Skill UI

Guides diagnosing Buttercup CRS Kubernetes issues across the crs namespace by triaging pod states, analyzing logs, checking resource pressure, monitoring Redis, and inspecting queues for cascading failures in services such as redis, build-bot, scheduler, and UI.

Operates as an end-to-end GitHub repository steward, triaging issues, reviewing PRs, analyzing contributor activity, and generating maintenance guidance so the human can simply ask “what’s next” while the agent keeps UX, docs, and backlog healthy.

A comprehensive guide for structured incident response when a Supabase-backed application fails. This runbook guides users through triaging issues, verifying platform status, inspecting connection pools, debugging stuck queries using pg_stat_activity, and analyzing Edge Function logs. Essential for root cause analysis and escalating issues to support.

This skill performs comprehensive static analysis of Android APK malware. It utilizes industry-standard tools like androguard and apktool to decompile resources, inspect manifests, and identify dangerous permissions, obfuscated code patterns, dynamic loading mechanisms, and suspicious API calls without executing the sample. It is essential for security analysts, SOC teams, and threat hunters building detection rules or triaging suspicious malware samples.

A comprehensive workflow for performing static and dynamic analysis of malicious PDF documents. It utilizes tools like peepdf, pdfid, and pdf-parser to extract embedded JavaScript, shellcode, and suspicious objects. Ideal for triaging phishing attachments, analyzing exploit documents, and building threat signatures in a controlled forensic environment.

Establishes a repeatable, structured operational process for managing Microsoft Patch Tuesday security updates. The workflow guides users through advisory review, vulnerability triaging (including zero-days), phased testing, and deployment across major platforms (Windows, Azure, Office). Ideal for maturing patch management programs and defining risk-based remediation SLAs.

This tool provides a structured methodology for triaging web application security findings generated by DAST and SAST scanners (e.g., Burp Suite, ZAP). It validates true positives, dismisses false positives, and assigns risk ratings using the OWASP Risk Rating Methodology (Risk = Likelihood x Impact). Use it to reduce alert fatigue and prioritize remediation efforts for development teams, ensuring focus on the most critical vulnerabilities.

A structured guide for SOC Tier 1 analysts to triage security alerts within Splunk Enterprise Security (ES). It provides a systematic workflow for classifying severity, investigating notable events, correlating evidence across diverse data sources (proxy, firewall, logs), and making clear disposition decisions (True Positive, False Positive) required for escalation or closure.

This playbook guides SOC analysts through the structured triage of security incidents. It ingests alerts from SIEM platforms (Splunk, Elastic), enriches data using threat intelligence (VirusTotal, AbuseIPDB), classifies the incident type, and calculates a severity score based on asset criticality and data sensitivity. It culminates in creating structured incident tickets and notifying the appropriate response teams via paging systems, ensuring a comprehensive and standardized incident response workflow.

A structured methodological framework for prioritizing vulnerabilities beyond raw CVSS scores. It utilizes CISA’s SSVC model, integrating real-time data like exploitation status (CISA KEV), EPSS scores, and technical impact to assign actionable outcomes: Track, Track*, Attend, or Act. Essential for mature security operations and remediation planning.

A structured framework for performing initial security incident triage. It guides analysts through classifying incident types using established standards like NIST SP 800-61r3, assigning business impact severity (P1-P4), enriching alerts with threat intelligence, and determining containment and escalation paths. Use when SIEM/EDR alerts require human judgment or when coordinating multiple concurrent security events.

Guides teams through classifying and triaging declared security incidents, scoring severity, filtering false positives, routing escalations, and starting forensic collection consistent with NIST SP 800-61.