121 skills · sorted by relevance
Design a security operations center escalation matrix that defines incident priorities, response deadlines, analyst responsibilities, and notification paths. Use business impact, asset importance, and data sensitivity to decide when incidents need senior or management attention.
Set up MISP to collect threat feeds and centrally manage indicators such as suspicious IP addresses and domains. Configure automated synchronization, connect related findings, and export indicators to security monitoring platforms or blocklists.
Investigate suspicious IP addresses, domains, URLs, file hashes, and email artifacts using multiple threat intelligence sources. Assess confidence that each indicator is malicious, check links to known campaigns, and document evidence for blocking, monitoring, or allowing it.
Guides migration of existing codebases to Rust without unsafe code, covering architecture, implementation, testing, and output comparisons. It measures performance before and after optimization and produces an interactive HTML report documenting results and unresolved differences.
Triage Google SecOps alerts by checking logs, related cases, asset importance, and threat intelligence. Classify findings, adjust severity and priority, and document evidence for closing benign cases or handing suspicious activity to incident responders.
Monitor one explicitly authorized pull or merge request, inspect current reviews and checks, and fix actionable findings within scope. Apply separate permission and verification conditions before publishing fixes, replying, approving, or merging.
Organization-grade identity-fabric mapping: tenant/federation fingerprinting and the pre-auth user-ENUMERATION oracle methodology — enumeration and fingerprint only, never credential submission. Covers domain-to-tenant resolution (Microsoft getuserrealm.srf Managed/Federated namespace check, Entra OIDC metadata tenant-GUID extraction, Autodiscover v2), keyless Microsoft tenant-federation mapping (GetFederationInformation SOAP -> sibling-domain discovery, discover-only ROE, FEDERATED_WITH provenance edge held out of attack-path pivoting), Okta org-slug derivation + OIDC fingerprint + governed custom-domain enumeration, ADFS passive/active fingerprint + version inference, Google Workspace MX-correlated detection, generic OIDC (Auth0/Keycloak/Ping Identity/OneLogin/Duo) discovery, SAML metadata (5 paths), Azure AD Seamless-SSO Negotiate-challenge detection, Microsoft Defender for Identity (MDI) sensor-API presence check, the user-enumeration oracle methodology for Microsoft GetCredentialType (IfExistsResult semantics: exists / doesn't-exist / exists-in-federated-tenant / throttled) and Okta /api/v1/authn (errorCode differential), Medium-detectability discipline with a hard 20-candidate-per-tenant cap and admin/role interest-based ranking, and name x confirmed-email-pattern login-candidate synthesis that FAILS CLOSED with zero output when no org pattern is confirmed. Grounded directly in a production ASM implementation's sso_idp.py, tenant_recon.py, and core/email_patterns.py modules. Deepens — does not duplicate — offensive-osint skill's Identity Fabric endpoint reference with the tenant-federation MAP, the oracle WORKFLOW, and the candidate-SYNTHESIS methodology that reference lacks. Use when fingerprinting an organization's identity provider, mapping its tenant/federation boundary, running an authorized pre-auth user-enumeration pass, or synthesizing login candidates from harvested names to feed that oracle — never for password spray, credential submission, or auth bypass.
The English summary is being prepared. Showing the original description.
XXE playbook. Use when XML, SVG, OOXML, SOAP, or parser-driven imports may resolve external entities, files, or internal network resources.
The English summary is being prepared. Showing the original description.
Convert physician verbal dictation into structured SOAP notes. Trigger.
The English summary is being prepared. Showing the original description.
Performance, load, and reliability (SLO/SRE) planning for production readiness. Use when defining service level objectives, load characterization, capacity, latency budgets, stress/soak/spike test plans, false-positive baselines, and reliability targets. USE FOR: SLO/SLA definition, load testing plan, performance budget, capacity planning, reliability/SRE backlog, latency targets, error-budget policy. DO NOT USE FOR: executing load tests (use Azure Load Testing tooling), security threat modeling, RAI assessment, privacy/compliance planning, or authoring/restating PRD requirements (cite the PRD's existing NFR/FR ids instead).
The English summary is being prepared. Showing the original description.
Write a structured clinical case summary or case presentation. Use when asked to write a clinical case summary, case presentation, patient case report, or clinical handover. Produces a structured summary using SBAR or SOAP format. For educational and documentation purposes only — not a substitute for clinical judgement.
The English summary is being prepared. Showing the original description.
Automate security workflows and remediation. Build security pipelines, automate compliance checks, and implement SOAR capabilities. Use when scaling security operations or implementing DevSecOps.
The English summary is being prepared. Showing the original description.
Expert ISO 27001 compliance assistant for security and compliance teams. Use this skill whenever a user asks about ISO 27001 or ISO/IEC 27001, including any of the following: gap analysis, auditing, compliance assessments, control checklists, policy writing, document generation, Statement of Applicability (SoA), risk assessment, risk registers, risk treatment plans, Annex A controls, ISMS implementation, clause requirements, certification readiness, transitioning from 2013 to 2022, control implementation guidance, incident response policies, access control policies, supplier security, or any information security management system (ISMS) topic. Trigger even if the user doesn't say "skill" — any ISO 27001 or ISMS question should use this skill.
The English summary is being prepared. Showing the original description.
Expert ISO 27001 compliance assistant for security and compliance teams. Use this skill whenever a user asks about ISO 27001 or ISO/IEC 27001, including any of the following: gap analysis, auditing, compliance assessments, control checklists, policy writing, document generation, Statement of Applicability (SoA), risk assessment, risk registers, risk treatment plans, Annex A controls, ISMS implementation, clause requirements, certification readiness, transitioning from 2013 to 2022, control implementation guidance, incident response policies, access control policies, supplier security, or any information security management system (ISMS) topic. Trigger even if the user doesn't say "skill" — any ISO 27001 or ISMS question should use this skill.
The English summary is being prepared. Showing the original description.
Orientação LGPD para operações de tratamento no Brasil. Cobre bases legais (Art. 7º e Art. 11), RIPD, incidentes (Arts. 48-49), direitos dos titulares (Art. 18) e transferências internacionais. Triggers: LGPD, RIPD, ANPD, proteção de dados, dados pessoais, consentimento, encarregado, DPO Brasil, incidente de dados, legítimo interesse.
The English summary is being prepared. Showing the original description.
Use for authorized security assessment of REST, GraphQL, WebSocket, or SOAP APIs, including discovery, authentication, authorization, rate-limit, and CI/CD testing.
The English summary is being prepared. Showing the original description.
Expert knowledge for Azure Defender For Iot development including troubleshooting, best practices, decision making, architecture & design patterns, limits & quotas, security, configuration, integrations & coding patterns, and deployment. Use when configuring OT sensors/micro agents, traffic mirroring, Zero Trust OT monitoring, SIEM/SOAR integrations, or OT network design, and other Azure Defender For Iot related development tasks. Not for Azure Defender For Cloud (use azure-defender-for-cloud), Azure Security (use azure-security), Azure IoT (use azure-iot), Azure IoT Hub (use azure-iot-hub).
The English summary is being prepared. Showing the original description.
Dung khi phai setup do luong TRUOC khi tieu bat ky dong nao — pixel va CAPI, GA4, UTM convention, event mapping, offline conversion, dong y du lieu, va checklist verify xanh. Kich hoat khi user nhac 'setup tracking', 'cai pixel', 'UTM', 'CAPI', 'do luong chuyen doi', 'so lieu khong khop'. Quy tac cung: khong chay ads khi tracking chua xanh. Khong dung cho — doc data da co ra insight thi dung skill 13-phan-tich-du-lieu; ra soat cau hinh ads thi dung skill 21-audit-ads-performance.
The English summary is being prepared. Showing the original description.
Dung khi can dung cau truc tai khoan quang cao truoc khi bat campaign — phan tang campaign/adset/ad, naming convention de doc data ve sau, CBO hay ABO, va so luong adset hop ly. Kich hoat khi user nhac 'cau truc campaign', 'naming convention ads', 'chia adset the nao', 'CBO hay ABO', 'setup tai khoan ads', 'to chuc campaign'. Khong dung cho — ra soat tai khoan dang chay thi dung skill 21-audit-ads-performance; phan bo ngan sach theo kenh thi dung skill 54-media-plan.
The English summary is being prepared. Showing the original description.
Dung khi can test co ky luat de biet phuong an nao thang that — chon dung mot bien de test, viet gia thuyet, tinh sample size, setup tracking, doc y nghia thong ke va ghi test log cho ads, landing page, email hoac gia. Kich hoat khi user nhac 'A/B test', 'split test', 'test creative', 'test copy', 'test landing', 'chay bao lau moi du ket luan', 'ban nao thang', 'test xong khong biet doc ket qua', 'ket qua co dang tin khong'. Khong dung cho — so dang xau va can chan doan nguyen nhan thi dung skill 03-danh-gia-hieu-suat; nhan ngan sach cho creative da thang thi dung skill 55-scaling-ads; ra soat toan bo trang khong ra don thi dung skill 68-cro-audit-trang.
The English summary is being prepared. Showing the original description.
Dung khi can ra soat CAU HINH tai khoan quang cao mot cach he thong — 6 khau tu account, campaign, adset, creative, landing den tracking, cham Health Score 0-100 va liet ke Quick Wins. Kich hoat khi user nhac 'audit tai khoan ads', 'kiem tra tai khoan quang cao', 'health score ads', 'tai khoan chay kem qua', 'setup ads co dung khong', 'review tai khoan Meta'. Ho tro Meta, TikTok, Google, Zalo Ads. Khong dung cho — chan doan nhanh tai sao so xau thi dung skill 03-danh-gia-hieu-suat; lap ngan sach ky moi thi dung skill 54-media-plan.
The English summary is being prepared. Showing the original description.
Work on WCF services, clients, bindings, contracts, and migration decisions for SOAP and multi-transport service-oriented systems on .NET Framework or compatible stacks. USE FOR: working on WCF services, bindings, or clients; deciding whether a service should stay WCF or move to modern HTTP APIs; reviewing transport, security, or interoperability. DO NOT USE FOR: unrelated stacks; generic tasks that do not need this specific guidance. INVOKES: inspect the repository context, edit targeted files, and run relevant build, test, lint, or validation commands when changes are made.
The English summary is being prepared. Showing the original description.
Build, run, and improve a Security Operations Center — alert prioritization, runbook authoring, escalation criteria, on-call structure, alert tuning workflow, MTTD / MTTR / fidelity KPIs, analyst tiering, and shift handoffs. Use when the user mentions 'SOC,' 'security operations,' 'SOC analyst,' 'alert triage workflow,' 'runbook,' 'escalation,' 'on-call,' 'SOC tiering,' 'tier 1 / tier 2,' 'MTTD,' 'MTTR,' 'alert fatigue,' 'alert tuning,' 'shift handoff,' 'SOAR,' or wants to design or improve a security operations team.
The English summary is being prepared. Showing the original description.
BRENDA Enzyme DB SOAP/REST queries: kinetic parameters (Km, Vmax, kcat, Ki), EC classes, substrate specificity, inhibitors, cofactors, organism data. 80K+ enzymes, 7M+ values. Free academic registration. For metabolic modeling use cobrapy-metabolic-modeling; metabolites use hmdb-database.
The English summary is being prepared. Showing the original description.