647 skills · sorted by relevance
Detect unauthorized cryptocurrency mining in cloud workloads by combining billing changes, CPU usage, mining pool connections, and process alerts. Follow workflows to preserve evidence, isolate affected resources, and trace how attackers gained access.
Analyze AWS CloudTrail logs against normal activity patterns to spot unusual API calls, IP addresses, errors, and sensitive changes. Produce a JSON report with anomaly scores, suspicious users, and suggested investigation steps.
Investigate DCSync attacks, which abuse Active Directory replication to steal password hashes. Use audit events and network traffic to identify suspicious replication requests, examine their sources, and check for subsequent credential misuse.
Deploy decoy accounts, service entries, and policy objects in Active Directory to detect suspicious activity. Configure monitoring rules for Windows security events and validate alerts for credential misuse, reconnaissance, and movement between systems.
Investigate reported phishing emails by checking sender details, links, and attachments. Identify affected recipients and exposed login credentials, guide removal of malicious messages across the organization, and secure compromised accounts with password resets and session revocation.
Plan and measure defensive deception operations with MITRE Engage. Connect decoy systems and credentials to specific attacker techniques, define measurable objectives, and document operating boundaries, response procedures, and criteria for assessing results.
Deploy decoy files and monitor changes, renames, and deletions for early signs of ransomware. This skill guides Python monitoring, email, Slack, and syslog alerts, plus simulated file operations to verify that the detection and notification pipeline works.
Assess whether stolen Kerberos tickets, credentials used for network authentication, can enable access to other systems during authorized testing. Guide ticket extraction and reuse, review detection indicators, and document evidence for security reports.
Map an organization's internet-facing assets using public information, including domains, indexed services, employee details, and leaked data. Compile findings into a reconnaissance report to support authorized security assessments and identify potential exposure.
Build a GitLab CI/CD pipeline with automated checks for vulnerable code, dependencies, container images, running applications, and exposed secrets. Covers scanner configuration, consolidated findings, and approval policies for serious vulnerabilities before production deployment.
Test iOS apps while they run using Objection and Frida, tools for inspecting and changing runtime behavior. Examine stored credentials, files, memory, and authentication calls, and evaluate client-side protections during authorized security assessments.
Analyze captured RAM with Volatility to investigate suspicious processes, injected code, network connections, and other evidence of compromise. The skill guides memory investigations and organizes findings into timelines and reports, including malware traces absent from disk.
Build connections between applications and external APIs, interfaces used to exchange data with other services. The skill guides authentication, data conversion, webhook verification, request limits, retries, and troubleshooting to support reliable API clients.
Build AI agents that inspect screenshots, choose actions, and operate a mouse and keyboard. Covers the observation and action loop, desktop control examples, and isolated environments that restrict access to files, credentials, and networks.
Deploy apps and websites to Vercel and get a URL to share. The skill selects a deployment method based on Git integration and authentication, using preview deployments by default and production deployments when explicitly requested.
Plan authentication for a Zoom integration by choosing an app type, selecting an authorization flow, and defining minimum permissions. Work through token storage, renewal, and authentication failures with a clear implementation approach.
Choose an authentication flow for a Zoom integration, define scopes that control access, and understand token renewal. Use the reference examples and error tables to investigate failed authorization or token requests.
Connect business software to Claude by checking existing connectors first, then Zapier or scheduled exports. The skill narrows the task, configures access, tests real data, and explains limits, with approval required for write actions.
Set up the first NanoClaw agent on a configured messaging channel. The skill identifies the operator and DM destination, selects or creates an agent group, and sends a welcome message to verify delivery through the service.
Add email conversations to NanoClaw using Resend and Chat SDK. Install and test the email adapter, configure sending credentials and incoming email notifications, then connect your address to an agent for ongoing replies.
Give selected NanoClaw agents access to Dial for sending SMS, making AI voice calls, and receiving verification codes. It installs the command-line tool and uses OneCLI to supply credentials and control which agents can use it.
Connect NanoClaw agents to Microsoft Teams channels, group chats, and direct messages. The skill installs and tests the adapter, then guides bot creation, credentials, app installation, and connecting the assistant to a selected Teams user.
Connect NanoClaw to Slack so you can chat with an AI assistant in direct messages and channels. The skill guides connection setup, credentials, installation, and checks, with support for Socket Mode or webhook event delivery.
Connect NanoClaw to Matrix rooms and direct messages through Chat SDK. The skill installs and registers the adapter, applies a compatibility patch, configures bot credentials, and checks the build and channel registration.