Skill UI

A comprehensive design specification detailing 98 rules for building Command Line Interface (CLI) tools that are safe, reliable, and easily consumable by AI agents. It covers structured JSON output formats, standardized error handling (to stderr), robust input contracts, safety guardrails (e.g., preventing path traversal), and tiered compliance levels (Agent-Friendly, Agent-Ready, Agent-Native) for seamless integration into AI workflows.

A deep-dive tool for cybersecurity professionals to analyze malware Command and Control (C2) communication across multiple protocols (HTTP, HTTPS, DNS, custom). It helps reverse-engineer beaconing patterns, decode proprietary protocols, and map threat actor infrastructure, making it crucial for building robust detection signatures and attributing threats.

This skill analyzes DNS query logs to detect sophisticated threats such as data exfiltration via DNS tunneling, Domain Generation Algorithm (DGA) usage, and covert Command and Control (C2) channels. It utilizes advanced techniques like entropy analysis, query volume anomaly detection, and subdomain length analysis within SIEM platforms, helping SOC teams identify threats that bypass traditional network security controls.

This tool analyzes network packet captures (PCAP) to detect covert communication channels used by malware for Command and Control (C2) and data exfiltration. It specifically focuses on identifying indicators of DNS tunneling, ICMP tunneling, and protocol abuse patterns, providing scoring and detailed reasons for suspicious activity. Useful for threat hunting and security incident investigation.

This tool parses NetFlow v9 and IPFIX records to conduct deep network security analysis. It is crucial for investigating security incidents by building traffic baselines and applying statistical methods. Key detection capabilities include identifying port scanning, data exfiltration attempts, command and control (C2) beaconing patterns, and general volumetric anomalies in network traffic.

A comprehensive guide for analyzing PCAP files captured during malware execution. It demonstrates advanced techniques using Wireshark, Zeek, Suricata, and Python (scapy) to identify Command and Control (C2) communications, data exfiltration channels, Domain Generation Algorithms (DGA), and periodic beaconing patterns. Essential for malware reverse engineering and network threat detection.

A comprehensive guide for deep packet inspection and network forensics using Wireshark and tshark. This skill is critical for incident response, where it allows users to capture, filter, and analyze network packet data to identify malicious command-and-control traffic, diagnose complex protocol issues, extract indicators of compromise (IOCs), and reconstruct data exfiltration paths. Use it for validating security rules and understanding network anomalies.

A dedicated tool for forensic analysis of Windows PowerShell Script Block Logs (Event ID 4104) captured in EVTX files. It reconstructs multi-block scripts, applying advanced detection heuristics such as entropy analysis and pattern matching to identify obfuscated commands, encoded payloads (Base64), download cradles, and AMSI bypass attempts, crucial for threat hunting and incident response.

This comprehensive skill analyzes Zeek conn.log and NetFlow data to proactively detect advanced indicators of ransomware activity. It identifies critical threats such as Command and Control (C2) beaconing patterns, connections to TOR exit nodes, large-scale data exfiltration flows, and suspicious DNS anomalies. It is essential for threat hunting and complex security incident response.

This skill enables an autonomous research review loop using any OpenAI-compatible LLM API. It iterates through review, implementation, and re-review phases until a positive assessment is achieved or maximum rounds are reached. Configure via MCP server or environment variables. Trigger with specific commands to improve research quality automatically.

This system builds an automated framework to track adversary Command and Control (C2) infrastructure. By leveraging passive DNS records, Certificate Transparency logs, and WHOIS data, it maps complex relationships between domains, IPs, and registrars. Use it to pivot from known indicators to discover entirely new, related threat actor infrastructure or maintain a continuous map of a threat group's network activity.

Details the deployment, hardening, and operation of a resilient Command and Control (C2) infrastructure using the open-source Sliver framework. This guide covers advanced techniques including multi-protocol listeners (mTLS, HTTP/S, DNS, WireGuard), deployable redirectors, and domain fronting, making it essential for authorized red-teaming and sophisticated adversary simulation.