Skill UI

This skill provides methods to safely monitor and analyze data leak sites (DLS) used by ransomware groups. It extracts structured victim data, tracks group activity trends over time, and generates sector- and geography-specific ransomware risk assessments, crucial for proactive threat intelligence gathering and incident response.

This guide provides a deep dive into the cryptographic techniques used by ransomware, including AES, RSA, ChaCha20, and hybrid schemes. It covers identifying algorithms, analyzing key management patterns (strong, weak, flawed), and reverse engineering file encryption routines to assess decryption feasibility and support recovery efforts.

This skill provides advanced threat hunting queries for Microsoft Sentinel/Log Analytics. It detects the behavioral and string fingerprints left by popular offensive Entra ID enumeration tools (like ROADtools, AADInternals, and AzureHound) within both MicrosoftGraphActivityLogs and AADGraphActivityLogs. Use this when investigating suspicious Graph API activity, identifying internal reconnaissance, or building detection rules to surface active intrusions.

This skill provides comprehensive, read-only access to the pkg.go.dev API using the `godig` tool. It allows users to query detailed information about Go packages and modules, including full documentation, API signatures, available versions, dependency graphs, and known security vulnerabilities. It is essential for researching the external Go ecosystem and comparing library metadata.

This skill proactively hunts for advanced firmware threats, including UEFI bootkits (e.g., BlackLotus, ESPecter), residing in the EFI System Partition (ESP). It establishes a cryptographic baseline, verifies bootloader signatures, scans for out-of-band changes, and uses YARA rules to detect persistence mechanisms related to pre-OS compromise (MITRE ATT&CK T1542.003). Ideal for forensic investigations and security hardening.

A comprehensive guide for engineering the migration from classical public-key cryptography to quantum-resistant standards. This skill covers building a Cryptographic Bill of Materials (CBOM) to inventory assets, prioritizing migration based on Harvest-Now-Decrypt-Later (HNDL) risk, and deploying hybrid PQC key exchange (e.g., X25519MLKEM768) on critical channels like TLS, VPN, and SSH. Essential for achieving long-term quantum readiness and crypto-agility.

This guide details how to deploy OpenCTI, a powerful, open-source threat intelligence platform, and utilize the pycti Python client. It teaches analysts how to model complex cyber threat intelligence, including threat actors, campaigns, and indicators, into a structured STIX 2.1 knowledge graph. Use this for centralized threat-intel correlation, building adversary graphs, and generating STIX bundles for detection engineering.

GraphRunner is a powerful PowerShell toolset built on the Microsoft Graph API, designed for authorized red-teaming engagements against M365/Entra ID tenants. After obtaining a valid Graph token, it enables reconnaissance, establishes persistence (e.g., injecting OAuth apps and inbox rules), performs privilege escalation, and exfiltrates sensitive data from mailboxes, SharePoint, and Teams. Use only in authorized testing environments.

A spectral vector search tool that enhances nearest-neighbor search with graph Laplacian features, capturing both semantic similarity and structural roles in embedding spaces.

Provides comprehensive guidelines and utilities for modern unit testing using Jest and React Native. Covers Test-Driven Development (TDD) workflows, Behavior-Driven Development (BDD) principles, advanced mocking strategies for modules and GraphQL hooks, and implementing reusable factory functions for props and data. Use this skill to write robust, maintainable, and highly structured unit tests.

This comprehensive skill demonstrates advanced usage patterns for Formik, a popular React form handling library. It covers basic form setup, complex validation schema creation using Yup (including conditional logic), field helper utilities, and integrating form submissions with GraphQL mutations for both creation and editing scenarios.

This guide details best practices for implementing robust, type-safe GraphQL queries and mutations. It covers using separate .gql files, running code generation tools, and implementing mandatory error handling (onError) and loading states. Use this when building complex, reliable data fetching layers with Apollo Client.