Skill UI

Guides hardening Windows Active Directory via Group Policy to block ransomware execution, enforce AppLocker/WDAC rules, enable Controlled Folder Access, configure ASR, and lock down lateral movement paths.

Implements comprehensive external attack surface management using Shodan, Censys, subfinder, httpx, and nuclei to discover assets, enumerate services, and score exposures for continuous ASM or pentest reconnaissance.

Implements AWS Nitro Enclave deployments with PCR-aware attestation, KMS key policies, and secure vsock communication so sensitive workloads stay isolated and auditable.

Implements remote browser isolation with URL risk scoring, isolation policies, content disarming/reconstruction, DLP controls, and Secure Web Gateway plus ZTNA integration to harden web browsing against exploits and credential theft.

Deploys DNS, HTTP, and AWS API key canary tokens across enterprise networks so SOC teams catch unauthorized access and lateral movement via webhook-integrated alerts.

Sets up Microsoft Purview data loss prevention policies to protect sensitive content across Exchange, SharePoint, OneDrive, Teams, Power BI, and managed endpoints by defining sensitivity label taxonomies, custom regex types, endpoint controls, and monitoring with Activity Explorer plus PowerShell/Graph automation.

Deploys Cilium Tetragon-based eBPF tracing to watch processes, network, file access, and enforce runtime policies while streaming JSON events to SIEM pipelines for Linux hosts or Kubernetes clusters.

Automates GDPR DSAR workflows including intake, identity verification, PII discovery via regex/NER, data mapping, templated Article 15 responses, deadline tracking, batch processing, and audit logging for compliant subject access handling.

Implements end-to-end FIDO2/WebAuthn hardware security key authentication, covering server configuration, registration and authentication ceremonies, YubiKey enrollment, and passkey migration so high-value accounts gain phishing-resistant, passwordless MFA.

Builds NeMo Guardrails-based input/output validation pipelines to block prompt injection, redact PII, enforce content policies, and verify structured outputs so LLM-powered services stay safe before downstream use.

Detects and exploits ransomware kill switch mechanisms via mutex, domain, registry, and file checks, enabling proactive vaccination and DNS monitoring to stop execution before encryption.

This skill provides a comprehensive framework for validating the integrity and recoverability of critical data backups. It goes beyond simple file checks by implementing cryptographic hash verification (SHA-256), simulating automated restore tests in isolated environments, detecting silent data corruption (bit rot), and scanning for signs of ransomware artifacts. It is crucial for ensuring data reliability against cyberattacks and hardware failures, adhering to standards like NIST CSF.