Skill UI

This comprehensive workflow automates the creation of C4 architectural documentation for any codebase. It utilizes a bottom-up analysis approach, starting by analyzing code details (Code Level), synthesizing them into logical components, mapping containers, and finally establishing the high-level system context. Ideal for documenting complex, existing systems and ensuring comprehensive technical knowledge transfer.

Generates C4 code-level documentation from a code directory by summarizing functions, classes, dependencies, and optional diagrams to guide reviews and implementation workflows.

This skill specializes in generating expert-level, component-level architecture documentation based on the C4 Model. It synthesizes low-level code documentation into a high-level view, clearly defining component boundaries, service interfaces (REST, GraphQL, etc.), and inter-component dependencies. Ideal for documenting complex software systems and creating accurate Mermaid C4 Component diagrams.

This expert skill specializes in generating comprehensive, structured documentation for microservices and containerized architectures using the C4 Model. It covers system boundaries, container definitions, technology stacks, inter-container communication protocols, API specifications (OpenAPI/Swagger), and deployment infrastructure (e.g., Docker, Kubernetes). Ideal for documenting complex system deployments and mapping architectural relationships.

Generates stakeholder-friendly C4 context-level documentation, covering personas, user journeys, features, external dependencies, and Mermaid diagrams to clarify system boundaries and interactions.

Analyze domain controller Kerberos/TGT logs to detect Golden Ticket anomalies such as RC4 encryption, impossible lifetimes, forged PACs, and missing TGT events, enabling SOCs to hunt post-breach persistence or credential theft across AD environments.

Detect Kerberos Golden Ticket forgery by analyzing Windows Event ID 4769 RC4 downgrades, orphaned TGS requests, and abnormal lifetimes in Splunk or Elastic SIEM to alert on credential-theft attacks.

Detect Kerberos Pass-the-Ticket attacks by correlating Windows Security Event IDs 4768, 4769, and 4771 inside Splunk or Elastic SIEM, flagging ticket reuse, RC4 downgrades, and unusual service ticket volumes for SOC hunting and coverage validation.

Guides creation or updates of object-oriented component documentation by analyzing code or existing docs, then applying C4/Arc42/IEEE templates to capture architecture, interfaces, and quality traits.