Skill UI

A robust framework for orchestrating complex, multi-step coding tasks using multiple AI agents. It functions by first planning the entire project into a mission dependency graph (DAG), then dispatching specialized agents to isolated Git worktrees for parallel development. The system automatically monitors progress, handles merges, and generates structured, comprehensive reports detailing changes, completed tasks, and next steps.

This skill correlates disparate security incidents, Indicators of Compromise (IOCs), and adversary behaviors across time and organizations. It systematically identifies unified threat campaigns, attributes them to common threat actors, and extracts shared indicators for significantly improved detection capabilities. Ideal for cross-organizational threat intelligence sharing and building comprehensive campaign reports.

This skill analyzes proxy access logs, DNS query logs, and network flow data to identify unauthorized SaaS and cloud services (Shadow IT). It uses Python and pandas to aggregate traffic, classify domains against known SaaS categories, and calculate risk scores based on data volume and user count. Ideal for conducting thorough security audits and generating actionable remediation reports.

This tool analyzes Web Application Firewall (WAF) logs (ModSecurity, AWS WAF, Cloudflare) to detect sophisticated SQL injection attack campaigns. It parses diverse log formats, identifies common SQLi payloads (UNION SELECT, OR 1=1), correlates multi-stage attacks, tracks source IPs, and generates detailed incident reports classified by OWASP standards for SOC analysts and security researchers.

This skill guides the creation of high-quality, finished cyber threat intelligence reports. It tails content for specific audiences—from C-suite executives (strategic risk) to SOC analysts (tactical IOCs). Use it when synthesizing raw data into actionable intelligence products, generating threat briefings, or conducting post-incident assessments, ensuring adherence to industry standards like TLP and NIST.

This skill implements Cloud Security Posture Management (CSPM) across multi-cloud environments. It detects critical cloud-native misconfigurations, such as over-permissive IAM roles, exposed storage buckets, and unencrypted data, using industry-leading tools like AWS Security Hub, Azure Defender for Cloud, Prowler, and ScoutSuite. Use this when conducting comprehensive audits of complex, multi-cloud infrastructures for compliance or building consolidated security posture reports.

This skill uses the Thinkst Canary REST API to programmatically deploy and monitor various tripwire mechanisms, including web bugs, DNS tokens, MS Word documents, and AWS API keys. It is designed for early breach detection by simulating attacker activity and generating comprehensive deception coverage reports and alert histories.

This skill implements the Diamond Model framework, providing a structured approach to analyzing complex cyber intrusions. It allows users to programmatically classify and correlate events based on four core elements: Adversary, Capability, Infrastructure, and Victim. Key functionalities include building activity threads, identifying pivot points, and generating comprehensive, pivot-ready threat intelligence reports.

This comprehensive skill guides the setup and deployment of File Integrity Monitoring (FIM) using AIDE on Linux systems. It covers generating the initial baseline database, configuring monitoring rules, running scheduled checks via cron, and parsing change reports to detect unauthorized file modifications. Essential for meeting strict compliance requirements and enhancing endpoint security.

Learn how to build and share structured threat intelligence objects, including indicators, malware, and campaigns, using the stix2 Python library. This guide details publishing data via the TAXII 2.1 protocol, making it essential for developing threat intelligence platforms, automating IOC exchange, and creating machine-readable reports for ISAC/ISAO communities.

This skill uses the python-gvm library to programmatically deploy and operate Greenbone/OpenVAS vulnerability management. It connects via the Greenbone Management Protocol (GMP) to create scan targets, execute vulnerability scans, and parse complex XML reports into structured, actionable JSON findings. Ideal for automating security assessments, compliance checks, and detailed vulnerability reporting.

This skill guides the end-to-end management of the Cyber Threat Intelligence (CTI) lifecycle. It covers defining Priority Intelligence Requirements (PIRs), planning data collection, processing data, performing multi-level analysis (Strategic, Operational, Tactical), disseminating tailored reports, and establishing continuous feedback loops to ensure intelligence relevance and maturity.