3 Commits

Include renames

Author	SHA1	Message	Date
Mahipal	6972fe933e	docs(skills): rewrite container-security descriptions to a uniform standard ... All 33 container-security skills now carry what it does, an explicit "Use when" trigger, keywords, and a negative trigger naming the nearest neighbour. Six collision clusters resolved by differentiating scope rather than merging, so no skill is removed: - kube-bench: running the tool vs interpreting findings into an audit - Calico: portable upstream NetworkPolicy vs Calico-as-CNI vs Calico-only CRDs (GlobalNetworkPolicy, HostEndpoint, DNS egress) - Falco: deploying and operating it vs authoring escape rules - container escape: tool-agnostic runtime signals vs Falco rule syntax vs static posture audit vs offensive breakout - Trivy: all-target platform and operator vs single-image scan - Docker: images and Dockerfiles vs daemon.json vs the CIS audit script Also replaces the templated "When to Use" boilerplate in these files, including bullets that only restated the skill's own name. Worst pair (Pod Security Standards vs Pod Security Admission) drops from 0.77 cosine to below the 0.45 threshold. Repo-wide: colliding pairs 60 -> 56, skills involved 105 -> 94.	2026-08-23 17:15:30 +02:00
Mahipal	2fb6a9faff	Rewrite 548 skill descriptions to the activation rubric ... Each rewritten description now states both what the skill does (concrete capability, named tools/artifacts) and an explicit when-to-use trigger, improving agent discovery/activation. Grounded in each skill's own body; changes confined to the `description` field only (bodies and all other frontmatter untouched). Produced by a gated audit->rewrite->recheck loop (548 -> 0 flagged) with a sampled anti-invention check (0 ungrounded). Schema: 817/817 pass. Framework-ID gate: 0 defects.	2026-08-02 09:32:13 -07:00
mukul975	8cae0648ec	Add 55 new skills across 3 new domains + 6 undercovered areas (762 -> 817) ... Demand-driven expansion targeting the fastest-growing 2025-2026 threat and skills categories (ISC2/WEF/CrowdStrike/Mandiant signals): - AI Security (NEW domain, 12 skills): LLM red-teaming with garak/PyRIT, prompt injection (direct/indirect/RAG), MCP tool-poisoning, agentic tool invocation, guardrails, model/data poisoning, system-prompt leakage, embedding/vector weaknesses, model extraction, continuous red-teaming - Supply Chain Security (NEW domain, 5 skills): SBOMs, dependency confusion, malicious-npm triage, typosquatting, SLSA/Sigstore provenance - Hardware & Firmware Security (NEW domain, 4 skills): CHIPSEC/UEFI audit, Secure Boot bypass, TPM measured-boot attestation, ESP bootkit hunting - Identity (10): Entra ID/ROADtools, GraphRunner, AADInternals, ADCS/Certipy, shadow credentials, coercion, BloodHound CE, device-code phishing, SSO abuse - Cloud-native (8): Stratus, Pacu, CloudFox, container escape, K8s RBAC, Falco, Trivy, kube-bench - Offensive C2 (6): Sliver, Havoc, NetExec, DPAPI, NTLM relay ESC8, redirectors - DFIR (6): Hayabusa, Chainsaw, KAPE, Velociraptor, EZ Tools, Plaso - Backfill (4): OpenCTI, MISP, honeytokens, post-quantum crypto migration Each skill follows the repo taxonomy (SKILL.md + references/{standards,api-reference}.md + scripts/agent.py + LICENSE), with researched real tool commands (no placeholders), complete frontmatter, and ATT&CK/ATLAS + NIST CSF mappings. Updates README domain table, skill count, and index.json.	2026-06-22 19:08:16 +02:00