Skill UI

Analyzes structured and unstructured threat intelligence feeds to extract indicators, normalize data into STIX 2.1, enrich IOCs, deduplicate, and distribute via TAXII to SIEM/EDR systems—ideal for assessing CTI feed quality or automating feed ingestion pipelines.

Monitors crt.sh certificate transparency logs via pycrtsh to detect phishing domains, unauthorized issuance, typosquatting, and shadow IT, enabling SOC analysts to proactively hunt for suspicious certificates and validate monitoring coverage.

Analyzing USB device connection history by extracting Windows registry hives, SetupAPI logs, and event logs to track removable media usage during incidents or insider investigations.

Extract Windows Shellbag registry artifacts with SBECmd and ShellBags Explorer to reconstruct folder browsing, removable media and network share access, and prove user interaction even after deletion or disconnection.

A comprehensive tool for searching, retrieving, and analyzing academic papers from the arXiv repository. Users can search by topic or specific ID to get metadata, download associated PDF files, and receive a structured summary of the paper's key contributions, making it essential for academic research and literature review.

Guides security teams through CIS benchmark audits for AWS, Azure, and GCP using tools like Prowler and ScoutSuite, covering assessment, remediation prioritization, and continuous compliance monitoring.

Audit Google Cloud IAM using gcloud CLI, Policy Analyzer, and IAM Recommender to flag over-privileged bindings, primitive roles, service-account keys, and cross-project risks during security assessments and compliance reviews.

Automates review of Terraform infrastructure-as-code via Checkov, tfsec, Terrascan, and OPA/Rego policies to find permissive IAM roles, public exposure, missing encryption, and insecure defaults before cloud deployment.

This skill executes an autonomous, iterative research review loop, simulating a rigorous peer-review process. It repeatedly uses an external OpenAI-compatible LLM via API calls to score, critique, and identify weaknesses in a given research topic or document. The process continues to refine the content by implementing suggested fixes until the LLM provides a positive assessment or the maximum round limit is reached. Ideal for academic writing, technical documentation, and refining complex proposals.

Automates enrichment of indicators of compromise with multi-source threat intelligence via SOAR playbooks or Python pipelines to speed SIEM alert triage and bulk IOC processing.

AWT provides AI coding tools with the ability to perform sophisticated End-to-End (E2E) web testing using a real browser. It accepts declarative YAML scenarios and executes them via Playwright. Key features include visual matching (OpenCV + OCR) instead of relying on fragile DOM selectors, automatic platform detection (React, Vue, etc.), and structured failure diagnosis for improved AI coding workflows.

Orchestrates collection of suspicious files from endpoints and email gateways, pre-screens via VirusTotal/MalwareBazaar, and routes samples to sandbox engines so SOC teams can scale triage without manual uploads.