Skill UI

This advanced skill specializes in analyzing complex mail-related abuse scenarios, including OAuth consent flows, forwarding rule exploitation, shared mailbox access, and transport rule manipulation. It is used in forensic investigations to trace message artifacts, identify persistence mechanisms, and prove privilege escalation or data exfiltration following a compromise.

This skill audits a complete security or forensics case package to ensure its readiness for formal report handoff. It verifies scope metadata, evidence record integrity, traceability between Findings, Paths, and Evidence, and checks artifact hash consistency. It is a non-destructive, read-only review process designed to validate the defensibility and completeness of the investigation before documentation.

This skill enables authorized reverse engineering of Chrome and Firefox browser extensions. It involves analyzing manifest files, background workers, and content scripts to investigate credential handling, data exposure, and malicious behavior. Suitable for security audits, supply chain poisoning investigations, and understanding extension logic through static and dynamic analysis using tools like DevTools and Frida.

This skill compiles durable, non-obvious findings into an interlinked markdown knowledge store using atomic files and wiki links. It ensures agents retain knowledge across sessions without relearning facts. It involves creating one fact per file with metadata like confidence and provenance, maintaining an index for easy retrieval. Ideal for research, competitive intel, or investigation results.

Configure GCP Cloud Audit Logs for compliance and security investigation. Set up log sinks to BigQuery, Cloud Storage, and Pub/Sub for export and real-time streaming. Query audit logs to monitor admin activity, data access, and policy changes.

Enrich IOCs and profile threat actors from public sources with defined boundaries. Supports domain, IP, URL, hash, email, and wallet enrichment, plus impersonation and scam investigation. Includes X/Twitter data collection via Xquik, normalization, independent verification, and intelligence package handoff.

This skill helps identify explanatory attributes or hypotheses for variations in process metrics such as duration, waiting time, utilization, and rework. It involves checking metadata correlations, statistical evidence, and cohort comparisons to distinguish competing explanations. The method emphasizes evidence-based analysis, avoiding silent assumptions, and framing findings as testable hypotheses rather than definitive causal claims. It supports structured investigation of process efficiency and bottlenecks using specific analytical tools and frozen baseline scopes.