Skill UI

Guides users who are unsure where to start by asking structured questions, then recommends the best matching skill(s) from the installed library with explanations and invocation templates.

Guides the full Odoo purchase cycle from RFQ through PO, receiving, and vendor billing, covering approvals, agreements, vendor price lists, automation, and 3-way matching so procurement teams can configure, enforce, and troubleshoot workflows.

Vexor CLI is a powerful tool for developers needing to locate code, functions, or documentation sections within large repositories based on *intent* rather than exact keywords or file paths. It provides semantic discovery, making it invaluable when manual searching or simple text matching fails, helping developers understand the implementation logic across complex codebases.

Coordinates discovery, matching, and workflow orchestration across agent ecosystems, automatically scanning SKILL.md, ranking relevant skills, and executing multi-step plans for complex requests.

A dedicated tool for forensic analysis of Windows PowerShell Script Block Logs (Event ID 4104) captured in EVTX files. It reconstructs multi-block scripts, applying advanced detection heuristics such as entropy analysis and pattern matching to identify obfuscated commands, encoded payloads (Base64), download cradles, and AMSI bypass attempts, crucial for threat hunting and incident response.

This tool provides a comprehensive framework for analyzing web server logs (Apache/Nginx) to detect various security threats. It uses advanced regex matching against OWASP attack signatures to identify SQL injection, Local File Inclusion, and Directory Traversal attempts, alongside behavioral analysis for brute-force attacks and web scanner fingerprints. The system also enriches data using GeoIP for source attribution, generating a prioritized report for SOC analysts.

AWT provides AI coding tools with the ability to perform sophisticated End-to-End (E2E) web testing using a real browser. It accepts declarative YAML scenarios and executes them via Playwright. Key features include visual matching (OpenCV + OCR) instead of relying on fragile DOM selectors, automatic platform detection (React, Vue, etc.), and structured failure diagnosis for improved AI coding workflows.

This skill provides a comprehensive framework for building automated pipelines that ingest, normalize, and operationalize threat intelligence (TI). It connects diverse sources—including STIX/TAXII feeds, open-source feeds (e.g., Abuse.ch), and commercial TI platforms—into SIEM and security tools. Use this when SOC teams need to automate the entire lifecycle of IOC ingestion, scoring, and real-time matching against network telemetry.

This skill provides comprehensive guidance on detecting network reconnaissance and port scanning activities using industry-standard IDS/IPS systems like Suricata and Snort. It covers various scanning techniques (e.g., SYN, FIN, NULL, Xmas scans, UDP sweeps) and advanced detection methods, including signature matching, threshold-based alerting, and traffic anomaly analysis to identify tools like Nmap and Masscan.

This script is designed for malware analysis, specifically targeting .NET-based Remote Access Trojans (RATs) like Agent Tesla. It automatically extracts embedded and obfuscated configuration data, including SMTP credentials, FTP endpoints, Telegram tokens, and C2 webhooks. It utilizes advanced techniques such as regex pattern matching, Base64 decoding, and simulating XOR/SHA256 decryption to reveal critical threat intelligence for security research.

This skill guides threat hunters in detecting Cobalt Strike Command and Control (C2) beacons. It utilizes advanced network forensic techniques, including analyzing default TLS certificate serials, JA3/JA3S/JARM fingerprints, beacon jitter, and HTTP profile matching. Detection is achieved by correlating data from Zeek logs, Suricata rules, and Python PCAP analysis to identify suspicious outbound communications.

Monitors Windows process creation events to flag Living Off The Land Binary abuse by matching Event ID 4688/Sysmon 1 logs against LOLBAS database entries, supporting threat hunting and SIEM rule creation for fileless attacks.