Skill UI

This skill allows users to customize and optimize keyboard shortcuts within the Windsurf IDE, covering AI features, multi-file editing, and custom workflow bindings. It is used when setting up, reviewing, or adapting keybindings for maximum productivity and ergonomic efficiency.

This skill enables complex, coordinated multi-file editing operations within the Windsurf IDE using Cascade AI. It ensures atomic changes, maintaining consistency when performing cross-file refactoring, renaming symbols, or modifying code across project boundaries. Use this when needing to make large, interdependent changes across multiple source files.

Create a disciplined, developer-ready implementation plan whenever a multi-step spec arises; document every file, command, and bite-sized action with precise steps, tests, and commit guidance so any engineer can execute confidently with DRY/YAGNI/TDD practices.

This skill automates the creation of isolated, pre-configured development containers (devcontainers). It scans the project structure to detect supported languages (Python, Node.js, Rust, Go) and intelligently generates the necessary configuration files, VS Code extensions, and setup scripts. It ensures all required tools are installed in a sandboxed environment, making it ideal for starting new multi-language projects or needing consistent, reproducible development workspaces.

This tool allows users to explicitly save critical, project-specific facts, conventions, or debugging insights to a dedicated auto-memory file. Use it when the knowledge is too important or specialized to rely on the AI's automatic context capture. It ensures persistent recall of architectural decisions, tool gotchas, or team preferences across multiple sessions and projects.

This agent ensures seamless continuity across multiple work sessions. It automatically captures, compresses, and stores critical project information—including summarized discussions, architectural decisions, pending tasks, modified files, and technical discoveries. When a new session starts, it loads a comprehensive briefing, allowing users to quickly resume work without losing track of the project's current state.

Opinionated Docker development assistant that analyzes Dockerfiles, docker-compose setups, multi-stage builds, and container security to shrink images, speed builds, and enforce production-ready practices when users need optimized containers.

This skill provides a programmatic method for analyzing Advanced Persistent Threat (APT) groups using the MITRE ATT&CK framework. By querying TTPs and generating multi-layer JSON files compatible with ATT&CK Navigator, analysts can visualize threat actor coverage, map detection capabilities, and identify critical security gaps to build highly targeted, threat-informed defenses.

A dedicated tool for forensic analysis of Windows PowerShell Script Block Logs (Event ID 4104) captured in EVTX files. It reconstructs multi-block scripts, applying advanced detection heuristics such as entropy analysis and pattern matching to identify obfuscated commands, encoded payloads (Base64), download cradles, and AMSI bypass attempts, crucial for threat hunting and incident response.

Builds a comprehensive, automated pipeline for malware submission and analysis. It collects suspicious files from multiple sources (EDR, email gateways), automatically submits them to sandbox environments and multi-engine scanners, and generates detailed verdicts and Indicators of Compromise (IOCs). Essential for SOC teams needing to scale high-volume malware triage and incident response.

This tool deploys decoy canary files in critical system directories to provide early warning against ransomware attacks. Utilizing Python's watchdog library, it monitors for any read, modify, rename, or delete operations on these decoy files. Detection triggers immediate alerts via multiple channels (Email, Slack, Syslog), helping security teams identify and respond to malicious activity before full data encryption occurs. It serves as a crucial detection layer in a layered security defense.

This guide details how to implement sophisticated Security Orchestration, Automation, and Response (SOAR) playbooks using Palo Alto Cortex XSOAR. It demonstrates full lifecycle automation, such as phishing incident investigation, requiring enrichment of URLs, IPs, and files, followed by automated containment actions (e.g., blocking senders, purging mailboxes). Mastering this allows SOC teams to drastically reduce Mean Time To Respond (MTTR) by automating detection, analysis, and remediation steps across multiple security tools.