Skill UI

This skill performs a comprehensive audit of project dependencies, identifying critical security vulnerabilities (CVEs), analyzing license compliance against established policies, and detecting outdated or risky packages. It produces an actionable report including an overall dependency health score and a prioritized, time-bound remediation plan, ensuring the software supply chain is secure and legally compliant.

This skill provides comprehensive guidance for developing professional, interactive, and distributable Power BI developer visuals (.pbiviz). It covers the entire workflow using the pbiviz toolchain, including scaffolding the project, implementing the IVisual class using TypeScript, managing the formatting model, live-previewing, packaging, certifying, and finally publishing the visual to AppSource.

A comprehensive, pre-deployment, defense-in-depth security audit tool for Solidity smart contracts built with Foundry. It combines static analysis (Slither, Aderyn), symbolic execution (Mythril), property-based fuzz testing, and key hygiene checks to proactively detect critical vulnerabilities like reentrancy, access control flaws, and arithmetic bugs before deployment to any EVM chain.

A comprehensive framework for managing third-party risk (TPRM) throughout the entire vendor lifecycle. This tool guides users through inventory, risk tiering, running due diligence questionnaires (SIG, CAIQ), reviewing security evidence (SOC 2, ISO 27001), codifying requirements in contracts, and establishing continuous monitoring protocols. It is essential for maintaining compliance, managing supply chain risk, and securing data handled by external vendors.

This skill analyzes ransomware cryptocurrency payment flows by utilizing major blockchain intelligence APIs (like Chainalysis and WalletExplorer). It identifies wallet clusters, tracks movements through obfuscation services (mixers, tumblers), and determines fund flows to exchanges, supporting forensic investigations and law enforcement attribution efforts.

This skill provides comprehensive security auditing for Model Context Protocol (MCP) servers and their associated tool metadata. It is designed to detect sophisticated supply chain attacks, including tool poisoning (indirect prompt injection), Server-Side Request Forgery (SSRF), tool shadowing, and unauthenticated exposure. It is essential for securing AI agent stacks before integrating new tools or during CI/CD processes.

Plaso (log2timeline) is an open-source engine used to generate forensic super-timelines. This skill guides the process of normalizing hundreds of diverse artifact types—including MACB times, registry keys, EVTX logs, and browser history—into a single, cohesive chronological view. The workflow covers extraction, filtering, and importing the timeline into Timesketch for collaborative analysis, which is crucial for incident response, correlating complex activity chains, and detecting anti-forensic techniques like timestomping.

This skill guides the deployment and strategic use of honeytokens and canarytokens (decoy credentials, files, URLs, etc.). These high-fidelity decoys are designed to detect unauthorized access, insider threats, or adversary reconnaissance by triggering alerts upon any interaction, providing early warning deep within the kill chain.

This skill provides comprehensive tools to detect data poisoning and model backdooring attacks throughout the machine learning lifecycle. It checks data provenance, detects label-flip anomalies (using Cleanlab), and analyzes model activations and spectra (using ART) to identify malicious triggers or compromised weights, ensuring ML supply chain integrity.

A comprehensive tool and methodology for identifying and preventing dependency confusion attacks across major package ecosystems (npm, PyPI, Maven). It detects instances where internal, private package names are leaked and subsequently published publicly by attackers. The skill provides both detection (enumerating claimable internal names) and prevention strategies (enforcing registry pinning and scope restrictions) to secure the software supply chain.

Provides a comprehensive workflow and tooling (GuardDog) to triage npm packages and dependency trees for signs of malicious activity. It focuses on static analysis of install scripts, detecting credential exfiltration, reverse shells, and worming behavior, thereby safeguarding against software supply-chain attacks.

This skill provides a comprehensive, cross-platform workflow for auditing UEFI firmware security. It detects advanced threats like bootkits (e.g., BlackLotus, Bootkitty) and Secure Boot bypasses by verifying the integrity of the platform's trust chain. Key checks include confirming Secure Boot status, assessing the currency and application of DBX revocations, and examining the protection of critical EFI variables using specialized tools. Essential for hardware security assessments and forensic investigation.