Skill UI

This skill acts as an anti-over-engineering guardrail, instructing AI coding agents to maintain strict scope control and minimalism. It guides the AI to only modify the files and lines explicitly requested by the user, avoiding unnecessary abstractions, unrequested refactors, or scope creep. Use it when you prefer the simplest, most direct solution and want to prevent the agent from 'grinding' the code base.

This skill enforces a rigorous, 5-phase debugging protocol (Reproduce, Isolate, Root Cause, Fix, Verify) for AI coding agents. It forces a disciplined approach, preventing agents from guessing fixes or making premature edits. Use this when debugging complex, intermittent, or hard-to-isolate bugs to ensure the root cause is fully confirmed before any code changes are applied, maximizing debugging accuracy.

This guide provides comprehensive patterns for designing and implementing secure multi-tenant SaaS applications using shared databases. It covers critical techniques like Row-Level Security (RLS) in PostgreSQL, implementing tenant-aware middleware in TypeScript (Express/Fastify), and enforcing data scoping at the ORM level (Prisma/Drizzle). Learn how to prevent data leakage and manage tenant isolation across shared schemas.

Deploy deception-based Active Directory honeytokens—fake privileged accounts, SPNs, decoy GPOs and BloodHound paths—to detect Kerberoasting, lateral movement, credential theft and other reconnaissance activity via monitored Windows Security events.

Detect NTLM relay attacks by correlating Windows Security Event 4624 LogonType 3 entries against IP-to-hostname inventories, auditing SMB/LDAP signing enforcement, spotting Responder/LLMNR poisoning traffic, and tagging NTLM downgrade attempts for SIEM alerting.

Detects and prevents injection attacks targeting serverless functions by combining static analysis, event mapping, runtime behavior monitoring, and IAM auditing so SOCs can spot poisoned triggers, malicious layers, and privilege escalations across Lambda, Azure, and GCP environments.

Detects DCOM lateral movement by triangulating Sysmon Event ID 1/3, Windows security logs, and RPC traffic patterns tied to MMC20, ShellWindows, and ShellBrowserWindow abuse, enabling SOCs to hunt and tune detections across AD domains.

Sets up Microsoft Purview data loss prevention policies to protect sensitive content across Exchange, SharePoint, OneDrive, Teams, Power BI, and managed endpoints by defining sensitivity label taxonomies, custom regex types, endpoint controls, and monitoring with Activity Explorer plus PowerShell/Graph automation.

Deploys Cilium Tetragon-based eBPF tracing to watch processes, network, file access, and enforce runtime policies while streaming JSON events to SIEM pipelines for Linux hosts or Kubernetes clusters.

Safety Guard prevents destructive operations on production systems or during autonomous agent runs by intercepting risky commands, restricting write access to specified directories, and combining both protections when needed.

Checks AWS, Azure, and GCP configurations for IAM escalation paths, public storage exposure, open security groups, and IaC gaps, providing preventive findings with MITRE mapping for cloud posture management workflows.

An advanced framework designed to transform standard Claude Code into a persistent, self-directing agent system. It integrates crucial components like structured persistent memory (MCP), scheduled operations (Crons), remote dispatching, and computer automation (browser/desktop control). This system is ideal for implementing complex, continuous, or event-driven automated workflows that require statefulness and long-term monitoring.