineering of x86_64 and ARM samples.
-  reverse engineering of x86_64 and ARM ELF samples. Activates for requests involving
+  Use when investigating Linux malware, triaging a suspicious ELF binary, assessing
-  Linux malware analysis, ELF binary investigation, Linux server compromise assessment,
+  a compromised Linux server, or analyzing container-targeted malware.
-  or container malware analysis.
 
   '
 domain: cybersecurity

skills/analyzing-linux-system-artifacts/SKILL.md

@@ -1,8 +1,10 @@
 ---
 name: analyzing-linux-system-artifacts
-description: Examine Linux system artifacts including auth logs, cron jobs, shell
+description: Examine Linux system artifacts (auth logs, cron/systemd persistence,
-  history, and system configuration to uncover evidence of compromise or unauthorized
+  shell history, SSH keys, and system configuration) to uncover evidence of compromise,
-  activity.
+  detect rootkits or backdoors, and reconstruct user/attacker activity. Use when
+  investigating a compromised Linux server or workstation, hunting for persistence
+  mechanisms, or scoping a Linux-based breach during incident response.
 domain: cybersecurity
 subdomain: digital-forensics
 tags:

skills/analyzing-lnk-file-and-jump-list-artifacts/SKILL.md

@@ -1,8 +1,11 @@
 ---
 name: analyzing-lnk-file-and-jump-list-artifacts
-description: Analyze Windows LNK shortcut files and Jump List artifacts to establish
+description: Analyze Windows LNK shortcut files and Jump List artifacts with LECmd,
-  evidence of file access, program execution, and user activity using LECmd, JLECmd,
+  JLECmd, and manual Shell Link Binary Format parsing to establish evidence of file
-  and manual binary parsing of the Shell Link Binary format.
+  access, program execution, and user activity that persists even after the target
+  file is deleted. Use when investigating Windows user activity, reconstructing file-access
+  or program-execution timelines, or examining recent/frequently-used file evidence
+  in a forensic exam.
 domain: cybersecurity
 subdomain: digital-forensics
 tags:

skills/analyzing-malicious-pdf-with-peepdf/SKILL.md

@@ -2,6 +2,9 @@
 name: analyzing-malicious-pdf-with-peepdf
 description: Perform static analysis of malicious PDF documents using peepdf, pdfid,
   and pdf-parser to extract embedded JavaScript, shellcode, and suspicious objects.
+  Use when triaging a suspicious PDF attachment from a phishing email, analyzing a
+  PDF-based exploit document, or building detection signatures for weaponized PDF
+  threats.
 domain: cybersecurity
 subdomain: malware-analysis
 tags:

skills/analyzing-malware-behavior-with-cuckoo-sandbox/SKILL.md

@@ -1,10 +1,11 @@
 ---
 name: analyzing-malware-behavior-with-cuckoo-sandbox
-description: 'Executes malware samples in Cuckoo Sandbox to observe runtime behavior
+description: 'Detonate malware samples in Cuckoo Sandbox to observe runtime behavior
-  including process creation, file system modifications, registry changes, network
+  — process creation, file system and registry changes, network communications,
-  communications, and API calls. Generates comprehensive behavioral reports for malware
+  and API calls — and generate behavioral reports for classification and IOC extraction.
-  classification and IOC extraction. Activates for requests involving dynamic malware
+  Use when a sample has passed static triage and needs dynamic/behavioral analysis,
-  analysis, sandbox detonation, behavioral analysis, or automated malware execution.
+  when mapping a full infection chain, or when building YARA/behavioral signatures
+  from observed sandbox activity.
 
   '
 domain: cybersecurity

skills/analyzing-malware-family-relationships-with-malpedia/SKILL.md

@@ -1,8 +1,10 @@
 ---
 name: analyzing-malware-family-relationships-with-malpedia
-description: Use the Malpedia platform and API to research malware family relationships,
+description: Query the Malpedia API to look up malware family aliases and naming
-  track variant evolution, link families to threat actors, and integrate YARA rules
+  (platform.family_name), pull community/vendor YARA rules, link families to threat
-  for detection across malware lineages.
+  actors, and map family relationships such as loader-payload chains and shared authorship.
+  Use when researching a malware family's aliases, lineage, or actor attribution,
+  or when sourcing YARA rules for detection.
 domain: cybersecurity
 subdomain: threat-intelligence
 tags:

skills/analyzing-malware-persistence-with-autoruns/SKILL.md

@@ -1,8 +1,10 @@
 ---
 name: analyzing-malware-persistence-with-autoruns
-description: Use Sysinternals Autoruns to systematically identify and analyze malware
+description: Use Sysinternals Autoruns to systematically enumerate and analyze malware
-  persistence mechanisms across registry keys, scheduled tasks, services, drivers,
+  persistence mechanisms across Windows registry run keys, scheduled tasks, services,
-  and startup locations on Windows systems.
+  drivers, and startup locations. Use when hunting for persistence during Windows
+  incident response, triaging a compromised endpoint, or validating that malware
+  autostart entries have been fully identified and removed.
 domain: cybersecurity
 subdomain: malware-analysis
 tags:

skills/analyzing-malware-sandbox-evasion-techniques/SKILL.md

@@ -1,8 +1,10 @@
 ---
 name: analyzing-malware-sandbox-evasion-techniques
-description: Detect sandbox evasion techniques in malware samples by analyzing timing
+description: Detect sandbox and VM evasion techniques in malware samples by analyzing
-  checks, VM artifact queries, user interaction detection, and sleep inflation patterns
+  timing checks, VM/hypervisor artifact queries, user-interaction checks, and sleep-inflation
-  from Cuckoo/AnyRun behavioral reports
+  patterns from Cuckoo or AnyRun behavioral reports. Use when a sample shows no or
+  minimal activity in a sandbox, when a behavioral report needs review for evasion
+  indicators, or when building detections for anti-analysis techniques.
 domain: cybersecurity
 subdomain: malware-analysis
 tags:

skills/analyzing-mft-for-deleted-file-recovery/SKILL.md

@@ -1,8 +1,10 @@
 ---
 name: analyzing-mft-for-deleted-file-recovery
-description: Analyze the NTFS Master File Table ($MFT) to recover metadata and content
+description: Analyze the NTFS Master File Table ($MFT) with MFTECmd, analyzeMFT,
-  of deleted files by examining MFT record entries, $LogFile, $UsnJrnl, and MFT slack
+  and X-Ways Forensics to recover metadata and content of deleted files by examining
-  space using MFTECmd, analyzeMFT, and X-Ways Forensics.
+  MFT record entries, $LogFile, $UsnJrnl, and MFT slack space. Use when recovering
+  evidence of deleted files, reconstructing NTFS file-system timelines, or detecting
+  anti-forensic timestomping during a Windows forensic examination.
 domain: cybersecurity
 subdomain: digital-forensics
 tags:

skills/analyzing-network-covert-channels-in-malware/SKILL.md

@@ -1,8 +1,10 @@
 ---
 name: analyzing-network-covert-channels-in-malware
-description: Detect and analyze covert communication channels used by malware including
+description: Detect and analyze covert communication channels used by malware, including
-  DNS tunneling, ICMP exfiltration, steganographic HTTP, and protocol abuse for C2
+  DNS tunneling, ICMP exfiltration, steganographic HTTP, and other protocol abuse
-  and data exfiltration.
+  used for C2 and data exfiltration. Use when investigating suspicious DNS/ICMP/HTTP
+  traffic patterns, hunting for hidden C2 channels in network captures, or attributing
+  exfiltration traffic to a known tunneling toolset.
 domain: cybersecurity
 subdomain: malware-analysis
 tags:

skills/analyzing-network-packets-with-scapy/SKILL.md

@@ -1,8 +1,6 @@
 ---
 name: analyzing-network-packets-with-scapy
-description: Craft, send, sniff, and dissect network packets using Scapy for protocol
+description: Use Scapy to craft, send, sniff, and dissect TCP/UDP/ICMP/DNS packets, analyze pcap files, implement SYN scans, and detect anomalous traffic such as fragmented or malformed packets. Use when performing authorized network reconnaissance, protocol-level forensic analysis, or building traffic anomaly detection during security testing.
-  analysis, network reconnaissance, and traffic anomaly detection in authorized security
-  testing
 domain: cybersecurity
 subdomain: network-security
 tags:

skills/analyzing-outlook-pst-for-email-forensics/SKILL.md

@@ -1,9 +1,6 @@
 ---
 name: analyzing-outlook-pst-for-email-forensics
-description: Analyze Microsoft Outlook PST and OST files for email forensic evidence
+description: Parse Microsoft Outlook PST and OST files using libpff and pst-utils to extract message content, headers, attachments, deleted items, and MAPI metadata, including recovery of items from the Recoverable Items folder. Use when conducting email forensic investigations, legal e-discovery, or incident response that requires reconstructing communication patterns or tracing message routing from Outlook archives.
-  including message content, headers, attachments, deleted items, and metadata using
-  libpff, pst-utils, and forensic email analysis tools for legal investigations and
-  incident response.
 domain: cybersecurity
 subdomain: digital-forensics
 tags:

skills/analyzing-packed-malware-with-upx-unpacker/SKILL.md

@@ -1,10 +1,6 @@
 ---
 name: analyzing-packed-malware-with-upx-unpacker
-description: 'Identifies and unpacks UPX-packed and other packed malware samples to
+description: 'Identifies and unpacks UPX-packed malware samples, including binaries with modified UPX magic bytes or headers that block automated decompression, to recover the original executable for static analysis. Use when a sample shows high entropy, minimal imports, or only LoadLibrary/GetProcAddress in its import table, or when preparing a packed binary for disassembly in Ghidra or IDA.
-  expose the original executable code for static analysis. Covers both standard UPX
-  unpacking and handling modified UPX headers that prevent automated decompression.
-  Activates for requests involving malware unpacking, UPX decompression, packer removal,
-  or preparing packed samples for analysis.
 
   '
 domain: cybersecurity

skills/analyzing-persistence-mechanisms-in-linux/SKILL.md

@@ -1,8 +1,6 @@
 ---
 name: analyzing-persistence-mechanisms-in-linux
-description: Detect and analyze Linux persistence mechanisms including crontab entries,
+description: Scan Linux systems for persistence mechanisms including crontab/systemd entries, LD_PRELOAD injection, shell profile modifications (.bashrc, .profile), and SSH authorized_keys backdoors, then correlate findings with auditd logs into an installation timeline. Use during incident response or threat hunting to detect or confirm how an adversary maintained access to a compromised Linux host.
-  systemd service units, LD_PRELOAD hijacking, bashrc modifications, and authorized_keys
-  backdoors using auditd and file integrity monitoring
 domain: cybersecurity
 subdomain: threat-hunting
 tags:

skills/analyzing-powershell-empire-artifacts/SKILL.md

@@ -1,8 +1,6 @@
 ---
 name: analyzing-powershell-empire-artifacts
-description: Detect PowerShell Empire framework artifacts in Windows event logs by
+description: Detect PowerShell Empire post-exploitation framework artifacts in Windows Script Block Logging (Event ID 4104) and Module Logging (Event ID 4103), including the default launcher string, Base64-encoded WebClient/FromBase64String payloads, known module invocations (Invoke-Mimikatz, Invoke-Kerberoast), and staging URL patterns. Use when hunting for or confirming Empire C2 activity in Windows event logs.
-  identifying Base64 encoded launcher patterns, default user agents, staging URL structures,
-  stager IOCs, and known Empire module signatures in Script Block Logging events.
 domain: cybersecurity
 subdomain: threat-hunting
 tags:

skills/analyzing-prefetch-files-for-execution-history/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: analyzing-prefetch-files-for-execution-history
-description: Parse Windows Prefetch files to determine program execution history including
+description: Parse Windows Prefetch files (versions 17, 23, 26, 30) with tools like PECmd, WinPrefetchView, or python-prefetch to determine program execution history, including run counts, execution timestamps, and referenced files/DLLs. Use when building a timeline of program execution on a Windows system, confirming whether a suspicious binary ran, or correlating execution evidence with other forensic artifacts during an investigation.
-  run counts, timestamps, and referenced files for forensic investigation.
 domain: cybersecurity
 subdomain: digital-forensics
 tags:

skills/analyzing-ransomware-leak-site-intelligence/SKILL.md

@@ -1,8 +1,6 @@
 ---
 name: analyzing-ransomware-leak-site-intelligence
-description: Monitor and analyze ransomware group data leak sites (DLS) to track victim
+description: Safely monitor ransomware group Tor-hosted data leak sites (DLS) to collect and extract structured victim posting data, track group activity trends over time, and produce sector- and geography-specific ransomware risk assessments. Use when performing threat intelligence gathering on active ransomware groups or building proactive defense reporting from double-extortion leak-site activity.
-  postings, extract threat intelligence on group tactics, and assess sector-specific
-  ransomware risk for proactive defense.
 domain: cybersecurity
 subdomain: threat-intelligence
 tags:

skills/analyzing-ransomware-network-indicators/SKILL.md

@@ -1,8 +1,6 @@
 ---
 name: analyzing-ransomware-network-indicators
-description: Identify ransomware network indicators including C2 beaconing patterns,
+description: Identify ransomware-related network indicators, including C2 beaconing patterns, TOR exit node connections, data exfiltration flows, and encryption key exchange, by analyzing Zeek conn.log and NetFlow data. Use when threat hunting for active ransomware network activity or investigating suspected pre-encryption exfiltration during incident response.
-  TOR exit node connections, data exfiltration flows, and encryption key exchange
-  via Zeek conn.log and NetFlow analysis
 domain: cybersecurity
 subdomain: threat-hunting
 tags:

skills/analyzing-ransomware-payment-wallets/SKILL.md

@@ -1,11 +1,6 @@
 ---
 name: analyzing-ransomware-payment-wallets
-description: 'Traces ransomware cryptocurrency payment flows using blockchain analysis
+description: 'Traces ransomware cryptocurrency payment flows using blockchain analysis tools such as Chainalysis Reactor, WalletExplorer, and blockchain.com APIs, identifying wallet clusters and tracking fund movement through mixers and exchanges to support law enforcement attribution. Use when tracing ransomware bitcoin payments, performing cryptocurrency wallet forensics, or gathering blockchain threat intelligence on extortion payments.
-  tools such as Chainalysis Reactor, WalletExplorer, and blockchain.com APIs. Identifies
-  wallet clusters, tracks fund movement through mixers and exchanges, and supports
-  law enforcement attribution. Activates for requests involving ransomware payment
-  tracing, bitcoin wallet analysis, cryptocurrency forensics, or blockchain intelligence
-  gathering.
 
   '
 domain: cybersecurity

skills/analyzing-slack-space-and-file-system-artifacts/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: analyzing-slack-space-and-file-system-artifacts
-description: Examine file system slack space, MFT entries, USN journal, and alternate
+description: Examine NTFS slack space, MFT entries, the USN Change Journal, and Alternate Data Streams (ADS) to recover hidden or residual data, reconstruct deleted-file metadata, and reconstruct available file-system change activity from USN records. Use during deep forensic analysis of an NTFS image when standard file recovery is insufficient, such as hunting for data hidden in ADS.
-  data streams to recover hidden data and reconstruct file activity on NTFS volumes.
 domain: cybersecurity
 subdomain: digital-forensics
 tags:

skills/analyzing-threat-actor-ttps-with-mitre-attack/SKILL.md

@@ -1,8 +1,6 @@
 ---
 name: analyzing-threat-actor-ttps-with-mitre-attack
-description: MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics,
+description: Systematically map threat actor behavior and observed IOCs to the MITRE ATT&CK framework, build technique coverage heatmaps with the ATT&CK Navigator, identify detection gaps, and produce actionable threat intelligence reports across the Enterprise, Mobile, and ICS matrices. Use when analyzing threat actor TTPs, correlating IOCs to specific ATT&CK techniques, or assessing defensive detection coverage against adversary behavior.
-  techniques, and procedures (TTPs) based on real-world observations. This skill covers
-  systematically mapping threat actor beh
 domain: cybersecurity
 subdomain: threat-intelligence
 tags:

skills/analyzing-threat-actor-ttps-with-mitre-navigator/SKILL.md

@@ -1,11 +1,6 @@
 ---
 name: analyzing-threat-actor-ttps-with-mitre-navigator
-description: 'Map advanced persistent threat (APT) group tactics, techniques, and
+description: 'Map advanced persistent threat (APT) group TTPs to the MITRE ATT&CK framework using the attackcti Python library to query STIX/TAXII data for group-technique associations, then generate ATT&CK Navigator layer files to visualize and compare defensive coverage against adversary profiles. Use when profiling an APT group''s techniques, building Navigator coverage heatmaps, or assessing technique coverage gaps against a specific threat actor.
-  procedures (TTPs) to the MITRE ATT&CK framework using the ATT&CK Navigator and attackcti
-  Python library. The analyst queries STIX/TAXII data for group-technique associations,
-  generates Navigator layer files for visualization, and compares defensive coverage
-  against adversary profiles. Activates for requests involving APT TTP mapping, ATT&CK
-  Navigator layers, threat actor profiling, or MITRE technique coverage analysis.
 
   '
 domain: cybersecurity

skills/analyzing-threat-landscape-with-misp/SKILL.md

@@ -1,10 +1,10 @@
 ---
 name: analyzing-threat-landscape-with-misp
-description: Analyze the threat landscape using MISP (Malware Information Sharing
+description: Query a MISP (Malware Information Sharing Platform) instance via PyMISP
-  Platform) by querying event statistics, attribute distributions, threat actor galaxy
+  to compute event statistics, IOC type breakdowns, threat actor galaxy clusters,
-  clusters, and tag trends over time. Uses PyMISP to pull event data, compute IOC
+  and tag trends, and generate threat landscape reports with temporal trends. Use
-  type breakdowns, identify top threat actors and malware families, and generate threat
+  when asked to analyze threat intelligence data, summarize top threat actors or
-  landscape reports with temporal trends.
+  malware families, or produce a CTI landscape report from MISP events.
 domain: cybersecurity
 subdomain: threat-intelligence
 tags:

skills/analyzing-typosquatting-domains-with-dnstwist/SKILL.md

@@ -1,8 +1,9 @@
 ---
 name: analyzing-typosquatting-domains-with-dnstwist
-description: Detect typosquatting, homograph phishing, and brand impersonation domains
+description: Generate domain permutations with dnstwist and check DNS resolution
-  using dnstwist to generate domain permutations and identify registered lookalike
+  to detect typosquatting, homograph phishing, and brand impersonation domains registered
-  domains targeting your organization.
+  against your organization. Use when asked to monitor for lookalike domains, investigate
+  a phishing domain, or assess brand-impersonation risk.
 domain: cybersecurity
 subdomain: threat-intelligence
 tags:

skills/analyzing-uefi-bootkit-persistence/SKILL.md

@@ -1,12 +1,10 @@
 ---
 name: analyzing-uefi-bootkit-persistence
-description: 'Analyzes UEFI bootkit persistence mechanisms including firmware implants
+description: 'Analyzes UEFI bootkit persistence (SPI flash implants, ESP modifications,
-  in SPI flash, EFI System Partition (ESP) modifications, Secure Boot bypass techniques,
+  Secure Boot bypass, UEFI variable manipulation) using chipsec for firmware integrity
-  and UEFI variable manipulation. Covers detection of known bootkit families (BlackLotus,
+  verification, detecting known families like BlackLotus, LoJax, and MoonBounce.
-  LoJax, MosaicRegressor, MoonBounce, CosmicStrand), ESP partition forensic inspection,
+  Use for UEFI malware analysis, firmware persistence investigation, or Secure Boot
-  chipsec-based firmware integrity verification, and Secure Boot configuration auditing.
+  bypass detection.
-  Activates for requests involving UEFI malware analysis, firmware persistence investigation,
-  boot chain integrity verification, or Secure Boot bypass detection.
 
   '
 domain: cybersecurity

skills/analyzing-usb-device-connection-history/SKILL.md

@@ -1,7 +1,9 @@
 ---
 name: analyzing-usb-device-connection-history
-description: Investigate USB device connection history from Windows registry, event
+description: Correlate Windows registry keys (USBSTOR, MountedDevices), Event Logs,
-  logs, and setupapi logs to track removable media usage and potential data exfiltration.
+  and setupapi.dev.log to reconstruct USB device connection history, first/last-plugged
+  timestamps, and drive letter mappings. Use when investigating removable media usage,
+  tracking device provenance, or building a timeline for suspected data exfiltration.
 domain: cybersecurity
 subdomain: digital-forensics
 tags:

skills/analyzing-windows-amcache-artifacts/SKILL.md

@@ -1,12 +1,10 @@
 ---
 name: analyzing-windows-amcache-artifacts
-description: 'Parses and analyzes the Windows Amcache.hve registry hive to extract
+description: 'Parses the Windows Amcache.hve registry hive with Eric Zimmerman''s
-  evidence of program execution, application installation, and driver loading for
+  AmcacheParser and Timeline Explorer to extract evidence of program execution, application
-  digital forensics investigations. Uses Eric Zimmerman''s AmcacheParser and Timeline
+  installation, and driver loading, including SHA-1 hash correlation with threat
-  Explorer for artifact extraction, SHA-1 hash correlation with threat intel, and
+  intel and timeline reconstruction. Use for Amcache forensics, program execution
-  timeline reconstruction. Activates for requests involving Amcache forensics, program
+  evidence gathering, or application compatibility cache investigations in DFIR work.
-  execution evidence, Windows artifact analysis, or application compatibility cache
-  investigation.
 
   '
 domain: cybersecurity

skills/analyzing-windows-lnk-files-for-artifacts/SKILL.md

@@ -1,7 +1,9 @@
 ---
 name: analyzing-windows-lnk-files-for-artifacts
-description: Parse Windows LNK shortcut files to extract target paths, timestamps,
+description: Parse Windows LNK shortcut files to extract target paths, MAC timestamps,
-  volume information, and machine identifiers for forensic timeline reconstruction.
+  volume serial numbers, and machine identifiers for forensic timeline reconstruction.
+  Use when investigating recently-accessed files, tracking removable media or network
+  paths referenced by shortcuts, or building a DFIR timeline from LNK artifacts.
 domain: cybersecurity
 subdomain: digital-forensics
 tags:

skills/analyzing-windows-prefetch-with-python/SKILL.md

@@ -1,8 +1,10 @@
 ---
 name: analyzing-windows-prefetch-with-python
-description: Parse Windows Prefetch files using the windowsprefetch Python library
+description: Parse Windows Prefetch (.pf) files with the windowsprefetch Python
-  to reconstruct application execution history, detect renamed or masquerading binaries,
+  library to reconstruct application execution history, run counts, and accessed
-  and identify suspicious program execution patterns.
+  file/volume lists. Use when investigating renamed or masquerading binaries, verifying
+  program execution timelines, or hunting for suspicious execution patterns in incident
+  response.
 domain: cybersecurity
 subdomain: digital-forensics
 tags:

skills/analyzing-windows-registry-for-artifacts/SKILL.md

@@ -1,7 +1,10 @@
 ---
 name: analyzing-windows-registry-for-artifacts
-description: Extract and analyze Windows Registry hives to uncover user activity,
+description: Extract and analyze Windows Registry hives with tools like RegRipper
-  installed software, autostart entries, and evidence of system compromise.
+  and Registry Explorer to uncover user activity, installed software, autostart/persistence
+  entries, and evidence of system compromise. Use when investigating registry-based
+  persistence, reconstructing user or system activity, or performing DFIR triage
+  on a Windows image.
 domain: cybersecurity
 subdomain: digital-forensics
 tags:

skills/analyzing-windows-shellbag-artifacts/SKILL.md

@@ -1,8 +1,10 @@
 ---
 name: analyzing-windows-shellbag-artifacts
-description: Analyze Windows Shellbag registry artifacts to reconstruct folder browsing
+description: Analyze Windows Shellbag (BagMRU) registry artifacts with SBECmd and
-  activity, detect access to removable media and network shares, and establish user
+  Shellbags Explorer to reconstruct folder browsing activity and prove user interaction
-  interaction with directories even after deletion using SBECmd and ShellBags Explorer.
+  with directories, including removable media and network shares, even after the
+  folders are deleted. Use when reconstructing a user's folder access history or
+  proving access to a since-removed directory in DFIR work.
 domain: cybersecurity
 subdomain: digital-forensics
 tags:

skills/assessing-vector-and-embedding-weaknesses/SKILL.md

@@ -1,6 +1,9 @@
 ---
 name: assessing-vector-and-embedding-weaknesses
-description: Test vector stores for embedding inversion, cross-tenant leakage, and poisoning.
+description: Test RAG vector stores (Pinecone, Qdrant, Weaviate, Chroma, pgvector,
+  FAISS) for embedding inversion, cross-tenant data leakage, and data poisoning per
+  OWASP LLM08:2025. Use when performing an authorized security assessment of a RAG
+  pipeline's retrieval layer or auditing multi-tenant vector-store isolation.
 domain: cybersecurity
 subdomain: ai-security
 tags:

skills/attacking-entra-id-with-roadtools/SKILL.md

@@ -1,6 +1,10 @@
 ---
 name: attacking-entra-id-with-roadtools
-description: Enumerate Entra ID with ROADrecon and acquire and exchange tokens with roadtx.
+description: Enumerate Microsoft Entra ID (Azure AD) tenants with ROADrecon and
+  acquire, exchange, and abuse tokens (including primary refresh tokens) with roadtx.
+  Use for authorized red-team enumeration of a tenant's directory objects or for
+  token-based identity attacks against Entra ID you are explicitly authorized to
+  test.
 domain: cybersecurity
 subdomain: identity-access-management
 tags:

skills/attacking-oauth-with-device-code-phishing/SKILL.md

@@ -1,6 +1,10 @@
 ---
 name: attacking-oauth-with-device-code-phishing
-description: Run OAuth 2.0 device-code and illicit-consent phishing against Microsoft Entra ID to steal access and refresh tokens, bypass MFA, and pivot across Microsoft 365 services.
+description: Run OAuth 2.0 device-code and illicit-consent phishing attacks against
+  Microsoft Entra ID, using TokenTactics-style tooling to steal access and refresh
+  tokens, bypass MFA, and pivot across Microsoft 365 services. Use for authorized
+  red-team engagements simulating device-code or consent-grant phishing against a
+  tenant you have explicit written permission to test.
 domain: cybersecurity
 subdomain: identity-access-management
 tags:

skills/auditing-cloud-with-cis-benchmarks/SKILL.md

@@ -1,12 +1,6 @@
 ---
 name: auditing-cloud-with-cis-benchmarks
-description: 'This skill details how to conduct cloud security audits using Center
+description: Audit AWS, Azure, and GCP environments against the CIS Foundations Benchmarks by running automated scans with tools like Prowler and ScoutSuite, interpreting failed controls, and tracking remediation for continuous compliance. Use when conducting a cloud security audit, validating CIS benchmark compliance (CIS v5 AWS, v4 Azure, v4 GCP), or setting up continuous cloud compliance monitoring.
-  for Internet Security benchmarks for AWS, Azure, and GCP. It covers interpreting
-  CIS Foundations Benchmark controls, running automated assessments with tools like
-  Prowler and ScoutSuite, remediating failed controls, and maintaining continuous
-  compliance monitoring against CIS v5 for AWS, v4 for Azure, and v4 for GCP.
-
-  '
 domain: cybersecurity
 subdomain: cloud-security
 tags:

skills/auditing-entra-id-with-aadinternals/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: auditing-entra-id-with-aadinternals
-description: Run Microsoft Entra ID tenant reconnaissance, token acquisition and manipulation, and federation backdoor testing with the AADInternals PowerShell toolkit to validate identity-attack resilience.
+description: Drive the AADInternals PowerShell toolkit to perform Microsoft Entra ID tenant reconnaissance, access-token acquisition across Microsoft APIs, and federation/AD FS backdoor testing (Golden SAML, T1606.002) for defensive validation. Use during an authorized Entra ID/Microsoft 365 red-team assessment to map external attack surface or verify AD FS signing certs resist Golden SAML.
 domain: cybersecurity
 subdomain: identity-access-management
 tags:

skills/auditing-mcp-servers-for-tool-poisoning/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: auditing-mcp-servers-for-tool-poisoning
-description: Scan Model Context Protocol servers and tool metadata for poisoning, SSRF, and unauthenticated exposure.
+description: Audit MCP servers for tool poisoning, tool shadowing, rug pulls, SSRF, and unauthenticated exposure using Invariant Labs' mcp-scan for static/runtime scanning plus manual SSRF/auth checks and description pinning. Use before adding a new MCP server to an agent stack, when reviewing an internal MCP server, detecting rug pulls, or investigating an agent's unexpected tool-driven behavior.
 domain: cybersecurity
 subdomain: ai-security
 tags:

skills/benchmarking-kubernetes-with-kube-bench/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: benchmarking-kubernetes-with-kube-bench
-description: Run CIS Kubernetes Benchmark checks and remediate findings with kube-bench.
+description: Run kube-bench (Aqua Security) against a Kubernetes cluster's control-plane, kubelet, and node configuration to check compliance with the CIS Kubernetes Benchmark and remediate PASS/FAIL/WARN findings. Use when establishing a security baseline for a new cluster, performing periodic hardening audits, validating remediation after configuration changes, or gathering compliance evidence for SOC 2/PCI DSS.
 domain: cybersecurity
 subdomain: container-security
 tags:

skills/building-adversary-infrastructure-tracking-system/SKILL.md

@@ -1,8 +1,6 @@
 ---
 name: building-adversary-infrastructure-tracking-system
-description: Build an automated system to track adversary infrastructure using passive
+description: Build an automated adversary infrastructure tracking system in Python (dnspython, python-whois, shodan, networkx) that pivots across passive DNS, certificate transparency logs, WHOIS records, and IP enrichment to map threat-actor C2 networks and flag newly registered domains matching known patterns. Use when pivoting from known indicators to discover related C2 infrastructure or maintaining a continuously updated map of a threat actor's network.
-  DNS, certificate transparency, WHOIS data, and IP enrichment to map and monitor
-  threat actor command-and-control networks.
 domain: cybersecurity
 subdomain: threat-intelligence
 tags:

skills/building-attack-pattern-library-from-cti-reports/SKILL.md

@@ -1,8 +1,6 @@
 ---
 name: building-attack-pattern-library-from-cti-reports
-description: Extract and catalog attack patterns from cyber threat intelligence reports
+description: Parse cyber threat intelligence reports (Mandiant, CrowdStrike, Talos, Microsoft) with stix2, mitreattack-python, and spaCy to extract adversary behaviors, map them to MITRE ATT&CK technique IDs, and build a searchable STIX 2.1 attack-pattern library with detection templates. Use when cataloging attack patterns from CTI reports for threat-informed detection engineering, or generating Sigma/YARA templates from documented behaviors.
-  into a structured STIX-based library mapped to MITRE ATT&CK for detection engineering
-  and threat-informed defense.
 domain: cybersecurity
 subdomain: threat-intelligence
 tags:

skills/building-c2-infrastructure-with-sliver-framework/SKILL.md

@@ -1,8 +1,6 @@
 ---
 name: building-c2-infrastructure-with-sliver-framework
-description: Build and configure a resilient command-and-control infrastructure using
+description: Deploy and harden a Sliver C2 team server (BishopFox's Go-based adversary emulation framework) with multi-protocol listeners (mTLS, HTTP/S, DNS, WireGuard), redirectors, domain fronting, and multi-operator support for authorized red-team operations. Use when standing up resilient C2 for a red-team engagement or generating beacon/session implants that must survive blue-team detection.
-  BishopFox's Sliver C2 framework with redirectors, HTTPS listeners, and multi-operator
-  support for authorized red team engagements.
 domain: cybersecurity
 subdomain: red-teaming
 tags:

skills/building-c2-redirector-infrastructure/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: building-c2-redirector-infrastructure
-description: Architect redirectors with nginx and Apache, malleable profiles, and OPSEC
+description: Build dumb-pipe and traffic-filtering C2 redirectors with nginx (proxy_pass) and Apache (mod_rewrite), deriving filter rules from a Malleable C2 profile, layering Let's Encrypt TLS, and applying OPSEC controls like domain fronting and UA/geo filtering. Use when standing up red-team C2 that must survive blue-team triage or ensuring only profile-matching implant traffic reaches the hidden team server.
-  for resilient C2.
 domain: cybersecurity
 subdomain: red-teaming
 tags:

skills/building-cloud-siem-with-sentinel/SKILL.md

@@ -1,12 +1,6 @@
 ---
 name: building-cloud-siem-with-sentinel
-description: 'This skill covers deploying Microsoft Sentinel as a cloud-native SIEM
+description: Deploy Microsoft Sentinel as a cloud-native SIEM/SOAR by configuring multi-cloud data connectors (AWS, Azure, GCP), writing KQL detection and hunting queries, and building automated Logic Apps response playbooks. Use when establishing a centralized SOC for multi-cloud environments, migrating from a legacy SIEM, or performing petabyte-scale threat hunting; not for AWS-only setups where Security Hub/GuardDuty suffice or for endpoint EDR needs.
-  and SOAR platform for centralized security operations. It details configuring data
-  connectors for multi-cloud log ingestion, writing KQL detection queries, building
-  automated response playbooks with Logic Apps, and leveraging the Sentinel data lake
-  for petabyte-scale threat hunting across AWS, Azure, and GCP security telemetry.
-
-  '
 domain: cybersecurity
 subdomain: cloud-security
 tags:

skills/building-devsecops-pipeline-with-gitlab-ci/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: building-devsecops-pipeline-with-gitlab-ci
-description: Design and implement a comprehensive DevSecOps pipeline in GitLab CI/CD
+description: Configure a GitLab CI/CD pipeline that embeds SAST (Semgrep, SpotBugs, Gosec, Bandit, NodeJsScan), DAST, container scanning, dependency scanning, and secret detection via GitLab's managed security templates. Use when building a shift-left DevSecOps pipeline in GitLab, adding automated vulnerability scanning stages to .gitlab-ci.yml, or triaging scanner findings with GitLab Duo AI before deployment.
-  integrating SAST, DAST, container scanning, dependency scanning, and secret detection.
 domain: cybersecurity
 subdomain: devsecops
 tags:

skills/building-identity-federation-with-saml-azure-ad/SKILL.md

@@ -1,8 +1,6 @@
 ---
 name: building-identity-federation-with-saml-azure-ad
-description: Establish SAML 2.0 identity federation between on-premises Active Directory
+description: Configure SAML 2.0 identity federation between on-premises Active Directory (via AD FS or a third-party IdP) and Microsoft Entra ID, covering federation models (AD FS, password hash sync, pass-through auth, third-party IdP) and the SAML authentication flow. Use when extending on-premises authentication authority to cloud resources or designing hybrid identity SSO architecture for Entra ID.
-  and Azure AD (Microsoft Entra ID) for seamless cross-domain authentication and SSO
-  to cloud applications.
 domain: cybersecurity
 subdomain: identity-access-management
 tags:

skills/building-identity-governance-lifecycle-process/SKILL.md

@@ -1,12 +1,6 @@
 ---
 name: building-identity-governance-lifecycle-process
-description: 'Builds comprehensive identity governance and lifecycle management processes
+description: Design identity governance and lifecycle (IGA) programs on platforms like SailPoint, Saviynt, or Entra ID Governance, covering joiner-mover-leaver (JML) automation, role mining, access requests, periodic recertification, and orphaned-account remediation sourced from an HR feed. Use when automating cross-system JML provisioning, remediating former-employee access, or building lifecycle processes for SOX, HIPAA, or GDPR compliance.
-  including joiner-mover-leaver automation, role mining, access request workflows,
-  periodic recertification, and orphaned account remediation using IGA platforms.
-  Activates for requests involving identity lifecycle management, JML processes, role-based
-  access provisioning, or identity governance program design.
-
-  '
 domain: cybersecurity
 subdomain: identity-access-management
 tags:

skills/building-incident-response-playbook/SKILL.md

@@ -1,13 +1,10 @@
 ---
 name: building-incident-response-playbook
-description: 'Designs and documents structured incident response playbooks that define
+description: Designs and documents structured incident response playbooks with step-by-step
-  step-by-step procedures for specific incident types aligned with NIST SP 800-61r3
+  procedures per incident type, decision trees, escalation criteria, RACI matrices,
-  and SANS PICERL frameworks. Covers playbook structure, decision trees, escalation
+  and SOAR platform integration, aligned to NIST SP 800-61r3 and SANS PICERL. Use
-  criteria, RACI matrices, and integration with SOAR platforms. Activates for requests
+  when creating or maturing an IR program, documenting response runbooks for a new
-  involving IR playbook creation, incident response procedure documentation, response
+  incident type, or designing SOAR playbooks.
-  runbook development, or SOAR playbook design.
-
-  '
 domain: cybersecurity
 subdomain: incident-response
 tags:

skills/building-incident-timeline-with-timesketch/SKILL.md

@@ -1,8 +1,10 @@
 ---
 name: building-incident-timeline-with-timesketch
 description: Build collaborative forensic incident timelines using Timesketch to ingest,
-  normalize, and analyze multi-source event data for attack chain reconstruction and
+  normalize, and analyze multi-source event data (including Plaso output) for attack
-  investigation documentation.
+  chain reconstruction and investigation documentation. Use when reconstructing the
+  sequence of events during an incident investigation or when multiple analysts need
+  to jointly tag, annotate, and search a shared DFIR timeline.
 domain: cybersecurity
 subdomain: incident-response
 tags:

skills/building-ioc-defanging-and-sharing-pipeline/SKILL.md

@@ -1,8 +1,10 @@
 ---
 name: building-ioc-defanging-and-sharing-pipeline
-description: Build an automated pipeline to defang indicators of compromise (URLs,
+description: Build an automated pipeline that ingests raw IOCs (URLs, IPs, domains,
-  IPs, domains, emails) for safe sharing and distribute them in STIX format through
+  emails), normalizes and deduplicates them, then produces defanged renderings for
-  TAXII feeds and threat intelligence platforms.
+  safe human reading alongside canonical STIX 2.1 bundles distributed via TAXII servers,
+  MISP, or email reports. Use when preparing indicators of compromise for safe analyst
+  sharing or automating threat intel distribution to TAXII/MISP feeds.
 domain: cybersecurity
 subdomain: threat-intelligence
 tags:

skills/building-ioc-enrichment-pipeline-with-opencti/SKILL.md

@@ -1,8 +1,10 @@
 ---
 name: building-ioc-enrichment-pipeline-with-opencti
-description: OpenCTI is an open-source platform for managing cyber threat intelligence
+description: Build an automated IOC enrichment pipeline on OpenCTI (STIX 2.1 native
-  knowledge, built on STIX 2.1 as its native data model. This skill covers building
+  threat intel platform) using its internal enrichment connectors to pull context
-  an automated IOC enrichment pipeline using O
+  from VirusTotal, Shodan, AbuseIPDB, and GreyNoise, correlate indicators with known
+  actors/campaigns, and score them for analyst prioritization. Use when deploying
+  OpenCTI or automating enrichment and confidence scoring of newly ingested indicators.
 domain: cybersecurity
 subdomain: threat-intelligence
 tags:

skills/building-malware-incident-communication-template/SKILL.md

@@ -1,8 +1,10 @@
 ---
 name: building-malware-incident-communication-template
-description: Build structured communication templates for malware incidents including
+description: Build structured communication templates for malware incidents (ransomware,
-  stakeholder notifications, executive briefings, technical advisories, and regulatory
+  wiper, trojan, worm), covering internal stakeholder notifications, executive briefings,
-  disclosures with severity-based escalation procedures.
+  technical advisories for IT teams, customer notifications, and regulatory disclosures,
+  with severity-based escalation procedures. Use when drafting or standardizing incident
+  communications and notification workflows for a malware outbreak.
 domain: cybersecurity
 subdomain: incident-response
 tags:

skills/building-patch-tuesday-response-process/SKILL.md

@@ -1,7 +1,10 @@
 ---
 name: building-patch-tuesday-response-process
-description: Establish a structured operational process to triage, test, and deploy
+description: Establish a repeatable operational process for triaging, testing, and
-  Microsoft Patch Tuesday security updates within risk-based remediation SLAs.
+  deploying Microsoft Patch Tuesday security updates (Windows, Office, Exchange, SQL
+  Server, Azure) via WSUS/SCCM within risk-based remediation SLAs, from advisory review
+  through validation. Use when building or improving a monthly patch management workflow
+  or prioritizing which CVEs to remediate first.
 domain: cybersecurity
 subdomain: vulnerability-management
 tags:

skills/building-phishing-reporting-button-workflow/SKILL.md

@@ -1,8 +1,10 @@
 ---
 name: building-phishing-reporting-button-workflow
-description: Implement a phishing report button in email clients with automated triage
+description: Implement a phishing report button (Microsoft 365 built-in Report button
-  workflow that analyzes user-reported suspicious emails and provides feedback to
+  or third-party like KnowBe4/Cofense) in email clients with a SOAR-driven automated
-  reporters.
+  triage workflow that classifies reported emails, extracts IOCs, takes remediation
+  actions, and gives feedback to reporters. Use when deploying user-reported phishing
+  intake or automating triage of the resulting reporting mailbox.
 domain: cybersecurity
 subdomain: phishing-defense
 tags:

skills/building-ransomware-playbook-with-cisa-framework/SKILL.md

@@ -1,12 +1,10 @@
 ---
 name: building-ransomware-playbook-with-cisa-framework
-description: 'Builds a structured ransomware incident response playbook aligned with
+description: Builds a structured ransomware incident response playbook aligned with
-  the CISA StopRansomware Guide and NIST Cybersecurity Framework. Covers preparation,
+  the CISA StopRansomware Guide and NIST Cybersecurity Framework, covering preparation,
   detection, containment, eradication, recovery, and post-incident phases with actionable
-  checklists. Activates for requests involving ransomware response planning, CISA
+  checklists. Use when creating or updating a ransomware playbook, running a CISA-aligned
-  compliance, incident response playbook creation, or ransomware preparedness assessment.
+  readiness assessment, or validating response steps during a tabletop exercise.
-
-  '
 domain: cybersecurity
 subdomain: ransomware-defense
 tags:

skills/building-red-team-c2-infrastructure-with-havoc/SKILL.md

@@ -1,7 +1,10 @@
 ---
 name: building-red-team-c2-infrastructure-with-havoc
-description: Deploy and configure the Havoc C2 framework with teamserver, HTTPS listeners,
+description: Deploy and configure the Havoc C2 framework (teamserver, HTTPS/HTTP/SMB
-  redirectors, and Demon agents for authorized red team operations.
+  listeners, Nginx redirectors, and Demon agents) with malleable traffic profiles and
+  OPSEC-hardened infrastructure for authorized red team operations. Use when standing
+  up or hardening Havoc C2 infrastructure for a written, authorized adversary emulation
+  engagement.
 domain: cybersecurity
 subdomain: red-teaming
 tags:

skills/building-role-mining-for-rbac-optimization/SKILL.md

@@ -1,8 +1,10 @@
 ---
 name: building-role-mining-for-rbac-optimization
-description: Apply bottom-up and top-down role mining techniques to discover optimal
+description: Apply bottom-up and top-down role mining techniques, including clustering
-  RBAC roles from existing user-permission assignments, reducing role explosion and
+  algorithms and formal concept analysis, to discover optimal RBAC roles from existing
-  enforcing least privilege.
+  user-permission assignments, consolidating overlapping roles and enforcing least
+  privilege. Use when an identity program needs to reduce role explosion or redesign
+  its RBAC role set from access data.
 domain: cybersecurity
 subdomain: identity-access-management
 tags:

skills/building-soc-escalation-matrix/SKILL.md

@@ -1,7 +1,10 @@
 ---
 name: building-soc-escalation-matrix
 description: Build a structured SOC escalation matrix defining severity tiers, response
-  SLAs, escalation paths, and notification procedures for security incidents.
+  SLAs, tiered escalation paths, and notification procedures for security incidents,
+  using context-driven criteria that combine business risk, asset criticality, and
+  data sensitivity. Use when designing or revising how a SOC triages and escalates
+  incidents across analyst tiers.
 domain: cybersecurity
 subdomain: soc-operations
 tags:

skills/building-super-timelines-with-plaso/SKILL.md

@@ -1,6 +1,10 @@
 ---
 name: building-super-timelines-with-plaso
-description: Generate log2timeline and Plaso super-timelines and triage them in Timesketch.
+description: Generate forensic super-timelines with Plaso's log2timeline.py, pinfo.py,
+  psort.py, and psteal.py CLI tools (fusing file-system MACB, registry, EVTX, browser
+  history, prefetch, LNK, and more), then triage and filter the results in Timesketch.
+  Use when reconstructing the full sequence of events on a compromised or forensically
+  imaged host during a DFIR investigation.
 domain: cybersecurity
 subdomain: digital-forensics
 tags:

skills/building-threat-actor-profile-from-osint/SKILL.md

@@ -1,8 +1,6 @@
 ---
 name: building-threat-actor-profile-from-osint
-description: Build comprehensive threat actor profiles using open-source intelligence
+description: Build threat actor profiles by collecting OSINT from vendor reports, paste sites, dark web forums, social media, and code repos, correlating indicators, mapping adversary infrastructure with tools like Maltego and SpiderFoot, and producing structured dossiers of motivations, capabilities, infrastructure, and TTPs. Use when performing attribution or building an adversary dossier from open-source intelligence.
-  (OSINT) techniques to document adversary motivations, capabilities, infrastructure,
-  and TTPs for proactive defense.
 domain: cybersecurity
 subdomain: threat-intelligence
 tags:

skills/building-threat-feed-aggregation-with-misp/SKILL.md

@@ -1,8 +1,6 @@
 ---
 name: building-threat-feed-aggregation-with-misp
-description: Deploy MISP (Malware Information Sharing Platform) to aggregate, correlate,
+description: Deploy MISP via Docker and configure feeds from sources like abuse.ch, AlienVault OTX, and CIRCL to aggregate, correlate, and distribute threat intelligence, including automated feed synchronization and STIX/TAXII-based integration with Splunk, Elasticsearch, and SOAR platforms. Use when standing up centralized IOC management or wiring multi-source threat feeds into a SIEM.
-  and distribute threat intelligence feeds from multiple sources for centralized IOC
-  management and automated SIEM integration.
 domain: cybersecurity
 subdomain: threat-intelligence
 tags:

skills/building-threat-hunt-hypothesis-framework/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: building-threat-hunt-hypothesis-framework
-description: Build a systematic threat hunt hypothesis framework that transforms threat
+description: Build a systematic threat-hunt workflow that turns threat intelligence and ATT&CK gap analysis into testable hypotheses, then executes and validates them via EDR/SIEM queries (CrowdStrike, Defender, Splunk, Elastic, Sysmon, Velociraptor, Sigma) and documents findings in a standardized hunt report. Use when planning or running a proactive threat hunt or scoping compromise from an intel- or anomaly-driven lead.
-  intelligence, attack patterns, and environmental data into testable hunting hypotheses.
 domain: cybersecurity
 subdomain: threat-hunting
 tags:

skills/building-threat-intelligence-enrichment-in-splunk/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: building-threat-intelligence-enrichment-in-splunk
-description: Build automated threat intelligence enrichment pipelines in Splunk Enterprise
+description: Build automated IOC enrichment pipelines in Splunk Enterprise Security by ingesting threat feeds into KV Store collections and correlating them against security events via lookup tables, modular inputs, and the Threat Intelligence Framework. Use when wiring threat intel into Splunk correlation searches to flag IOC matches and cut SOC triage time.
-  Security using lookup tables, modular inputs, and the Threat Intelligence Framework.
 domain: cybersecurity
 subdomain: soc-operations
 tags:

skills/building-threat-intelligence-platform/SKILL.md

@@ -1,8 +1,6 @@
 ---
 name: building-threat-intelligence-platform
-description: Building a Threat Intelligence Platform (TIP) involves deploying and
+description: Design and deploy a Threat Intelligence Platform (TIP) by integrating open-source CTI tools (MISP, OpenCTI, TheHive, Cortex) into a unified system with feed ingestion pipelines, enrichment workflows, STIX/TAXII interoperability, and analyst dashboards. Use when architecting or standing up a centralized CTI platform to collect, analyze, and disseminate threat intelligence across a security team.
-  integrating multiple CTI tools into a unified system for collecting, analyzing,
-  enriching, and disseminating threat intelligence. T
 domain: cybersecurity
 subdomain: threat-intelligence
 tags:

skills/building-vulnerability-aging-and-sla-tracking/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: building-vulnerability-aging-and-sla-tracking
-description: Implement a vulnerability aging dashboard and SLA tracking system to
+description: Implement a vulnerability aging dashboard and SLA tracking system that measures time-to-remediation against severity-based deadlines (e.g. 14 days critical, 30 days high, 60 days medium, 90 days low), with automated escalations and compliance metrics reporting. Use when designing SLA policies, building aging/remediation dashboards, or proving compliance with remediation timelines.
-  measure remediation performance against severity-based timelines and drive accountability.
 domain: cybersecurity
 subdomain: vulnerability-management
 tags:

skills/building-vulnerability-dashboard-with-defectdojo/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: building-vulnerability-dashboard-with-defectdojo
-description: Deploy DefectDojo as a centralized vulnerability management dashboard
+description: Deploy DefectDojo as a centralized vulnerability management dashboard that ingests findings from 200+ security scanners, deduplicates results, tracks remediation metrics, and integrates with CI/CD, Jira ticketing, and Slack notifications via its REST API. Use when consolidating scanner output into one dashboard or automating vulnerability ticketing and executive reporting.
-  with scanner integrations, deduplication, metrics tracking, and Jira ticketing workflows.
 domain: cybersecurity
 subdomain: vulnerability-management
 tags:

skills/building-vulnerability-exception-tracking-system/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: building-vulnerability-exception-tracking-system
-description: Build a vulnerability exception and risk acceptance tracking system with
+description: Build a vulnerability exception and risk acceptance tracking system covering approval workflows, compensating controls documentation, and automatic expiration for vulnerabilities that miss SLA remediation timelines. Use when standing up a governance process for risk acceptance and exception approvals to support PCI DSS, SOC 2, or NIST CSF compliance.
-  approval workflows, compensating controls documentation, and expiration management.
 domain: cybersecurity
 subdomain: vulnerability-management
 tags:

skills/coercing-authentication-with-coercer-petitpotam/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: coercing-authentication-with-coercer-petitpotam
-description: Trigger machine account authentication with PetitPotam (MS-EFSR) and Coercer across MS-RPRN, MS-DFSNM, and MS-FSRVP to feed NTLM relay into AD CS Web Enrollment (ESC8) and other relay targets.
+description: Trigger machine account authentication with PetitPotam (MS-EFSR) and Coercer (MS-RPRN, MS-DFSNM, MS-FSRVP, MS-EVEN) via Coercer's scan/coerce/fuzz modes, feeding the coerced NTLM auth into a relay against AD CS Web Enrollment (ESC8), LDAP (RBCD), or SMB. Use in authorized engagements to complete a coercion-relay chain against a Domain Controller, or to validate coercion detections and signing/EPA mitigations.
 domain: cybersecurity
 subdomain: red-teaming
 tags:

skills/collecting-threat-intelligence-with-misp/SKILL.md

@@ -1,8 +1,6 @@
 ---
 name: collecting-threat-intelligence-with-misp
-description: MISP (Malware Information Sharing Platform) is an open-source threat
+description: Deploy MISP, configure threat feeds (MISP community, freetext, TAXII, CSV), and use the PyMISP API to programmatically fetch, add, and search events and IOCs, building automated collection pipelines that aggregate indicators from community and commercial sources. Use when gathering, storing, or correlating IOCs and threat intelligence, or when scripting MISP ingestion via PyMISP.
-  intelligence platform for gathering, sharing, storing, and correlating Indicators
-  of Compromise (IOCs) of targeted attacks, threat
 domain: cybersecurity
 subdomain: threat-intelligence
 tags:

skills/collecting-volatile-evidence-from-compromised-host/SKILL.md

@@ -1,8 +1,6 @@
 ---
 name: collecting-volatile-evidence-from-compromised-host
-description: Collect volatile forensic evidence from a compromised system following
+description: Collect volatile forensic evidence from a compromised host by following the order of volatility, preserving memory, network connections, running processes, and system state with documented chain of custody before they are lost. Use before isolating, shutting down, or remediating a compromised host, especially when fileless or memory-resident malware is suspected, root cause analysis is needed, or the evidence must hold up in legal proceedings.
-  order of volatility, preserving memory, network connections, processes, and system
-  state before they are lost.
 domain: cybersecurity
 subdomain: incident-response
 tags:

skills/conducting-cloud-incident-response/SKILL.md

@@ -1,11 +1,6 @@
 ---
 name: conducting-cloud-incident-response
-description: 'Responds to security incidents in cloud environments (AWS, Azure, GCP) by performing identity-based containment,
+description: Respond to security incidents in AWS, Azure, and GCP via identity-based containment, cloud-native log analysis (CloudTrail, Azure Activity Logs, GCP Audit Logs), resource isolation, and forensic evidence acquisition adapted for ephemeral cloud infrastructure. Use when CSPM alerts or audit logs show compromised cloud credentials, unauthorized IAM changes, or a breach spanning cloud services.
-  cloud-native log analysis, resource isolation, and forensic evidence acquisition adapted for ephemeral cloud infrastructure.
-  Activates for requests involving cloud incident response, AWS security incident, Azure compromise, GCP breach, cloud forensics,
-  or cloud identity compromise.
-
-  '
 domain: cybersecurity
 subdomain: incident-response
 tags:

skills/conducting-domain-persistence-with-dcsync/SKILL.md

@@ -1,8 +1,6 @@
 ---
 name: conducting-domain-persistence-with-dcsync
-description: Perform DCSync attacks to replicate Active Directory credentials and
+description: Perform DCSync attacks by abusing MS-DRSR replication rights (DS-Replication-Get-Changes/-All) to impersonate a Domain Controller and extract KRBTGT, Domain Admin, and service account hashes for Golden Ticket forging, typically with Mimikatz. Use in authorized engagements after finding principals with replication rights, to establish long-term domain persistence, or to validate detections for replication abuse.
-  establish domain persistence by extracting KRBTGT, Domain Admin, and service account
-  hashes for Golden Ticket creation.
 domain: cybersecurity
 subdomain: red-teaming
 tags:

skills/conducting-external-reconnaissance-with-osint/SKILL.md

@@ -1,14 +1,6 @@
 ---
 name: conducting-external-reconnaissance-with-osint
-description: 'Conducts external reconnaissance using Open Source Intelligence (OSINT)
+description: Conduct external recon using OSINT techniques to map an organization's external attack surface without touching target systems, gathering DNS records, certificate transparency logs, search results, social media, code repositories, and breach databases into a target profile. Use for the passive info-gathering phase of a pentest, external footprinting, or collecting employee/email intel for a social engineering campaign.
-  techniques to map an organization''s external attack surface without directly interacting
-  with target systems. The tester gathers information from public sources including
-  DNS records, certificate transparency logs, search engines, social media, code repositories,
-  and data breach databases to build a comprehensive target profile. Activates for
-  requests involving OSINT reconnaissance, external footprinting, attack surface mapping,
-  or passive information gathering.
-
-  '
 domain: cybersecurity
 subdomain: penetration-testing
 tags:

skills/conducting-full-scope-red-team-engagement/SKILL.md

@@ -1,8 +1,6 @@
 ---
 name: conducting-full-scope-red-team-engagement
-description: Plan and execute a comprehensive red team engagement covering reconnaissance
+description: Plan and execute a comprehensive, MITRE ATT&CK-aligned red team engagement spanning threat modeling, reconnaissance, initial access, and post-exploitation to evaluate an organization's detection, prevention, and response against APT-style behavior. Use when scoping or running a full-scope, objective-based engagement, or purple-teaming against a specific threat actor's TTPs.
-  through post-exploitation using MITRE ATT&CK-aligned TTPs to evaluate an organization's
-  detection and response capabilities.
 domain: cybersecurity
 subdomain: red-teaming
 tags:

skills/conducting-internal-reconnaissance-with-bloodhound-ce/SKILL.md

@@ -1,8 +1,6 @@
 ---
 name: conducting-internal-reconnaissance-with-bloodhound-ce
-description: Conduct internal Active Directory reconnaissance using BloodHound Community
+description: Conduct internal Active Directory reconnaissance using BloodHound Community Edition's graph database with the SharpHound (AD) and AzureHound (Entra ID) collectors, mapping ACLs, sessions, and group memberships into attack paths from a low-privileged foothold to Domain Admin. Use after an initial AD foothold to identify privilege escalation chains, or to validate that AD hardening closed known attack paths.
-  Edition to map attack paths, identify privilege escalation chains, and discover
-  misconfigurations in domain environments.
 domain: cybersecurity
 subdomain: red-teaming
 tags:

skills/conducting-malware-incident-response/SKILL.md

@@ -1,11 +1,6 @@
 ---
 name: conducting-malware-incident-response
-description: 'Responds to malware infections across enterprise endpoints by identifying the malware family, determining infection
+description: Respond to malware infections across enterprise endpoints by identifying the malware family, determining infection vectors, assessing spread, and executing containment, analysis, eradication, and recovery procedures aligned to MITRE ATT&CK. Use when responding to a confirmed or suspected malware infection, including trojan/worm/ransomware outbreaks, malware triage, or infected endpoint remediation.
-  vectors, assessing spread, and executing eradication procedures. Covers the full lifecycle from detection through containment,
-  analysis, removal, and recovery. Activates for requests involving malware response, malware eradication, trojan removal,
-  worm containment, malware triage, or infected endpoint remediation.
-
-  '
 domain: cybersecurity
 subdomain: incident-response
 tags:

skills/conducting-pass-the-ticket-attack/SKILL.md

@@ -1,8 +1,6 @@
 ---
 name: conducting-pass-the-ticket-attack
-description: Pass-the-Ticket (PtT) is a lateral movement technique that uses stolen
+description: Perform Pass-the-Ticket (PtT) lateral movement by extracting Kerberos TGT/TGS tickets from LSASS memory on a compromised host and injecting them into another session to impersonate the ticket owner without knowing their password. Use during authorized post-exploitation to move laterally or escalate access via stolen Kerberos tickets, or to validate detections for Kerberos ticket theft and reuse.
-  Kerberos tickets (TGT or TGS) to authenticate to services without knowing the user's
-  password. By extracting Kerberos tickets fro
 domain: cybersecurity
 subdomain: red-teaming
 tags:

skills/conducting-phishing-incident-response/SKILL.md

@@ -1,13 +1,6 @@
 ---
 name: conducting-phishing-incident-response
-description: 'Responds to phishing incidents by analyzing reported emails, extracting
+description: Respond to phishing incidents by analyzing reported emails, extracting indicators, sandboxing URLs/attachments, assessing credential compromise, quarantining malicious messages organization-wide, and remediating affected accounts. Use when investigating a reported phishing or credential-phishing email, a suspected spearphishing incident, or when a mailbox-wide purge and account remediation is needed.
-  indicators, assessing credential compromise, quarantining malicious messages across
-  the organization, and remediating affected accounts. Covers email header analysis,
-  URL/attachment sandboxing, and mailbox-wide purge operations. Activates for requests
-  involving phishing response, email incident, credential phishing, spear phishing
-  investigation, or phishing remediation.
-
-  '
 domain: cybersecurity
 subdomain: incident-response
 tags:

skills/conducting-social-engineering-penetration-test/SKILL.md

@@ -1,8 +1,6 @@
 ---
 name: conducting-social-engineering-penetration-test
-description: Design and execute a social engineering penetration test including phishing,
+description: Design and execute a social engineering penetration test combining OSINT-driven target profiling with phishing, vishing, smishing, and physical pretexting campaigns using tools like GoPhish, the Social Engineer Toolkit (SET), and Evilginx to measure human security resilience. Use when scoping or running an authorized human-attack-surface test and reporting results to identify security awareness training gaps.
-  vishing, smishing, and physical pretexting campaigns to measure human security resilience
-  and identify training gaps.
 domain: cybersecurity
 subdomain: penetration-testing
 tags:

skills/conducting-spearphishing-simulation-campaign/SKILL.md

@@ -1,8 +1,6 @@
 ---
 name: conducting-spearphishing-simulation-campaign
-description: Spearphishing simulation is a targeted social engineering attack vector
+description: Run a targeted spearphishing simulation for initial access by developing OSINT-derived pretexts, building payloads (HTML smuggling, macro docs, ISO/LNK, OneNote, QR codes), standing up look-alike-domain email infrastructure with SPF/DKIM/DMARC via GoPhish, and tracking results. Use in authorized engagements to gain initial access via personalized phishing against specific individuals, distinct from broad campaigns.
-  used by red teams to gain initial access. Unlike broad phishing campaigns, spearphishing
-  uses OSINT-derived intelligence to craf
 domain: cybersecurity
 subdomain: red-teaming
 tags:

skills/configuring-active-directory-tiered-model/SKILL.md

@@ -1,8 +1,11 @@
 ---
 name: configuring-active-directory-tiered-model
 description: Implement Microsoft's Enhanced Security Admin Environment (ESAE) tiered
-  administration model for Active Directory. Covers Tier 0/1/2 separation, privileged
+  administration model for Active Directory, covering Tier 0/1/2 separation, privileged
-  access workstations (PAWs), administrative f
+  access workstations (PAWs), administrative forest design, and authentication policy
+  silos. Use when designing or hardening AD privileged-access architecture, segmenting
+  Domain/Enterprise Admin accounts into tiers, or containing lateral movement and
+  credential theft (pass-the-hash, Kerberoasting, golden tickets).
 domain: cybersecurity
 subdomain: identity-access-management
 tags:

skills/configuring-aws-verified-access-for-ztna/SKILL.md

@@ -1,8 +1,11 @@
 ---
 name: configuring-aws-verified-access-for-ztna
 description: Configure AWS Verified Access to provide VPN-less zero trust network
-  access to internal applications using identity and device posture verification with
+  access to internal apps, combining identity trust providers (IAM Identity Center,
-  Cedar policy language.
+  Okta/OIDC), device posture providers (CrowdStrike, Jamf), Cedar policy authoring, and
+  Terraform deployment. Use when replacing VPN access with ZTNA, writing Cedar access
+  policies, or deploying Verified Access instances, groups, and endpoints across AWS
+  accounts.
 domain: cybersecurity
 subdomain: zero-trust-architecture
 tags:

skills/configuring-certificate-authority-with-openssl/SKILL.md

@@ -1,8 +1,11 @@
 ---
 name: configuring-certificate-authority-with-openssl
-description: A Certificate Authority (CA) is the trust anchor in a PKI hierarchy,
+description: Build a two-tier PKI Certificate Authority hierarchy (offline Root CA
-  responsible for issuing, signing, and revoking digital certificates. This skill
+  plus issuing Intermediate CA) using OpenSSL and the Python cryptography library,
-  covers building a two-tier CA hierarchy (Root CA +
+  covering certificate extensions, CRL distribution points, OCSP responder
+  configuration, and certificate policy management. Use when standing up an internal
+  CA, issuing or revoking X.509 certificates, or designing PKI trust hierarchies for
+  TLS, code-signing, or client-authentication use cases.
 domain: cybersecurity
 subdomain: cryptography
 tags:

skills/configuring-hsm-for-key-storage/SKILL.md

@@ -1,8 +1,10 @@
 ---
 name: configuring-hsm-for-key-storage
-description: Hardware Security Modules (HSMs) are tamper-resistant physical devices
+description: Configures Hardware Security Modules for cryptographic key storage
-  that safeguard cryptographic keys and perform cryptographic operations in a hardened
+  using the PKCS#11 standard interface, covering key generation, signing, encryption,
-  environment. Keys stored in an HSM never lea
+  and key management on physical HSMs and SoftHSM2 for development. Use when protecting
+  cryptographic keys so they never leave a hardened device boundary, or when building
+  and testing PKCS#11-based key management workflows.
 domain: cybersecurity
 subdomain: cryptography
 tags:

skills/configuring-identity-aware-proxy-with-google-iap/SKILL.md

@@ -1,9 +1,11 @@
 ---
 name: configuring-identity-aware-proxy-with-google-iap
-description: 'Configuring Google Cloud Identity-Aware Proxy (IAP) to enforce per-request
+description: 'Configures Google Cloud Identity-Aware Proxy (IAP) via gcloud to enforce
-  identity verification for Compute Engine, App Engine, Cloud Run, and GKE services
+  per-request identity verification on Compute Engine, App Engine, Cloud Run, and
-  using access levels, context-aware policies, and programmatic access with service
+  GKE, including IAM bindings, Access Context Manager access levels, session/reauth
-  accounts.
+  settings, and service-account programmatic access. Use when replacing VPN access
+  with identity-based access to GCP backends or configuring context-aware, zero-trust
+  policies for Google Cloud services.
 
   '
 domain: cybersecurity

skills/configuring-ldap-security-hardening/SKILL.md

@@ -1,8 +1,10 @@
 ---
 name: configuring-ldap-security-hardening
-description: Harden LDAP directory services against common attacks including credential
+description: Hardens LDAP directory services against credential harvesting, LDAP
-  harvesting, LDAP injection, anonymous binding, and channel binding bypass. Covers
+  injection, anonymous binding, and channel-binding bypass by enforcing LDAPS, channel
-  LDAPS enforcement, channel binding, LDAP si
+  binding, and LDAP signing. Use when securing an LDAP or Active Directory environment
+  against these attack classes or auditing directory service configurations for
+  these vulnerabilities.
 domain: cybersecurity
 subdomain: identity-access-management
 tags:

skills/configuring-microsegmentation-for-zero-trust/SKILL.md

@@ -1,8 +1,9 @@
 ---
 name: configuring-microsegmentation-for-zero-trust
-description: Configure microsegmentation policies to enforce least-privilege workload-to-workload
+description: Configures microsegmentation policies to enforce least-privilege workload-to-workload
-  access using tools like VMware NSX, Illumio, and Calico, preventing lateral movement
+  access using tools such as VMware NSX, Illumio, and Calico, preventing lateral
-  in zero trust architectures.
+  movement in zero trust architectures. Use when designing or implementing network
+  microsegmentation as part of a zero trust architecture aligned with NIST SP 800-207.
 domain: cybersecurity
 subdomain: zero-trust-architecture
 tags: