Skill UI

Helps founders, RevOps, and GTM engineers turn manual revenue processes into reliable, observable automation by mapping tech stacks, designing workflow architectures, and orchestrating AI agents across platforms like n8n, Make, and Zapier.

This skill automates the complex and tedious process of porting academic papers written in LaTeX from one publisher's journal template (e.g., Springer) to another (e.g., MDPI, IEEE). It executes a structured multi-stage workflow, including content extraction, structural mapping, systematic fixing of common LaTeX issues (like float placement and math environments), and final compilation to ensure the output adheres to the target journal's specifications.

This skill provides a comprehensive method for querying advanced threat intelligence using ATT&CK data. It maps the Tactics, Techniques, and Procedures (TTPs) of specific APT groups into MITRE ATT&CK Navigator layers. Users can build multi-layer heatmaps to identify detection gaps, compare threat coverage, and create structured threat-intel reports for defense engineering.

A specialized tool designed for incident responders and threat hunters. It extracts critical configuration data—such as C2 server addresses, malleable profiles, watermarks, and communication settings—from Cobalt Strike beacon payloads found in PE files or memory dumps. This analysis is crucial for mapping attacker infrastructure and improving defensive detection rules.

This system maps advanced persistent threat (APT) group TTPs to the MITRE ATT&CK framework. Utilizing the attackcti library to query STIX/TAXII data, it generates specialized ATT&CK Navigator layer files. It is essential for security analysts to profile threat actors, visualize comprehensive coverage heatmaps, and precisely assess detection gaps against sophisticated adversaries.

This guide outlines the process of passive external reconnaissance using Open Source Intelligence (OSINT) techniques. Users can map an organization's digital footprint by gathering comprehensive data, including DNS records, subdomains, certificate transparency logs, social media profiles, and leaked credentials. It is critical for the planning phase of penetration testing, asset mapping, or preparing for social engineering, all without actively interacting with target systems.

A comprehensive, multi-stage framework for responding to confirmed or suspected malware infections across an enterprise. This guide covers the entire incident lifecycle: detection, scoping, containment, deep analysis (mapping to MITRE ATT&CK), thorough eradication, and system recovery, ensuring all steps are documented for resilience and compliance.

This guide provides comprehensive techniques for detecting Layer 2 ARP poisoning and spoofing attacks. It covers monitoring gratuitous ARP floods, tracking IP-to-MAC mapping changes, and identifying rogue devices. Techniques include deploying ARPWatch, configuring Dynamic ARP Inspection (DAI) on managed switches, and using advanced Wireshark filters or custom Python scripts for robust security monitoring and incident response.

A comprehensive guide and framework for detecting attacker lateral movement within enterprise networks. It details the use of network flow analysis (Zeek), authentication log review (Windows Event Logs, Kerberos), and dedicated SIEM correlation rules (Splunk, Elastic) to identify techniques like Pass-the-Hash and RDP hopping. Ideal for threat hunters and security engineers building detection pipelines.

A comprehensive guide detailing the systematic process of eradicating malware, backdoors, and attacker persistence mechanisms from compromised Windows and Linux systems. This workflow covers mapping persistence (Autoruns, registry, scheduled tasks), identifying artifacts (YARA, AV scans), removing threats, resetting credentials, and patching vulnerabilities to restore a clean state.

This guide provides comprehensive steps to harden Docker containers and associated runtime environments based on the CIS Docker Benchmark v1.8.0. It covers implementing least-privilege principles, such as running as non-root users, dropping capabilities, using read-only filesystems, and applying seccomp/AppArmor profiles. Use this when preparing containers for production deployment or conducting security audits to minimize the attack surface.

This guide details how to harden the Docker daemon (dockerd) configuration by modifying /etc/docker/daemon.json. It implements critical security controls such as user namespace remapping, disabling inter-container communication (ICC), enforcing no-new-privileges, and configuring secure TLS client authentication. Use this method to prevent container breakout, privilege escalation, and lateral movement, ensuring compliance with standards like CIS benchmarks.