106 skills · sorted by relevance
Find classes left in parent folders or namespaces and identify nested component structures. Compare consolidation, splitting, and shared code extraction, then plan and carry out refactoring with updated references and tests.
Cyber threat intelligence production — the intelligence cycle, IOC extraction/normalization/enrichment, STIX/TAXII and MISP, structured analytic models (Diamond, Kill Chain, ATT&CK), source scoring, actor/campaign tracking, and finished intelligence reporting
The English summary is being prepared. Showing the original description.
IOC export formats and procedures. CSV, STIX 2.1, OpenIOC, MISP. Handles format conversion and packaging, and carries per-claim evidence grades (access level and claim support) from /quality-of-information-check into each format (STIX confidence, MISP attribute tags).
The English summary is being prepared. Showing the original description.
Correlates disparate security incidents, IOCs, and adversary behaviors across time and organizations to identify unified threat campaigns, attribute them to common threat actors, and extract shared indicators for improved detection. Use when multiple incidents exhibit overlapping indicators, when sector-wide attack campaigns require cross-organizational analysis, or when building campaign-level intelligence products. Activates for requests involving campaign analysis, incident clustering, cross-organizational IOC correlation, or MISP correlation engine.
The English summary is being prepared. Showing the original description.
Analyzes structured and unstructured threat intelligence feeds to extract actionable indicators, adversary tactics, and campaign context. Use when ingesting commercial or open-source CTI feeds, evaluating feed quality, normalizing data into STIX 2.1 format, or enriching existing IOCs with campaign attribution. Activates for requests involving ThreatConnect, Recorded Future, Mandiant Advantage, MISP, AlienVault OTX, or automated feed aggregation pipelines.
The English summary is being prepared. Showing the original description.
Analyzes indicators of compromise (IOCs) including IP addresses, domains, file hashes, URLs, and email artifacts to determine maliciousness confidence, campaign attribution, and blocking priority. Use when triaging IOCs from phishing emails, security alerts, or external threat feeds; enriching raw IOCs with multi-source intelligence; or making block/monitor/whitelist decisions. Activates for requests involving VirusTotal, AbuseIPDB, MalwareBazaar, MISP, or IOC enrichment pipelines.
The English summary is being prepared. Showing the original description.
Correlates disparate security incidents, IOCs, and adversary behaviors across time and organizations to identify unified threat campaigns, attribute them to common threat actors, and extract shared indicators for improved detection. Use when multiple incidents exhibit overlapping indicators, when sector-wide attack campaigns require cross-organizational analysis, or when building campaign-level intelligence products. Activates for requests involving campaign analysis, incident clustering, cross-organizational IOC correlation, or MISP correlation engine.
The English summary is being prepared. Showing the original description.
Analyzes structured and unstructured threat intelligence feeds to extract actionable indicators, adversary tactics, and campaign context. Use when ingesting commercial or open-source CTI feeds, evaluating feed quality, normalizing data into STIX 2.1 format, or enriching existing IOCs with campaign attribution. Activates for requests involving ThreatConnect, Recorded Future, Mandiant Advantage, MISP, AlienVault OTX, or automated feed aggregation pipelines.
The English summary is being prepared. Showing the original description.
Analyzes indicators of compromise (IOCs) including IP addresses, domains, file hashes, URLs, and email artifacts to determine maliciousness confidence, campaign attribution, and blocking priority. Use when triaging IOCs from phishing emails, security alerts, or external threat feeds; enriching raw IOCs with multi-source intelligence; or making block/monitor/whitelist decisions. Activates for requests involving VirusTotal, AbuseIPDB, MalwareBazaar, MISP, or IOC enrichment pipelines.
The English summary is being prepared. Showing the original description.
Evaluates and selects Threat Intelligence Platform (TIP) products based on organizational requirements including feed integration capability, STIX/TAXII support, workflow automation, analyst interface, and total cost of ownership. Use when conducting a TIP procurement, migrating between TIP solutions, or assessing whether the current TIP meets program maturity requirements. Activates for requests involving ThreatConnect, MISP, OpenCTI, Anomali, EclecticIQ, or TIP procurement decisions.
The English summary is being prepared. Showing the original description.
Correlates disparate security incidents, IOCs, and adversary behaviors across time and organizations to identify unified threat campaigns, attribute them to common threat actors, and extract shared indicators for improved detection. Use when multiple incidents exhibit overlapping indicators, when sector-wide attack campaigns require cross-organizational analysis, or when building campaign-level intelligence products. Activates for requests involving campaign analysis, incident clustering, cross-organizational IOC correlation, or MISP correlation engine.
The English summary is being prepared. Showing the original description.
Analyzes structured and unstructured threat intelligence feeds to extract actionable indicators, adversary tactics, and campaign context. Use when ingesting commercial or open-source CTI feeds, evaluating feed quality, normalizing data into STIX 2.1 format, or enriching existing IOCs with campaign attribution. Activates for requests involving ThreatConnect, Recorded Future, Mandiant Advantage, MISP, AlienVault OTX, or automated feed aggregation pipelines.
The English summary is being prepared. Showing the original description.
Analyzes indicators of compromise (IOCs) including IP addresses, domains, file hashes, URLs, and email artifacts to determine maliciousness confidence, campaign attribution, and blocking priority. Use when triaging IOCs from phishing emails, security alerts, or external threat feeds; enriching raw IOCs with multi-source intelligence; or making block/monitor/whitelist decisions. Activates for requests involving VirusTotal, AbuseIPDB, MalwareBazaar, MISP, or IOC enrichment pipelines.
The English summary is being prepared. Showing the original description.
Create, edit, and clean spreadsheet files, convert table formats, and add formulas, formatting, or charts. The workflow includes recalculating formulas and checking errors before delivering a spreadsheet that updates when its inputs change.
Review proposed code changes before merging them. Compare changes with the base branch to find structural issues, including unsafe SQL, misplaced trust in large language model inputs, and unintended effects within conditional code.
Check a Claude Code plugin before publishing. Inspect file placement, required configuration fields, metadata at the start of skill and agent files, and MCP tool references, then report failures with practical suggestions for fixing them.
Inspect page HTML for metadata tags placed outside the head section, where page settings belong. Identify misplaced tags and guide fixes to templates or scripts that insert them into the body.
Review where keyboard focus, the current target for keyboard input, moves when dialogs open, views change, or content updates. Identify misplaced or lost focus and propose changes that help keyboard and screen reader users continue navigating.
Review the HTML delivered to browsers for a correct UTF-8 character encoding declaration. Find missing or misplaced charset tags in templates and rendered pages, then position the declaration early to help prevent garbled multilingual text.
Review whether ARIA roles, which describe interface elements to assistive technology, have the required parent roles. Find misplaced menu items, tabs, or list items, suggest suitable containers, and explain how to verify the corrected structure.
Create, edit, and clean spreadsheet files, including Excel workbooks and CSV data. Add formulas, formatting, and charts, preserve existing workbook conventions, and recalculate formulas with error checks before delivering the spreadsheet.
Create, edit, and clean spreadsheet files, including Excel workbooks and CSV data. Add formulas, formatting, and charts, preserve existing template styles, and recalculate formulas to check for errors before delivering the spreadsheet.
Create automated workflows that add threat intelligence to suspicious IP addresses, domains, URLs, and file hashes. Combine findings from multiple services into consistent alert context and confidence scores to support analysts reviewing security alerts.
Map attacker behaviors and indicators of compromise, or traces of an intrusion, to MITRE ATT&CK techniques. Build coverage heatmaps, compare threat groups, and identify monitoring gaps to guide detection improvements and threat intelligence reporting.