Skill UI

A comprehensive security analysis tool for cryptocurrency wallets. It meticulously scans ERC20 token approvals, analyzes transaction patterns, and calculates a weighted security risk score (0-100). Use this skill to assess your wallet's overall security posture, identify risky approvals, and receive actionable recommendations to mitigate potential vulnerabilities.

A comprehensive security analysis tool for cryptocurrency wallets. It meticulously scans ERC20 token approvals, analyzes transaction patterns, and calculates a weighted security risk score (0-100). Use this skill to assess your wallet's overall security posture, identify risky approvals, and receive actionable recommendations to mitigate potential vulnerabilities.

A comprehensive guide to implementing best practices for security within Databricks. Learn how to manage secrets using scoped storage, enforce the principle of least privilege via Unity Catalog grants, audit API tokens, and apply advanced data protection techniques like column-level masking and row-level security for enhanced data governance and compliance.

Enables Claude to apply anomaly-detection-system workflows for spotting outliers, fraud, or unusual patterns across datasets, selecting tailored algorithms like Isolation Forest and summarizing deviations for any data monitoring or security use case.

Detects abnormal access patterns across major cloud storage platforms, including AWS S3, GCS, and Azure Blob Storage. By analyzing cloud audit logs (CloudTrail, etc.), this tool identifies critical security threats such as after-hours bulk data downloads, sudden spikes in API calls (GetObject spikes), access from new geographic IPs, and potential data exfiltration. It utilizes statistical baselines and time-series anomaly detection for proactive threat hunting and security incident investigation.

This skill analyzes Indicators of Compromise (IOCs)—such as IP addresses, domains, and file hashes—by querying multiple threat intelligence platforms (VirusTotal, AbuseIPDB, MISP). It determines maliciousness confidence, assigns blocking priorities, and attributes threats to campaigns, crucial for incident response, threat triage, and making informed security decisions.

This system automates the tracking and mapping of threat actor Command-and-Control (C2) networks. By leveraging passive DNS records, WHOIS data, certificate transparency logs, and IP enrichment, it helps security analysts perform infrastructure pivoting. It identifies shared hosting patterns, monitors domain reuse, and continuously maps adversary relationships for proactive threat intelligence.

This skill analyzes Windows Security Event Logs (EVTX) to detect RDP brute force attacks. It parses failed logon events (ID 4625) and correlates them with successful logons (ID 4624), performing source IP frequency analysis to identify attack patterns, username spraying, and potential account compromises. This is critical for SOC analysts and threat hunters investigating lateral movement or credential stuffing attempts.

This skill provides a structured methodology for detecting process injection techniques (MITRE ATT&CK T1055), which adversaries use for defense evasion and privilege escalation. It analyzes granular security logs, specifically utilizing Sysmon Event IDs 8 (CreateRemoteThread) and 10 (ProcessAccess), alongside source-target process relationship mapping to identify suspicious malicious behavior over general system activity.

This skill automates deep packet capture (PCAP) analysis using tshark and pyshark. It is invaluable for security assessments and incident response, enabling the extraction of protocol statistics, identification of suspicious network flows (e.g., port scanning, beaconing), and comprehensive extraction of Indicators of Compromise (IOCs), including IPs, domains, and URLs. It also specializes in detecting complex anomalies like DNS tunneling.