Skill UI

This expert skill performs non-intrusive static analysis to thoroughly audit AI skills and bundles. It identifies malicious patterns, data leaks, system stability risks, and obfuscated payloads across major operating systems (Windows, macOS, Linux/Unix) and mobile platforms (Android/iOS). Use it when verifying skill legitimacy or performing deep cross-platform security reviews.

A comprehensive guide for deploying and configuring CrowdStrike Falcon EDR agents across diverse endpoints (Windows, macOS, Linux). This skill covers silent installation via SCCM, Intune, GPO, and command-line methods, alongside establishing robust prevention and response policies. Ideal for onboarding endpoints, enhancing threat detection capabilities, and integrating Falcon telemetry into SIEM platforms for advanced security operations.

This guide details how to write and tune Falco rules to monitor Linux syscalls in real-time. It is designed to detect critical container escape techniques, such as mounting host filesystems, accessing sensitive host paths, loading kernel modules, and exploiting privileged container capabilities. Ideal for security hardening, threat hunting, and incident response in Kubernetes or containerized environments.

This skill provides a comprehensive framework for detecting various privilege escalation techniques across Windows and Linux. It covers access token manipulation, UAC bypass, unquoted service path abuse, and kernel exploits. It is essential for threat hunting, scoping compromise during incident response, and validating detection coverage in proactive security assessments.

This skill automates the hardening of Linux endpoints (Ubuntu, RHEL, CentOS) by implementing industry-standard security best practices guided by CIS Benchmarks. It systematically secures various layers, including filesystem permissions, network parameters (sysctl), SSH configuration, user access controls (PAM), and integrates deep auditing using auditd and OpenSCAP. It is essential for achieving compliance with standards like PCI DSS, HIPAA, and SOC 2.

This comprehensive skill guides the setup and deployment of File Integrity Monitoring (FIM) using AIDE on Linux systems. It covers generating the initial baseline database, configuring monitoring rules, running scheduled checks via cron, and parsing change reports to detect unauthorized file modifications. Essential for meeting strict compliance requirements and enhancing endpoint security.

Tetragon is a CNCF project that provides advanced, high-performance runtime security observability and enforcement for Kubernetes clusters. By utilizing eBPF, it operates directly at the Linux kernel level to monitor and enforce policies on process execution, file system access, network traffic, and dangerous system calls (syscalls). It offers low-overhead threat detection, making it essential for securing containerized environments against container escapes and unauthorized activity.

LaZagne is an open-source post-exploitation tool utilized by red teams to harvest stored credentials from compromised endpoints. It supports Windows, Linux, and macOS, extracting passwords from browsers (Chrome, Edge), databases (MySQL, SQLite), system vaults (DPAPI, LSA), and various applications. It is crucial for privilege escalation and lateral movement during authorized security assessments.

This skill covers the technical process of setting up SSL/TLS inspection (decryption) on next-generation firewalls and proxies. It details how to act as a trusted Man-in-the-Middle to intercept, decrypt, and inspect encrypted HTTPS traffic for malicious payloads, data exfiltration, and policy violations. The workflow includes generating internal Certificate Authority (CA) certificates and deploying them across various operating systems (Windows, macOS, Linux) to ensure visibility into the web's encrypted blind spot.

A comprehensive playbook detailing advanced techniques for post-exploitation security bypass on Linux systems. Covers escaping restricted shells (rbash), evading noexec/read-only filesystems using in-memory execution (DDexec, memfd_create), and circumventing mandatory access controls like AppArmor and SELinux. Essential for penetration testing and red team operations.