В каталоге 183 730 навыков в 14 категориях.
Detecting misconfigured Azure Storage accounts including publicly accessible blob containers, missing encryption setting...
<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
Detect command injection attacks against Modbus TCP/RTU protocol in ICS environments by monitoring for unauthorized writ...
This skill covers detecting anomalies in Modbus/TCP and Modbus RTU communications in industrial control systems. It addr...
Deploys and configures Zeek (formerly Bro) network security monitor to passively analyze network traffic, generate struc...
Detect network reconnaissance and port scanning using Suricata and Snort IDS signatures, threshold-based detection rules...
Detects null pointer dereference vulnerabilities by identifying unchecked pointer usage and missing validation. Use when...
Detects and responds to OAuth token theft and replay attacks in cloud environments, focusing on Microsoft Entra ID (Azur...
Detect and respond to OAuth token theft and replay in Microsoft Entra ID (Azure AD), covering access token theft, refres...
Detects off-by-one errors by identifying incorrect loop conditions, array indexing mistakes, and boundary condition prob...
Detect Pass-the-Hash attacks by analyzing NTLM authentication patterns, identifying Type 3 logons with NTLM where Kerber...
Detect Pass-the-Hash (T1550.002) attacks by analyzing NTLM authentication patterns, flagging Type 3 logons using NTLM wh...
Detect Kerberos Pass-the-Ticket (PtT) attacks by analyzing Windows Event IDs 4768, 4769, and 4771 for anomalous ticket u...
This skill enables AI assistant to detect and resolve performance bottlenecks in applications. it analyzes cpu, memory,...
Compare current benchmark results against historical baselines to spot performance regressions. Use as an explicit/manua...
Automatically detect performance regressions in CI/CD pipelines by comparing metrics against baselines. Use when validat...
Detects unsafe pointer subtraction operations that can lead to incorrect size calculations and integer underflow. Use wh...
Configures Fail2ban with custom filters and actions to detect port scanning activity, SSH brute force attempts, and netw...
Detects privilege escalation vulnerabilities including setuid/setgid abuse, permission check bypasses, and unsafe privil...
Detect privilege escalation attempts including token manipulation, UAC bypass, unquoted service paths, kernel exploits,...
Detect and prevent privilege escalation in Kubernetes pods by monitoring security contexts, capabilities, and syscall pa...
Detect process hollowing (T1055.012) by analyzing memory-mapped sections, hollowed process indicators, and parent-child...
Detects process injection in a memory image by identifying private executable regions with no file backing, RWX protecti...
Detects and analyzes process injection techniques used by malware including classic DLL injection, process hollowing, AP...
Computes disproportionality signals — PRR, ROR, EBGM, and IC (BCPNN) — over FAERS / OpenFDA drug-event data to flag pote...
Detect and prevent QR code phishing (quishing) attacks that bypass traditional email security by embedding malicious URL...
Detects race condition vulnerabilities including TOCTOU, double-checked locking issues, and shared state problems. Use w...
Detects ransomware encryption activity in real time using entropy analysis, file system I/O monitoring, and behavioral h...
Detects early-stage ransomware indicators in network traffic before encryption begins, including initial access broker a...
Detect RDP brute force attacks by analyzing Windows Security Event Logs for failed authentication patterns (Event ID 462...
Detects rootkit presence on compromised systems by identifying hidden processes, hooked system calls, modified kernel st...
Detecting data exfiltration attempts from AWS S3 buckets by analyzing CloudTrail S3 data events, VPC Flow Logs, GuardDut...
Detects sandbox and analysis evasion techniques in a sample by scanning static strings, imports, and API traces for VM a...
Detect UEFI Secure Boot bypasses and bootkits such as BlackLotus and Bootkitty by verifying Secure Boot state, checking...
Detect abuse of service accounts through anomalous interactive logons, privilege escalation, lateral movement, and unaut...
Detect abuse of service accounts by hunting for anomalous interactive logons, privilege escalation, and lateral movement...
Discover and inventory shadow API endpoints that operate outside documented specifications using traffic analysis, code...
Discover and inventory shadow API endpoints that operate outside documented OpenAPI/Swagger specs, using traffic analysi...
Detect unauthorized SaaS and cloud service usage (shadow IT) by analyzing proxy logs, DNS query logs, and netflow data u...
Detect unauthorized SaaS and cloud service usage (shadow IT) by parsing proxy access logs, DNS query logs, and firewall/...
Detects unsafe signed/unsigned integer conversions that can lead to integer overflow and security check bypasses. Use wh...
Spearphishing targets specific individuals using personalized, researched content that bypasses generic spam filters. Em...
Analyze WAF (ModSecurity/AWS WAF/Cloudflare) logs to detect SQL injection attack campaigns. Parses ModSecurity audit log...
Detect and analyze SQL injection vulnerabilities in application code and database queries.Use when you need to scan code...
Scan all artifacts for confidence metadata and report staleness using pure derived scoring.
This skill covers detecting sophisticated cyber-physical attacks that follow the Stuxnet attack pattern of modifying PLC...
Detects sophisticated cyber-physical attacks that follow the Stuxnet pattern of modifying PLC logic while spoofing senso...
Scans GitHub Actions workflows and CI/CD pipeline configurations for supply chain attack vectors including unpinned acti...
Detects suspicious use of assertions for security checks that can be disabled in production builds. Use when analyzing a...
Detect risky OAuth application consent grants in Azure AD / Microsoft Entra ID using Microsoft Graph API, audit logs, an...
Detect suspicious PowerShell execution patterns including encoded commands, download cradles, AMSI bypass attempts, and...
Detect OS credential dumping techniques targeting LSASS memory, SAM database, NTDS.dit, and cached credentials using EDR...
Detect process injection techniques (T1055) including classic DLL injection, process hollowing, and APC injection by ana...
Detect abuse of elevation control mechanisms including UAC bypass, sudo exploitation, and setuid/setgid manipulation by...
Text-prompted image zone detection using TIPSv2 B/14 on CPU. Produces `focus_targets` / `focus_edges` bbox lists from na...
Detects type confusion vulnerabilities by identifying unsafe type casts, vtable corruption, and polymorphism issues. Use...
Flag misspelled, brandjacked, and typosquatted package names across npm, PyPI, and crates.io before installation, using...
Detects typosquatting attacks in npm and PyPI package registries by analyzing package name similarity using Levenshtein...
Detects unchecked return values of memory allocation functions like malloc, calloc, and realloc that can lead to null po...
Detects use-after-free vulnerabilities by identifying pointer dereferences after memory deallocation. Use when analyzing...
Detect WMI event subscription persistence by analyzing Sysmon Event IDs 19, 20, and 21 for malicious EventFilter, EventC...
Detect WMI event subscription persistence (MITRE T1546.003) by analyzing Sysmon Event IDs 19, 20, and 21 for malicious E...
Security detection use cases for identifying threats across network, endpoint, identity, cloud, application, and email v...
Builds the capability to notice an attack in progress — deciding what to log and retain, centralizing it somewhere tampe...
Use when building detections as versioned, tested code. Covers Sigma rule authoring, detection pipelines, unit testing d...
Create detection rules and hunting queries from malware analysis findings. Use when you need to write Sigma rules for SI...
Detection engineering skill for writing, testing, and tuning Sigma, YARA, YARA-L, Suricata, Snort, Zeek, KQL, SPL, EQL,...
Build, test, and tune defensive detections from logs and telemetry — turn an attack technique or an observed finding int...
Beginner-friendly reverse-engineering workflow for Detection Engineering. Use it to collect evidence, choose static or d...
Guides creation of detection rules using Sigma rule specification and the Palantir Alerting and Detection Strategy (ADS)...
Builds detection rules that are proven before they ship — fire on known-bad, stay silent on known-good — and keeps false...
Plans and records bounded defensive tests of whether preventive controls, telemetry, and detections remain effective acr...
Runs attacker techniques and confirms whether detections actually fire, producing an honest ATT&CK coverage map that sep...
Research external context for a dataset — domain background, history, related studies, and why this data matters. Output...
Engenharia reversa de specs para sistemas legados. Use quando precisar extrair specs executaveis, regras de negocio, con...
Detects SpecWeave context and provides workflow documentation for available commands. Use when learning SpecWeave comman...
Create new vision detector plugins following Bob The Skull's detector architecture. Use when adding new detectors like o...
This skill allows the agent to determine and structure the immediate next steps before executing anything. It ensures ac...
Determine current task from state files and git context
Use when verifying outcomes with code instead of LLM judgment, versioning prompts with hashes, or ensuring reproducible...
Scan the C# simulation and controller code for non-deterministic patterns that break reproducibility: wall-clock reads,...
The determinism spec for every build: what is filed literally (the estimand, every convention), what may stay open (the...
The determinism policy of RFC 0004, and how to satisfy it rather than route around it. Use when writing or reviewing any...
Use this skill when designing mine-rs deterministic tools, JSON schemas, VFS artifacts, task tools, subagents, verifier...
执行msProbe数据比对并分析比对结果，定位确定性计算问题首个输入一致输出不一致的API。
Use before committing, opening a PR, or reporting a task done — when you want ground-truth confirmation there are no con...
Render the UI and prove it's balanced and usable: a deterministic layout audit plus a vision-model-judged usability pass...
Render the UI and prove it's balanced + usable: a deterministic layout audit (centroid / optical-center / pixel-oracle b...
Master side-effect design under StrictMode and concurrent rendering, ensuring deterministic behavior.
Run deterministic, scriptable pre-PR verification gates (build, full test suite, coverage threshold, branch naming, chan...
Test distributed systems in the style of TigerBeetle and Joran Dirk Greef, using deterministic simulation and time compr...
Use this skill when the operator needs Detsky Mir data — prices and availability for kids' and baby goods, toys, strolle...
Provides comprehensive guidance for Detox mobile testing framework including React Native testing, E2E testing, and test...
Gray-box end-to-end testing for React Native apps with Detox. Covers .detoxrc.js configuration, build and test commands,...
Эксперт Detox тестирования. Используй для React Native E2E tests и mobile automation.
Authors React Native E2E tests with Detox (Wix) - gray-box architecture (runs in-process with the app), `element(by.id|b...
Simulate DETR p2p networking layer message passing outside Substrate defaults.