Skill UI

Expert in developing complete, high-performance firmware and peripheral drivers for ARM Cortex-M platforms (STM32, Teensy, nRF52). Specializes in low-level hardware interaction, including implementing drivers for I²C, SPI, UART, and managing complex concurrency patterns using FreeRTOS/Zephyr. Provides critical guidance on optimizing for determinism, cache coherency, DMA transfers, and memory barriers to ensure reliable embedded system operation.

This skill guides threat hunters in detecting Cobalt Strike Command and Control (C2) beacons. It utilizes advanced network forensic techniques, including analyzing default TLS certificate serials, JA3/JA3S/JARM fingerprints, beacon jitter, and HTTP profile matching. Detection is achieved by correlating data from Zeek logs, Suricata rules, and Python PCAP analysis to identify suspicious outbound communications.

This skill provides advanced techniques and code examples for monitoring, mapping, and pivoting across adversary-controlled infrastructure. It leverages Passive DNS, Certificate Transparency logs, Shodan/Censys scanning, and network fingerprinting (JARM/JA3S) to discover C2 servers, phishing domains, and exploitable assets over time, which is crucial for advanced security operations and threat intelligence gathering.

This guide outlines the implementation of Remote Browser Isolation (RBI) as a core component of a Zero Trust architecture. It details policies for URL risk classification, Data Loss Prevention (DLP) controls, and Content Disarm and Reconstruction (CDR). This is essential for hardening web access, protecting against zero-day exploits, phishing, and preventing data exfiltration from untrusted web content.

This comprehensive skill guides users through the entire Fluid storage extension lifecycle within KubeSphere. It allows for installing, upgrading, and uninstalling the Fluid extension, and managing various data resources. Users can generate YAML manifests for Datasets and specialized runtimes (Alluxio, JuiceFS, Thin), perform data loading/cache warming, scale operations, and troubleshoot issues using both kubectl and KubeSphere APIs.

A comprehensive playbook detailing advanced techniques for post-exploitation security bypass on Linux systems. Covers escaping restricted shells (rbash), evading noexec/read-only filesystems using in-memory execution (DDexec, memfd_create), and circumventing mandatory access controls like AppArmor and SELinux. Essential for penetration testing and red team operations.

A comprehensive guide for securing container images and runtime environments. Covers best practices from Dockerfile authoring (minimal base images, multi-stage builds, non-root users) through advanced runtime enforcement (seccomp, AppArmor) and Kubernetes security controls. Essential for production hardening and maintaining supply chain integrity.

This skill deploys Remote Browser Isolation (RBI) as a core component of a Zero Trust security architecture. It implements sophisticated isolation policies utilizing URL categorization, risk-based routing, and Content Disarming and Reconstruction (CDR) for file sanitization. It provides robust data loss prevention controls, effectively mitigating zero-day exploits, phishing, and data exfiltration across isolated web sessions, and integrating with SWG and ZTNA platforms.