Skill UI

This guide demonstrates how to use the pycti Python client to model complex cyber threat intelligence within the OpenCTI platform. It structures threat actors, intrusion sets, campaigns, and TTPs into a unified STIX 2.1 knowledge graph. The skill is essential for correlating fragmented data from multiple sources (IOCs, reports) into a comprehensive, queryable adversary picture, supporting advanced threat hunting and detection engineering.

PyRIT (Python Risk Identification Tool) is an open-source automation framework designed for advanced, multi-turn adversarial red-teaming of conversational LLMs. It simulates real-world attack scenarios by orchestrating an attacker model and a scorer model in a feedback loop. Features include Crescendo (gradual escalation) and Tree-of-Attacks with Pruning (TAP) techniques to detect complex vulnerabilities like prompt injection and jailbreaks in stateful dialogues.

This comprehensive tool suite provides high-fidelity parsers for key Windows artifacts, including MFT, Registry hives, Prefetch files, and ShellBags. Designed for digital forensics and incident response, it converts raw system evidence into structured CSV/JSON formats. The output is optimized for feeding into Timeline Explorer, enabling analysts to build comprehensive, correlated timelines and establish a clear chain of events.

This PowerShell toolset performs advanced post-exploitation, reconnaissance, persistence, and data exfiltration against Microsoft 365/Entra ID tenants using the Microsoft Graph API. It operationalizes stolen Graph tokens to enumerate users, dump policies, escalate privileges, and search sensitive data across mailboxes, SharePoint, and Teams. Essential for authorized red teaming engagements.

This skill utilizes NVIDIA's open-source garak framework to conduct comprehensive red-teaming assessments on Large Language Models (LLMs). It tests for critical vulnerabilities such as prompt injection, jailbreaks, data leakage, and toxic content generation by sending thousands of adversarial probes. Ideal for pre-deployment security validation, API guardrail testing, and generating defensible evidence for AI risk assessments.

Trivy is an open-source, comprehensive scanner used to find vulnerabilities (CVEs), misconfigurations, secrets, and license issues across multiple targets. It is essential for implementing 'shift-left' security gates in CI/CD pipelines, scanning container images, Infrastructure-as-Code (IaC) like Terraform/Kubernetes, and generating/re-scanning SBOMs for supply chain transparency.

This skill provides a comprehensive defense-in-depth framework for securing autonomous AI agents. It implements least-privilege tool allowlisting, identity binding, and human-in-the-loop controls to mitigate risks like prompt injection and tool poisoning. Use this when building agents that interact with sensitive systems (e.g., payments, file writes) to ensure governance, auditability, and compliance.

This comprehensive skill provides a holistic approach to building modern, accessible, and visually stunning user interfaces. It combines the highly accessible components of shadcn/ui (built on Radix UI), the utility-first power of Tailwind CSS, and sophisticated visual design principles (Canvas). Use this when developing complex React applications, implementing full design systems, ensuring responsive layouts across devices, and requiring professional-grade visual compositions, from dashboards to marketing posters. It guarantees consistency, accessibility, and rapid prototyping.

This skill guides the verification of software build provenance and signatures using industry standards like SLSA and Sigstore. It leverages tools like cosign and slsa-verifier to enforce keyless OIDC identity and confirm that artifacts were built by trusted sources without tampering. It is essential for hardening CI/CD pipelines and securing the entire software supply chain against advanced attacks.

This skill structures a highly controlled, bounded development life cycle for AI agents. It mandates a structured three-phase workflow: Planning (Spec), Implementation (Build), and Verification (Review). It is essential for building complex features from scratch, especially when dealing with ambiguous requirements, high risk, or needing explicit human approval gates to ensure the resulting code meets all defined specifications.

This critical protocol is the ultimate measure for dealing with deeply corrupted, unmaintainable, or structurally rotten code modules. Instead of risky patching, it mandates a controlled, multi-phase process to completely delete the target and rebuild it from scratch. It ensures precise identification of all public interfaces, implicit contracts, and working behaviors (the Preservation List) before any removal occurs, guaranteeing the new implementation matches the original functionality while resolving deep architectural debt.

This skill facilitates the systematic triage and closure of open promises or commitments within a project context. It guides the user to reliably close these commitments using verifiable, real-world outcomes via the acc_act(runtime="outcome") command. It emphasizes maintaining rigorous provenance discipline, ensuring that status updates are based only on external or runtime validated results, thereby maximizing data integrity and accountability.