Skill UI

Guides product teams through hypothesis writing, metric definition, sample-size planning, ICE prioritization, and statistical interpretation so experiments stay practical, defensible, and aligned with business decision thresholds.

This skill orchestrates end-to-end autonomous AI research projects using a sophisticated two-loop architecture. It manages the entire research lifecycle, from initial literature review and hypothesis formation to running constrained experiments and synthesizing findings into publishable papers. It acts as a project manager, autonomously driving the process while structuring the workspace and presenting progress to human users.

This skill implements an autonomous, multi-round research review loop, simulating the rigorous peer-review process of top-tier conferences. It iteratively reviews, identifies weaknesses, suggests fixes, and re-reviews a research document using the MiniMax API. The system manages state persistence across multiple rounds, ensuring continuous improvement until a 'ready' assessment is achieved or the maximum round limit is reached. Ideal for academic writing, thesis refinement, or comprehensive project documentation.

This framework guides the systematic process of proactive threat hunting. It transforms raw threat intelligence and ATT&CK gap analyses into concrete, testable hypotheses. Users execute these hypotheses using industry-standard EDR/SIEM platforms (Splunk, CrowdStrike, Defender, etc.) to validate potential compromises, correlate activity, and document findings in a standardized report format.

A proactive, hypothesis-driven skill designed to hunt for Advanced Persistent Threats (APT) within complex enterprise environments. It analyzes endpoint telemetry, network logs, and memory artifacts using frameworks like MITRE ATT&CK. Use this skill when investigating anomalous behavior flagged by UEBA, conducting scheduled threat sprints, or validating exposure to known TTPs using tools like Velociraptor and osquery.

A comprehensive guide for hypothesis-driven threat hunting focusing on Windows Scheduled Task persistence (T1053). This methodology guides the creation of advanced SIEM/EDR queries against critical events like task creation (Event ID 4698), suspicious actions, and unusual scheduling patterns. Essential for incident response, proactive threat hunting, and security assessments.

A comprehensive guide for conducting hypothesis-driven threat hunting against supply chain compromises (T1195). This skill focuses on querying SIEM/EDR logs to detect indicators of trojanized software updates, compromised dependencies, unauthorized code modifications, and tampered build artifacts. It is crucial when investigating suspected vendor compromises or scoping a build pipeline breach, requiring advanced knowledge of logging systems and threat intelligence.

Conduct hypothesis-driven threat hunting for Command-and-Control (C2) activity (T1071). This skill guides the analysis of SIEM/EDR network telemetry to detect anomalous outbound traffic, rare destination IPs, non-standard ports, and unusual connection frequencies, helping identify beaconing or data exfiltration attempts. Essential for proactive defense and incident response.

This guide provides a structured methodology for hypothesis-driven threat hunting focused on detecting web shell deployment (T1505.003) on internet-facing servers. It analyzes file creation in web directories, suspicious child-process generation from web server processes, and anomalous HTTP request patterns. Use this during incident response, proactive security assessments, or when EDR/SIEM alerts indicate web server process anomalies.

This comprehensive pipeline guides users from a vague research concept to a fully structured, testable academic proposal. It first refines the core methodology (research-refine) to establish a stable thesis, and then generates a detailed, claim-driven experiment roadmap (experiment-plan). This end-to-end workflow ensures that the final academic output is both elegant and empirically validated.

Hard screening skill runs deterministic VC analyses where Claude gathers context, Python scores/formats, and the pipeline produces auditable verdicts with investment thesis guidance.

This skill acts as a critical gatekeeper after a set of experiments are completed. It systematically evaluates raw experimental metrics and outcomes against predefined research claims. The goal is to determine whether the results adequately support a claim, contradict it, or if critical evidence is missing. It guides the research team towards the next decisive action: pivoting the hypothesis, supplementing the data, or confirming the findings. Use this before writing final reports.