Skill UI

A comprehensive design specification detailing 98 rules for building Command Line Interface (CLI) tools that are safe, reliable, and easily consumable by AI agents. It covers structured JSON output formats, standardized error handling (to stderr), robust input contracts, safety guardrails (e.g., preventing path traversal), and tiered compliance levels (Agent-Friendly, Agent-Ready, Agent-Native) for seamless integration into AI workflows.

Uses ldap3 to audit Active Directory ACLs, highlighting GenericAll/WriteDACL/WriteOwner abuse paths so analysts can triage privilege-escalation risks and produce structured remediation reports.

Static analysis workflow using apktool, jadx, and androguard to decompile Android APK malware, inspect manifests, permissions, APIs, and produce structured IOC/risk reports for SOC investigators.

Analyzes campaign attribution evidence with the Diamond Model and ACH, covering infrastructure overlaps, TTP consistency, malware similarities, timing, and language signals to help SOC analysts and hunters assess threat actor confidence.

Parses Cobalt Strike malleable C2 profiles via pyMalleableC2 to pull beacon configs, HTTP communication patterns, sleep/jitter settings, and combines JARM scans for C2 detection when hunting suspected infrastructure or building IDS signatures.

Guide to analyzing forensic disk images with Autopsy and Sleuth Kit, covering installation, case preparation, ingest modules, file recovery, keyword hunting, and evidence tagging for structured investigations.

Detect kernel-level rootkits in Linux memory dumps using Volatility3 plugins, rkhunter/chkrootkit live scans, and cross-view analysis of /proc, /sys, and kernel structures to flag hooked syscalls, hidden modules, and tampered binaries.

Guides analysts through detecting malware covert channels such as DNS tunneling, ICMP exfiltration, protocol abuse, and steganographic HTTP by combining Python packet parsing, entropy scoring, and structured SOC workflows.

Use Scapy to craft, send, sniff, and dissect network packets for protocol analysis, reconnaissance, detecting SYN floods or DNS tunneling, and producing structured reports during authorized security testing.

Analyzes structured and unstructured threat intelligence feeds to extract indicators, normalize data into STIX 2.1, enrich IOCs, deduplicate, and distribute via TAXII to SIEM/EDR systems—ideal for assessing CTI feed quality or automating feed ingestion pipelines.

Automates review of Terraform infrastructure-as-code via Checkov, tfsec, Terrascan, and OPA/Rego policies to find permissive IAM roles, public exposure, missing encryption, and insecure defaults before cloud deployment.

AWT provides AI coding tools with the ability to perform sophisticated End-to-End (E2E) web testing using a real browser. It accepts declarative YAML scenarios and executes them via Playwright. Key features include visual matching (OpenCV + OCR) instead of relying on fragile DOM selectors, automatic platform detection (React, Vue, etc.), and structured failure diagnosis for improved AI coding workflows.