Skill UI

This skill provides methods and tools for detecting sophisticated cyber attacks targeting Supervisory Control and Data Acquisition (SCADA) and Industrial Control Systems (ICS). It focuses on detecting anomalies like unauthorized command injection, Man-in-the-Middle attacks on industrial protocols (Modbus, DNP3), and data manipulation, which traditional IT security tools often miss. Usage involves establishing deterministic communication baselines and monitoring network traffic for deviations.

A robust security auditing tool designed to scan CI/CD pipeline configurations, such as GitHub Actions YAML, for critical supply chain vulnerabilities. It automatically detects issues like unpinned dependencies, script injection risks, secrets exposure, and dependency confusion, helping teams harden their build systems and maintain secure software development lifecycles.

A comprehensive guide detailing the systematic process of eradicating malware, backdoors, and attacker persistence mechanisms from compromised Windows and Linux systems. This workflow covers mapping persistence (Autoruns, registry, scheduled tasks), identifying artifacts (YARA, AV scans), removing threats, resetting credentials, and patching vulnerabilities to restore a clean state.

This skill guides the implementation of Just-In-Time (JIT) access provisioning, eliminating standing privileges by granting temporary, time-bound access. It covers designing robust approval workflows, integrating with PAM/IGA systems, automating revocation, and adhering to Zero Trust principles, significantly reducing the attack surface.

This skill provides comprehensive implementation for secure JWT (RFC 7519) signing and verification using multiple algorithms (HMAC-SHA256, RSA-PSS, ES256, EdDSA). It covers token expiration, claims validation, and crucial defenses against common attacks like algorithm confusion and 'none' algorithm bypass, essential for hardening web application authentication systems.

This tool implements critical NERC CIP controls for Bulk Electric System (BES) cyber systems, covering asset categorization (CIP-002), electronic security perimeters (CIP-005), system security management (CIP-007), configuration management (CIP-010), and supply chain risk (CIP-013). It is essential for maintaining compliance, preparing for audits, and commissioning new BES assets.

A guide and implementation pattern for deploying Nozomi Networks Guardian sensors. This solution enables passive, non-disruptive monitoring of Operational Technology (OT) and Industrial Control Systems (ICS). It provides critical asset visibility, behavioral anomaly detection, protocol-aware monitoring, and vulnerability assessment, making it essential for building robust OT Security Operations Centers (SOCs) and ensuring compliance without risking live operations.

Provides comprehensive management for the entire RSA key lifecycle. This includes generating key pairs, enforcing NIST SP 800-57 guidelines, serializing keys in various formats (PEM, DER, PKCS#8), and implementing secure rotation and protection. Use this skill when establishing robust security architectures, ensuring compliance, or upgrading cryptographic systems for high-security applications.

This skill implements advanced cryptographic techniques, including the Schnorr identification protocol and a simplified Zero-Knowledge Password Proof (ZKPP). It enables a prover to authenticate by demonstrating knowledge of a secret without ever revealing the underlying password or private key to the server. Ideal for building secure, password-less systems or environments where server compliance mandates that user credentials are never stored or transmitted in plain form.

This guide details how to configure and execute deep, authenticated vulnerability scans using OpenVAS/Greenbone Vulnerability Management (GVM). By utilizing valid credentials (SSH, SMB, or ESXi), users can log into target systems to detect local vulnerabilities, missing security patches, and misconfigurations, which are typically missed by unauthenticated scans. Essential for professional security auditing and penetration testing.

This comprehensive guide provides best practices for hardening container images, dramatically minimizing the attack surface in production environments. It covers advanced techniques such as implementing multi-stage builds, using distroless images, running containers as non-root users, and configuring read-only filesystems. Adherence to CIS Docker Benchmark and secure DevSecOps practices are key focuses.

This skill guides users through advanced container security practices using Trivy. It covers vulnerability scanning for container images, filesystems, IaC (Terraform, K8s), and Git repositories. Key features include generating industry-standard SBOMs (CycloneDX/SPDX), integrating scanning into CI/CD pipelines, and deploying the Kubernetes Operator for comprehensive supply chain security and compliance auditing.