Skill UI

A comprehensive toolkit for building production-grade AI agents focused on crypto business development. This skill guides users through the entire token listing lifecycle: autonomously discovering promising assets across multiple chains, applying a weighted 100-point scoring model, verifying safety via advanced wallet forensics, and managing outreach pipelines with necessary human oversight and LLM cascade patterns.

Auto-activating skill that guides analysts through forensics data collector operations, aligning advanced security practices with compliance frameworks while generating validated code and configurations for enterprise deployments.

A comprehensive, step-by-step guide for security professionals to perform deep-dive malware analysis. It covers methodologies for static analysis (disassemblers, imports), dynamic execution (sandboxing, monitoring), identifying Indicators of Compromise (IOCs), and structuring professional threat reports. Essential for incident response and threat intelligence.

This comprehensive guide provides techniques for acquiring, analyzing, and extracting artifacts from memory dumps. It covers best practices for digital forensics, crucial for incident response and malware analysis. Users learn how to use industry-standard tools like Volatility 3 on Windows, Linux, and macOS, including process, network, and registry deep dives.

This comprehensive guide details advanced forensic techniques for detecting and analyzing sophisticated malware that operates at the system's deepest levels, such as the Master Boot Record (MBR), Volume Boot Record (VBR), and UEFI firmware. It covers boot sector disassembly, UEFI module inspection, and memory forensics (SSDT/DKOM). Use this when standard security tools fail or when investigating nation-state level compromises.

Hindsight is an open-source digital forensics tool designed to parse and correlate artifacts from Chromium-based browsers (Chrome, Edge, Brave, Opera). It extracts comprehensive data, including browsing history, cookies, download records, autofill data, and saved passwords, generating unified, chronological timelines essential for incident response, insider threat investigation, and digital forensics cases.

A comprehensive guide and workflow for investigating compromised Docker containers. This tool assists digital forensic experts in analyzing layers, volumes, logs, runtime artifacts, and host configurations to identify malicious activity, privilege escalation attempts, and system breaches during incident response.

A comprehensive guide and workflow for digital forensics investigators to analyze raw email headers. This tool helps trace the true origin of suspicious emails, verify sender authenticity, and detect advanced spoofing techniques by validating crucial protocols like SPF, DKIM, and DMARC. It covers everything from header parsing to domain infrastructure analysis and IP reputation checks.

This skill provides a comprehensive guide to detecting and analyzing heap spray exploitation techniques from raw memory dumps. Utilizing Volatility3's advanced plugins (such as malfind and vadinfo), users can identify key forensic artifacts like NOP sled patterns, suspicious executable memory regions, and embedded shellcode. It is essential for malware analysts and digital forensics investigators conducting incident response.

This skill provides a comprehensive method for detecting kernel-level rootkits on Linux systems. It leverages memory forensics using Volatility3 on physical memory dumps, combined with cross-view analysis (comparing /proc vs /sys) and live system scanning (rkhunter). Techniques include identifying hooked syscall tables, discovering hidden kernel modules, and detecting tampered system structures.

Walks through analyzing RAM dumps with Volatility 3/2 to uncover injected code, hidden processes, network activity, and credentials when responding to compromised hosts.

This skill outlines the comprehensive process of memory forensics on compromised Linux systems. It guides users through acquiring volatile memory using the LiME kernel module and analyzing the resulting image with the Volatility 3 framework. Key artifacts extracted include process lists, network connections, bash history, and loaded kernel modules, making it an essential technique for incident response, threat hunting, and security investigations.