Skill UI

This skill provides comprehensive expertise for senior database administrators to optimize and manage PostgreSQL databases at an advanced level. Use it for deep query analysis via EXPLAIN ANALYZE, implementing advanced features like JSONB indexing, configuring streaming or logical replication, and maintaining database health through VACUUM tuning and monitoring pg_stat views. Ideal for building highly available, high-performance, and resilient system architectures.

This comprehensive profiler provides systematic performance analysis for modern applications built with Node.js, Python, and Go. It detects critical bottlenecks across CPU, memory, and I/O dimensions. Key features include generating flamegraphs, analyzing bundle sizes, optimizing database queries (N+1 detection), and running rigorous load tests using k6 and Artillery. It mandates before-and-after measurements to ensure verifiable performance improvements.

This expert skill performs non-intrusive static analysis to thoroughly audit AI skills and bundles. It identifies malicious patterns, data leaks, system stability risks, and obfuscated payloads across major operating systems (Windows, macOS, Linux/Unix) and mobile platforms (Android/iOS). Use it when verifying skill legitimacy or performing deep cross-platform security reviews.

A specialized tool designed for incident responders and threat hunters. It extracts critical configuration data—such as C2 server addresses, malleable profiles, watermarks, and communication settings—from Cobalt Strike beacon payloads found in PE files or memory dumps. This analysis is crucial for mapping attacker infrastructure and improving defensive detection rules.

This tool parses NetFlow v9 and IPFIX records to conduct deep network security analysis. It is crucial for investigating security incidents by building traffic baselines and applying statistical methods. Key detection capabilities include identifying port scanning, data exfiltration attempts, command and control (C2) beaconing patterns, and general volumetric anomalies in network traffic.

A comprehensive guide for analyzing PCAP files captured during malware execution. It demonstrates advanced techniques using Wireshark, Zeek, Suricata, and Python (scapy) to identify Command and Control (C2) communications, data exfiltration channels, Domain Generation Algorithms (DGA), and periodic beaconing patterns. Essential for malware reverse engineering and network threat detection.

A comprehensive guide utilizing Splunk Enterprise Security and SPL to conduct deep forensic analysis of security incidents. This skill covers correlating disparate sources like Windows event logs, firewall records, proxy data, and Sysmon logs to detect TTPs, reconstruct timelines, and identify anomalies, making it essential for incident response and threat hunting.

A comprehensive guide and workflow for detecting Mimikatz and similar credential-dumping activities. It utilizes command-line pattern matching, LSASS memory access signatures, binary indicators, and in-memory analysis. Ideal for threat hunting, scoping compromises during incident response, or validating detection coverage in purple team exercises using EDR/SIEM data.

Deploy Zeek for passive network analysis to generate structured logs (DNS, HTTP, etc.). This tool detects behavioral anomalies like DNS tunneling or beaconing, complementing traditional signature-based IDS tools. It is ideal for threat hunting and incident response, feeding rich protocol metadata into SIEM platforms.

Conduct hypothesis-driven threat hunting for Command-and-Control (C2) activity (T1071). This skill guides the analysis of SIEM/EDR network telemetry to detect anomalous outbound traffic, rare destination IPs, non-standard ports, and unusual connection frequencies, helping identify beaconing or data exfiltration attempts. Essential for proactive defense and incident response.

Automates deep packet inspection using tshark and pyshark on PCAP files. This tool is designed for cybersecurity professionals to perform structured network forensics, compute protocol distribution, detect suspicious activity (like port scans, beaconing, and data exfiltration), extract critical IOCs (IPs, domains, URLs), and identify advanced threats such as DNS tunneling patterns. Ideal for incident response and security auditing.

Zeek is a powerful, open-source network analysis framework that functions as a passive security monitor. It generates highly detailed, structured logs (e.g., HTTP, DNS, TLS) from raw network traffic, allowing for deep metadata extraction. This skill guides users through deploying Zeek, writing custom detection scripts, and integrating the resulting rich security logs with SIEM platforms for advanced threat detection and forensic investigations.