Skill UI

This skill provides comprehensive methods for detecting and preventing privilege escalation within Kubernetes pods and containers. It details using runtime tools like Falco for monitoring syscalls and capabilities, and implementing admission controls via OPA Gatekeeper or Pod Security Admission to enforce security best practices, thereby hardening the cluster against unauthorized access and dangerous configurations.

This skill provides advanced threat hunting capabilities to detect NTLM relay attacks within Active Directory environments. It analyzes critical Windows Security Event 4624 logs, specifically focusing on logon type 3 using NTLMSSP authentication. The detection logic identifies suspicious patterns, including IP-to-hostname mismatches, rapid multi-host authentications, and lack of SMB signing enforcement, helping SOC analysts pinpoint unauthorized credential access attempts.

This skill provides comprehensive guidance on implementing robust network security controls in Kubernetes using Calico's CNI capabilities. Learn to define and audit NetworkPolicy and GlobalNetworkPolicy resources to achieve zero-trust microsegmentation, restrict egress traffic, and control all pod-to-pod communications, ensuring compliance and enhanced security posture.

This skill guides the implementation of envelope encryption using AWS Key Management Service (KMS). Envelope encryption is a robust security pattern where data is encrypted locally using a Data Encryption Key (DEK), and the DEK itself is protected by a master Key Encryption Key (KEK) managed by AWS KMS. This approach overcomes the limitations of direct KMS encryption, enabling unlimited data size encryption, reducing latency, and allowing offline encryption capabilities by keeping the master key secure in an HSM.

This methodology provides SOC teams with an adversary-centric framework to evaluate security detection capabilities against the MITRE ATT&CK framework. By systematically mapping existing SIEM rules and data sources, users can identify critical detection gaps, prioritize rule development efforts, and measure the overall maturity of their security operations center (SOC) defenses over time.

This skill guides the implementation of security chaos engineering experiments. It involves deliberately degrading or disabling security controls (like WAF, firewalls, or log pipelines) in a controlled environment to rigorously verify the detection, alerting, and response capabilities of the Security Operations Center (SOC). Users learn to use tools like boto3 and Python to simulate failure scenarios and assess system resilience and compliance posture.

EvilGinx3 is an advanced Adversary-in-the-Middle (AiTM) framework designed for red teaming simulations. It goes beyond traditional credential harvesting by acting as a transparent proxy to intercept the entire authentication flow, including session cookies and Multi-Factor Authentication (MFA) tokens. This capability allows security professionals to assess the robustness of an organization's security posture against sophisticated account takeover attacks.

This comprehensive guide covers the principles and implementation steps for building Progressive Web Apps (PWAs). Learn to integrate essential components like Web App Manifests and Service Workers to ensure your web application offers a reliable, fast, and truly offline-capable experience, mimicking the feel of a native mobile app. Ideal for enhancing web resilience and installability.

A comprehensive guide and Python tool for reverse engineering Rust-compiled malware. It addresses unique Rust binary challenges, such as non-null-terminated strings and monomorphization. The script extracts crate dependencies, identifies suspicious capabilities (like networking or encryption), and filters for malware-related strings, assisting security researchers in deep binary analysis.

This skill provides a comprehensive, read-only audit of a development workspace, including active repositories, installed plugins, connected services, and environment configurations. It analyzes existing capabilities against best practices to identify functional gaps and recommends the most valuable ECC-native skills, hooks, and workflows needed to enhance the development experience. Ideal for setup planning and architectural reviews.

AgentPhone is an API-first platform designed for developers building AI agents with advanced telephony capabilities. It allows agents to manage phone numbers, make/receive voice calls, and handle SMS messages. Developers can utilize hosted mode for simple AI interactions or webhook mode for custom, complex logic, making it ideal for building sophisticated customer support bots or virtual assistants.

Comprehensive guide to Go's built-in and standard library data structures, including slices, maps, and arrays. Deep dives into memory allocation, capacity growth mechanics, and best practices for optimization. Learn when to use `strings.Builder`, preallocation techniques, `container/heap`, and managing pointers safely with `unsafe.Pointer` and `weak.Pointer`. Ideal for optimizing performance-critical Go code.