Skill UI

This guide outlines a comprehensive workflow for detecting and preventing the exposure of sensitive AWS credentials (access keys, session tokens) within source code repositories, CI/CD pipelines, and configuration files. It utilizes TruffleHog for deep historical scanning and integrates git-secrets for robust pre-commit hooks, significantly reducing the risk of credential theft and unauthorized account access.

This skill reconstructs the detailed workflow behind a specific coding artifact (like a feature or PR). By analyzing local `ax` agent traces, it connects commits, sessions, skills, and tool calls into a concise, evidence-grounded narrative. It is used when needing to understand the step-by-step process and key decisions that led to a result.

A comprehensive, adaptive framework for developing and implementing features, adhering to a strict, multi-phase workflow: Specify, Design, Tasks, and Execute. This skill ensures feature quality through granular task breakdown, atomic Git commits, requirement traceability, and mandatory, independent verification. It automatically adjusts its depth based on feature complexity (Small to Complex), providing a robust mechanism for managing technical debt and capturing project lessons.

This skill simulates advanced red-teaming techniques targeting Microsoft Entra ID's OAuth 2.0 device-code flow and illicit consent mechanisms. It demonstrates how attackers can steal access and refresh tokens, bypass Multi-Factor Authentication (MFA), and pivot across various Microsoft 365 services. It is designed for authorized security testing to validate token protection and conditional access policies.

Plaso (log2timeline) is an open-source engine used to generate forensic super-timelines. This skill guides the process of normalizing hundreds of diverse artifact types—including MACB times, registry keys, EVTX logs, and browser history—into a single, cohesive chronological view. The workflow covers extraction, filtering, and importing the timeline into Timesketch for collaborative analysis, which is crucial for incident response, correlating complex activity chains, and detecting anti-forensic techniques like timestomping.

Provides a comprehensive workflow and tooling (GuardDog) to triage npm packages and dependency trees for signs of malicious activity. It focuses on static analysis of install scripts, detecting credential exfiltration, reverse shells, and worming behavior, thereby safeguarding against software supply-chain attacks.

This skill provides a comprehensive, cross-platform workflow for auditing UEFI firmware security. It detects advanced threats like bootkits (e.g., BlackLotus, Bootkitty) and Secure Boot bypasses by verifying the integrity of the platform's trust chain. Key checks include confirming Secure Boot status, assessing the currency and application of DBX revocations, and examining the protection of critical EFI variables using specialized tools. Essential for hardware security assessments and forensic investigation.

This skill provides a comprehensive workflow for verifying the integrity of a system's boot chain using Trusted Platform Module (TPM 2.0). It covers local validation (event log replay against PCRs) and remote attestation (generating signed, nonce-bound quotes). Use this to detect bootkits, unauthorized firmware changes, or establish device posture for Zero Trust architectures.

A specialized diagnostic skill designed to analyze failing GitHub Actions workflow logs. It identifies the root cause of crashes, such as missing secrets, environment mismatches, or deprecated syntax. The output provides precise YAML or code diffs required to fix the pipeline and optimize CI/CD processes.

This skill structures a highly controlled, bounded development life cycle for AI agents. It mandates a structured three-phase workflow: Planning (Spec), Implementation (Build), and Verification (Review). It is essential for building complex features from scratch, especially when dealing with ambiguous requirements, high risk, or needing explicit human approval gates to ensure the resulting code meets all defined specifications.