Skill UI

This skill provides comprehensive methodologies for capturing, analyzing, and documenting network protocols. It is crucial for security researchers, developers ensuring interoperability, and engineers debugging complex network communications by understanding the underlying data exchange mechanisms.

This skill manages the integration of Model Context Protocol (MCP) servers with Windsurf, significantly extending its operational capabilities. It enables Windsurf to interact with external resources, including databases, file systems, APIs, and custom tools through a standardized protocol. Use this when configuring or utilizing advanced, external tool integrations within the Windsurf environment.

Submit and manage autonomous lab protocols on Ginkgo Cloud Lab, leveraging RACs for cell-free protein expression validation/optimization, fluorescent pixel art, EstiMate AI assessments, and guided ordering of sample inputs through the web interface.

An expert guide detailing the SuperScalar protocol and Bitcoin Lightning channel factories. It explains scalable onboarding mechanisms using shared UTXOs, advanced cryptographic structures like Decker-Wattenhofer trees, and MuSig2. This knowledge is vital for understanding how Bitcoin can scale significantly without requiring disruptive soft forks.

A rigorous, multi-phase auditing skill designed for blockchain protocols. It verifies whether the implemented smart contract code strictly adheres to the detailed specifications provided in whitepapers, design documents, or technical specifications. It performs exhaustive, line-by-line semantic analysis to identify gaps, inconsistencies, and deviations across logic, invariants, and security guarantees, making it essential for formal compliance checking in decentralized systems.

A deep-dive tool for cybersecurity professionals to analyze malware Command and Control (C2) communication across multiple protocols (HTTP, HTTPS, DNS, custom). It helps reverse-engineer beaconing patterns, decode proprietary protocols, and map threat actor infrastructure, making it crucial for building robust detection signatures and attributing threats.

A comprehensive guide for deep packet inspection and network forensics using Wireshark and tshark. This skill is critical for incident response, where it allows users to capture, filter, and analyze network packet data to identify malicious command-and-control traffic, diagnose complex protocol issues, extract indicators of compromise (IOCs), and reconstruct data exfiltration paths. Use it for validating security rules and understanding network anomalies.

This guide details the systematic process of creating comprehensive incident response playbooks and runbooks. It covers structured procedures, decision trees, RACI matrices, and escalation protocols for various incident types (e.g., ransomware, data breach). Designed for maturing an Incident Response (IR) program, maintaining compliance (SOC 2, HIPAA), and integrating automated workflows into SOAR platforms, aligning with NIST SP 800-61r3 standards.

A comprehensive guide to deploying and configuring Suricata as a high-performance Intrusion Detection System (IDS) or Intrusion Prevention System (IPS). This skill covers setting up multi-threaded packet processing for high-throughput links, enabling protocol-aware inspection (HTTP, TLS, DNS, SMB), generating structured EVE JSON logs for SIEM ingestion, and integrating advanced signature and anomaly detection capabilities.

A comprehensive guide to implementing and validating Transport Layer Security (TLS) 1.3. This skill covers configuring modern cipher suites, key exchange groups, and enforcing perfect forward secrecy (PFS). Use this when deploying secure communication protocols, hardening network services, meeting compliance standards, or performing deep security assessments on web servers and applications.

This guide details comprehensive detection methods for DCSync attacks (MITRE T1003.006) in Active Directory. Attackers abuse legitimate directory replication protocols to extract sensitive password hashes. Detection relies on auditing Windows Event ID 4662 for unauthorized access attempts to critical Directory Service GUIDs, specifically flagging non-domain-controller accounts attempting replication calls. Essential for threat hunting and incident response.

This tool detects critical anomalies in DNP3 communications used within SCADA and ICS environments. It employs deep packet inspection and machine learning to monitor for unauthorized control commands, protocol violations, firmware update attempts, and deviations from established network baselines. It is essential for securing critical infrastructure, such as energy grids and industrial control networks, and building robust anomaly-based Intrusion Detection Systems (IDS).