573 skills · sorted by relevance
Unwrap layers of obfuscated PowerShell malware to recover hidden commands, additional malicious code, and server addresses. Combines script structure analysis with execution tracing and decoding tools to support incident investigation and detection work.
Investigate ransomware payment addresses using public blockchain records. Trace transfers, group addresses likely controlled by the same entity, identify links to exchanges or mixing services, and organize findings into a report for incident responders and investigators.
Audit Kubernetes access rules to find excessive permissions and service account token abuse paths. Trace which users or workloads could gain cluster administrator access, then produce prioritized findings and recommendations for reducing permissions.
Examine Outlook PST and OST archives to extract messages, headers, attachments, and recoverable deleted items. Use the extracted records to trace email routing, reconstruct communication patterns, and support incident investigations or legal evidence review.
Analyze suspicious Linux ELF executables through file inspection, runtime tracing, and reverse engineering. Identify malware behavior, network destinations, and persistence mechanisms, then organize findings and indicators for investigations involving servers, containers, or cloud infrastructure.
Investigate why a PyTorch model behaves a certain way by changing its internal values with pyvene. The skill guides experiments that swap or remove activations, train interventions, compare outputs, and save or share intervention configurations.
Use Phoenix to record execution traces, detailed records of an AI application's operations, and investigate problems. Evaluate answers on datasets, compare prompts and models, and set up monitoring through a self-hosted server.
Build AI applications with LangChain, including chatbots with conversation history and systems that search documents before answering. The skill provides examples for connecting models, calling tools, retrieving information, and tracing application runs.
Check research claims cited in books, articles, or conversations by tracing the original paper, methods, underlying data, and independent replication. Save a sourced assessment explaining whether the claim holds up and what remains uncertain.
Investigate NanoClaw agent failures by tracing messages through logs and session databases. Check container startup, credential access, mounted folders, and service instances to locate where processing or delivery stops and choose a repair.
Investigate a GitHub issue or bug report by tracing code, checking relevant history, and testing the diagnosis where needed. Receive a concise verdict, supporting evidence, a proposed fix direction, and a record for follow-up questions.
Explore code structure and history using an index of code relationships and meaning-based search. Trace calls, assess change impact, find likely bug locations, generate architecture reports, and review pull requests for risk and conflicts.
Use Phoenix to record execution traces, detailed records of an AI application's operations, and investigate problems. Evaluate answers on datasets, compare prompts and models, and set up monitoring through a self-hosted server.
Guides experiments that change internal values in PyTorch models to test what causes their behavior. Uses pyvene to swap or remove activations, locate influential components, train interventions, and save experiments for reuse.
Design systems made of independently deployable services, or plan how to split an existing application. The skill produces service boundary diagrams and recommendations for communication, data ownership, failure handling, monitoring, and deployment.
Build a graph of functions and calls across multiple programming languages to investigate entry points, paths to sensitive operations, and potential impact. Use the results to prioritize security reviews and connect external findings with source code.
Test cryptographic code for timing side channels, where execution time can reveal secrets. Use dudect to detect statistical differences and Timecop with Valgrind to trace secret-dependent operations, then interpret results and retest changes.
Scans code for security vulnerabilities with CodeQL by tracing data across functions. Builds and checks analysis databases, models project-specific APIs, and saves findings in SARIF, a structured results format, with broad or focused scan options.
Review mock configurations in .NET tests by tracing the production code each test exercises. Identify unused, unreachable, duplicated, or replaceable setups, explain concrete fixes, and distinguish them from appropriate mocks for databases, HTTP clients, and other external services.
Diagnose MSBuild failures from an existing binary build log. Inspect errors, settings, project references, and execution details to explain failures that console output alone does not clarify, including failures across multiple projects.
Structure open-source intelligence research, meaning investigation using publicly available information, for authorized external assessments. Map organizational assets, record evidence and confidence levels, prioritize exposures, and prepare reports that explain technical findings and business risks.
Inspect Claude Code execution traces in Braintrust, including tool calls and token usage. The guide explains event hooks, troubleshooting missing records, and matching separate parent and sub-agent traces using timestamps and metadata.
Understand how unfamiliar code works from a security perspective. The skill maps architecture, follows untrusted input through the code, and searches for similar vulnerability patterns, with file and line references to support static analysis and finding validation.
Guides authorized source code security reviews across dangerous functions, data flow, authentication, logic flaws, and dependencies. Helps agents prioritize review paths and organize code locations, reproduction evidence, and remediation advice before drawing conclusions.