Skill UI

This tool parses Kubernetes API server audit logs (JSON lines) to detect critical security events. It specifically targets unauthorized access, secret enumeration, RBAC escalation, privileged pod creation, and shell access (exec/attach). Use it for incident response, threat hunting, or building SIEM detection rules.

Provides expert guidance for connecting to Power BI Desktop's local tabular model using the Tabular Object Model (TOM) and ADOMD.NET via PowerShell. This skill covers model enumeration, executing DAX queries, metadata modification (tables, measures, relationships), query tracing, and model refreshing. It is specifically designed for managing the underlying data model structure when external tools like Tabular Editor CLI are unavailable.

This guide details the process of parsing core Windows forensic artifacts, including MFT, Prefetch, Registry hives, ShellBags, and Amcache. Utilizing Eric Zimmerman's specialized EZ Tools, raw evidence is converted into standardized CSV/JSON formats. This process is crucial for Digital Forensics and Incident Response (DFIR) investigations, enabling analysts to reconstruct program execution, file access history, and persistence mechanisms, which can then be loaded into Timeline Explorer for unified analysis.

This skill serves as a deterministic internal downloader for image URLs extracted from comprehensive web search results. It receives normalized media slots and search output via stdin, utilizing Python HTTP APIs to download direct image links. The process includes validating MIME types and saving files accurately into the configured local project directory, ensuring reliable asset retrieval without relying on sandboxed shell tools.