Skill UI

A comprehensive guide detailing the entire workflow for analyzing embedded firmware. It covers hardware-level extraction methods (UART, JTAG, SPI dump), filesystem analysis (SquashFS, JFFS2), binary reverse engineering using tools like Ghidra, and identifying common vulnerabilities (Buffer Overflow, Command Injection). Ideal for security researchers and embedded systems engineers.

This skill manages the integration of Model Context Protocol (MCP) servers with Windsurf, significantly extending its operational capabilities. It enables Windsurf to interact with external resources, including databases, file systems, APIs, and custom tools through a standardized protocol. Use this when configuring or utilizing advanced, external tool integrations within the Windsurf environment.

This comprehensive profiler provides systematic performance analysis for modern applications built with Node.js, Python, and Go. It detects critical bottlenecks across CPU, memory, and I/O dimensions. Key features include generating flamegraphs, analyzing bundle sizes, optimizing database queries (N+1 detection), and running rigorous load tests using k6 and Artillery. It mandates before-and-after measurements to ensure verifiable performance improvements.

This skill details advanced digital forensics techniques for recovering metadata and content of deleted files by analyzing the NTFS Master File Table ($MFT). It covers examining key system artifacts like $LogFile and $UsnJrnl, and analyzing MFT slack space. Use this when reconstructing file system timelines, investigating data loss, or detecting anti-forensic techniques like timestomping during a Windows forensic examination.

This comprehensive skill scans Linux systems for various persistence vectors, including crontab entries, systemd units, LD_PRELOAD injections, and shell profile modifications. It correlates these findings with auditd logs to build a detailed installation timeline, which is critical for incident response and threat hunting to detect hidden backdoors.

This guide outlines the process of passive external reconnaissance using Open Source Intelligence (OSINT) techniques. Users can map an organization's digital footprint by gathering comprehensive data, including DNS records, subdomains, certificate transparency logs, social media profiles, and leaked credentials. It is critical for the planning phase of penetration testing, asset mapping, or preparing for social engineering, all without actively interacting with target systems.

This comprehensive guide details the methodology for detecting Process Hollowing (MITRE T1055.012), a critical defense evasion technique used by fileless malware. It involves analyzing memory-mapped sections, correlating EDR telemetry (Sysmon, ETW), and identifying memory mismatches between the running process and its on-disk binary image. Use this skill when investigating sophisticated, in-memory threats that masquerade as legitimate system processes.

This guide provides comprehensive steps to harden Docker containers and associated runtime environments based on the CIS Docker Benchmark v1.8.0. It covers implementing least-privilege principles, such as running as non-root users, dropping capabilities, using read-only filesystems, and applying seccomp/AppArmor profiles. Use this when preparing containers for production deployment or conducting security audits to minimize the attack surface.

This skill automates the hardening of Linux endpoints (Ubuntu, RHEL, CentOS) by implementing industry-standard security best practices guided by CIS Benchmarks. It systematically secures various layers, including filesystem permissions, network parameters (sysctl), SSH configuration, user access controls (PAM), and integrates deep auditing using auditd and OpenSCAP. It is essential for achieving compliance with standards like PCI DSS, HIPAA, and SOC 2.

This skill detects persistence mechanisms by monitoring Windows startup directories for suspicious file creation (T1547.001). It utilizes real-time file system monitoring via Python watchdog, cross-references Autoruns entries, and analyzes file metadata to identify implants that survive system reboots. Essential for threat hunting and validating security monitoring coverage.

This comprehensive skill guides the setup and deployment of File Integrity Monitoring (FIM) using AIDE on Linux systems. It covers generating the initial baseline database, configuring monitoring rules, running scheduled checks via cron, and parsing change reports to detect unauthorized file modifications. Essential for meeting strict compliance requirements and enhancing endpoint security.

Tetragon utilizes eBPF technology to provide deep, low-overhead security observability and runtime enforcement directly within Kubernetes clusters. It monitors system calls, process execution, file access, and network connections at the kernel level, allowing users to detect or block dangerous activities like container escapes or privilege escalation, ensuring robust cluster security and compliance.