Skill UI

A comprehensive design specification detailing 98 rules for building Command Line Interface (CLI) tools that are safe, reliable, and easily consumable by AI agents. It covers structured JSON output formats, standardized error handling (to stderr), robust input contracts, safety guardrails (e.g., preventing path traversal), and tiered compliance levels (Agent-Friendly, Agent-Ready, Agent-Native) for seamless integration into AI workflows.

Automates discovery and monitoring of threat actor C2 infrastructure by ingesting passive DNS, certificate transparency, WHOIS, and IP enrichment data to build a continuously updated graph of related domains, hosts, and registrars for intelligence or incident response teams.

Extracts adversary behaviors from CTI reports, maps them to MITRE ATT&CK IDs, and compiles STIX-based attack-pattern records so defenders can query tactics/techniques and generate detection templates.

Executes containment strategies to halt an ongoing breach, blocking lateral movement and adversary operations through network segmentation, endpoint isolation, credential revocation, and access control changes while live incident response is underway.

Hunt for adversaries creating malicious email forwarding rules to persist in environments, using SIEM/EDR telemetry to validate hypotheses, analyze anomalies, and document response guidance.

Framework for planning red team operations, covering scope, rules of engagement, threat modeling, operational timelines, and documentation to ensure safe, realistic adversary simulations aligned with organizational objectives.

Executes stealthy red team exercises emulating real adversaries to assess an organization’s detection, response, and containment across people, processes, and technology, covering planning, infrastructure, and the full attack lifecycle.

Guides security testers through discovering and abusing Android and iOS deep link handling flaws—custom URI schemes, App/Universal Links, intent hijacking, and WebView payloads—to evaluate unauthorized access and injection risks in mobile apps.

Hunts for adversary abuse of legitimate cloud services by layering telemetry from EDR, SIEM, and threat intelligence to detect C2, staging, or exfiltration activity across Azure, AWS, GCP, and SaaS platforms.

Hunts adversary abuse of legitimate system binaries by correlating EDR/SIEM telemetry, comparing anomalous command-lines and parent chains to baselines, then packaging detections/IOCs for response teams.

Analyzes endpoint process logs to detect legitimate Windows binaries abused by adversaries, ranking suspicious command lines, parent processes, execution paths, and network cues for prioritized triage.

Guide for threat hunters to detect adversary persistence by hunting Windows Scheduled Tasks, analyzing creation events, suspicious actions, and abnormal schedules across SIEM and EDR telemetry.