Skill UI

This system maps advanced persistent threat (APT) group TTPs to the MITRE ATT&CK framework. Utilizing the attackcti library to query STIX/TAXII data, it generates specialized ATT&CK Navigator layer files. It is essential for security analysts to profile threat actors, visualize comprehensive coverage heatmaps, and precisely assess detection gaps against sophisticated adversaries.

This skill parses various cyber threat intelligence (CTI) reports (Mandiant, CrowdStrike, etc.) using NLP and specialized libraries (stix2, mitreattack-python, spaCy). It systematically extracts adversary behaviors, maps them to MITRE ATT&CK IDs, and constructs a searchable STIX 2.1 Attack Pattern library. This is essential for threat-informed detection engineering, generating detection rules (Sigma, YARA), and validating security controls.

This tool deploys decoy canary files in critical system directories to provide early warning against ransomware attacks. Utilizing Python's watchdog library, it monitors for any read, modify, rename, or delete operations on these decoy files. Detection triggers immediate alerts via multiple channels (Email, Slack, Syslog), helping security teams identify and respond to malicious activity before full data encryption occurs. It serves as a crucial detection layer in a layered security defense.

This script performs statistical analysis on Zeek connection logs (conn.log) to detect Command and Control (C2) beaconing patterns. It leverages the ZAT library to load data into Pandas DataFrames, calculates inter-arrival time statistics, and flags connections with low standard deviation relative to the mean. This technique is crucial for network threat hunting and security incident investigation when identifying malicious, periodic callbacks.

This guide details the configuration and implementation of mutual TLS (mTLS) authentication between microservices. It utilizes Python's cryptography library for robust certificate generation, validation, and secure service-to-service authentication, essential for adopting zero-trust security models.

Learn how to build and share structured threat intelligence objects, including indicators, malware, and campaigns, using the stix2 Python library. This guide details publishing data via the TAXII 2.1 protocol, making it essential for developing threat intelligence platforms, automating IOC exchange, and creating machine-readable reports for ISAC/ISAO communities.

This skill uses the python-gvm library to programmatically deploy and operate Greenbone/OpenVAS vulnerability management. It connects via the Greenbone Management Protocol (GMP) to create scan targets, execute vulnerability scans, and parse complex XML reports into structured, actionable JSON findings. Ideal for automating security assessments, compliance checks, and detailed vulnerability reporting.

This file serves as the dedicated translation resource for the MCP Server Patterns library. It is used to localize key strings and texts to ensure accurate user experience across different languages. Developers should refer to the original skill file for the core English content.

This skill provides a comprehensive automation solution for conducting red team phishing simulations using the Python gophish library. It streamlines the entire campaign lifecycle, including creating sophisticated email templates with tracking pixels, configuring SMTP profiles, importing user groups from CSV, launching targeted attacks, and generating detailed reports on open rates, click-through rates, and credential submission statistics for robust security awareness assessments.

This skill assesses SSL/TLS server configurations using the sslyze Python library. It evaluates critical security parameters including supported protocol versions (TLS 1.0-1.3), cipher suite strength, certificate chain validation, HSTS enforcement, and known vulnerabilities like Heartbleed and ROBOT. Essential for security audits and compliance testing.

This skill utilizes PyMISP, the official library, to programmatically manage the lifecycle of threat intelligence within a MISP instance. Users can create structured events containing Indicators of Compromise (IOCs) such as IPs, domains, and hashes, enrich these events with MITRE ATT&CK tags, manage sharing groups, and export the collected data in standardized STIX 2.1 format. Ideal for security assessments, incident response, and integrating external IOC feeds.

A comprehensive, library-agnostic checklist covering best practices for Flutter and Dart applications. It guides developers on architectural principles, state management patterns (BLoC, Riverpod, etc.), Dart idioms, performance optimization, and clean code principles, making it invaluable for code reviews.