Skill UI

Hunts MITRE ATT&CK T1055 process-injection techniques via Sysmon Event IDs 8/10 and EDR telemetry, parsing JSON logs to flag CreateRemoteThread calls, risky access masks, and reporting severity with mitigation guidance.

Run security chaos engineering experiments that disable WAFs, firewall rules, log pipelines, or EDR via boto3 and subprocess calls to verify SOC detection, alerting, and response coverage during deployments or assessments.

Use Falco YAML rules and the Falco gRPC API to monitor syscalls and runtime behavior in containers or Kubernetes, catching shell spawns, file tampering, network anomalies, and privilege escalation while parsing alerts to support incident response and security testing.

Monitors Certificate Transparency logs via crt.sh and direct RFC 6962 API calls to spot unauthorized issuances, track CAs, discover subdomains, and alert on suspicious TLS certificates for owned domains.

Manage Google Drive assets end-to-end—locate Docs, Sheets, or Slides, inspect their structure, perform precise edits, and keep shared workflows clean without resorting to raw tool calls.

Diagnoses and explains fixes for Flutter runtime and layout errors such as RenderFlex overflow, unbounded constraints, scroll-controller conflicts, and inappropriate setState calls during build, helping developers resolve issues quickly.

Guides developers to wrap Feishu API calls into reusable lark-cli skills, covering API research, command templates, and best practices for authentication, permissions, and orchestration.