데이터·AI 스킬

Identify poisoned training data and backdoored models across the ML pipeline.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Conducts external reconnaissance using Open Source Intelligence (OSINT) techniques to map an organization's external attack surface without directly interacting with target systems. The tester gathers information from public sources including DNS records, certificate transparency logs, search engines, social media, code repositories, and data breach databases to build a comprehensive target profile. Activates for requests involving OSINT reconnaissance, external footprinting, attack surface mapping, or passive information gathering.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Wire Promptfoo and DeepTeam into CI/CD for automated regression red-teaming of LLM apps against OWASP LLM Top 10 and OWASP Agentic presets, failing the build when jailbreak or injection vulnerabilities regress.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Build collaborative forensic incident timelines using Timesketch to ingest, normalize, and analyze multi-source event data for attack chain reconstruction and investigation documentation.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

OpenCTI is an open-source platform for managing cyber threat intelligence knowledge, built on STIX 2.1 as its native data model. This skill covers building an automated IOC enrichment pipeline using O

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Build a systematic threat hunt hypothesis framework that transforms threat intelligence, attack patterns, and environmental data into testable hunting hypotheses.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Analyzes RAM memory dumps from compromised systems using the Volatility framework to identify malicious processes, injected code, network connections, loaded modules, and extracted credentials. Supports Windows, Linux, and macOS memory forensics. Activates for requests involving memory forensics, RAM analysis, volatile data examination, process injection detection, or memory-resident malware investigation.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Identify ransomware network indicators including C2 beaconing patterns, TOR exit node connections, data exfiltration flows, and encryption key exchange via Zeek conn.log and NetFlow analysis

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Parse NetFlow v9 and IPFIX records to detect volumetric anomalies, port scanning, data exfiltration, and C2 beaconing patterns. Uses the Python netflow library to decode flow records, builds traffic baselines, and applies statistical analysis to identify flows with abnormal byte counts, connection durations, and periodic timing patterns.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Detect and analyze covert communication channels used by malware including DNS tunneling, ICMP exfiltration, steganographic HTTP, and protocol abuse for C2 and data exfiltration.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Captures and analyzes network packet data using Wireshark and tshark to identify malicious traffic patterns, diagnose protocol issues, extract artifacts, and support incident response investigations on authorized network segments.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Analyzes network traffic generated by malware during sandbox execution or live incident response to identify C2 protocols, data exfiltration channels, payload downloads, and lateral movement patterns using Wireshark, Zeek, and Suricata. Activates for requests involving malware network analysis, C2 traffic decoding, malware PCAP analysis, or network-based malware detection.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Monitor and analyze ransomware group data leak sites (DLS) to track victim postings, extract threat intelligence on group tactics, and assess sector-specific ransomware risk for proactive defense.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Map advanced persistent threat (APT) group tactics, techniques, and procedures (TTPs) to the MITRE ATT&CK framework using the ATT&CK Navigator and attackcti Python library. The analyst queries STIX/TAXII data for group-technique associations, generates Navigator layer files for visualization, and compares defensive coverage against adversary profiles. Activates for requests involving APT TTP mapping, ATT&CK Navigator layers, threat actor profiling, or MITRE technique coverage analysis.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Analyzes structured and unstructured threat intelligence feeds to extract actionable indicators, adversary tactics, and campaign context. Use when ingesting commercial or open-source CTI feeds, evaluating feed quality, normalizing data into STIX 2.1 format, or enriching existing IOCs with campaign attribution. Activates for requests involving ThreatConnect, Recorded Future, Mandiant Advantage, MISP, AlienVault OTX, or automated feed aggregation pipelines.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Analyze the threat landscape using MISP (Malware Information Sharing Platform) by querying event statistics, attribute distributions, threat actor galaxy clusters, and tag trends over time. Uses PyMISP to pull event data, compute IOC type breakdowns, identify top threat actors and malware families, and generate threat landscape reports with temporal trends.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Test vector stores for embedding inversion, cross-tenant leakage, and poisoning.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Parse Apache and Nginx access logs to detect SQL injection attempts, local file inclusion, directory traversal, web scanner fingerprints, and brute-force patterns. Uses regex-based pattern matching against OWASP attack signatures, GeoIP enrichment for source attribution, and statistical anomaly detection for request frequency and response size outliers.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Extract DPAPI-protected secrets such as credentials and browser data offline and online.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use whenever the user asks anything about OpenAI products, APIs, models, or SDKs — including factual lookups ("what is the newest model", "does X support Y"), build/coding requests ("write a script using the Responses API"), latest/current/default-model prompting guidance, model migrations, and citation requests. Invoke before calling any openaiDeveloperDocs MCP tool.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Add or revise retrieval-quality eval fixtures under istaroth/rag/eval/retrieval_fixtures/ (one JSON file per category, e.g. breadth.json). Use when asked to add a retrieval eval case, add a new eval category, improve a fixture's ground truth, or harden fixtures against false misses. Fixtures grade whether retrieval surfaces the sources a query needs, measured by passage-anchored facet coverage.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

[Planning] Use when a workflow step or the user asks for adversarial scenarios for failure, data integrity, access, replay and recovery risks before planning.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

[Code Quality] Use when a workflow step or the user asks for AI code or plan review: LLM calls, prompts, agents, RAG, evals and guardrails. --mode={code|plan}; --report-only is read-only.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use at the Mem Off hackathon. Keeps a running, evidence-backed report on how the participant's memory system performed for their coding agent during the day — what the harness measured, what cognee-report's scorecard says, what was recalled and whether it helped — in ./memoff-report.md and ./memoff-report.json. The report is submitted together with the action results; it never contains quotes, keys, data or names.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.