Skill UI

This skill implements an autonomous, multi-round review loop for refining complex research or codebases. It iteratively reviews content using specified external backends (e.g., Codex, manual review), implements necessary fixes based on feedback, and re-reviews until the positive assessment criteria are met or the maximum round limit is reached. It manages state persistence and allows for configurable difficulty levels, making it ideal for projects requiring rigorous, self-correcting quality assurance.

This skill automates the research refinement process by entering an autonomous, multi-round review loop. It leverages any OpenAI-compatible LLM to score, critique, and guide necessary fixes until the work meets a high, expert-defined standard. It manages state persistence across rounds, simulating the rigorous process of professional peer review.

This skill implements an autonomous, multi-round research review loop, simulating the rigorous peer-review process of top-tier conferences. It iteratively reviews, identifies weaknesses, suggests fixes, and re-reviews a research document using the MiniMax API. The system manages state persistence across multiple rounds, ensuring continuous improvement until a 'ready' assessment is achieved or the maximum round limit is reached. Ideal for academic writing, thesis refinement, or comprehensive project documentation.

This skill outlines the development of an automated pipeline to ingest raw Indicators of Compromise (IOCs) from various sources. It performs normalization, defanging (e.g., converting 'http://' to 'hxxp://'), and converts indicators into the standardized STIX 2.1 format. The processed, safe indicators can then be securely distributed via TAXII feeds, MISP, and other threat intelligence platforms.

This skill deploys advanced anomaly detection systems for Operational Technology (OT) and Industrial Control Systems (ICS). It builds multi-dimensional baselines by analyzing SCADA communications, network traffic (Modbus, DNP3, OPC UA), and timing patterns. It detects deviations, rogue devices, and potential intrusions by profiling normal behavior, complementing signature-based IDS.

Utilizes User and Entity Behavior Analytics (UEBA), statistical baselines, and machine learning models to monitor authentication logs. This skill identifies sophisticated security threats such as impossible travel, credential stuffing, brute force attacks, and compromised accounts in real-time. Essential for security operations and identity access management.

This guide provides advanced detection methods and threat hunting queries (KQL/SPL) to identify abuse of Azure service principals. It covers techniques such as privilege escalation, credential compromise, unauthorized role assignment, and enumeration, essential for SOC analysts and security teams monitoring Microsoft Entra ID.

This skill guides security analysts through advanced threat-hunting methodologies focused on detecting DNS-based persistence. It analyzes passive DNS history, zone file audits, and API data (like SecurityTrails) to identify unauthorized record modifications, subdomain takeovers, and DNS hijacking attempts that bypass traditional security controls. Ideal for SOC analysts and threat hunters.

A comprehensive guide and methodology for proactively hunting adversary abuse of legitimate cloud services (Azure, AWS, GCP, SaaS). This technique focuses on identifying Command and Control (C2), data staging, and exfiltration methods that leverage normal cloud functionality, making detection challenging.

This advanced workflow orchestrates the entire research idea lifecycle. Starting from a broad research direction, it systematically executes literature mapping, creative brainstorming, novelty verification, and proposal refinement. The final output is a validated IDEA_REPORT, a detailed proposal, and a concrete experiment plan, transforming preliminary concepts into actionable, structured research projects. Ideal for users needing a full, end-to-end research guidance system.

This skill guides the implementation of network traffic baselining using historical NetFlow/IPFIX data. It leverages Python's pandas library to compute detailed statistical profiles, including hourly/daily distributions, per-host metrics, and protocol ratios. Anomalies are robustly detected using z-score and Interquartile Range (IQR) methods, assisting SOC analysts in identifying unusual activities like data exfiltration or beaconing.

Tetragon, a CNCF project under Cilium, provides advanced, kernel-level runtime security observability and policy enforcement in Kubernetes clusters. By utilizing eBPF, it monitors process execution, file access, and network connections with minimal overhead, enabling detection and prevention of container escapes, unauthorized access, and suspicious activity.