Skill UI

This script detects and analyzes sophisticated fileless malware techniques that operate entirely in system memory. It specializes in identifying threats that utilize Living Off the Land Binaries (LOLBins), WMI event subscriptions, and registry-resident payloads, bypassing traditional file-based security controls. It is ideal for forensic investigations, threat hunting, and building advanced detection rules in modern enterprise environments.

A detailed methodology for proactive threat hunting focused on identifying deep-seated persistence mechanisms within Windows operating systems. This guide covers advanced techniques such as monitoring Run keys, analyzing Winlogon modifications, detecting IFEO injection, and identifying COM object hijacking. It is crucial for incident response, purple teaming, and ensuring system integrity against advanced persistent threats (APTs).

This guide details a threat hunting technique for detecting persistence mechanisms utilizing Windows Registry Run keys (T1547.001). By analyzing Sysmon Event ID 13 logs, it identifies suspicious auto-start entries pointing to temporary directories, encoded PowerShell commands, or abused LOLBins. Essential for SOC analysts and security engineers investigating incidents and developing robust detection rules.

This skill provides a comprehensive workflow for analyzing malicious software to extract actionable Indicators of Compromise (IOCs). It covers static analysis (PE parsing, hashing, string extraction) and dynamic analysis techniques. Users learn how to identify file hashes, network indicators (C2 IPs, domains), registry modifications, and behavioral artifacts, ultimately formatting the findings into standard STIX 2.1 formats for sharing and incident response.

A comprehensive guide and technical framework for detecting and mitigating ransomware kill switch mechanisms. It details methods for analyzing mutex guards, domain-based communication, and registry checks. Learn how to deploy proactive mutex vaccination and use Sysmon/DNS monitoring to prevent malware execution during incident response and analysis.

A comprehensive guide on using the nacos-cli tool to discover, install, update, merge, and publish AI skills stored in a Nacos registry. It covers key commands for listing, getting, uploading, reviewing, and releasing skills, ensuring version-aware publishing workflows for personal and team use.

This skill provides comprehensive integration with the Benchling cloud platform using the Python SDK and REST API. It allows users to programmatically manage critical life sciences data, including registry entities (DNA/RNA/proteins), inventory tracking, ELN entries, workflows, and querying the Data Warehouse. Ideal for automating complex lab data pipelines and syncing Benchling with external systems.

Provides essential database abstractions and utility classes for robust API development. This module includes components like FilterUtil, ValueFilter, and ValueFilterRegistry, allowing developers to implement standardized, efficient, and complex data querying and filtering logic across various database contexts.

This skill serves as a compatibility demonstration to verify that the Hermes Agent can successfully parse and load an SKILL.md file generated from an MDA source. It confirms that the compiled structure, including specific frontmatter and reserved metadata namespaces, survives the round-trip compilation process, ensuring structural integrity for the agent's skill registry.

Plaso (log2timeline) is an open-source engine used to generate forensic super-timelines. This skill guides the process of normalizing hundreds of diverse artifact types—including MACB times, registry keys, EVTX logs, and browser history—into a single, cohesive chronological view. The workflow covers extraction, filtering, and importing the timeline into Timesketch for collaborative analysis, which is crucial for incident response, correlating complex activity chains, and detecting anti-forensic techniques like timestomping.

A comprehensive tool and methodology for identifying and preventing dependency confusion attacks across major package ecosystems (npm, PyPI, Maven). It detects instances where internal, private package names are leaked and subsequently published publicly by attackers. The skill provides both detection (enumerating claimable internal names) and prevention strategies (enforcing registry pinning and scope restrictions) to secure the software supply chain.

This guide explains how to register custom model slugs (variants) within the Pi Agent's configuration files. It is essential for ensuring that specialized OpenRouter variants or brand-new provider models, which are not part of the static bundled registry, resolve correctly and are available for accurate agent model invocation.