Skill UI

This comprehensive toolkit audits and manages dependencies across multi-language projects (e.g., Python, JS, Go, Java). It identifies critical security vulnerabilities (CVE), ensures license compliance, detects outdated packages, and plans safe upgrade paths. Essential for pre-release quality assurance, vulnerability investigation, and supply chain risk management.

This skill provides a comprehensive, multi-phase guided workflow for professional incident response management. Following modern SRE principles and the Incident Command System (ICS), it guides users from initial detection and triage (P0-P3 classification) through deep investigation (observability, debugging, security checks), culminating in structured resolution and post-mortem analysis. Use this when managing critical system outages or performance degradation.

Auto-activating security skill that guides path traversal finder investigations, shares patterns and best practices, and produces validated code/configurations within Security Fundamentals.

Guide to capturing, filtering, and inspecting packets with Wireshark for troubleshooting, performance tuning, and security investigations across live and PCAP-based workflows.

Guide to capturing, filtering, and inspecting packets with Wireshark for troubleshooting, performance tuning, and security investigations across live and PCAP-based workflows.

This guide provides a deep, investigation-driven methodology for reviewing Django and Django REST Framework (DRF) codebases. It helps identify critical authorization gaps, focusing on Insecure Direct Object References (IDOR) and object-level access failures. Learn how to trace data flows, analyze custom managers, and verify that users can only access resources they are explicitly authorized to view or modify.

Yara Authoring helps security teams write precise YARA rules for threat detection and malware hunting by guiding string/tag management and metadata handling so signature creation keeps pace with investigations.

This skill provides a structured guide to querying Azure Monitor activity and sign-in logs using KQL. It is crucial for proactive threat hunting and security incident investigation. Users can detect suspicious administrative actions, including unauthorized role assignments, impossible travel, privilege escalation, and resource modifications within Azure environments. Ideal for SOC analysts and cloud security engineers.

Analyzes Office 365 audit logs via Microsoft Graph to detect inbox rules, email forwarding, delegation changes, OAuth grants, and other compromise indicators for security investigations and monitoring.

Guides configuring Windows Advanced Audit Policy, enabling command-line capture, sizing event logs, and forwarding critical IDs so SOC teams feed high-fidelity security events into SIEMs for detection and investigation.

Detect defense-evasion techniques in endpoint logs by identifying log tampering, timestomping, process injection, security-tool disabling, and masquerading; use in threat hunting, detection engineering, or investigations that query telemetry from Sysmon, SIEM, or EDR.

Guides security teams through detecting and responding to OAuth token theft, covering Microsoft Entra ID/Azure AD protections, conditional access policies, and sign-in log investigations to block token replay, PRT abuse, and session hijacking in cloud deployments.