Skill UI

This comprehensive toolkit audits and manages dependencies across multi-language projects (e.g., Python, JS, Go, Java). It identifies critical security vulnerabilities (CVE), ensures license compliance, detects outdated packages, and plans safe upgrade paths. Essential for pre-release quality assurance, vulnerability investigation, and supply chain risk management.

This skill provides a comprehensive, multi-phase guided workflow for professional incident response management. Following modern SRE principles and the Incident Command System (ICS), it guides users from initial detection and triage (P0-P3 classification) through deep investigation (observability, debugging, security checks), culminating in structured resolution and post-mortem analysis. Use this when managing critical system outages or performance degradation.

Auto-activating security skill that guides path traversal finder investigations, shares patterns and best practices, and produces validated code/configurations within Security Fundamentals.

Guide to capturing, filtering, and inspecting packets with Wireshark for troubleshooting, performance tuning, and security investigations across live and PCAP-based workflows.

Guide to capturing, filtering, and inspecting packets with Wireshark for troubleshooting, performance tuning, and security investigations across live and PCAP-based workflows.

This guide provides a deep, investigation-driven methodology for reviewing Django and Django REST Framework (DRF) codebases. It helps identify critical authorization gaps, focusing on Insecure Direct Object References (IDOR) and object-level access failures. Learn how to trace data flows, analyze custom managers, and verify that users can only access resources they are explicitly authorized to view or modify.

Yara Authoring helps security teams write precise YARA rules for threat detection and malware hunting by guiding string/tag management and metadata handling so signature creation keeps pace with investigations.

Guides configuring Windows Advanced Audit Policy, enabling command-line capture, sizing event logs, and forwarding critical IDs so SOC teams feed high-fidelity security events into SIEMs for detection and investigation.

Detect defense-evasion techniques in endpoint logs by identifying log tampering, timestomping, process injection, security-tool disabling, and masquerading; use in threat hunting, detection engineering, or investigations that query telemetry from Sysmon, SIEM, or EDR.

Guides security teams through detecting and responding to OAuth token theft, covering Microsoft Entra ID/Azure AD protections, conditional access policies, and sign-in log investigations to block token replay, PRT abuse, and session hijacking in cloud deployments.

Analyzes CloudTrail logs via Athena, CloudWatch Logs Insights, and SIEM feeds to monitor AWS security, detect threats, and support forensic investigations by identifying unauthorized access, privilege escalations, and anomalous API activity.

Analyze Linux system logs (syslog, auth.log, kern.log, systemd journal, audit records, cron and application logs) to reconstruct user sessions, detect unauthorized access, and build event timelines for incident response and security assessments.