Skill UI

This skill provides comprehensive strategies and technical blueprints for monetizing digital products, especially SaaS platforms. It covers everything from defining advanced pricing models (freemium, value-based pricing) and optimizing revenue flows (LTV/CAC, churn prevention) to practical Stripe integrations. Use it when you need to set up subscription plans, process webhooks, or implement automated billing cycles for your software.

This router aggregates two specialized finance skills: general financial analysis (DCF, ratio analysis, budgeting) and SaaS operational metrics (ARR, LTV, churn). Use this skill when a user's financial request requires determining whether the analysis should focus on traditional statement-level financials or modern subscription-based SaaS performance indicators.

This script detects and analyzes sophisticated fileless malware techniques that operate entirely in system memory. It specializes in identifying threats that utilize Living Off the Land Binaries (LOLBins), WMI event subscriptions, and registry-resident payloads, bypassing traditional file-based security controls. It is ideal for forensic investigations, threat hunting, and building advanced detection rules in modern enterprise environments.

This guide details how to detect WMI event subscription persistence, a common attacker technique (T1546.003). It focuses on analyzing suspicious Sysmon Event IDs 19, 20, and 21 to identify malicious EventFilters, EventConsumers, and Bindings. Essential for incident response and threat hunting in Windows environments.

This skill detects WMI-based lateral movement by analyzing key Windows Security Event ID 4688 and Sysmon Event ID 1 logs. It focuses on identifying suspicious process execution patterns, such as WmiPrvSE.exe spawning unauthorized child processes (cmd.exe, powershell.exe), suspicious command lines, and WMI event subscriptions used for persistence. Ideal for security incident response and threat detection.

This guide details a systematic methodology for proactive threat hunting across Windows endpoints. It focuses on identifying various adversary persistence techniques, such as registry modifications (Run Keys), malicious services, WMI event subscriptions, and scheduled tasks. It is essential for incident response, security audits, and improving detection coverage against dormant backdoors.

This guide details advanced threat hunting techniques to proactively uncover adversary persistence mechanisms leveraging Windows Management Instrumentation (WMI) event subscriptions. It monitors the creation and binding of WMI events (Filter, Consumer, Binding) to detect malicious, fileless backdoors used by sophisticated threat actors, especially when standard persistence locations are clean.

This skill automates GraphQL introspection to extract the complete API schema, including types, queries, mutations, and subscriptions. It is designed to map the entire attack surface, helping authorized testers identify sensitive endpoints and test for vulnerabilities such as query depth abuse, batching attacks, and resource exhaustion. Ideal for comprehensive API security assessment.

tRPC allows developers to build highly type-safe APIs in a full-stack environment without needing to write or maintain separate schemas. It provides end-to-end type safety from server routers to client components, supporting queries, mutations, subscriptions, and robust middleware. Ideal for building modern TypeScript monorepos, Next.js, or Remix applications.

A comprehensive operational guide for support teams to manage complex customer billing workflows. It assists operators in diagnosing billing anomalies, processing refunds, triaging charges, and recovering customer portals. Use this when investigating billing discrepancies, assessing churn risk, or ensuring accurate subscription state and revenue management.

CLI surface for subscribing to and managing Google Workspace events, streaming task updates, and handling subscription lifecycles through `gws events` commands such as create, renew, delete, and patch.

Command-line helper to renew or reactivate Google Workspace Events subscriptions, either by specifying a subscription name or by bulk renewing those expiring within a configurable window, ideal for automating cron-based maintenance.