Skill UI

A comprehensive guide detailing how to implement declarative, Git-based continuous delivery for Kubernetes. It covers setup using industry-leading tools like ArgoCD and Flux CD, adhering to OpenGitOps principles for automated, reliable, and traceable application deployments and infrastructure management.

An expert guide for designing, implementing, and optimizing large-scale, secure, and highly available cloud-native infrastructure using Kubernetes. Covers advanced topics including GitOps workflows (ArgoCD/Flux), service mesh architecture (Istio), multi-cluster management, Policy as Code (OPA), and infrastructure automation with Terraform. Ideal for platform engineers building enterprise-grade container orchestration solutions.

This expert skill performs non-intrusive static analysis to thoroughly audit AI skills and bundles. It identifies malicious patterns, data leaks, system stability risks, and obfuscated payloads across major operating systems (Windows, macOS, Linux/Unix) and mobile platforms (Android/iOS). Use it when verifying skill legitimacy or performing deep cross-platform security reviews.

This comprehensive guide details the process of creating forensically sound, bit-for-bit disk images using industry-standard tools like `dd` and `dcfldd` on Linux systems. It covers essential steps including enabling write protection, documenting source metadata, performing the acquisition, and crucially, verifying the image integrity using cryptographic hashing (MD5/SHA-256). This methodology is vital for digital forensics, incident response, and legal proceedings to ensure evidence remains unaltered and admissible.

A comprehensive guide for digital forensics analysts to investigate compromised Linux systems. This workflow details the collection and analysis of critical system artifacts, including authentication logs, shell histories, SSH keys, and system configurations. Use this methodology during incident response to detect rootkits, unauthorized persistence mechanisms, and reconstruct full attacker activity.

This comprehensive skill scans Linux systems for various persistence vectors, including crontab entries, systemd units, LD_PRELOAD injections, and shell profile modifications. It correlates these findings with auditd logs to build a detailed installation timeline, which is critical for incident response and threat hunting to detect hidden backdoors.

A comprehensive guide for deploying and configuring CrowdStrike Falcon EDR agents across diverse endpoints (Windows, macOS, Linux). This skill covers silent installation via SCCM, Intune, GPO, and command-line methods, alongside establishing robust prevention and response policies. Ideal for onboarding endpoints, enhancing threat detection capabilities, and integrating Falcon telemetry into SIEM platforms for advanced security operations.

This skill provides a comprehensive framework for detecting various privilege escalation techniques across Windows and Linux. It covers access token manipulation, UAC bypass, unquoted service path abuse, and kernel exploits. It is essential for threat hunting, scoping compromise during incident response, and validating detection coverage in proactive security assessments.

This skill automates the hardening of Linux endpoints (Ubuntu, RHEL, CentOS) by implementing industry-standard security best practices guided by CIS Benchmarks. It systematically secures various layers, including filesystem permissions, network parameters (sysctl), SSH configuration, user access controls (PAM), and integrates deep auditing using auditd and OpenSCAP. It is essential for achieving compliance with standards like PCI DSS, HIPAA, and SOC 2.

This comprehensive skill guides the setup and deployment of File Integrity Monitoring (FIM) using AIDE on Linux systems. It covers generating the initial baseline database, configuring monitoring rules, running scheduled checks via cron, and parsing change reports to detect unauthorized file modifications. Essential for meeting strict compliance requirements and enhancing endpoint security.

Utilize Velociraptor, an advanced open-source platform, to collect, query, and monitor forensic artifacts across diverse endpoints (Windows, Linux, macOS). This skill enables incident response teams to perform large-scale, rapid digital forensic investigations by collecting critical data such as event logs, registry entries, prefetch files, and network metadata using VQL queries.

LaZagne is an open-source post-exploitation tool utilized by red teams to harvest stored credentials from compromised endpoints. It supports Windows, Linux, and macOS, extracting passwords from browsers (Chrome, Edge), databases (MySQL, SQLite), system vaults (DPAPI, LSA), and various applications. It is crucial for privilege escalation and lateral movement during authorized security assessments.