Skill UI

This skill guides the end-to-end process of supply chain security by generating standards-compliant Software Bills of Materials (SBOMs) in CycloneDX and SPDX formats. It details using Syft to create inventories, correlating them with vulnerability intelligence via Grype, enforcing CI/CD gates based on severity, and establishing verifiable provenance using Cosign signing. Essential for modern DevSecOps practices.

Chainsaw is a fast, Rust-based tool for digital forensics and threat hunting. It enables analysts to rapidly perform Sigma rule checks and keyword searches across collected Windows Event Logs (.evtx) and specialized artifacts (like shimcache and SRUM). Ideal for first-response and offline analysis, it provides detection capabilities without needing a SIEM ingestion pipeline, allowing quick hypothesis testing in the field or air-gapped environments.

This skill enables comprehensive security graph mapping by ingesting both on-premises Active Directory data (via SharpHound) and cloud Entra ID data (via AzureHound) into BloodHound CE. It analyzes complex, hybrid attack paths, allowing security teams to identify critical privilege escalation chains from low-privileged accounts to Tier-0 assets, mapping findings to MITRE ATT&CK.

This comprehensive tool suite provides high-fidelity parsers for key Windows artifacts, including MFT, Registry hives, Prefetch files, and ShellBags. Designed for digital forensics and incident response, it converts raw system evidence into structured CSV/JSON formats. The output is optimized for feeding into Timeline Explorer, enabling analysts to build comprehensive, correlated timelines and establish a clear chain of events.

Trivy is an open-source, comprehensive scanner used to find vulnerabilities (CVEs), misconfigurations, secrets, and license issues across multiple targets. It is essential for implementing 'shift-left' security gates in CI/CD pipelines, scanning container images, Infrastructure-as-Code (IaC) like Terraform/Kubernetes, and generating/re-scanning SBOMs for supply chain transparency.

This skill provides a comprehensive workflow for verifying the integrity of a system's boot chain using Trusted Platform Module (TPM 2.0). It covers local validation (event log replay against PCRs) and remote attestation (generating signed, nonce-bound quotes). Use this to detect bootkits, unauthorized firmware changes, or establish device posture for Zero Trust architectures.

This skill guides the verification of software build provenance and signatures using industry standards like SLSA and Sigstore. It leverages tools like cosign and slsa-verifier to enforce keyless OIDC identity and confirm that artifacts were built by trusted sources without tampering. It is essential for hardening CI/CD pipelines and securing the entire software supply chain against advanced attacks.