Skill UI

This specialized skill guides users through a structured, forensic investigation process when facing sudden, significant drops in organic traffic or search rankings. It is designed for incident scenarios—such as suspected penalties, Core Updates, major technical regressions, or unexplained traffic crashes—providing a systematic approach to triage, root-cause analysis, and developing a prioritized recovery plan.

This powerful tool generates comprehensive operational runbooks from a service name. It structures critical workflows, including deployment, incident response, maintenance, and rollback procedures. It is essential for standardizing on-call procedures, ensuring consistent incident handling across teams, and quickly documenting services before production launch.

Guides growth-stage companies through CISO-level security programs by quantifying risks in dollars, sequencing compliance (SOC 2/ISO 27001/HIPAA/GDPR), architecting zero-trust defenses, leading incident response, and translating budgets for boards or sales conversations.

Functions as a Chief Security Architect assistant that performs STRIDE/PASTA threat modeling, OWASP checks, Red/Blue team simulations and incident response playbooks to harden any project before production.

Guide for creating bit-for-bit copies of disks with dd or dcfldd while enforcing write protection, documenting sources, and verifying hashes to preserve evidence during incident response or legal work.

Use Hindsight to parse Chrome and Chromium-based browser artifacts, extracting history, downloads, cookies, autofill entries, passwords, cache, extensions, and structured timelines for incident response investigators.

Investigate compromised Docker containers by analyzing images, layers, volumes, logs, and runtime artifacts to identify malicious activity and gather evidence during incident response.

Parse and analyze suspicious email headers to trace delivery hops, verify SPF/DKIM/DMARC alignment, and expose phishing origin and spoofing tactics during incident response.

Analyzes VBA and XLM macro malware hidden in Office documents to reveal download URLs, execution chains, persistence tactics, and anti-analysis tricks for informed incident response.

This skill details a comprehensive workflow for performing Linux memory forensics. It involves acquiring the volatile memory using the LiME kernel module, and subsequently analyzing the resulting image with Volatility 3. Key analyses cover critical artifacts such as process listings, network connections, loaded kernel modules, and bash history, making it an essential technique for incident response, digital forensics, and threat hunting on compromised Linux systems.

Analyze NTFS Master File Table artifacts with MFTECmd, analyzeMFT, and X-Ways to recover metadata and content of deleted files, leveraging $LogFile, $UsnJrnl, and slack space for incident response or threat hunting.

Analyzes malware-generated network traffic using Wireshark, Zeek, Suricata, and Python scripts to uncover C2 protocols, data exfiltration, DNS tunneling, HTTP/HTTPS payloads, and beaconing patterns during sandbox or live incident-response investigations.