41 skills · sorted by relevance
Set up a Gmail out-of-office reply with a custom subject and message. The recipe covers enabling automatic replies, checking the saved settings, and turning the responder off when the absence ends.
Investigate NTLM relay, an attack that forwards authentication messages to another service, by comparing Windows login events with host inventories. Use the supplied queries and audits to identify suspicious sources, weaker authentication, and gaps in signing enforcement.
Assess an internal network from the position of an intruder or malicious insider. Covers discovering systems, testing paths to other machines and higher privileges, demonstrating sensitive data access, and documenting findings with remediation recommendations.
Plan authorized internal network assessments covering traffic interception, spoofed network services, network separation, and access controls. The skill combines testing workflows with traffic analysis guidance and indicators defenders can use to detect suspicious activity.
Expert SRE incident responder specializing in rapid problem resolution, modern observability, and comprehensive incident management. Masters incident command, blameless post-mortems, error budget management, and system reliability patterns. Handles critical outages, communication strategies, and continuous improvement. Use IMMEDIATELY for production incidents or SRE practices.
The English summary is being prepared. Showing the original description.
Execute advanced Man-in-the-Middle (MITM) NTLM Relay attacks specifically targeting environments where SMB Signing is purportedly enabled but improperly configured (e.g., exclusively required on Domain Controllers but NOT enforced universally on standard Workstations or File Servers). Utilize powerful tools like Responder and Impacket's NTLMRelayX to coercively capture NTLMv2 authentications (via LLMNR, WPAD, or Coercion methods like PetitPotam) and seamlessly relay them across the network identically yielding immediate Local Administrator command execution.
The English summary is being prepared. Showing the original description.
Detect NTLM relay attacks through Windows Security Event correlation by analyzing Event 4624 LogonType 3 for IP-to-hostname mismatches, identifying Responder/LLMNR poisoning artifacts, auditing SMB and LDAP signing enforcement across the domain, and detecting NTLM downgrade attacks from NTLMv2 to NTLMv1 using event log analysis.
The English summary is being prepared. Showing the original description.
Expert SRE incident responder specializing in rapid problem resolution, modern observability, and comprehensive incident management.
The English summary is being prepared. Showing the original description.
Detect NTLM relay attacks through Windows Security Event correlation by analyzing Event 4624 LogonType 3 for IP-to-hostname mismatches, identifying Responder/LLMNR poisoning artifacts, auditing SMB and LDAP signing enforcement across the domain, and detecting NTLM downgrade attacks from NTLMv2 to NTLMv1 using event log analysis.
The English summary is being prepared. Showing the original description.
Generates ADR Responder classes for PHP 8.5. Creates HTTP response builders with PSR-7/PSR-17 support. Includes unit tests.
The English summary is being prepared. Showing the original description.
Expert SRE incident responder specializing in rapid problem resolution, modern observability, and comprehensive incident management. Masters incident command, blameless post-mortems, error budget management, and system reliability patterns. Handles critical outages, communication strategies, and continuous improvement. Use IMMEDIATELY for production incidents or SRE practices.
The English summary is being prepared. Showing the original description.
Detect NTLM relay attacks through Windows Security Event correlation by analyzing Event 4624 LogonType 3 for IP-to-hostname mismatches, identifying Responder/LLMNR poisoning artifacts, auditing SMB and LDAP signing enforcement across the domain, and detecting NTLM downgrade attacks from NTLMv2 to NTLMv1 using event log analysis.
The English summary is being prepared. Showing the original description.
Design production alerts, route notifications by severity, and organize on-call schedules. Use configuration examples to define backup contacts, escalation steps when alerts go unanswered, and runbooks that guide responders through incident investigation.
Prepare handoffs between engineers responsible for responding to system incidents. Organize active incidents, investigations, recent changes, and upcoming events into shift summaries, with guidance for mid-incident transfers, asynchronous updates, and checks that the incoming engineer receives alerts.
Build a two-tier certificate authority with OpenSSL and Python, separating the offline root from the issuing authority. Covers server and client certificates, revocation checks, and policies that define certificate usage and trust.
Draft malware incident communications for internal teams, executives, IT responders, customers, and regulators. Provides structured templates and severity-based notification workflows to organize impact details, response actions, decisions needed, and the timing of updates.
Investigate ransomware payment addresses using public blockchain records. Trace transfers, group addresses likely controlled by the same entity, identify links to exchanges or mixing services, and organize findings into a report for incident responders and investigators.
Create a feedback form in Google Forms, retrieve its respondent link, and send that link through Gmail. The workflow connects form creation with an email invitation asking recipients to share feedback.
Structure responses to buyer questionnaires and proposal requests by classifying requirements, matching claims to verifiable evidence, and exposing gaps. Develop buyer-focused reasons to choose your offer and estimate win probability to support bid decisions.
Route pricing, discount, partnership, sales channel, proposal response, and bookings forecast questions to one of seven specialist skills. Receive a concise digest of findings, recommended actions, and output files to support commercial decisions and human approval.
Triage Google SecOps alerts by checking logs, related cases, asset importance, and threat intelligence. Classify findings, adjust severity and priority, and document evidence for closing benign cases or handing suspicious activity to incident responders.
Add native macOS behavior when SwiftUI alone falls short. Choose a small AppKit bridge for views, windows, panels, or menus, while clarifying state ownership, data flow, and lifecycle risks that need validation.
Use this skill when the user is doing hands-on DOCA RDMI (RDMA Initiator) programming — picking doca-rdmi vs doca-rdma for an accelerator-initiated one-sided RDMA flow, standing up a doca_rdmi_connection or doca_rdmi_poster, attaching a doca_dpa_completion or doca_verbs_cq before doca_ctx_start(), retrieving the DPA-side handle for a DPA kernel, auditing whether a doca_rdmi_* symbol is EXPERIMENTAL on this DOCA, or debugging DOCA_ERROR_* returns from RDMI calls. Trigger even when the user does not say "DOCA RDMI" or "initiator" — implicit phrasings include "my DPA kernel needs to post RDMA writes to a remote responder", "DPA kernel sees no completions", "function not found on doca_rdmi_* at link time", "DOCA_ERROR_BAD_STATE from completion attach", or "the DPA posted but the work request never arrived". Refuse and route elsewhere for two-sided or host-CPU RDMA, the DPA programming model, GPU-side RDMA initiation, or general RDMA/IB/RoCE concepts — those belong to other skills.
The English summary is being prepared. Showing the original description.
Designs studies for predicting treatment response or resistance in biomedical and clinical research. Always use this skill when the user needs a treatment-response or resistance prediction study blueprint rather than a prognostic biomarker protocol, diagnostic test design, causal treatment-effect estimation, or a completed manuscript. Focus on responder definition, treatment context, baseline comparability, feature integration strategy, model development logic, validation architecture, and interpretation boundaries. Do not invent response rates, cohort size, assay readiness, regimen uniformity, literature support, or validation access.
The English summary is being prepared. Showing the original description.