Skill UI

This skill details the process of building and maintaining a comprehensive anti-phishing training program. It covers establishing baseline susceptibility assessments, deploying regular, progressive simulations, and providing interactive, role-based learning modules (using platforms like KnowBe4 or Proofpoint). The focus is on measuring and improving the human layer of defense against social engineering and sophisticated phishing attempts, thereby fostering a continuous security culture.

This skill reconstructs the detailed workflow behind a specific coding artifact (like a feature or PR). By analyzing local `ax` agent traces, it connects commits, sessions, skills, and tool calls into a concise, evidence-grounded narrative. It is used when needing to understand the step-by-step process and key decisions that led to a result.

This skill enforces a rigorous data validation protocol by establishing hard boundaries at every point data enters the system (API requests, user input, environment variables, webhooks, etc.). It mandates a four-phase process: detection, trust classification, mandatory filtering (schema validation, sanitization, type checking), and final verification. This prevents untrusted data from reaching core business logic, mitigating risks like SQL injection and XSS.

This skill provides comprehensive security auditing for Model Context Protocol (MCP) servers and their associated tool metadata. It is designed to detect sophisticated supply chain attacks, including tool poisoning (indirect prompt injection), Server-Side Request Forgery (SSRF), tool shadowing, and unauthenticated exposure. It is essential for securing AI agent stacks before integrating new tools or during CI/CD processes.

Plaso (log2timeline) is an open-source engine used to generate forensic super-timelines. This skill guides the process of normalizing hundreds of diverse artifact types—including MACB times, registry keys, EVTX logs, and browser history—into a single, cohesive chronological view. The workflow covers extraction, filtering, and importing the timeline into Timesketch for collaborative analysis, which is crucial for incident response, correlating complex activity chains, and detecting anti-forensic techniques like timestomping.

This skill guides the end-to-end process of supply chain security by generating standards-compliant Software Bills of Materials (SBOMs) in CycloneDX and SPDX formats. It details using Syft to create inventories, correlating them with vulnerability intelligence via Grype, enforcing CI/CD gates based on severity, and establishing verifiable provenance using Cosign signing. Essential for modern DevSecOps practices.

Hayabusa is a Sigma-based tool for fast digital forensics and incident response. It analyzes multiple Windows EVTX event logs, applying a comprehensive library of Sigma rules to detect suspicious activity. The output is a single, chronologically ordered timeline, complete with severity levels, MITRE ATT&CK mapping, and evidence summaries, streamlining the triage process for security analysts.

This skill guides the full lifecycle of threat intelligence processing, transforming raw indicators of compromise (IOCs) from MISP feeds into actionable security detections. It covers feed curation, false positive reduction using warninglists, and automating the generation of high-fidelity rules for Suricata, Sigma, and Wazuh. Use this to mature your MISP instance from a repository into a proactive detection engine.

A specialized diagnostic skill designed to analyze failing GitHub Actions workflow logs. It identifies the root cause of crashes, such as missing secrets, environment mismatches, or deprecated syntax. The output provides precise YAML or code diffs required to fix the pipeline and optimize CI/CD processes.

Provides comprehensive architectural guidelines and code patterns for developing high-end, immersive 3D web experiences. This skill covers advanced topics such as custom WebGL shaders, post-processing effects (Bloom, Depth of Field), realistic physics interactions, and crucial performance optimization techniques, ensuring a premium, polished user experience across devices.

This critical protocol is the ultimate measure for dealing with deeply corrupted, unmaintainable, or structurally rotten code modules. Instead of risky patching, it mandates a controlled, multi-phase process to completely delete the target and rebuild it from scratch. It ensures precise identification of all public interfaces, implicit contracts, and working behaviors (the Preservation List) before any removal occurs, guaranteeing the new implementation matches the original functionality while resolving deep architectural debt.

This skill guides developers through the complex process of integrating an iOS App Clip target into an existing Expo project. It covers setting up the necessary bundle identifiers, configuring associated domains (AASA file), and deploying the required metadata to allow the lightweight clip to be invoked directly from a URL alongside the parent application.