Security AI agent skills

3,127 skills in the archive. Read a skill’s instructions or open its original repository.

• Analyzing Ransomware Payment Wallets

  by @mukul975

  Traces ransomware cryptocurrency payment flows using blockchain analysis tools such as Chainalysis Reactor, WalletExplorer, and blockchain.com APIs, identifying wallet clusters and tracking fund movement through mixers and…

• Analyzing Security Logs With Splunk

  by @mukul975

  Leverages Splunk Enterprise Security and SPL (Search Processing Language) to investigate security incidents through log correlation, timeline reconstruction, and anomaly detection. Covers Windows event logs, firewall logs, proxy…

• Analyzing Windows Amcache Artifacts

  by @mukul975

  Parses the Windows Amcache.hve registry hive with Eric Zimmerman's AmcacheParser and Timeline Explorer to extract evidence of program execution, application installation, and driver loading, including SHA-1 hash correlation with…

• Analyzing Windows Event Logs In Splunk

  by @mukul975

  Analyzes Windows Security, System, and Sysmon event logs in Splunk to detect authentication attacks, privilege escalation, persistence mechanisms, and lateral movement using SPL queries mapped to MITRE ATT&CK techniques. Use…

• Auditing Cloud With Cis Benchmarks

  by @mukul975

  Audit AWS, Azure, and GCP environments against the CIS Foundations Benchmarks by running automated scans with tools like Prowler and ScoutSuite, interpreting failed controls, and tracking remediation for continuous compliance.…

• Analyzing Threat Landscape With Misp

  by @mukul975

  Query a MISP (Malware Information Sharing Platform) instance via PyMISP to compute event statistics, IOC type breakdowns, threat actor galaxy clusters, and tag trends, and generate threat landscape reports with temporal trends.…

• Analyzing Slack Space And File System Artifacts

  by @mukul975

  Examine NTFS slack space, MFT entries, the USN Change Journal, and Alternate Data Streams (ADS) to recover hidden or residual data, reconstruct deleted-file metadata, and reconstruct available file-system change activity from…

• Building Automated Malware Submission Pipeline

  by @mukul975

  Builds an automated malware submission and analysis pipeline that collects suspicious files from endpoints and email gateways, submits them to sandbox environments and multi-engine scanners, and generates verdicts with IOCs for…

• Analyzing Web Server Logs For Intrusion

  by @mukul975

  Parse Apache and Nginx access logs to detect SQL injection attempts, local file inclusion, directory traversal, web scanner fingerprints, and brute-force patterns. Uses regex-based pattern matching against OWASP attack…

• Analyzing Windows Registry For Artifacts

  by @mukul975

  Extract and analyze Windows Registry hives with tools like RegRipper and Registry Explorer to uncover user activity, installed software, autostart/persistence entries, and evidence of system compromise. Use when investigating…

• Analyzing Uefi Bootkit Persistence

  by @mukul975

  Analyzes UEFI bootkit persistence (SPI flash implants, ESP modifications, Secure Boot bypass, UEFI variable manipulation) using chipsec for firmware integrity verification, detecting known families like BlackLotus, LoJax, and…

• Analyzing Windows Prefetch With Python

  by @mukul975

  Parse Windows Prefetch (.pf) files with the windowsprefetch Python library to reconstruct application execution history, run counts, and accessed file/volume lists. Use when investigating renamed or masquerading binaries,…

• Analyzing Usb Device Connection History

  by @mukul975

  Correlate Windows registry keys (USBSTOR, MountedDevices), Event Logs, and setupapi.dev.log to reconstruct USB device connection history, first/last-plugged timestamps, and drive letter mappings. Use when investigating removable…

• Analyzing Windows Lnk Files For Artifacts

  by @mukul975

  Parse Windows LNK shortcut files to extract target paths, MAC timestamps, volume serial numbers, and machine identifiers for forensic timeline reconstruction. Use when investigating recently-accessed files, tracking removable…

• Analyzing Tls Certificate Transparency Logs

  by @mukul975

  Queries Certificate Transparency logs via crt.sh and pycrtsh to detect phishing domains, unauthorized certificate issuance, and shadow IT. Monitors newly issued certificates for typosquatting and brand impersonation using…

• Analyzing Typosquatting Domains With Dnstwist

  by @mukul975

  Generate domain permutations with dnstwist and check DNS resolution to detect typosquatting, homograph phishing, and brand impersonation domains registered against your organization. Use when asked to monitor for lookalike…

• Auditing Azure Active Directory Configuration

  by @mukul975

  Auditing Microsoft Entra ID (Azure Active Directory) configuration to identify risky authentication policies, overly permissive role assignments, stale accounts, conditional access gaps, and guest user risks using AzureAD…

• Auditing Terraform Infrastructure For Security

  by @mukul975

  Auditing Terraform infrastructure-as-code for security misconfigurations using Checkov, tfsec, Terrascan, and OPA/Rego policies to detect overly permissive IAM policies, public resource exposure, missing encryption, and insecure…

• Auditing Aws S3 Bucket Permissions

  by @mukul975

  Systematically audit AWS S3 bucket permissions to identify publicly accessible buckets, overly permissive ACLs, misconfigured bucket policies, and missing encryption settings using AWS CLI, S3audit, and Prowler to enforce…

• Auditing Kubernetes Cluster Rbac

  by @mukul975

  Auditing Kubernetes cluster RBAC configurations to identify overly permissive roles, wildcard permissions, dangerous ClusterRoleBindings, service account abuse, and privilege escalation paths using kubectl, rbac-tool, KubiScan,…

• Auditing Gcp Iam Permissions

  by @mukul975

  Auditing Google Cloud Platform IAM permissions to identify overly permissive bindings, primitive role usage, service account key proliferation, and cross-project access risks using gcloud CLI, Policy Analyzer, and IAM Recommender.

• Analyzing Lnk File And Jump List Artifacts

  by @mukul975

  Analyze Windows LNK shortcut files and Jump List artifacts with LECmd, JLECmd, and manual Shell Link Binary Format parsing to establish evidence of file access, program execution, and user activity that persists even after the…

• Analyzing Golang Malware With Ghidra

  by @mukul975

  Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from…

• Analyzing Campaign Attribution Evidence

  by @mukul975

  Systematically evaluate cyber-campaign evidence to attribute an operation to a threat actor, using the Diamond Model and Analysis of Competing Hypotheses (ACH) to weigh infrastructure overlaps, TTP consistency, malware code…

• Analyzing Mft For Deleted File Recovery

  by @mukul975

  Analyze the NTFS Master File Table ($MFT) with MFTECmd, analyzeMFT, and X-Ways Forensics to recover metadata and content of deleted files by examining MFT record entries, $LogFile, $UsnJrnl, and MFT slack space. Use when…

• Analyzing Ios App Security With Objection

  by @mukul975

  Runtime iOS app security testing with Objection (Frida): inspect keychain and filesystem data, explore app internals at runtime, and validate/bypass client-side protections during authorized mobile assessments.

• Analyzing Cobalt Strike Beacon Configuration

  by @mukul975

  Extract and analyze Cobalt Strike beacon configuration from PE files and memory dumps to identify C2 infrastructure, malleable profiles, and operator tradecraft.

• Analyzing Malware Persistence With Autoruns

  by @mukul975

  Use Sysinternals Autoruns to systematically enumerate and analyze malware persistence mechanisms across Windows registry run keys, scheduled tasks, services, drivers, and startup locations. Use when hunting for persistence…

• Analyzing Network Covert Channels In Malware

  by @mukul975

  Detect and analyze covert communication channels used by malware, including DNS tunneling, ICMP exfiltration, steganographic HTTP, and other protocol abuse used for C2 and data exfiltration. Use when investigating suspicious…

• Achieving Cmmc Level 2 Compliance

  by @mukul975

  Prepare a defense-contractor environment for CMMC Level 2 certification: scope CUI and FCI, implement the 110 NIST SP 800-171 Rev 2 security requirements across 14 families, compute the SPRS score with the DoD Assessment…

• Abusing Shadow Credentials For Privesc

  by @mukul975

  Take over Active Directory accounts by writing attacker-controlled public keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, or Certipy, then authenticate via PKINIT to recover the target's NT hash…

• Abusing Dpapi For Credential Access

  by @mukul975

  Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys) online or offline using SharpDPAPI, SharpChrome, Mimikatz, or Impacket's dpapi.py, including…

• Analyzing Kubernetes Audit Logs

  by @mukul975

  Parses Kubernetes API server audit logs (JSON lines) to detect exec-into-pod, secret access, RBAC modifications, privileged pod creation, and anonymous API access, and builds SIEM detection rules from the event patterns. Use…

• Analyzing Cyber Kill Chain

  by @mukul975

  Analyzes intrusion activity against the Lockheed Martin Cyber Kill Chain framework to identify which phases an adversary has completed, where defenses succeeded or failed, and what controls would have interrupted the attack at…

• Analyzing Linux Audit Logs For Intrusion

  by @mukul975

  Uses the Linux Audit framework (auditd) with ausearch and aureport utilities to detect intrusion attempts, unauthorized access, privilege escalation, and suspicious system activity. Covers audit rule configuration, log querying,…

• Analyzing Network Traffic For Incidents

  by @mukul975

  Analyzes network traffic captures and flow data to identify adversary activity during security incidents, including command-and-control communications, lateral movement, data exfiltration, and exploitation attempts. Uses…

• Analyzing Malware Behavior With Cuckoo Sandbox

  by @mukul975

  Detonate malware samples in Cuckoo Sandbox to observe runtime behavior — process creation, file system and registry changes, network communications, and API calls — and generate behavioral reports for classification and IOC…

• Acquiring Disk Image With Dd And Dcfldd

  by @mukul975

  Create forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash verification (MD5/SHA) during acquisition. Use when imaging a suspect drive, USB…

• Analyzing Prefetch Files For Execution History

  by @mukul975

  Parse Windows Prefetch files (versions 17, 23, 26, 30) with tools like PECmd, WinPrefetchView, or python-prefetch to determine program execution history, including run counts, execution timestamps, and referenced files/DLLs. Use…

• Analyzing Memory Dumps With Volatility

  by @mukul975

  Analyzes RAM memory dumps from compromised systems using the Volatility framework to identify malicious processes, injected code, network connections, loaded modules, and extracted credentials. Supports Windows, Linux, and macOS…

• Analyzing Macro Malware In Office Documents

  by @mukul975

  Analyzes malicious VBA macros embedded in Microsoft Office documents (Word, Excel, PowerPoint) to identify download cradles, payload execution, persistence mechanisms, and anti-analysis techniques. Uses olevba, oledump, and VBA…

• Analyzing Ransomware Encryption Mechanisms

  by @mukul975

  Analyzes encryption algorithms, key management, and file encryption routines used by ransomware families to assess decryption feasibility, identify implementation weaknesses, and support recovery efforts. Covers AES, RSA,…

• Analyzing Powershell Empire Artifacts

  by @mukul975

  Detect PowerShell Empire post-exploitation framework artifacts in Windows Script Block Logging (Event ID 4104) and Module Logging (Event ID 4103), including the default launcher string, Base64-encoded WebClient/FromBase64String…

• Analyzing Cobaltstrike Malleable C2 Profiles

  by @mukul975

  Parse and analyze Cobalt Strike Malleable C2 profiles with dissect.cobaltstrike (profiles and beacon-payload configs) and pyMalleableC2 (AST parsing) to extract HTTP/DNS transforms, URIs, headers, sleep/jitter, and injection…

• Analyzing Pdf Malware With Pdfid

  by @mukul975

  Analyzes malicious PDF files using PDFiD, pdf-parser, and peepdf to identify embedded JavaScript, shellcode, exploits, and suspicious objects without opening the document. Determines the attack vector and extracts embedded…

• Analyzing Malware Sandbox Evasion Techniques

  by @mukul975

  Detect sandbox and VM evasion techniques in malware samples by analyzing timing checks, VM/hypervisor artifact queries, user-interaction checks, and sleep-inflation patterns from Cuckoo or AnyRun behavioral reports. Use when a…

• Analyzing Command And Control Communication

  by @mukul975

  Analyzes malware C2 communication over HTTP, HTTPS, DNS, and custom protocols to reverse-engineer beacon patterns, command structures, data encoding, and infrastructure (primary servers, fallback domains, dead drops). Use after…

• Analyzing Persistence Mechanisms In Linux

  by @mukul975

  Scan Linux systems for persistence mechanisms including crontab/systemd entries, LD_PRELOAD injection, shell profile modifications (.bashrc, .profile), and SSH authorized_keys backdoors, then correlate findings with auditd logs…

• Analyzing Ransomware Leak Site Intelligence

  by @mukul975

  Safely monitor ransomware group Tor-hosted data leak sites (DLS) to collect and extract structured victim posting data, track group activity trends over time, and produce sector- and geography-specific ransomware risk…

• Analyzing Linux System Artifacts

  by @mukul975

  Examine Linux system artifacts (auth logs, cron/systemd persistence, shell history, SSH keys, and system configuration) to uncover evidence of compromise, detect rootkits or backdoors, and reconstruct user/attacker activity. Use…

• Analyzing Cloud Storage Access Patterns

  by @mukul975

  Detect abnormal access in AWS S3, GCS, and Azure Blob Storage by analyzing CloudTrail Data Events, GCS audit logs, and Azure Storage Analytics for after-hours bulk downloads, new-IP access, and API-call spikes (e.g. GetObject)…

• Analyzing Packed Malware With Upx Unpacker

  by @mukul975

  Identifies and unpacks UPX-packed malware samples, including binaries with modified UPX magic bytes or headers that block automated decompression, to recover the original executable for static analysis. Use when a sample shows…

• Analyzing Network Traffic Of Malware

  by @mukul975

  Analyzes network traffic generated by malware during sandbox execution or live incident response to identify C2 protocols, data exfiltration channels, payload downloads, and lateral movement patterns using Wireshark, Zeek, and…

• Analyzing Powershell Script Block Logging

  by @mukul975

  Parse Windows PowerShell Script Block Logs (Event ID 4104) from EVTX files to detect obfuscated commands, encoded payloads, and living-off-the-land techniques. Uses python-evtx to extract and reconstruct multi-block scripts,…

• Analyzing Disk Image With Autopsy

  by @mukul975

  Perform comprehensive forensic analysis of raw (dd), E01, or AFF disk images with Autopsy and The Sleuth Kit, recovering deleted files, examining metadata and embedded artifacts, keyword searching, and building investigation…

• Analyzing Malware Family Relationships With Malpedia

  by @mukul975

  Query the Malpedia API to look up malware family aliases and naming (platform.family_name), pull community/vendor YARA rules, link families to threat actors, and map family relationships such as loader-payload chains and shared…

• Analyzing Bootkit And Rootkit Samples

  by @mukul975

  Analyzes bootkit and advanced rootkit malware infecting the Master Boot Record (MBR), Volume Boot Record (VBR), or UEFI firmware for below-OS persistence, covering boot sector analysis, UEFI module inspection, and anti-rootkit…

• Analyzing Apt Group With Mitre Navigator

  by @mukul975

  Query ATT&CK data with attackcti, mitreattack-python, and stix2, then build MITRE ATT&CK Navigator layers and multi-layer heatmap overlays mapping one or more APT groups' TTPs for detection-gap analysis. Use to compare…

• Analyzing Ransomware Network Indicators

  by @mukul975

  Identify ransomware-related network indicators, including C2 beaconing patterns, TOR exit node connections, data exfiltration flows, and encryption key exchange, by analyzing Zeek conn.log and NetFlow data. Use when threat…

• Analyzing Azure Activity Logs For Threats

  by @mukul975

  Queries Azure Monitor activity logs and sign-in logs via azure-monitor-query to detect suspicious administrative operations, impossible travel, privilege escalation, and resource modifications. Builds KQL queries for threat…

• Analyzing Email Headers For Phishing Investigation

  by @mukul975

  Parse and analyze email headers (Received chain, Return-Path, Message-ID) to trace the true origin of a phishing email and validate SPF, DKIM, and DMARC results to confirm or rule out sender spoofing. Use when triaging a…

• Analyzing Network Flow Data With Netflow

  by @mukul975

  Parse NetFlow v9 and IPFIX records to detect volumetric anomalies, port scanning, data exfiltration, and C2 beaconing patterns. Uses the Python netflow library to decode flow records, builds traffic baselines, and applies…

• Analyzing Network Packets With Scapy

  by @mukul975

  Use Scapy to craft, send, sniff, and dissect TCP/UDP/ICMP/DNS packets, analyze pcap files, implement SYN scans, and detect anomalous traffic such as fragmented or malformed packets. Use when performing authorized network…

• Analyzing Malicious Pdf With Peepdf

  by @mukul975

  Perform static analysis of malicious PDF documents using peepdf, pdfid, and pdf-parser to extract embedded JavaScript, shellcode, and suspicious objects. Use when triaging a suspicious PDF attachment from a phishing email,…

• Analyzing Dns Logs For Exfiltration

  by @mukul975

  Analyzes DNS query logs to detect data exfiltration via DNS tunneling, DGA domain communication, and covert C2 channels using entropy analysis, query volume anomalies, and subdomain length detection in SIEM platforms. Use when…

• Analyzing Memory Forensics With Lime And Volatility

  by @mukul975

  Performs Linux memory acquisition using LiME (Linux Memory Extractor) kernel module and analysis with Volatility 3 framework. Extracts process lists, network connections, bash history, loaded kernel modules, and injected code…

• Analyzing Linux Kernel Rootkits

  by @mukul975

  Detect kernel-level rootkits in Linux memory dumps using Volatility3 linux plugins (check_syscall, lsmod, hidden_modules), rkhunter system scanning, and /proc vs /sys discrepancy analysis to identify hooked syscalls, hidden…

• Analyzing Network Traffic With Wireshark

  by @mukul975

  Captures and analyzes network packet data using Wireshark and tshark to identify malicious traffic patterns, diagnose protocol issues, extract artifacts, and support incident response investigations on authorized network segments.

• Analyzing Ethereum Smart Contract Vulnerabilities

  by @mukul975

  Perform static and symbolic analysis of Solidity smart contracts using Slither and Mythril to detect reentrancy, integer overflow, access control, and other vulnerability classes before deployment to Ethereum mainnet.

• Analyzing Heap Spray Exploitation

  by @mukul975

  Detect and analyze heap spray attacks in memory dumps using Volatility3 plugins to identify NOP sled patterns, shellcode landing zones, and suspicious large allocations in process virtual address space.

• Analyzing Office365 Audit Logs For Compromise

  by @mukul975

  Parse Office 365 Unified Audit Logs via Microsoft Graph API to detect email forwarding rule creation, inbox delegation, suspicious OAuth app grants, and other indicators of account compromise.

• Analyzing Certificate Transparency For Phishing

  by @mukul975

  Monitor Certificate Transparency logs using crt.sh and Certstream to detect phishing domains, lookalike certificates, and unauthorized certificate issuance targeting your organization.

• Analyzing Docker Container Forensics

  by @mukul975

  Investigate compromised Docker containers by analyzing images, layers, volumes, logs, and runtime artifacts to identify malicious activity and evidence.

• Analyzing Active Directory Acl Abuse

  by @mukul975

  Detect dangerous ACL misconfigurations in Active Directory using ldap3 to identify GenericAll, WriteDACL, and WriteOwner abuse paths

• Vercel Cli With Tokens

  by @vercel-labs

  Deploy and manage projects on Vercel using token-based authentication. Use when working with Vercel CLI using access tokens rather than interactive login — e.g. "deploy to vercel", "set up vercel", "add environment variables to…

• Gws Shared

  by @googleworkspace

  gws CLI: Shared patterns for authentication, global flags, and output formatting.

• Gws Modelarmor Sanitize Response

  by @googleworkspace

  Google Model Armor: Sanitize a model response through a Model Armor template.

• Gws Modelarmor Sanitize Prompt

  by @googleworkspace

  Google Model Armor: Sanitize a user prompt through a Model Armor template.

• Gws Events Renew

  by @googleworkspace

  Google Workspace Events: Renew/reactivate Workspace Events subscriptions.

• Gws Script Push

  by @googleworkspace

  Google Apps Script: Upload local files to an Apps Script project.

• Gws Modelarmor

  by @googleworkspace

  Google Model Armor: Filter user-generated content for safety.

• Gws Admin Reports

  by @googleworkspace

  Google Workspace Admin SDK: Audit logs and usage reports.

• Gws Gmail Triage

  by @googleworkspace

  Gmail: Show unread inbox summary (sender, subject, date).

• Persona It Admin

  by @googleworkspace

  Administer IT — monitor security and configure Workspace.

• Gws Drive

  by @googleworkspace

  Google Drive: Manage files, folders, and shared drives.

• Gws Gmail Read

  by @googleworkspace

  Gmail: Read a message and extract its body or headers.

• Gws Calendar

  by @googleworkspace

  Google Calendar: Manage calendars and events.

• Gws Chat

  by @googleworkspace

  Google Chat: Manage Chat spaces and messages.

• Gws Slides

  by @googleworkspace

  Google Slides: Read and write presentations.

• Gws Tasks

  by @googleworkspace

  Google Tasks: Manage task lists and tasks.

• Gws Chat Send

  by @googleworkspace

  Google Chat: Send a message to a space.

• Gws Docs Write

  by @googleworkspace

  Google Docs: Append text to a document.

• Gws Events

  by @googleworkspace

  Subscribe to Google Workspace events.

• Gws Meet

  by @googleworkspace

  Manage Google Meet conferences.

• Gws Forms

  by @googleworkspace

  Read and write Google Forms.

• Gws Docs

  by @googleworkspace

  Read and write Google Docs.

• Gws Keep

  by @googleworkspace

  Manage Google Keep notes.

• Add Onecli

  by @nanocoai

  Install or refresh OneCLI as NanoClaw's gateway provider. Use when setup selects OneCLI, an existing OneCLI-backed install is migrated to the gateway seam, or its runtime, approval bridge, setup, and agent guidance must be…

• Add Vercel

  by @nanocoai

  Add Vercel deployment capability to NanoClaw agents. Installs the Vercel CLI in agent containers and sets up OneCLI credential injection for api.vercel.com. Use when the user wants agents to deploy web applications to Vercel.

• Iron Proxy Gateway

  by @nanocoai

  Use Iron Proxy for external accounts and APIs, including GitHub through gh. Connect credentials through the operator console and diagnose blocked requests without exposing tokens or adding unnecessary MCP servers.