Skill UI

This skill provides comprehensive management for multiple local Command Line Interface (CLI) agents. It allows users to start, stop, monitor, and assign tasks to these agents, running them in separate tmux sessions for parallel execution. It is ideal for complex, scheduled workflows requiring multi-agent coordination, task monitoring, and log tailing, making it invaluable for advanced automation setups.

Execute complex and compute-intensive workloads directly on fully managed Hugging Face cloud infrastructure. This skill eliminates the need for local setup, allowing users to run jobs using cloud CPUs, GPUs, or TPUs. Ideal for large-scale data processing, batch inference, reproducible model training, and scheduled automation tasks, while persisting results to the Hugging Face Hub.

Catalogs proven n8n workflow architectural patterns for webhook handling, APIs, database syncing, AI agents, and scheduled tasks, helping teams pick structures, plan nodes, and handle triggers, data paths, and error strategies during workflow design and troubleshooting.

Provides a catalog of Linux and Windows post-exploitation privilege escalation techniques, covering sudo/capability abuse, scheduled tasks, token impersonation, AD kerberoasting, credential harvesting, and tool recommendations for red teamers.

Upstash QStash expert handles serverless message queues, scheduled HTTP jobs, retries, deduplication, and callback tracking so you can deliver asynchronous tasks without managing infrastructure.

Manage cron-based schedules by querying current jobs, prompting user decisions, and creating or deleting tasks with self-contained messages so automated operations run exactly when needed.

This skill provides a comprehensive workflow for detecting and analyzing malware persistence mechanisms on Windows systems. It automates the use of Sysinternals Autoruns via scripting to scan hundreds of Auto-Start Extensibility Points (ASEPs), including registry keys, services, scheduled tasks, and drivers. The process flags suspicious entries like unsigned binaries, suspicious paths, or dangerous command-line arguments, making it an essential tool for security incident response and threat hunting.

This skill provides a structured methodology for detecting persistence and lateral movement via malicious scheduled tasks. It utilizes Sysmon Event IDs (1, 11) and Windows Security Events (4698/4702) to correlate process creation, task file writes, and task registration details. Ideal for threat hunting and building robust detection rules for T1053.005.

This guide details a systematic methodology for proactive threat hunting across Windows endpoints. It focuses on identifying various adversary persistence techniques, such as registry modifications (Run Keys), malicious services, WMI event subscriptions, and scheduled tasks. It is essential for incident response, security audits, and improving detection coverage against dormant backdoors.

This guide provides a structured methodology for proactively hunting adversaries who establish persistence using Windows Scheduled Tasks (T1053). It outlines the necessary prerequisites (EDR, SIEM, Sysmon) and a comprehensive workflow—from hypothesis formulation to threat correlation—for detecting suspicious task creation, unusual scheduling patterns, and attacker TTPs during incident response or red teaming.

A comprehensive threat hunting methodology designed to detect adversary persistence and execution mechanisms utilizing Windows Scheduled Tasks (T1053.005). This guide covers analyzing task creation events (Event ID 4698), suspicious properties, unusual triggers, and correlating activity with process execution logs (Sysmon). Ideal for incident responders and security analysts conducting proactive threat hunting on compromised endpoints.

This skill provides a systematic methodology for investigating malware persistence mechanisms across Windows and Linux systems. It covers analyzing critical areas like the Windows Registry (SYSTEM, SOFTWARE, Run keys), Scheduled Tasks, and WMI artifacts. Use it during incident response, threat hunting, or digital forensics to ensure all unauthorized startup entries are found and remediated.