Skill UI

Structures completed intrusion investigations with the Diamond Model by documenting adversaries, capabilities, infrastructure, and victims plus their relationships, metadata, and pivots to cluster incidents and support campaign attribution, confidence scoring, and analytic write-ups.

Detect Cobalt Strike beacon callbacks by correlating TLS certificate signatures, JA3/JA3S/JARM fingerprints, HTTP C2 profile matches, beacon interval jitter, and Zeek/Suricata/Python PCAP analysis to flag high-confidence activity and suggest responses.

Detects domain fronting C2 traffic by comparing TLS SNI and HTTP Host headers from proxy logs, leveraging pyOpenSSL to inspect certificate issuers and SANs, correlating CDN providers and IP ranges, and scoring alerts for high-confidence threat hunting.

Automates indicator lifecycle tracking from discovery through validation, enrichment, deployment, monitoring, and retirement while applying confidence decay, hit-rate and false-positive tracking, and aging policies to keep IOC databases accurate and actionable with MISP/OpenCTI and SIEM integrations.

Handles IMO/Putnam/USAMO/AIME style problems by generating refined proofs, then running a fresh-context adversarial verifier to catch flaws, finally producing honest confidence reports and verified PDFs when possible.

This skill reviews code differences (diffs) to identify opportunities for improvement in clarity, reusability, efficiency, and overall quality. It employs multiple specialized sub-agents (e.g., Code Reuse, Efficiency, Quality) to audit changes. It can provide high-confidence, behavior-preserving fixes when requested, ensuring the code adheres to best practices without introducing regressions. Best used when refactoring, cleaning up, or auditing a specific code scope.

Captures coding session learnings by extracting corrections, successes, and anti-patterns with confidence scoring so teams can track, reinforce, and reuse technical knowledge across projects.

Correlates OSINT findings across usernames, emails, social media, domains, breach records, and dark-web mentions using AI/LLM reasoning to build unified target profiles with confidence scoring and link analysis.

Generates implementation-ready JSON-LD schema for FAQPage, Article, Product, HowTo, and other types, validating required fields against Google rich result rules while outputting single script blocks plus guidance so teams can deploy structured data with confidence.

DiffDock uses diffusion-based deep learning to predict protein-ligand binding poses, confidence, and batch virtual screening workflows for structure-based drug design.