Skill UI

Monitor and analyze Windows Management Instrumentation event subscriptions (filters, consumers, bindings) to detect and investigate fileless persistence mechanisms and attacker activity triggered via WMI, especially when other persistence traces are absent.

Reads `.agent.md` or `.prompt.md` files, assesses task complexity, tooling, and requirements, then recommends the most cost-efficient GitHub Copilot model(s) (e.g., GPT-5, Claude Sonnet) with rationale for users across different subscription tiers and priorities.