Skill UI

Stratus Red Team is an open-source tool designed for detection engineering and purple teaming. It programmatically detonates granular, documented offensive techniques across major cloud platforms (AWS, Azure, GCP, and Kubernetes). It validates existing security detections (like CloudTrail/GuardDuty) by simulating real attacker activity in a controlled, reversible environment. The tool ensures deterministic lifecycles, guaranteeing that all created resources are cleaned up after testing.

CloudFox is an open-source, attacker-centric tool designed for authorized cloud penetration testing. It maps attack paths and identifies exploitable misconfigurations across AWS and Azure environments. By simulating an attacker's perspective, it goes beyond simple configuration audits to reveal critical assets, exposed secrets, and lateral movement opportunities (like STS AssumeRole trust relationships), providing comprehensive situational awareness for security assessment.

This skill simulates high-impact container breakout techniques, demonstrating how to achieve root compromise on the underlying host operating system. It covers exploiting misconfigurations (e.g., privileged pods, hostPath mounts, exposed Docker sockets) and leveraging known vulnerabilities in runC/containerd, making it essential for authorized penetration testing and assessing the blast radius of a compromised microservice.

Hayabusa is a Sigma-based tool for fast digital forensics and incident response. It analyzes multiple Windows EVTX event logs, applying a comprehensive library of Sigma rules to detect suspicious activity. The output is a single, chronologically ordered timeline, complete with severity levels, MITRE ATT&CK mapping, and evidence summaries, streamlining the triage process for security analysts.

A comprehensive tool for exploring Go/Golang packages and modules using the pkg.go.dev API via the `godig` client. It provides read-only access to essential information, including detailed API signatures, comprehensive documentation, version history, dependency graphs, known vulnerabilities (CVEs), and import usage. Ideal for researching external Go libraries, verifying API usage, or understanding module structure.

Chainsaw is a fast, Rust-based tool for digital forensics and threat hunting. It enables analysts to rapidly perform Sigma rule checks and keyword searches across collected Windows Event Logs (.evtx) and specialized artifacts (like shimcache and SRUM). Ideal for first-response and offline analysis, it provides detection capabilities without needing a SIEM ingestion pipeline, allowing quick hypothesis testing in the field or air-gapped environments.

A comprehensive guide to setting up the open-source Sliver C2 framework. It covers deploying the server, generating cross-platform implants and beacons, establishing resilient multi-protocol listeners (mTLS, DNS, HTTPS), and executing advanced post-exploitation and pivoting techniques using the built-in armory for adversary emulation.

PyRIT (Python Risk Identification Tool) is an open-source automation framework designed for advanced, multi-turn adversarial red-teaming of conversational LLMs. It simulates real-world attack scenarios by orchestrating an attacker model and a scorer model in a feedback loop. Features include Crescendo (gradual escalation) and Tree-of-Attacks with Pruning (TAP) techniques to detect complex vulnerabilities like prompt injection and jailbreaks in stateful dialogues.

This comprehensive tool suite provides high-fidelity parsers for key Windows artifacts, including MFT, Registry hives, Prefetch files, and ShellBags. Designed for digital forensics and incident response, it converts raw system evidence into structured CSV/JSON formats. The output is optimized for feeding into Timeline Explorer, enabling analysts to build comprehensive, correlated timelines and establish a clear chain of events.

This specialized skill reviews user interface animations, motion patterns, and interactive code (CSS, Framer Motion, etc.) against a strict, high-craft standard. It evaluates not only functionality but also performance, accessibility, physical correctness, and adherence to motion design principles. Use it when reviewing diffs related to transitions, keyframes, or gestures to ensure the motion feels right, not just that it runs.

Trivy is an open-source, comprehensive scanner used to find vulnerabilities (CVEs), misconfigurations, secrets, and license issues across multiple targets. It is essential for implementing 'shift-left' security gates in CI/CD pipelines, scanning container images, Infrastructure-as-Code (IaC) like Terraform/Kubernetes, and generating/re-scanning SBOMs for supply chain transparency.

This skill provides a comprehensive defense-in-depth framework for securing autonomous AI agents. It implements least-privilege tool allowlisting, identity binding, and human-in-the-loop controls to mitigate risks like prompt injection and tool poisoning. Use this when building agents that interact with sensitive systems (e.g., payments, file writes) to ensure governance, auditability, and compliance.