Skill UI

Claudeception continuously monitors work sessions, looking for reusable insights—debugging tricks, tool integrations, and workflow optimizations—and codifies them into new Claude Code skills so teams retain non-obvious knowledge for future tasks.

SAELens provides a framework for training and analyzing Sparse Autoencoders (SAEs). SAEs decompose the dense, often polysemantic activations of large language models into sparse, monosemantic features. Use this when you need to discover the discrete, interpretable concepts a model has learned, study feature superposition, or analyze specific safety-relevant behaviors (like bias or deception) within deep neural networks.

Hypogenic automates LLM-driven hypothesis generation and testing over tabular datasets, blending literature insights with empirical analysis to accelerate discovery in domains like deception detection or AI content evaluation.

This skill utilizes the Thinkst Canary REST API to programmatically deploy various decoy tokens, including web bugs, DNS records, MS Word documents, and AWS API keys. By monitoring these fake resources, the system detects unauthorized internal or external access attempts, providing early warnings and generating detailed deception coverage reports to strengthen security architecture.

This guide details the deployment of deception technologies, including canary files and honeypot shares, to detect ransomware activity at its earliest stages. It outlines configuring file integrity monitoring (FIM) and using specialized tokens to trigger alerts when ransomware attempts encryption or performs lateral movement, significantly enhancing security posture beyond standard EDR.

A comprehensive guide for deploying and managing network deception systems using industry-leading honeypot platforms like OpenCanary, T-Pot, and Cowrie. This skill helps security professionals detect unauthorized access attempts, trace lateral movement, and gather critical threat intelligence by simulating vulnerable services within a controlled environment. Ideal for enhancing network security architecture and creating early warning indicators for intrusions.

A comprehensive guide to deploying deception technologies, including honeypots, honeytokens, and decoy systems, within a Security Operations Center (SOC). This skill is used to detect advanced attackers who bypass perimeter defenses by monitoring lateral movement, credential abuse, and internal reconnaissance. It provides high-fidelity, near-zero false positive alerts and is essential for threat hunting and incident response strategy.

This skill provides a comprehensive guide to executing web cache deception attacks. It details methods for exploiting path normalization discrepancies, delimiter abuse, and cache key manipulation across CDNs and reverse proxies (e.g., Cloudflare, Akamai). Use this during authorized penetration testing to assess if authenticated sensitive content can be cached and retrieved by unauthenticated attackers.

This tool automates the deployment of deception-based honeytokens within Active Directory environments. It creates fake privileged accounts, decoy SPNs for Kerberoasting detection, and misleading GPOs with password traps. Designed for advanced security teams to detect reconnaissance, lateral movement, and credential theft with high fidelity.

This skill outlines the architecture and methodology for deploying canary files (honeytokens) across critical file systems. By placing decoy documents with known content in high-value locations, this system monitors for unauthorized modifications, deletions, or encryption attempts. It detects ransomware by triggering high-fidelity alerts via File Integrity Monitoring (FIM) systems, serving as a crucial deception layer that complements existing EDR/AV solutions.

This skill details the deployment of various canary tokens (DNS, HTTP, AWS API Keys) across enterprise network infrastructure. It establishes digital tripwires that detect behavioral anomalies, such as unauthorized access, credential leakage, or lateral movement. Tokens are configured with webhook alerts (Slack, SIEM) for real-time, low-false-positive notification, significantly enhancing traditional IDS/IPS capabilities.

Hypogenic is an advanced framework that uses Large Language Models (LLMs) to systematically generate and test hypotheses on complex tabular datasets. It supports three powerful modes: data-driven generation (HypoGeniC), literature-grounded refinement (HypoRefine), and combined union methods. This tool is essential for accelerating scientific discovery in fields such as predictive modeling, content analysis, and deception detection by combining empirical data insights with theoretical knowledge.