Skill UI

This assistant is an expert guide for developing user interfaces using the Makepad framework. It helps users write, explain, and troubleshoot code for a comprehensive set of widgets, including containers (View, PortalList), input controls (TextInput, Slider), navigation elements (TabBar, Modal), and media components. It adheres to best practices, providing structured code patterns and detailed usage documentation for building complex, modern UIs.

Opinionated Docker development assistant that analyzes Dockerfiles, docker-compose setups, multi-stage builds, and container security to shrink images, speed builds, and enforce production-ready practices when users need optimized containers.

A comprehensive guide for digital forensics professionals to investigate compromised Docker containers. It covers best practices for preserving container state, analyzing image layers, reviewing runtime logs, and examining host system artifacts to identify evidence of malicious activity, container escapes, or misconfigurations.

Detects unauthorized runtime drift in containers by monitoring binary execution, filesystem changes, and configuration deviation from the original immutable image. Uses Falco and Microsoft Defender for Containers. Ideal for validating immutable-infrastructure controls, hunting for unexpected package installs or binaries, and determining whether a container diverged from its source image.

Authoring and tuning Falco rules to detect container escape techniques, including host filesystem mounts, nsenter usage, privileged containers, kernel module loading, and host manipulation. Covers rule syntax, condition tuning, output fields, priorities, and false positive reduction.

This guide provides a comprehensive framework for auditing Azure Storage accounts to detect critical security misconfigurations. It specifically checks for publicly accessible blob containers, insufficient encryption settings (e.g., missing infrastructure encryption), overly permissive network rules, and exposed SAS tokens. It is essential for compliance verification, responding to security alerts (like anonymous access), and establishing a robust security baseline when onboarding new cloud subscriptions.

Detects and prevents privilege escalation in Kubernetes pods by combining admission control, runtime monitoring, and audit log analysis. Covers security contexts, Linux capabilities, and syscall patterns. Use when investigating pods running as root or privileged, hardening workloads against in-pod escalation, or hunting for containers exceeding their intended scope.

This guide provides comprehensive steps to harden Docker containers and associated runtime environments based on the CIS Docker Benchmark v1.8.0. It covers implementing least-privilege principles, such as running as non-root users, dropping capabilities, using read-only filesystems, and applying seccomp/AppArmor profiles. Use this when preparing containers for production deployment or conducting security audits to minimize the attack surface.

A comprehensive guide detailing how to implement Microsoft Defender for Cloud across various workloads (VMs, containers, SQL, storage) to achieve continuous security monitoring and compliance assessment. This process utilizes Azure Policy, Log Analytics, and Azure Arc for holistic protection, enabling adaptive remediation and meeting stringent regulatory requirements like PCI-DSS and CIS standards.

This guide details implementing robust code signing for various build artifacts, including binaries, packages, and containers. It covers both traditional GPG key-based signing and modern, keyless signing using Sigstore/cosign. Use this process to establish verifiable trust chains, ensure artifact integrity against supply-chain tampering, prove authenticity, and meet advanced security standards like SLSA.

This guide details implementing microsegmentation using Akamai Guardicore Segmentation. It helps map application dependencies, visualize east-west traffic flows, and establish granular, least-privilege network policies across diverse environments (VMs, containers, bare metal, cloud). Essential for achieving zero-trust architecture and meeting compliance standards like PCI DSS or HIPAA by preventing lateral movement.

This skill automates the entire phishing incident response lifecycle using the Splunk SOAR REST API. It processes reported emails, extracts indicators of compromise (IOCs) like URLs and IPs, creates incident containers, attaches artifacts, and triggers automated playbooks for deep analysis and reporting. It is essential for security operations teams needing robust, programmatic incident handling and compliance alignment.