Skill UI

This meta-skill transforms raw ideas, research notes, or documents into structured, multi-platform content drafts. It orchestrates a complete content pipeline, generating optimized drafts for blogs, social media (Xiaohongshu, Zhihu), newsletters, video scripts, and slides, ensuring content consistency across various marketing channels.

Use the Composio CLI to automate the entire Pull Request review and Continuous Integration (CI) triage process for GitHub and GitLab. This tool fetches code diffs, analyzes failure logs, posts detailed inline review comments, and iteratively patches and re-runs CI checks until the code passes, significantly enhancing code quality and developer efficiency.

This comprehensive workflow analyzes the health status of various AWS resources (EC2, Lambda, RDS, DynamoDB, etc.). It uses AWS CLI to diagnose potential issues by analyzing CloudWatch logs, metrics, and performance data. The process culminates in classifying root causes and generating actionable, tiered remediation plans (Immediate, Short-term, Long-term) to ensure system resilience and stability.

This tool parses raw, complex error logs, stack traces, and crash reports into a highly structured and actionable diagnosis. It goes beyond simple error reporting to identify the probable root cause, analyze the affected code path, and provide concrete, code-level fix suggestions and ordered next debugging steps. Ideal for developers facing critical production bugs or unexplained application crashes.

This skill applies the RICE framework (Reach, Impact, Confidence, Effort) to objectively score and rank product initiatives. It helps teams prioritize backlogs, plan quarters, and compare multiple competing ideas by providing a structured, data-driven ranking. The output identifies quick wins, high-risk moonshots, and critical data gaps for validation.

This skill uses Python and boto3 to analyze AWS CloudTrail logs. It establishes statistical baselines of normal API activity and detects various anomalies, such as unusual event sources, first-time API usage, geographic IP deviations, and high-frequency calls. This is critical for identifying credential compromise, privilege escalation, and unauthorized resource access in a security incident.

This skill provides advanced detection methods for credential dumping, covering LSASS memory access, SAM hive extraction, and NTDS.dit theft (e.g., using Mimikatz). It utilizes Sysmon Event ID 10 and Windows Security logs to enable threat hunting, assisting SOC analysts in triaging EDR alerts and building robust SIEM correlation rules.

A comprehensive guide to deploying cloud-native deception across AWS, Azure, and GCP. This skill utilizes decoy resources—such as canary IAM keys, honey object storage buckets, and decoy secrets—whose sole purpose is to generate high-fidelity alerts the instant they are interacted with by an attacker. It detects cloud reconnaissance, credential theft, and lateral movement by wiring detection through native logging services (CloudTrail, Sentinel, Cloud Audit Logs), ensuring near-zero false positives for the SOC.

This skill details how to monitor Certificate Transparency (CT) logs using industry tools like crt.sh and Certstream. By analyzing publicly issued SSL/TLS certificates, users can proactively detect lookalike domains, unauthorized certificate issuance for owned assets, and early-stage phishing infrastructure targeting their organization. Ideal for SOC analysts and threat hunters.

A comprehensive tool designed to discover and map adversary-controlled assets, including C2 servers, phishing domains, and exploit kits. It utilizes sophisticated pivoting techniques across passive DNS records, Certificate Transparency logs, Shodan/Censys scans, and network fingerprints (JARM/JA3S) to generate actionable threat intelligence, perfect for CTI investigations and security operations.

This skill provides advanced threat hunting queries for Microsoft Sentinel/Log Analytics. It detects the behavioral and string fingerprints left by popular offensive Entra ID enumeration tools (like ROADtools, AADInternals, and AzureHound) within both MicrosoftGraphActivityLogs and AADGraphActivityLogs. Use this when investigating suspicious Graph API activity, identifying internal reconnaissance, or building detection rules to surface active intrusions.

Hayabusa is a specialized threat-hunting and fast-forensics tool designed to analyze Windows EVTX event logs. It applies a comprehensive library of Sigma detection rules to raw log data, generating a single, prioritized, chronological timeline. The output includes severity levels, MITRE ATT&CK mappings, and detailed metrics, enabling analysts to perform rapid, SIEM-free incident triage and export results for collaborative analysis.