Skill UI

Uses Falco runtime security rules to monitor syscalls, file access, and privilege escalations for detecting container escape attempts across Kubernetes and standalone Linux deployments.

Configures Fail2ban with custom filters, iptables logging, and webhook ban actions to detect port scanning, SSH brute-force, and HTTP probes, automatically blocking offenders and notifying teams for faster incident response.

Guides penetration testers through identifying SSRF-prone features, calling cloud metadata endpoints, internal scanning, and filter bypass techniques for safely validating SSRF flaws during authorized assessments.

Internal Feishu/Lark notification utility that other skills call to push event cards or run interactive dialogs via webhook or bridge, ensuring safe fire-and-forget delivery whenever checkpoints, experiments, reviews, or pipelines change state.

Apply frequency analysis, jitter metrics, and coefficient-of-variation scoring to Zeek/proxy logs and SIEM data to surface periodic C2 beaconing, enrich with threat intelligence, correlate endpoints, and prioritize high-risk callbacks during threat hunting.

Detect Cobalt Strike beacon callbacks by correlating TLS certificate signatures, JA3/JA3S/JARM fingerprints, HTTP C2 profile matches, beacon interval jitter, and Zeek/Suricata/Python PCAP analysis to flag high-confidence activity and suggest responses.

Systematically hunt for Windows persistence across registry keys, services, scheduled tasks, WMI subscriptions, and other locations by collecting endpoint data, baselining legitimate entries, correlating process activity, and removing malicious footholds.

Hunts MITRE ATT&CK T1055 process-injection techniques via Sysmon Event IDs 8/10 and EDR telemetry, parsing JSON logs to flag CreateRemoteThread calls, risky access masks, and reporting severity with mitigation guidance.

This comprehensive skill guides users through the entire research idea discovery pipeline. Given a broad research direction, it systematically surveys the current academic landscape, identifies structural gaps, and uses advanced LLMs to generate, validate, and rank concrete, publishable research hypotheses and methodologies. It integrates literature review, novelty checking, and structured brainstorming.

This advanced skill orchestrates a systematic, multi-stage workflow for generating novel and feasible research ideas in robotics and embodied AI. It moves users from a broad concept (e.g., manipulation, locomotion) to specific, benchmark-grounded, simulation-first projects. The pipeline surveys literature, checks novelty against major conferences (CoRL, ICRA, RSS), and reviews technical constraints to ensure ideas are falsifiable and practically achievable with current infrastructure.

Programmatically implements the Diamond Model to structure intrusion data, link events into activity threads, discover pivots by shared infrastructure or capabilities, and output intelligence-ready reports for threat analysts.

Walks through setting up AWS KMS envelope encryption so you can generate DEKs, encrypt/decrypt data locally with AES-256-GCM, cache keys, and rotate master keys while maintaining compliance controls in cloud security deployments.