Skill UI

Defines how to discover and invoke Superpowers skills before responding, emphasizing mandatory skill checks, priority rules, and how skills interact with other instructions.

Guides users who are unsure where to start by asking structured questions, then recommends the best matching skill(s) from the installed library with explanations and invocation templates.

This protocol defines the structured communication rules for multiple specialized AI agents simulating C-suite roles (e.g., CFO, CTO, CRO). It dictates invocation syntax, response formatting, and enforces strict constraints (such as loop prevention, call depth limits, and isolation rules) to ensure coordinated, non-contradictory, and reliable cross-functional analysis for executive decision-making.

This module adopts the persona, vocabulary, and critical pedagogical style of Yann LeCun. It provides deep insights into open-source technology, the concept of technological sovereignty, and the geopolitical incentives driving major AI companies (Meta, OpenAI, Google). It structures explanations using Socratic methods, grounding complex AI concepts in physical analogies.

This command executes the entire AgentHub lifecycle in a single, chained invocation. It automates complex development tasks by sequentially handling initialization, capturing performance baselines, spawning multiple specialized agents, evaluating the results (via metrics or LLM judging), and finally presenting a winner for merging. Use this when running an end-to-end competition or complex refactoring task.

This tool is designed for advanced threat hunting and digital forensics. It analyzes Windows Event Logs (specifically Script Block Logging 4104 and Module Logging 4103) to detect artifacts left by the PowerShell Empire post-exploitation framework. Detection patterns include default launchers, Base64 payloads (WebClient, FromBase64String), known module invocations (e.g., Invoke-Mimikatz), and staging URL patterns, helping confirm C2 activity and lateral movement.

This comprehensive guide details the deployment and hardening of the Havoc C2 framework, a modern post-exploitation Command and Control system. Learn how to establish a production-grade infrastructure, including configuring Teamservers, setting up various listeners (HTTP/HTTPS/SMB), and integrating Nginx redirectors. It provides OPSEC-hardened techniques for authorized red team adversary emulation engagements.

Master the creation of a two-tier Public Key Infrastructure (PKI) Certificate Authority hierarchy—including an offline Root CA and an operational Intermediate CA. This skill guides you through using OpenSSL and Python cryptography to manage X.509 certificate issuance, configure Certificate Revocation Lists (CRLs), set up OCSP responders, and enforce strict certificate policies. Essential for deploying robust trust anchors for TLS, code signing, or client authentication.

This comprehensive guide provides a structured, multi-stage workflow for containing active security breaches. It details both short-term and long-term strategies, including network segmentation, endpoint isolation, credential revocation, and evidence preservation. Use this process during confirmed intrusions, ransomware attacks, or lateral movement events to effectively stop adversary activity and secure critical assets before eradication.

This methodology systematically deobfuscates multi-layered PowerShell malware. It utilizes Abstract Syntax Tree (AST) analysis, dynamic execution tracing, and specialized tools (like PSDecode) to recover hidden payloads, original commands, and C2 infrastructure from scripts obfuscated with Base64, string concatenation, or complex invocation tricks. Essential for incident response and deep malware analysis.

This skill guides the implementation of Just-In-Time (JIT) access provisioning, eliminating standing privileges by granting temporary, time-bound access. It covers designing robust approval workflows, integrating with PAM/IGA systems, automating revocation, and adhering to Zero Trust principles, significantly reducing the attack surface.

HashiCorp Boundary is an identity-aware proxy that establishes secure, zero-trust access to infrastructure resources, eliminating the need for traditional VPNs. It enforces a default-deny model and integrates with HashiCorp Vault to dynamically broker credentials. This ensures just-in-time, least-privilege access, automatic credential revocation, and comprehensive session recording for strict compliance and auditing.