1.2K skills · sorted by relevance
Help and guidance for Azure DevOps synchronization with SpecWeave increments. Use when asking how to set up ADO sync, configure credentials, or troubleshoot integration issues. For actual syncing, use /sw-ado:sync command.
The English summary is being prepared. Showing the original description.
Guide for configuring Adobe AEP and CJA API access with OAuth Server-to-Server authentication. Use when setting up API credentials or troubleshooting OAuth errors (401/403).
The English summary is being prepared. Showing the original description.
Add Google Calendar as an MCP tool (list calendars, list/search/create events, free/busy queries) using OneCLI-managed OAuth. Multi-calendar and multi-account supported. Mirrors /add-gmail-tool's stub pattern — no raw credentials ever reach the container; OneCLI injects real tokens at request time.
The English summary is being prepared. Showing the original description.
Add Vercel deployment capability to NanoClaw agents. Installs the Vercel CLI in agent containers and sets up OneCLI credential injection for api.vercel.com. Use when the user wants agents to deploy web applications to Vercel.
The English summary is being prepared. Showing the original description.
Deploy Adobe-powered applications to Vercel, Cloud Run, and Adobe App Builder with proper credential injection and health monitoring. Use when deploying Adobe API integrations to production platforms. Trigger with phrases like "deploy adobe", "adobe Vercel", "adobe Cloud Run", "adobe App Builder deploy", "adobe production deploy".
The English summary is being prepared. Showing the original description.
Configure Adobe OAuth credentials and API access across development, staging, and production environments with separate Developer Console projects, secret managers, and environment-specific scoping. Trigger with phrases like "adobe environments", "adobe staging", "adobe dev prod", "adobe environment setup", "adobe config by env".
The English summary is being prepared. Showing the original description.
Implement Adobe-specific lint rules, CI policy checks, and runtime guardrails covering credential scanning (p8_ patterns), Firefly content policy pre-screening, PDF Services quota enforcement, and OAuth scope validation. Trigger with phrases like "adobe policy", "adobe lint", "adobe guardrails", "adobe eslint", "adobe content policy".
The English summary is being prepared. Showing the original description.
Provide comprehensive techniques for attacking Microsoft Active Directory environments. Covers reconnaissance, credential harvesting, Kerberos attacks, lateral movement, privilege escalation, and domain dominance for red team operations and penetration testing.
The English summary is being prepared. Showing the original description.
Android Accessibility Service security analysis and pentesting. Use this skill whenever the user mentions Android security testing, accessibility service abuse, RAT detection, malware analysis, ClayRat, PlayPraetor, overlay phishing, credential harvesting, or any Android app security assessment involving AccessibilityService APIs. This skill helps detect malicious accessibility services, analyze abuse patterns, and harden apps against accessibility-based attacks.
The English summary is being prepared. Showing the original description.
Background information about Lendtrain powered by Atlantic Home Mortgage — company history, credentials, founder bio, and contact information for borrower trust-building.
The English summary is being prepared. Showing the original description.
Security-Scanner Agent fuer fabrikIQ und andere Projekte. Fuehrt umfassende Sicherheitspruefungen durch. Trigger bei: (1) Pre-commit Validation, (2) PR-Creation, (3) Weekly Security Audits, (4) Nach Dependency-Updates, (5) Vor Production Deployments. <example> Context: User moechte vor einem Commit sicherstellen, dass keine Secrets committed werden. user: "Ich will gleich committen. Pruefe mal auf Secrets." assistant: "Ich starte den security-scanner Agent, um den Code auf API Keys, Tokens und andere Secrets zu pruefen." <Task tool call to security-scanner agent> </example> <example> Context: Weekly Security Audit des fabrikIQ-Projekts. user: "Fuehre den woechentlichen Security-Scan durch." assistant: "Ich fuehre einen vollstaendigen Security-Scan durch: Secret Detection, Dependency Audit, OWASP Patterns, Security Headers und Rate Limiting." <Task tool call to security-scanner agent> </example> <example> Context: User hat Dependencies aktualisiert und will Vulnerabilities pruefen. user: "Ich habe npm update und pip install -U gemacht. Gibt es Sicherheitsprobleme?" assistant: "Ich scanne die aktualisierten Dependencies auf bekannte Vulnerabilities mit dem security-scanner Agent." <Task tool call to security-scanner agent> </example> <example> Context: PR-Review mit Security-Fokus. user: "Review den PR #42 auf Security-Probleme." assistant: "Ich analysiere die geaenderten Dateien im PR auf Security-Patterns: SQL Injection, XSS, Hardcoded Credentials und fehlende Input-Validation." <Task tool call to security-scanner agent> </example>
The English summary is being prepared. Showing the original description.
Run a Busabase-backed job-search outreach desk with a bundled Hono App-in-Skill deployable to AirApp. Use when the user invokes $kelly-jobhunt or /kelly-jobhunt, wants to turn a resume into a structured profile and a typeset PDF, wants to find target companies and their contact addresses instead of applying through a job board, wants one tailored application email drafted per company, or wants to review and approve each send. Four subcommands - setup, profile, research, send - plus the desk itself. One company receives exactly one email; mailbox credentials live in the Busabase Vault and never reach browser code.
The English summary is being prepared. Showing the original description.
Detect Kerberoasting attacks by monitoring for anomalous Kerberos TGS requests targeting service accounts with SPNs for offline password cracking.
The English summary is being prepared. Showing the original description.
Detects early-stage ransomware indicators in network traffic before encryption begins, including initial access broker activity, command-and-control beaconing, credential harvesting, reconnaissance scanning, and staging behavior. Uses network detection tools (Zeek, Suricata, Arkime), SIEM correlation rules, and threat intelligence feeds to identify ransomware precursor patterns such as Cobalt Strike beacons, Mimikatz network signatures, and RDP brute-force attempts. Activates for requests involving pre-ransomware detection, network-based ransomware indicators, or early warning ransomware monitoring.
The English summary is being prepared. Showing the original description.
Detect Kerberos Pass-the-Ticket (PtT) attacks by analyzing Windows Event IDs 4768, 4769, and 4771 for anomalous ticket usage patterns in Splunk and Elastic SIEM
The English summary is being prepared. Showing the original description.
Detect Kerberos Golden Ticket forgery by analyzing Windows Event ID 4769 for RC4 encryption downgrades (0x17), abnormal ticket lifetimes, and krbtgt account anomalies in Splunk and Elastic SIEM
The English summary is being prepared. Showing the original description.
Detects and analyzes malicious behavior in mobile applications through behavioral analysis, permission abuse detection, network traffic monitoring, and dynamic instrumentation. Use when analyzing suspicious mobile applications for data exfiltration, command-and-control communication, credential stealing, SMS interception, or other malware indicators. Activates for requests involving mobile malware analysis, app behavior monitoring, trojan detection, or suspicious app investigation.
The English summary is being prepared. Showing the original description.
Detect Mimikatz execution through command-line patterns, LSASS access signatures, binary indicators, and in-memory detection of known modules.
The English summary is being prepared. Showing the original description.
Detect Golden Ticket attacks in Active Directory by analyzing Kerberos TGT anomalies including mismatched encryption types, impossible ticket lifetimes, non-existent accounts, and forged PAC signatures in domain controller event logs.
The English summary is being prepared. Showing the original description.
Deploys and monitors ransomware canary files across critical directories using Python's watchdog library for real-time filesystem event detection. Places strategically named decoy files that mimic high-value targets (financial records, credentials, database exports) in locations ransomware typically enumerates first. Monitors for any read, modify, rename, or delete operations on canary files and triggers immediate alerts via email, Slack webhook, or syslog when interaction is detected, providing early warning before full encryption begins.
The English summary is being prepared. Showing the original description.
Deploys deception-based honeytokens in Active Directory including fake privileged accounts with AdminCount=1, fake SPNs for Kerberoasting detection (honeyroasting), decoy GPOs with cpassword traps, and fake BloodHound paths. Monitors Windows Security Event IDs 4769, 4625, 4662, 5136 for honeytoken interaction. Use when implementing AD deception defenses for detecting lateral movement, credential theft, and reconnaissance.
The English summary is being prepared. Showing the original description.
Detect unusual API call patterns in AWS CloudTrail logs using boto3, statistical baselining, and behavioral analysis to identify credential compromise, privilege escalation, and unauthorized resource access.
The English summary is being prepared. Showing the original description.
Detect DCSync attacks where adversaries abuse Active Directory replication privileges to extract password hashes by monitoring for non-domain-controller accounts requesting directory replication via DsGetNCChanges.
The English summary is being prepared. Showing the original description.
Performs memory forensics analysis using Volatility 3 to extract evidence of malware execution, process injection, network connections, and credential theft from RAM dumps captured during incident response. Covers memory acquisition, process analysis, DLL inspection, and malware detection. Activates for requests involving memory forensics, RAM analysis, Volatility framework, memory dump investigation, volatile evidence analysis, or live memory acquisition.
The English summary is being prepared. Showing the original description.