Skill UI

Expert in developing complete, high-performance firmware and peripheral drivers for ARM Cortex-M platforms (STM32, Teensy, nRF52). Specializes in low-level hardware interaction, including implementing drivers for I²C, SPI, UART, and managing complex concurrency patterns using FreeRTOS/Zephyr. Provides critical guidance on optimizing for determinism, cache coherency, DMA transfers, and memory barriers to ensure reliable embedded system operation.

This guide provides a comprehensive framework for minimizing cloud expenditure on Databricks. It covers identifying cost drivers via system billing tables, implementing cluster policies, utilizing spot instances for batch processing, right-sizing SQL warehouses, and automating the shutdown of idle development clusters. Use it when managing cloud spending or optimizing data platform usage.

This skill specializes in implementing Service Level Objectives (SLOs) and Service Level Indicators (SLIs) to enforce reliability standards. It guides users in designing comprehensive SLO frameworks, calculating error budgets, and building robust monitoring systems. Use this when you need to establish data-driven reliability targets, balance feature velocity with technical health, and align service performance directly with core business objectives.

A comprehensive guide to optimizing cloud expenditure on the Vercel platform. It details how to understand the Fluid Compute pricing model, identify key cost drivers (such as function execution time, bandwidth, and middleware invocations), and implement best practices like edge caching, memory right-sizing, and aggressive asset caching. Use this when analyzing high Vercel billing, implementing cost controls, or managing a SaaS budget.

A comprehensive tool for security professionals to enumerate and analyze malware persistence mechanisms across critical Windows Auto-Start Extensibility Points (ASEPs). It systematically scans registry run keys, scheduled tasks, services, drivers, and startup locations. Ideal for incident response, threat hunting, and validating the complete removal of malicious autostart entries.

This guide details deploying Tailscale (or self-hosted Headscale) to create a WireGuard-based zero trust mesh VPN. It establishes encrypted peer-to-peer connections between devices, eliminating the need for traditional VPN servers. Features include identity-aware Access Control Lists (ACLs), subnet routing, and secure connectivity for compliance-driven architectures. Use this when enforcing granular, identity-authenticated access control.

A proactive, hypothesis-driven skill designed to hunt for Advanced Persistent Threats (APT) within complex enterprise environments. It analyzes endpoint telemetry, network logs, and memory artifacts using frameworks like MITRE ATT&CK. Use this skill when investigating anomalous behavior flagged by UEBA, conducting scheduled threat sprints, or validating exposure to known TTPs using tools like Velociraptor and osquery.

A comprehensive guide for conducting hypothesis-driven threat hunting against supply chain compromises (T1195). This skill focuses on querying SIEM/EDR logs to detect indicators of trojanized software updates, compromised dependencies, unauthorized code modifications, and tampered build artifacts. It is crucial when investigating suspected vendor compromises or scoping a build pipeline breach, requiring advanced knowledge of logging systems and threat intelligence.

Conduct hypothesis-driven threat hunting for Command-and-Control (C2) activity (T1071). This skill guides the analysis of SIEM/EDR network telemetry to detect anomalous outbound traffic, rare destination IPs, non-standard ports, and unusual connection frequencies, helping identify beaconing or data exfiltration attempts. Essential for proactive defense and incident response.

This guide provides a structured methodology for hypothesis-driven threat hunting focused on detecting web shell deployment (T1505.003) on internet-facing servers. It analyzes file creation in web directories, suspicious child-process generation from web server processes, and anomalous HTTP request patterns. Use this during incident response, proactive security assessments, or when EDR/SIEM alerts indicate web server process anomalies.

This skill guides the deployment and configuration of Data Loss Prevention (DLP) controls directly on endpoints. It detects and prevents the unauthorized exfiltration of sensitive data (PII, PHI, PCI) via common vectors like email, USB drives, cloud storage uploads, and printing. Use this when establishing compliance policies (HIPAA, GDPR) or securing data against internal data movement risks.

A comprehensive guide for implementing a highly secure and reliable centralized logging pipeline using rsyslog. This method utilizes TLS encryption via X.509 certificate authentication and GnuTLS stream drivers, ensuring all log data is securely transmitted. The guide covers per-host log segregation, robust log rotation, and disk-assisted queueing for high-availability log infrastructure, making it ideal for compliance and security operations.