Skill UI

This skill provides advanced threat hunting techniques to detect unauthorized data exfiltration. It guides the analysis of network traffic, DNS queries, and cloud uploads to identify unusual data flows, DNS tunneling, and abuse of encrypted channels, essential for incident response and preventing data loss.

A comprehensive guide and detection methodology for identifying covert communication channels utilizing DNS records. This technique analyzes Zeek dns.log for indicators such as high-entropy subdomains, excessive query volume, unusually long query lengths, and abnormal record type distributions, which suggest data exfiltration or Command and Control (C2) activity.

This skill detects covert data exfiltration occurring over DNS tunnels. It analyzes DNS query names by computing Shannon entropy, examining query length distributions, and identifying high subdomain cardinality. It is essential for security operations, incident response, and proactive threat hunting when suspicious or encoded DNS activity is suspected.

This skill automates deep packet capture (PCAP) analysis using tshark and pyshark. It is invaluable for security assessments and incident response, enabling the extraction of protocol statistics, identification of suspicious network flows (e.g., port scanning, beaconing), and comprehensive extraction of Indicators of Compromise (IOCs), including IPs, domains, and URLs. It also specializes in detecting complex anomalies like DNS tunneling.

This skill detects malicious Command and Control (C2) communications tunneled through the DNS protocol. It analyzes DNS query logs for indicators such as DNS tunneling tools (Iodine, dnscat2), Domain Generation Algorithms (DGA), and encoded payloads within TXT/CNAME records. Techniques include Shannon entropy analysis of subdomains, statistical anomaly detection, and machine learning classification. Ideal for network security analysts conducting deep threat hunting and forensic investigations.

A comprehensive guide to setting up a robust and efficient local development environment for Intercom integrations. This workflow emphasizes test isolation, utilizing mock clients (e.g., vitest) for reliable unit testing, proper environment variable management, and simulating real-world interactions via webhook tunneling (ngrok). It ensures fast iteration cycles when developing SaaS features against the Intercom API.

This skill provides a comprehensive guide to setting up a robust local development workflow for building Miro integrations. It encompasses hot reloading for rapid iteration, structured unit and integration testing using Vitest, and configuring ngrok tunneling for simulating real-world webhooks and interacting with the Miro REST API v2.

This guide provides a comprehensive workflow for developing and testing with Persona's identity verification services in a controlled sandbox environment. It details setting up local environment variables, tunneling webhooks using ngrok, creating test inquiries via API, and mocking API responses for robust unit and integration testing.

This guide provides a comprehensive and reproducible local development workflow for Shopify applications. It details how to use the Shopify CLI for scaffolding and hot reloading, integrate ngrok for stable webhook tunneling, and set up Vitest for robust API testing, enabling developers to achieve rapid and reliable iteration cycles.

A comprehensive guide to configuring a fast, reproducible local development workflow for Webflow Data API v2 integrations. This setup includes TypeScript, hot reloading, Vitest mocking, and ngrok webhook tunneling, enabling developers to establish a rapid iteration cycle for seamless Webflow development and testing.

Manage global n8n instances, runtime state, tunnels, API keys, credentials, projects, and workflow presentation links. Useful for setting up local Docker, connecting remote instances, and controlling n8n execution environments.

A comprehensive, advanced playbook for conducting deep network traffic analysis and PCAP forensics. Covers essential skills like PCAP repair, advanced Wireshark filtering (HTTP, DNS, TLS), data extraction (file carving, credential harvesting), and detecting covert channels. It guides users through sophisticated techniques, including TLS decryption workflows and DNS tunneling identification.