596 skills · sorted by relevance
Investigate suspicious privilege increases, including Windows UAC approval bypasses and Linux sudo or setuid abuse. Use registry changes, process relationships, and permission changes to identify possible abuse and document affected hosts, methods, and risk levels.
Set up host-based intrusion detection to monitor changes on Windows and Linux endpoints. Configure Wazuh agents, file integrity checks, registry monitoring, alert rules, and automated responses, with guidance on exclusions and centralized security monitoring.
Develop C++ bots that join existing Zoom meetings from Linux servers without a graphical interface. Follow guidance for recording raw audio and video, feeding transcription or AI workflows, and handling authentication, recording permissions, and Docker audio setup.
Operate Agent Zero's built-in Linux desktop to work with LibreOffice, files, and terminal apps. The skill guides visual layout checks, live spreadsheet edits, and saved-result verification within the internal desktop environment.
Prepare a local LangBot environment for development and browser testing. The skill covers service startup, shared connection settings, browser access, proxy troubleshooting, and reusable login profiles, with guidance for Linux and WSL environments.
Analyzes malicious Linux ELF (Executable and Linkable Format) binaries including botnets, cryptominers, ransomware, and rootkits targeting Linux servers, containers, and cloud infrastructure. Covers static analysis, dynamic tracing, and reverse engineering of x86_64 and ARM ELF samples. Activates for requests involving Linux malware analysis, ELF binary investigation, Linux server compromise assessment, or container malware analysis.
The English summary is being prepared. Showing the original description.
Analyzes malicious Linux ELF (Executable and Linkable Format) binaries including botnets, cryptominers, ransomware, and rootkits targeting Linux servers, containers, and cloud infrastructure. Covers static analysis, dynamic tracing, and reverse engineering of x86_64 and ARM ELF samples. Activates for requests involving Linux malware analysis, ELF binary investigation, Linux server compromise assessment, or container malware analysis.
The English summary is being prepared. Showing the original description.
Analyzes malicious Linux ELF (Executable and Linkable Format) binaries including botnets, cryptominers, ransomware, and rootkits targeting Linux servers, containers, and cloud infrastructure. Covers static analysis, dynamic tracing, and reverse engineering of x86_64 and ARM ELF samples. Activates for requests involving Linux malware analysis, ELF binary investigation, Linux server compromise assessment, or container malware analysis.
The English summary is being prepared. Showing the original description.
Set up reproducible development environments with Flox on macOS and Linux. Define tools, package versions, setup steps, and local services in one configuration, then share it with teammates or add project-specific tools for AI agents.
Develop exploit code from a known memory corruption flaw, then investigate differences between local and remote execution. Covers stack, heap, and Linux kernel cases, with attention to library versions, debugging, and repeatable results.
Prepare an ASP.NET Core project to run in a Linux Docker container. Create a project-specific Dockerfile and .dockerignore, configure dependencies, ports, and environment variables, and check that the container image builds successfully.
Investigate attempts to gain higher privileges on Windows and Linux using endpoint and security logs. Guide hypothesis testing, evidence analysis, false-positive checks, and reporting to help assess suspicious privilege changes and the scope of a compromise.
Guide malware cleanup on infected Windows and Linux systems after containment and investigation. Covers removing malicious files and mechanisms that preserve attacker access, rotating credentials, patching entry points, and documenting validation results before recovery.
Deploy and operate Falco to monitor running containers in Kubernetes or Docker. Choose a driver, validate detection rules, confirm alerts for suspicious activity, and forward those alerts to a central security monitoring system.
Create disk images for investigations using dd or dcfldd on Linux. The workflow covers write protection, bit-for-bit copying, hash checks to verify integrity, and documentation of the acquisition process.
Create disposable Linux or macOS computers for running code, testing apps, operating desktop interfaces, and browsing websites. Use isolated environments locally or in the Cua cloud, then delete them when the work is complete.
Operate native applications on macOS, Windows, and Linux using Qwen Cua Driver. Inspect screenshots and structured interface elements, perform clicks, typing, menu actions, or window adjustments, and verify the resulting application state.
Capture desktop screenshots on macOS, Linux, and Windows. Save the full screen, a selected window, or a region defined by coordinates, with support for a specified file path, the default location, or temporary storage.
Install the free OpenWork desktop app on macOS, Windows, or Linux using the appropriate download for the computer. Guide initial setup, folder authorization, model selection, and a first task such as summarizing local files.
Builds CARLA's ue4-dev branch on Linux, producing the Unreal Engine 4.26 editor, server modules, and an installed Python client package. Fetches required content, optionally compiles native ROS 2 support, and verifies the build against a source-built server.
This skill should be used when the user asks to "escalate privileges on Linux", "find privesc vectors on Linux systems", "exploit sudo misconfigurations", "abuse SUID binaries", "exploit cron jobs for root access", "enumerate Linux systems for privilege escalation", or "gain root access from low-privilege shell". It provides comprehensive techniques for identifying and exploiting privilege escalation paths on Linux systems.
The English summary is being prepared. Showing the original description.
Performs Linux memory acquisition using LiME (Linux Memory Extractor) kernel module and analysis with Volatility 3 framework. Extracts process lists, network connections, bash history, loaded kernel modules, and injected code from Linux memory images. Use when performing incident response on compromised Linux systems.
The English summary is being prepared. Showing the original description.
Uses the Linux Audit framework (auditd) with ausearch and aureport utilities to detect intrusion attempts, unauthorized access, privilege escalation, and suspicious system activity. Covers audit rule configuration, log querying, timeline reconstruction, and integration with SIEM platforms. Activates for requests involving auditd analysis, Linux audit log investigation, ausearch queries, aureport summaries, or host-based intrusion detection on Linux.
The English summary is being prepared. Showing the original description.
This skill should be used when the user asks to "escalate privileges on Linux", "find privesc vectors on Linux systems", "exploit sudo misconfigurations", "abuse SUID binaries", "exploit cron jobs for root access", "enumerate Linux systems for privilege escalation", or "gain root access from low-privilege shell". It provides comprehensive techniques for identifying and exploiting privilege escalation paths on Linux systems.
The English summary is being prepared. Showing the original description.