Skill UI

Falco is a powerful CNCF project for real-time runtime security monitoring. This guide teaches authors how to write and deploy custom detection rules using Falco's robust YAML rule engine and modern eBPF driver. It is designed to detect critical threats such as container escapes, namespace manipulation, privileged mounts, and anomalous syscalls in Kubernetes and Docker environments, significantly hardening the overall container security posture.

This skill provides a comprehensive, cross-platform workflow for auditing UEFI firmware security. It detects advanced threats like bootkits (e.g., BlackLotus, Bootkitty) and Secure Boot bypasses by verifying the integrity of the platform's trust chain. Key checks include confirming Secure Boot status, assessing the currency and application of DBX revocations, and examining the protection of critical EFI variables using specialized tools. Essential for hardware security assessments and forensic investigation.

CloudFox is an open-source, attacker-centric tool designed for authorized cloud penetration testing. It maps attack paths and identifies exploitable misconfigurations across AWS and Azure environments. By simulating an attacker's perspective, it goes beyond simple configuration audits to reveal critical assets, exposed secrets, and lateral movement opportunities (like STS AssumeRole trust relationships), providing comprehensive situational awareness for security assessment.

This skill simulates high-impact container breakout techniques, demonstrating how to achieve root compromise on the underlying host operating system. It covers exploiting misconfigurations (e.g., privileged pods, hostPath mounts, exposed Docker sockets) and leveraging known vulnerabilities in runC/containerd, making it essential for authorized penetration testing and assessing the blast radius of a compromised microservice.

This skill is designed for proactive firmware forensics and advanced threat hunting. It analyzes the EFI System Partition (ESP) to detect sophisticated, pre-OS persistence mechanisms, such as UEFI bootkits (e.g., BlackLotus, ESPecter). Detection methods include verifying file hashes against a trusted golden baseline, checking Secure Boot signatures, scanning with YARA, and flagging structural anomalies within the ESP.

This skill guides the secure migration from classical cryptography (RSA, ECC) to quantum-resistant algorithms (PQC). It covers building a Cryptographic Bill of Materials (CBOM), identifying data at risk (HNDL), and deploying hybrid key exchange protocols like X25519MLKEM768 to ensure long-term data security against quantum threats.

This skill guides the deployment and operation of the Havoc C2 framework, enabling advanced adversary emulation. It utilizes Yaotl profiles to generate highly evasive agents (Demon) that employ sophisticated techniques like indirect syscalls and sleep obfuscation. The scope covers the full red-teaming lifecycle, including C2 setup, payload generation, post-exploitation, and lateral movement, making it ideal for authorized security testing and validating EDR detection capabilities.

Trivy is an open-source, comprehensive scanner used to find vulnerabilities (CVEs), misconfigurations, secrets, and license issues across multiple targets. It is essential for implementing 'shift-left' security gates in CI/CD pipelines, scanning container images, Infrastructure-as-Code (IaC) like Terraform/Kubernetes, and generating/re-scanning SBOMs for supply chain transparency.

This skill provides a comprehensive workflow for verifying the integrity of a system's boot chain using Trusted Platform Module (TPM 2.0). It covers local validation (event log replay against PCRs) and remote attestation (generating signed, nonce-bound quotes). Use this to detect bootkits, unauthorized firmware changes, or establish device posture for Zero Trust architectures.

This guide details how to integrate Expo and React Native into existing native iOS or Android applications (brownfield development). It addresses the core challenge of adopting new technology incrementally, outlining two distinct approaches: Isolated (consuming prebuilt AAR/XCFramework) and Integrated (adding sources directly to existing build systems like Gradle/CocoaPods).

rclone is a powerful, feature-rich command-line utility designed to manage files across diverse cloud storage backends, including S3-compatible services. It provides robust, reliable equivalents to core Unix commands (sync, copy, move, mount). Use this skill for all terminal-based cloud operations, such as syncing, backing up, downloading, or managing remote data securely.

KubeEye is a comprehensive cluster inspection tool designed for Kubernetes environments, particularly within KubeSphere. It systematically detects issues across workloads, nodes, and configurations by integrating multiple policy engines, including OPA/Rego, PromQL, file integrity checks, kernel parameter validation, and systemd health checks. Users can define custom inspection rules (InspectRule), schedule checks (InspectPlan), and retrieve detailed reports (InspectResult) to ensure cluster compliance and stability.