Skill UI

This skill provides a comprehensive framework for vulnerability prioritization by combining three crucial data points: CISA's Known Exploited Vulnerabilities (KEV) catalog (confirming real-world exploitation evidence), EPSS scores (predicting exploitation probability), and CVSS metrics (assessing intrinsic severity). It builds a multi-factor prioritization engine to determine the most critical CVEs for immediate remediation, assisting security teams in managing large vulnerability backlogs efficiently.

EvilGinx3 is an advanced Adversary-in-the-Middle (AiTM) framework designed for red teaming simulations. It goes beyond traditional credential harvesting by acting as a transparent proxy to intercept the entire authentication flow, including session cookies and Multi-Factor Authentication (MFA) tokens. This capability allows security professionals to assess the robustness of an organization's security posture against sophisticated account takeover attacks.

This comprehensive guide outlines a structured workflow for investigating insider threats—incidents where authorized employees or contractors misuse their access to steal data or sabotage systems. It integrates DLP alerts, User Behavior Analytics (UBA), and digital forensics, emphasizing mandatory collaboration between Legal, HR, and Security teams to build an admissible, evidence-based case.

This skill guides the execution of structured purple team exercises, simulating real-world adversary techniques (Red Team) and validating the effectiveness of existing detection rules and controls (Blue Team). It is essential for Security Operations Center (SOC) teams to identify critical detection gaps, optimize analyst response playbooks, and enhance the overall security posture against specific threat actors mapped to MITRE ATT&CK techniques.

Conducts comprehensive, sector-specific threat landscape assessments by profiling key threat actors, mapping attack vectors, and detailing associated MITRE ATT&CK TTPs (covering financial, healthcare, energy, etc.). Utilizing sophisticated data analysis via Python stacks and integrating real-time threat intelligence feeds (ISAC, CVEs), this tool generates highly actionable intelligence for risk management, security investment prioritization, and high-level board-level reporting on industry exposure.

Processes STIX 2.1 threat intelligence bundles delivered via TAXII 2.1 servers. It normalizes various threat intelligence objects (indicators, actors) into platform-native schemas, enabling automated ingestion, validation, and routing to SIEM, TIP, and EDR systems. Ideal for integrating new ISAC feeds or building bi-directional intelligence pipelines.

Develops comprehensive profiles for Advanced Persistent Threat (APT) groups, criminal organizations, and hacktivist collectivities. This tool aggregates TTP documentation, campaign data, and attribution indicators from major intelligence sources (MITRE ATT&CK, Mandiant, CrowdStrike) to help organizations update threat models, prioritize defensive controls, and prepare executive briefings on sector-specific risks.

A comprehensive guide to writing robust and maintainable tests in Rust. It covers various advanced testing patterns, including Unit, Integration, Async, and Property-Based testing. Learn how to apply the TDD (Test-Driven Development) cycle (RED-GREEN-REFACTOR) to enhance code reliability and ensure high code coverage.

This guide details the design and configuration of secure, compliant remote access architectures for Operational Technology (OT) and Industrial Control Systems (ICS). It covers implementing jump server architectures, Multi-Factor Authentication (MFA), Privileged Access Management (PAM), session recording, and adhering to standards like IEC 62443 and NERC CIP-005. Ideal for network architects, security engineers, and operations teams needing to manage third-party vendor access securely.

This skill provides advanced techniques and code examples for monitoring, mapping, and pivoting across adversary-controlled infrastructure. It leverages Passive DNS, Certificate Transparency logs, Shodan/Censys scanning, and network fingerprinting (JARM/JA3S) to discover C2 servers, phishing domains, and exploitable assets over time, which is crucial for advanced security operations and threat intelligence gathering.

The /hub:spawn command launches N subagents simultaneously, each operating in an isolated git worktree to work on the same task. It supports custom templates (like optimizer or refactorer) and manages the entire parallel execution cycle, ensuring diverse strategies and structured results for maximum value exploration.

This skill generates user-friendly, public-facing release notes (changelogs) for App Stores. It analyzes the raw Git history since the last tag, intelligently filtering out internal commits (like refactors, CI updates, or build scripts) and grouping visible changes into concise, benefit-focused bullet points suitable for a "What's New" section.