Skill UI

This assistant is an expert guide for developing user interfaces using the Makepad framework. It helps users write, explain, and troubleshoot code for a comprehensive set of widgets, including containers (View, PortalList), input controls (TextInput, Slider), navigation elements (TabBar, Modal), and media components. It adheres to best practices, providing structured code patterns and detailed usage documentation for building complex, modern UIs.

Opinionated Docker development assistant that analyzes Dockerfiles, docker-compose setups, multi-stage builds, and container security to shrink images, speed builds, and enforce production-ready practices when users need optimized containers.

A comprehensive guide and workflow for investigating compromised Docker containers. This tool assists digital forensic experts in analyzing layers, volumes, logs, runtime artifacts, and host configurations to identify malicious activity, privilege escalation attempts, and system breaches during incident response.

This skill detects unauthorized modifications (container drift) to running containers by monitoring for deviations from the original image state. It monitors binary execution drift, file system changes, and configuration deviations using tools like Falco and Kubernetes security contexts. Essential for SOC analysts and security teams investigating runtime compromises and enforcing immutable infrastructure.

This guide details methods and rules for detecting container escape attempts, a critical security vulnerability where an adversary breaks out of container isolation to access the host system or other containers. It covers monitoring syscalls, namespace manipulation (e.g., nsenter, unshare), accessing sensitive host paths (/proc), and detecting privileged operations using tools like Falco and eBPF.

This tool provides a comprehensive security audit framework for Azure Storage accounts. It systematically detects critical misconfigurations, such as publicly accessible blob containers, weak encryption settings, overly permissive network access rules, and missing logging. Use it when performing compliance checks, responding to security incidents, or establishing storage security baselines in Azure environments.

This skill provides comprehensive methods for detecting and preventing privilege escalation within Kubernetes pods and containers. It details using runtime tools like Falco for monitoring syscalls and capabilities, and implementing admission controls via OPA Gatekeeper or Pod Security Admission to enforce security best practices, thereby hardening the cluster against unauthorized access and dangerous configurations.

A comprehensive guide detailing best practices for hardening Docker containers, aligning with CIS Docker Benchmark v1.8.0. It covers host configuration, minimizing attack surface, implementing least privilege, and enhancing runtime security using techniques like read-only filesystems, Seccomp, and AppArmor. Use this when deploying secure, production-grade containerized applications.

This guide details the implementation of Microsoft Defender for Cloud, enabling comprehensive cloud security posture management (CSPM) and workload protection (CWPP). Learn how to secure VMs, containers, databases, and storage accounts, configure security recommendations, and establish automated remediation workflows to ensure continuous compliance and robust cloud defense.

This skill guides implementing robust code signing for software artifacts (binaries, packages, containers). It ensures integrity and authenticity throughout the entire software supply chain. Learn to use traditional methods like GPG and modern, keyless approaches like Sigstore (cosign) to establish trust chains, verify provenance, and meet compliance standards (e.g., SLSA).

OPA Gatekeeper is a powerful Kubernetes admission controller that enforces policies using Rego rules. It utilizes ConstraintTemplates and Constraints to validate, mutate, or deny API requests at the cluster admission stage. This tool is essential for implementing policy-as-code practices, ensuring that Kubernetes deployments adhere to organizational security standards, compliance requirements, and best practices, such as mandating labels or blocking privileged containers.

This skill automates the entire phishing incident response lifecycle using the Splunk SOAR REST API. It processes reported emails, extracts indicators of compromise (IOCs) like URLs and IPs, creates incident containers, attaches artifacts, and triggers automated playbooks for deep analysis and reporting. It is essential for security operations teams needing robust, programmatic incident handling and compliance alignment.