Skill UI

A comprehensive security analysis tool for cryptocurrency wallets. It meticulously scans ERC20 token approvals, analyzes transaction patterns, and calculates a weighted security risk score (0-100). Use this skill to assess your wallet's overall security posture, identify risky approvals, and receive actionable recommendations to mitigate potential vulnerabilities.

A comprehensive security analysis tool for cryptocurrency wallets. It meticulously scans ERC20 token approvals, analyzes transaction patterns, and calculates a weighted security risk score (0-100). Use this skill to assess your wallet's overall security posture, identify risky approvals, and receive actionable recommendations to mitigate potential vulnerabilities.

Query UCSF’s ZINC22 repository of 230M+ purchasable compounds via the web UI or CartBlanche APIs to fetch IDs/SMILES, run similarity, supplier, or random sampling, and assemble docking-ready libraries for virtual screening.

This skill analyzes DNS query logs to detect sophisticated threats such as data exfiltration via DNS tunneling, Domain Generation Algorithm (DGA) usage, and covert Command and Control (C2) channels. It utilizes advanced techniques like entropy analysis, query volume anomaly detection, and subdomain length analysis within SIEM platforms, helping SOC teams identify threats that bypass traditional network security controls.

This script performs statistical analysis on Zeek connection logs (conn.log) to detect Command and Control (C2) beaconing patterns. It leverages the ZAT library to load data into Pandas DataFrames, calculates inter-arrival time statistics, and flags connections with low standard deviation relative to the mean. This technique is crucial for network threat hunting and security incident investigation when identifying malicious, periodic callbacks.

This skill detects DNS-based data exfiltration by analyzing Zeek dns.log files. It identifies indicators such as high Shannon entropy subdomains, oversized TXT/NULL records, and abnormal query volumes. Use it when investigating suspected DNS tunneling or covert C2 channels to enhance threat detection capabilities.

This capability provides advanced threat hunting by analyzing network telemetry (DNS, proxy, connection logs) to detect Command and Control (C2) beaconing patterns. It uses statistical analysis, frequency detection, and jitter analysis to identify compromised endpoints communicating with adversary infrastructure, crucial for proactive threat detection and incident response.

This tool provides comprehensive network traffic analysis capabilities by querying the Arkime API. Users can search sessions, download PCAPs for forensics, detect sophisticated threats like C2 beaconing (via jitter/interval analysis), spot DNS tunneling patterns, and flag connections to known-bad TLS certificate issuers. Ideal for security assessment and incident investigation.

A sophisticated skill for detecting Command and Control (C2) traffic tunneled through DNS protocols. It utilizes advanced techniques like Shannon entropy analysis of subdomains, Machine Learning for DGA classification, and correlation with network logs from Zeek/Suricata. Ideal for SOC analysts and threat hunters investigating data exfiltration, DNS beaconing, or suspicious DNS activity.

AWS Detective automatically analyzes log data from CloudTrail, VPC Flow Logs, GuardDuty, and EKS audit logs to build interactive behavior graphs. This tool enables security analysts to investigate suspicious activity, trace lateral movement across accounts, profile compromised entities (IAM users, EC2 instances), and reconstruct complex attack timelines without manual log parsing. Ideal for triaging GuardDuty findings or investigating suspected AWS compromises.

This skill converts complex, narrative technical documents, research excerpts, or natural language problem descriptions into a highly structured Mathematical Problem Specification (MPS). It systematically extracts variables, constraints, objectives, and uncertainty parameters. By adhering to a strict Zero-Inference Protocol, it ensures all extracted elements are strictly grounded in the source text, making it invaluable for formalizing real-world optimization, data science, and engineering problems.

A highly specialized, downstream skill for advanced threat analysis. This tool is used to recover hidden configurations, decode C2 (Command and Control) parameters, unpack staged payloads, and extract Indicators of Compromise (IOCs) from complex malware samples. It focuses on identifying the exact decode chains—including compression, encoding, and crypto steps—and linking recovered fields to observed behavioral outcomes within a sandbox environment.