Skill UI

A comprehensive guide for setting up a local development loop to test AI agent integrations. This skill teaches developers how to build and debug webhook receivers, callback handlers, and associated application code that interacts with a cloud-hosted AI agent (like Lindy). It requires using tunneling services (e.g., ngrok) to expose local endpoints for receiving webhooks and simulating the entire agent-to-application data flow.

Guides SSH service security assessments from discovery, enumeration, credential attacks and key testing to tunneling, vulnerability exploitation, and reporting deliverables.

Run Playwright tests on BrowserStack's cloud grid for cross-browser and cross-device testing. Supports configuring browser projects, running tests remotely, retrieving build results, listing available browsers, and setting up local tunneling for private environments.

This skill analyzes DNS query logs to detect sophisticated threats such as data exfiltration via DNS tunneling, Domain Generation Algorithm (DGA) usage, and covert Command and Control (C2) channels. It utilizes advanced techniques like entropy analysis, query volume anomaly detection, and subdomain length analysis within SIEM platforms, helping SOC teams identify threats that bypass traditional network security controls.

This tool analyzes network packet captures (PCAP) to detect covert communication channels used by malware for Command and Control (C2) and data exfiltration. It specifically focuses on identifying indicators of DNS tunneling, ICMP tunneling, and protocol abuse patterns, providing scoring and detailed reasons for suspicious activity. Useful for threat hunting and security incident investigation.

Utilize the Scapy library in Python to perform deep packet inspection, crafting, sending, and sniffing of various network protocols (TCP, UDP, ICMP, DNS). This skill is essential for analyzing pcap files, implementing advanced security techniques like SYN scans, extracting protocol fields, and detecting network anomalies such as fragmentation or tunneling indicators. Ideal for security researchers, SOC analysts, and penetration testers.

This skill provides methods for detecting covert data exfiltration channels using DNS tunneling. It analyzes DNS query patterns, including subdomain entropy, query volume anomalies, oversized TXT/CNAME records, and unusual query types, to identify potential data leakage attempts from compromised networks. Ideal for threat hunting and building advanced passive DNS monitoring capabilities.

This skill detects DNS-based data exfiltration by analyzing Zeek dns.log files. It identifies indicators such as high Shannon entropy subdomains, oversized TXT/NULL records, and abnormal query volumes. Use it when investigating suspected DNS tunneling or covert C2 channels to enhance threat detection capabilities.

Deploy Zeek for passive network analysis to generate structured logs (DNS, HTTP, etc.). This tool detects behavioral anomalies like DNS tunneling or beaconing, complementing traditional signature-based IDS tools. It is ideal for threat hunting and incident response, feeding rich protocol metadata into SIEM platforms.

A comprehensive guide for security professionals to detect data exfiltration by analyzing network telemetry (Zeek, Suricata) and logs. Techniques include identifying DNS tunneling, unusual cloud uploads, and detecting large/abusive data flows across various channels during incident response and proactive threat hunting.

A comprehensive guide to identifying covert data exfiltration channels using Zeek logs. This technique analyzes DNS traffic for high-entropy subdomains, unusually long query lengths, abnormal record types (TXT/NULL), and excessive query volume, which are key indicators of malicious DNS tunneling or command-and-control (C2) activity.

This tool provides comprehensive network traffic analysis capabilities by querying the Arkime API. Users can search sessions, download PCAPs for forensics, detect sophisticated threats like C2 beaconing (via jitter/interval analysis), spot DNS tunneling patterns, and flag connections to known-bad TLS certificate issuers. Ideal for security assessment and incident investigation.