Skill UI

A comprehensive guide to deploying decoy artifacts, such as fake credentials, URLs, and files, called honeytokens or canarytokens. These tokens have no legitimate operational use; therefore, any interaction with them provides a high-fidelity, low-false-positive signal of an intrusion, data theft, or insider threat. Use this technique to enhance detection in low-telemetry areas like file shares or credential stores.

A comprehensive, all-in-one design skill covering the entire creative lifecycle. Features include building brand identity, defining design tokens, UI styling with Tailwind/shadcn/ui, sophisticated logo generation (AI-powered), Corporate Identity Program (CIP) mockups, professional pitch decks, multi-platform banner design, and social media image creation. It acts as a unified hub for professional graphic and digital assets.

Falco is a powerful CNCF project for real-time runtime security monitoring. This guide teaches authors how to write and deploy custom detection rules using Falco's robust YAML rule engine and modern eBPF driver. It is designed to detect critical threats such as container escapes, namespace manipulation, privileged mounts, and anomalous syscalls in Kubernetes and Docker environments, significantly hardening the overall container security posture.

A comprehensive tool for identifying poisoned training data, backdoored ML models, and supply-chain compromises. It leverages IBM's Adversarial Robustness Toolbox (ART) for activation clustering and spectral signature analysis, uses Cleanlab for label quality checks, and enforces integrity via weight-hash verification and safetensors. Essential for securing ML pipelines before training, deployment, or during supply chain audits.

This skill provides a comprehensive framework to detect and prevent dependency confusion—a critical supply chain vulnerability. It guides users through enumerating internal package names, scanning manifests (npm, PyPI, Maven, etc.) using tools like `confused` and OWASP `dep-scan`, and implementing preventative measures like registry pinning and defensive package registration.

This skill provides advanced threat hunting queries for Microsoft Sentinel/Log Analytics. It detects the behavioral and string fingerprints left by popular offensive Entra ID enumeration tools (like ROADtools, AADInternals, and AzureHound) within both MicrosoftGraphActivityLogs and AADGraphActivityLogs. Use this when investigating suspicious Graph API activity, identifying internal reconnaissance, or building detection rules to surface active intrusions.

A comprehensive security skill designed to detect and mitigate indirect prompt injection attacks. It scans untrusted external content—including web pages, PDFs, and images—for hidden, obfuscated instructions before an LLM agent processes them. The pipeline combines content extraction (HTML, OCR), normalization, and dedicated ML models (e.g., LLM Guard, Prompt Guard 2) to ensure data safety.

A comprehensive skill for triaging npm packages and dependency lockfiles against supply-chain threats. It utilizes heuristic scanning (GuardDog), manual tarball inspection, and dynamic detonation in isolated environments to detect malicious behavior such as credential exfiltration, reverse shell execution, and self-propagation. Essential for secure code review and CI/CD pipeline gating.

This skill provides comprehensive methods and frameworks to detect sophisticated AI attacks, including model extraction, membership inference, and model inversion, which abuse inference APIs. It focuses on monitoring per-principal query volume, input distribution, and confidence exposure. Use it for securing public or partner inference APIs, or for conducting pre-deployment red-teaming to assess the model's extractability and overall security posture against MITRE ATLAS techniques.

A comprehensive security auditing tool designed to detect UEFI Secure Boot bypasses and advanced bootkits (like BlackLotus and Bootkitty). It verifies the Secure Boot state, checks the freshness of the dbx revocation list, and hashes EFI boot binaries against known-bad sets. Use this skill for auditing enterprise fleets after major bootkit advisories or for hunting pre-OS persistence on compromised endpoints.

A critical security tool for detecting typosquatted, brandjacked, or misspelled packages across major registries (npm, PyPI, crates.io). It uses advanced techniques like edit-distance and corpus matching to proactively screen dependency names before installation. Ideal for implementing CI/CD gates, auditing lockfile diffs, or reviewing dependency lists sourced from AI models to mitigate supply chain attacks.

This skill provides expert guidance on design engineering, focusing on UI polish, micro-interactions, and high-craft component decisions. It is ideal for reviewing frontend code (React, CSS, Tailwind) to elevate perceived quality, addressing details like easing, duration, and physical feedback. Use it when subtle detail and refined taste are critical differentiators.