Create forensically sound bit-for-bit disk images using dd and dcfldd while preserving evidence integrity through hash verification.
The English summary is being prepared. Showing the original description.
261 skills · sorted by relevance
Create forensically sound bit-for-bit disk images using dd and dcfldd while preserving evidence integrity through hash verification.
The English summary is being prepared. Showing the original description.
Perform comprehensive forensic analysis of disk images using Autopsy to recover files, examine artifacts, and build investigation timelines.
The English summary is being prepared. Showing the original description.
Manage Docker containers, images, storage volumes, and networks with standard commands. Start multi-service applications with Docker Compose, investigate failures through logs, check disk usage, and review Dockerfiles for improvements.
Turn the most recent successful /scrape workflow into a reusable browser skill saved on disk. It builds a script, tests, and sample test data from the conversation, checks them, and asks before committing the result.
Inspect CPU, memory, disk, and accelerator information alongside container and scheduler limits. Produce a JSON snapshot with identifying details removed and conservative worker and memory estimates for planning local workloads, without running stress tests.
Investigate memory dumps, disk records, and captured network traffic while preserving evidence. The skill guides timeline reconstruction and examination of system traces to identify suspicious activity and produce findings that others can review.
Diagnose Google Cloud Filestore mount failures by checking client access rules, network firewalls, and audit logs. Distinguish permission errors from connection timeouts, then provide a structured report and remediation commands that require confirmation before execution.
Audits Google Cloud Filestore instances for missing or outdated backups, overly broad file share access, and zone isolation requirements. Produces a health scorecard, prioritized findings, an instance inventory, and proposed backup remediation.
Inspect Google Cloud Filestore usage and free space, then propose capacity increases or decreases based on configured thresholds and storage tier limits. Apply resizing after confirmation to address low space or reduce excess capacity.
Helps manage and troubleshoot Linux, macOS, and Windows systems. Guides checks of CPU, memory, disks, networks, and logs, then supports service configuration and security hardening with explanations suited to the operating system.
Review how evidence can be altered during authorized security exercises on Windows and Linux. Covers logs, timestamps, memory, disk records, and network traces, alongside the signs defenders use to detect manipulation.
Keeps multi-step work organized with Markdown files for the plan, research notes, and final deliverable. Tracks completed phases, decisions, and errors so the agent can revisit goals and resume work with durable records.
Hardware-offloaded erasure coding with DOCA Erasure Coding (Reed-Solomon, doca_ec) on a BlueField DPU, ConnectX NIC, or host: generating parity for data blocks, rebuilding lost blocks from the survivors, and refreshing parity after a change. Trigger on "one data block changed, how do I refresh parity without re-encoding", "a disk failed and 2 parity blocks are gone, can I rebuild", "RAID-6 resilience across 12 disks", "my doca_ec_task_create returns NOT_PERMITTED", or "is this N+K layout still recoverable", even without naming DOCA Erasure Coding. Covers bringing up a doca_ec context, the create / recover / update tasks, matrix type / N / K / block size, doca_ec_cap_* queries before sizing, doca_mmap src/dst permissions, and DOCA_ERROR_* from doca_ec_task_*. Refuse and route elsewhere for non-Reed-Solomon codes (fountain / LDPC / raptor), pure-replication designs, network FEC, or other DOCA accelerator libraries (SHA / Compress / AES-GCM / DMA).
The English summary is being prepared. Showing the original description.
Cross-platform, hardware-adaptive system optimizer. Auto-detects macOS / Linux / WSL / Windows (MINGW/Cygwin/MSYS2) and CPU/RAM/disk/GPU profile, then picks the right cleanup strategy. Scans reclaimable disk space, memory pressure, runaway processes, startup bloat, network issues. CleanMyMac built into Claude Code.
The English summary is being prepared. Showing the original description.
Amazon Redshift is NOT PostgreSQL; corrects LLM mistakes; covers SQL, metadata, connectivity/auth, storage, query performance, and operations. Applies ONLY to Redshift (provisioned or Serverless). Pushes back on: CREATE INDEX, string_agg, pg_catalog, text type, SERIAL, stl_query. Triggers on: Redshift SQL, Redshift CREATE TABLE, Redshift COPY/UNLOAD, slow or suddenly slow Redshift query, EXPLAIN plan, queue wait, stale statistics/ANALYZE, result cache, Redshift permission denied, Redshift disk full, storage growth, snapshot/backup cost, ghost rows/bloat, VACUUM, spill to disk, distribution skew, Redshift system views, QUALIFY, PIVOT, MERGE, materialized views, Redshift Data API (Python/boto3), Redshift workload management (WLM), concurrency scaling, Redshift resize, Spectrum, awsdatacatalog, connection failures (SSL/TLS, ODBC/JDBC, connection limit), IAM/SAML federation, IAM Identity Center, datashares. Does NOT apply to: S3 policies, Athena, Glue/Iceberg outside Redshift, Aurora, RDS, DynamoDB.
The English summary is being prepared. Showing the original description.
Diagnoses and repairs macOS TCC dialogs and silent denials: Full Disk Access, Screen Recording, Microphone, Camera, Accessibility, Automation. Use for recurring prompts, LaunchAgent/uv jobs that fail only in background, broken grants, or automating Full Disk Access (权限弹窗 / 授权了没用 / 完全磁盘访问). Checks requester and grants first. Not for launchd design (macos-watchdog) or app permission UX (developing-ios-apps).
The English summary is being prepared. Showing the original description.
Read and write 3-D point cloud data using Lidar Toolbox file I/O. Covers PLY, PCD, LAS/LAZ, PCAP (Velodyne/Ouster/Hesai), E57, and IDC (Ibeo) formats. Use when loading point clouds from disk, saving to disk, choosing the correct reader or writer for a file format, extracting or preserving lidar point attributes, reading Ibeo IDC sensor recordings, or converting between formats.
The English summary is being prepared. Showing the original description.
Manage block storage volumes and LVM. Configure cloud block storage and local disks. Use when managing disk storage.
The English summary is being prepared. Showing the original description.
Expert knowledge for Azure Virtual Machines development including troubleshooting, best practices, decision making, architecture & design patterns, limits & quotas, security, configuration, integrations & coding patterns, and deployment. Use when choosing VM/disk/GPU SKUs, configuring NVMe/Ultra disks, using Trusted Launch, or running Oracle/HPC workloads, and other Azure Virtual Machines related development tasks. Not for Azure Virtual Machine Scale Sets (use azure-vm-scalesets), SQL Server on Azure Virtual Machines (use azure-sql-virtual-machines), Azure Data Science Virtual Machines (use azure-data-science-vm), Azure DevTest Labs (use azure-devtest-labs).
The English summary is being prepared. Showing the original description.
Ranked content search over a text corpus you point it at, using BM25 (via xhluca/bm25s). Corpus-agnostic: cloned repos, project knowledge stores, uploaded files and archives, any local directory. In-memory BM25 index per invocation, with a session-local disk cache for repeat runs against the same corpus. Use for "rank these documents", "search this corpus", "which files are most about X", "find content about Y", or any multi-word concept query against a known body of text where grep would return everything or nothing. Needs a corpus on disk. Not for searching stored memories or prior-session decisions (remembering), not for a named symbol or a file's structure (tree-sitting), and not for a literal string you could grep.
The English summary is being prepared. Showing the original description.
Windows 11 system administration with PowerShell — system info reporting, hardware monitoring, package management (winget/scoop), disk cleanup, performance optimization, environment configuration, PowerShell profile setup with aliases and autocomplete, and Task Scheduler automation. Use when user asks to check system info, install tools on Windows, clean up disk space, set up PowerShell profile, or automate Windows tasks. Do NOT use for Linux administration, cross-platform scripting, or network infrastructure management.
The English summary is being prepared. Showing the original description.
Remove the git worktrees open-pr review checked PR code out into, each a full checkout on disk. Use when reclaiming disk space after reviews. Asks first; takes no URL.
The English summary is being prepared. Showing the original description.
Diagnose and fix RFDB data disappearing after compaction, where rfdb-server reports a tiny node count (e.g. "15 nodes") on startup despite manifest_index.json showing hundreds of thousands of nodes and segment files existing on disk. Use when: (1) rfdb-server logs "Default database: N nodes" with N orders of magnitude smaller than recent analysis output, (2) /api/stats returns only the most recent commit's nodes, (3) the issue appears AFTER a compaction event (manifest with l1_node_segments populated and node_segments: []), (4) subsequent commits dropped L1 references. Root cause: ManifestStore::create_manifest() initializes l1_node_segments/l1_edge_segments to Vec::new() instead of cloning from current manifest, so any commit AFTER compaction silently orphans all L1 data even though segment .seg files still exist on disk. Compaction injects L1 fields explicitly after create_manifest, but regular commits do not.
The English summary is being prepared. Showing the original description.
Analyzes destructive wiper malware by identifying raw-disk and MBR/VBR overwrite primitives, boot-record tampering, mass-deletion and backup-destruction behavior, and distinguishing wipers from ransomware. Activates for requests to analyze a wiper, identify destructive disk-overwrite behavior, or tell a wiper apart from ransomware.
The English summary is being prepared. Showing the original description.