Skill UI

A specialized deep-dive skill for analyzing container-to-host escape vulnerabilities. This tool is used after a sandbox orchestrator establishes initial assumptions, focusing on mapping isolation boundaries (namespaces, cgroups, seccomp, capabilities). It helps prove boundary crossings, identify minimal exploit primitives, and determine if an exploit can break out of the container context to the host kernel.

This specialized skill is designed for deep forensic analysis of compromised Linux environments, specifically tracing the sequence of credential usage (tokens, keys, service accounts) that leads to lateral movement or privilege escalation. It helps map the decisive path from a recovered artifact to an accepted replay mechanism, identifying the exact trust edge or capability abuse responsible for the host-to-host pivot.

This specialized skill is designed for advanced forensic analysis and penetration testing within Windows environments. It focuses on extracting and proving the replayability of credentials, tickets, and secrets stored in LSASS memory, Kerberos ticket caches, DPAPI, and SSP artifacts. Use it to establish the minimal, actionable chain (host artifact -> extracted material -> accepted privilege) that proves a decisive edge for privilege escalation.

This advanced skill specializes in analyzing complex mail-related abuse scenarios, including OAuth consent flows, forwarding rule exploitation, shared mailbox access, and transport rule manipulation. It is used in forensic investigations to trace message artifacts, identify persistence mechanisms, and prove privilege escalation or data exfiltration following a compromise.

This specialized skill is designed to analyze complex security flaws involving forced authentication (coercion) and identity relay chains. It guides users to trace and document the complete, minimal path from the initial coercion trigger (e.g., a specific service or protocol edge) through intermediate hops, to the final service that accepts the relayed credentials. Use this for deep security research, forensics, and documenting the decisive sequence leading to privilege escalation or code execution.

This expert, interactive assistant provides comprehensive troubleshooting for complex issues encountered with Claude Code. It systematically scans the user's environment, checks global and project configurations, and cross-references symptoms against a deep knowledge base to pinpoint root causes and provide actionable, step-by-step solutions. Ideal for resolving integration errors, permission issues, or unexpected behavior.

A comprehensive methodology for advanced red teaming and adversary emulation. This skill details how to bypass modern Endpoint Detection and Response (EDR) solutions (e.g., Defender, CrowdStrike, SentinelOne). Techniques include unhooking ntdll, utilizing indirect syscalls (Hell's Gate), patching ETW providers, and AMSI context blinding. Essential for authorized penetration testing and self-developed implant development, aligning with MITRE ATT&CK T1562.

A comprehensive guide for designing and building large-scale, resilient platforms using the evolutionary modular monolith approach. It enforces strong logical boundaries using DDD principles (bounded contexts, flat-by-aggregate) and implements necessary patterns like Anti-Corruption Layers and transactional outboxes. Use this when defining a system's structure, choosing between monolith and microservices, or ensuring robust decoupling from external vendors (e.g., ERP, AI).

This skill facilitates the extraction of population-scale (cohort-level) clinical text from Electronic Health Records (EHR) or FHIR data warehouses using the FHIR Bulk Data Access ($export) operation. It manages the asynchronous job kickoff, polling, and downloading of NDJSON files. The resulting data stream is designed to be fed in batches into OpenMed for mandatory de-identification and Named Entity Recognition (NER) analysis.

This skill automatically detects and extracts tabular laboratory panels from diverse sources, including scanned images, photos, and delimited files (CSV/TSV). It converts complex visual data into clean, structured rows, capturing the test name, measured value, unit, reference range, and abnormal flag. It is essential for preparing medical data for subsequent standardization using LOINC and UCUM, and for mapping into FHIR resources.

A comprehensive guide for performing reverse engineering using Ghidra. This skill is essential for scenarios where commercial tools like IDA are unavailable, or when performing large-scale, automated headless analysis. It covers the entire workflow, from project setup and function decompilation to advanced headless scripting and integration with other exploit tools.

This module converts diverse clinical inputs—including scanned images, faxes, CSV/TSV exports, and C-CDA XML—into a normalized, clean text format (`ExtractedDocument`). It supports on-device OCR (Tesseract/PaddleOCR) and structured redaction for tables. It is the crucial first stage for feeding de-identification and Named Entity Recognition (NER) pipelines.