Security Operations Bundle

A collection of skills to automate and enhance threat detection, investigation, and response.

Browse all skill bundles

Included Skills (100)

Postgres Egress Optimizer — This tool helps developers identify and refactor inefficient query patterns to reduce excessive data transfer costs from their Neon Postgres database.
SecOps Threat Hunter — This skill empowers security analysts to proactively identify undetected threats and perform retroactive indicator analysis using advanced UDM queries within Google SecOps.
Tao Train Mask Auto Label — MAL (Mask Auto-Label) for weakly-supervised segmentation. Produces segmentation masks from minimal annotations
Gke Productionize — Orchestrates comprehensive production readiness reviews and assessments for GKE clusters and workloads across scalability, security, reliability, observability, backup/DR, and cost optimization. Use when asked to productionize, prepare, assess, audit, or review a GKE cluster or workload before going live to production. Don't use for deep-dive single-domain implementation (use specific domain skills like gke-workload-scaling, gke-platform-security, gke-workload-security, gke-service-networking, gke-reliability instead).
Secops Investigate — Expert guidance for deep security incident and entity investigations in Google SecOps. Use when investigating cases, analyzing entities (hosts, IPs, domains, hashes, users), extracting and searching UDM events, performing asset and user timeline analysis, and detecting lateral movement across enterprise networks. Don't use for detection rule authoring or YARA-L tuning (use secops-detection-engineering), proactive hypothesis-driven hunting (use secops-hunt), initial alert triage (use secops-triage), or basic case status updates (use secops-cases).
Neon Branch Manager — This skill helps developers create and manage Neon Postgres branches for safe migration testing, isolated development environments, and secure schema-only data workflows.
PostgreSQL Code Reviewer — This assistant provides expert PostgreSQL code reviews, helping developers optimize schema design, JSONB operations, and security features to ensure high-performance database implementations.
Doca Urom Svc — Operate the DOCA UROM Service container on BlueField Arm for remote memory operations (puts, gets, atomics, collectives) enqueued by a paired host using `doca-urom`: pull the NGC image, choose the UCX component, size queues, configure Comch pairing, and align host and service versions. SECURITY: the service has no standalone access control; Comch pairing and RDMA permissions are the boundary. Pair only intended hosts, expose least-privilege memory regions, and verify both views before start. Trigger for slow UCX collectives, unexpected NOT_PERMITTED, or missing completions. Do not use for host application code, MPI/UCX integration design, or DOCA install.
Doca Dms — Operate NVIDIA DOCA Management Service on a BlueField, Arm/x86 host, or Kubernetes pod: from DOCA 3.5 the local `dms-cli` (one command per YANG path, no server), and the `dmsd` + `dmspe` service: choose deployment and authentication, configure `-allowed_users` and `dmsgroup`, use gNMI Get/Set/Subscribe, run supported gNOI workflows, and debug frontend/backend failures. Trigger even without "DMS" for "manage a remote BlueField over gRPC", "gNOI reboot from orchestrator", or fleet-management requests. SAFETY: reboot, OS install, factory-reset, and managed-file deletion are destructive and require target-bound explicit confirmation; never invoke them speculatively. Route installation and library/API build questions elsewhere, and route turnkey aggregation to the externally-productized DOCA Telemetry Service.
Doca Flow Dpa Perf — Use this skill when the user is invoking doca_flow_dpa_perf on DPA-capable hardware (ConnectX-7 minimum supported, ConnectX-8 recommended, or BlueField-3) to measure rule update / disable rates on the DPA-offloaded DOCA Flow path — picking the active / passive device split, choosing workload-shape axes (burst, queue, completion threshold, workers, hash pipe algo, PSL tables), or reading Kops/sec iteration stats and the optional self-test. Trigger even when the user does not explicitly mention "doca_flow_dpa_perf" or "DPA Provider" — typical implicit phrasings include "how fast can the DPA program path-selector entries", "baseline rule-update rate on ConnectX-8", "tool reports zero ops on my BlueField", "self-test sentinel never shows on tcpdump", or "is my BlueField-2 DPA-capable". Refuse and route elsewhere for the host / DPU-CPU Flow path (doca-flow-perf), Flow pipeline tuning (doca-flow-tune), writing doca-flow / doca-dpa applications, or DOCA install — those belong to other skills.
Doca Argus — Use this skill when the user is deploying or operating the DOCA Argus Service — the packaged BlueField-side runtime-security container that watches the BlueField and attached host for suspicious activity, integrity violations, and operational anomalies, and forwards findings to a SIEM (Splunk / ELK / Sentinel / syslog). Covers the four-axis config (detection policy, forwarding, sampling, host coverage), running the NGC container on BlueField Arm, and wiring the forwarder. Trigger even without "DOCA Argus" by name — typical implicit phrasings: "container green but no findings arrive", "false-positive flood in Splunk", or "runtime security on a fleet of BlueField-3s". Refuse and route elsewhere for installing DOCA, SIEM-side ingest stanzas, pre-baked detection-rule packs, and metrics observability (DOCA Telemetry). Argus is NVIDIA's currently- promoted runtime-security framework, superseding the older App Shield library; name it first for new runtime-security work.
Doca Upgrade — Changing DOCA versions safely: upgrading or downgrading the host DOCA packages, refreshing the BlueField BFB, bumping the NGC DOCA container tag, or rolling back, with the discipline detect -> report -> ASK -> only then a guided upgrade. Trigger on "is there a newer DOCA", "I want the newest DOCA features, can I just apt upgrade in place", "should I move to the next release", "the upgrade stopped midway and dpkg is in a broken state", "my component is being deprecated, what now", or "roll me back", even without the word upgrade. Detect what is installed, find the newer release, report the gap, then STOP and ask for explicit confirmation; never upgrade automatically. Do not use it for a runtime error on an unchanged install (doca-debug). Version detection alone belongs to doca-version, first-time install to doca-setup, any hardware / firmware / reboot step to doca-hardware-safety, and public-docs or sunset routing to doca-public-knowledge-map.
Implementing Microsegmentation With Guardicore — Implements microsegmentation with Akamai Guardicore Segmentation to map
CloudTrail Security Analyst — This tool assists security engineers in implementing AWS CloudTrail log analysis to detect unauthorized access, privilege escalation, and suspicious API activity.
Exploiting Vulnerabilities With Metasploit Framework — Uses the Metasploit Framework (msfconsole and its exploit, auxiliary,
Implementing Ransomware Kill Switch Detection — Analyzes ransomware kill switch mechanisms, including mutex-based execution
Analyzing Cobalt Strike Beacon Configuration — Extract and analyze Cobalt Strike beacon configuration from PE files
Implementing Application Whitelisting With Applocker — Implements application whitelisting using Windows AppLocker to restrict
Evasion Detection Analyst — This tool identifies adversary defense evasion techniques within endpoint logs to assist security analysts in threat hunting and building robust detection engineering rules.
Spec Driven Workflow — Use when the user asks to write specs before code, define acceptance criteria, plan features before implementation, generate tests from specifications, or follow spec-first development practices.
Cloud Forensic Acquisition — This tool assists digital forensic investigators by collecting cloud-based evidence and local sync-client artifacts for incident response and e-discovery investigations.
Operating Sliver C2 — Stand up a Sliver C2 server and mTLS listeners, generate cross-platform implants and beacons, and run post-exploitation, pivoting, and BOF/.NET tooling via the Armory for adversary emulation. Use during authorized, rules-of-engagement-bound red-team engagements that need a full open-source C2 lifecycle spanning server setup, implant generation, and post-exploitation tradecraft.
Enterprise .NET Architect — This expert assistant helps developers build scalable, secure, and high-performance ASP.NET Core 8+ backend services using industry-standard patterns and robust data access strategies.
Hunting For Defense Evasion Via Timestomping — Detect NTFS timestamp manipulation (MITRE T1070.006) by comparing $STANDARD_INFORMATION
Audit Logging — Implement centralized audit logging and SIEM integration. Configure log
Eradicating Malware From Infected Systems — Systematically map and remove malware, backdoors, and attacker persistence
Extracting Iocs From Malware Samples — Extracts indicators of compromise (IOCs) from malware samples, including
Detecting Rootkit Activity — Detects rootkit presence on compromised systems by identifying hidden
Analyzing Memory Dumps With Volatility — Analyzes RAM memory dumps from compromised systems using the Volatility framework to identify malicious processes,
Implementing Mitre Attack Coverage Mapping — Implement MITRE ATT&CK coverage mapping to identify detection gaps, prioritize
Agile Product Owner — Agile product ownership for backlog management and sprint execution. Covers user story writing, acceptance criteria, sprint planning, and velocity tracking. Use when writing user stories, creating acceptance criteria, planning sprints, estimating story points, breaking down epics, or prioritizing the backlog.
Exploiting Insecure Data Storage In Mobile — Identifies and exploits insecure local data storage vulnerabilities
Review Swarm — Reviews a diff with several independent read-only reviewer agents running at the same time, each looking through one lens (correctness, security, data, concurrency, compatibility, tests), then checks every claim against the code and merges the survivors into one prioritized report. Use when the user says "review swarm", "review this branch with parallel agents", "multi-agent code review", "get several reviewers on my diff", or wants a deeper pre-merge review than a single pass gives. It reports problems and does not change code.
Incident Response Architect — Designs structured, compliant incident response playbooks and automated SOAR workflows to help cybersecurity teams standardize their threat detection and mitigation procedures.
OAuth Token Security — This skill helps security professionals detect and mitigate OAuth token theft and session hijacking attacks within Microsoft Entra ID environments.
Detecting Modbus Command Injection Attacks — Detect command injection against Modbus TCP/RTU in ICS/SCADA environments by monitoring unauthorized writes, anomalous function codes, malformed frames, and deviations from communication baselines using ICS-aware IDS and deep packet inspection. Use when deploying IDS for Modbus OT networks, investigating unauthorized PLC register/coil changes, or responding to FrostyGoop-style Modbus attacks.
Performing Memory Forensics With Volatility3 Plugins — Analyze memory dumps using Volatility3 plugins to detect injected code,
NetExec Lateral Movement — This tool assists penetration testers in validating credentials, enumerating network services, and executing post-exploitation tasks across diverse protocols within authorized Active Directory environments.
Windows Amcache Analyzer — Parses Windows Amcache registry hives to help digital forensics investigators reconstruct program execution timelines and identify malicious software artifacts during incident response.
Post Exploiting Microsoft Graph With Graphrunner — Runs GraphRunner, a PowerShell post-exploitation toolset built on
Industrial Network Segmenter — Designs IEC 62443-compliant security zones and conduits for industrial control systems to help engineers secure operational technology networks against cyber threats.
Entra ID Auditor — This tool helps security professionals identify identity risks, misconfigurations, and policy gaps within Microsoft Entra ID environments to improve overall cloud security posture.
Performing Malware Ioc Extraction — Malware IOC extraction is the process of analyzing malicious software
Code Review Engine — This tool identifies actionable code defects by analyzing cross-boundary agreements, helping developers ensure system correctness, performance, and security through rigorous logical refutation.
Agent Skill Auditor — This tool analyzes agent skill performance using session data and static analysis to provide actionable, evidence-based recommendations for developers and AI engineers.
One On Ones — When the user needs to prepare for a 1:1 with a direct report, give feedback to a team member, handle a performance conversation, or says things like '1:1 with,' 'one on one,' 'give feedback to,' 'performance review,' 'how do I tell my [employee],' 'difficult conversation with,' 'skip-level,' 'coaching my team.' For founder-to-team management, not peer meetings.
Securing Agentic AI Tool Invocation — Implements defense-in-depth controls at an AI agent's tool-invocation
Implementing Anti Ransomware Group Policy — Configures Windows Group Policy Objects to block ransomware execution
Performing Initial Access With Evilginx3 — Perform authorized initial access using EvilGinx3 adversary-in-the-middle
Automating Ioc Enrichment — Automates the enrichment of raw indicators of compromise with multi-source
Operating Havoc C2 — The skill deploys a Havoc C2 team server with Yaotl malleable profiles and generates evasive Demon agents that use indirect syscalls and sleep obfuscation. It supports the full C2 lifecycle—server setup, implant generation, tasking, and lateral pivoting—enabling realistic adversary emulation for authorized red‑team engagements. Security professionals benefit from a comprehensive, rules‑of‑engagement‑compliant platform for post‑exploitation and pivoting operations.
Performing Static Malware Analysis With Pe Studio — Performs static analysis of Windows PE malware samples using PEStudio to examine file headers, imports, strings, and resources without executing the binary, identifying packing, anti-analysis tricks, and malicious imports. Use for pre-execution triage of a suspicious Windows executable before sandbox detonation.
Reverse Engineering Ransomware Encryption Routine — Reverse engineer ransomware encryption routines to identify cryptographic
Neon Postgres Expert — Provides comprehensive guidance and best practices for developers building applications with Neon Serverless Postgres, including configuration, branching, and SDK integration.
Performing Lateral Movement Detection — Detects lateral movement techniques including Pass-the-Hash, PsExec,
Reverse Engineering Malware With Ghidra — Reverse engineers malware binaries using NSA''s Ghidra disassembler and
Cloud Forensics Investigator — This tool assists cybersecurity professionals in collecting and analyzing cloud-native evidence to investigate security breaches across AWS, Azure, and GCP infrastructure environments.
Performing Packet Injection Attack — Crafts and injects custom network packets using Scapy, hping3, and Nemesis
Ransomware Exercise Facilitator — This tool plans and facilitates realistic ransomware tabletop exercises to help cybersecurity teams evaluate their incident response readiness against industry standards.
Production Readiness Auditor — This tool performs comprehensive post-deployment security and reliability audits on shipped repositories to identify critical infrastructure gaps for developers and engineering teams.
Performing Linux Log Forensics Investigation — Perform forensic investigation of Linux system logs including syslog,
Neon Object Storage — This S3-compatible storage solution enables developers to synchronize file assets with their Neon database branches for consistent development, staging, and production environments.
Cloud Forensic Investigator — This tool enables security professionals to perform forensic analysis on AWS logs using Athena to detect unauthorized access and potential data exfiltration.
Osquery Deployment Assistant — This tool helps security engineers deploy and configure osquery to gain fleet-wide endpoint visibility and perform SQL-based threat hunting across diverse operating systems.
Claude Power-User Coach — This skill teaches users to become Claude power users by providing tips and identifying optimization opportunities in their prompts.
Neon AI Gateway — This tool simplifies LLM integration by providing a unified API and credential system for developers to access multiple frontier and open-source models.
Detecting Ransomware Encryption Behavior — Detects ransomware encryption activity in real time using entropy
Detecting Lateral Movement In Network — Identifies lateral movement techniques in enterprise networks by analyzing
Performing Lateral Movement With Wmiexec — Perform lateral movement across Windows networks using WMI-based remote
Threat Intelligence Mapper — This skill maps threat actor behaviors to the MITRE ATT&CK framework to identify detection gaps and generate actionable intelligence reports for cybersecurity professionals.
Cyber Campaign Attribution — This skill assists threat intelligence analysts by systematically evaluating cyber-campaign evidence to generate confidence-weighted attribution assessments using established analytical frameworks like ACH.
Building Detection Rules With Sigma — Builds vendor-agnostic detection rules using the Sigma rule format for
Performing Cloud Penetration Testing With Pacu — Run authorized AWS penetration tests with Pacu, the open-source AWS exploitation
Apex Quality Guardrails — This skill enforces Salesforce Apex best practices, including bulk-safety, security compliance, and governor limit protection for developers building robust, scalable enterprise applications.
Cloudflare One Migrations — Assess and plan migrations from existing VPN, SWG, or SASE platforms to Cloudflare One, including policy mapping, parity gaps, and rollout.
Google Cloud Scc Remediation — Remediates Google Cloud Security Command Center findings, including IAM permission fixes, cloud resource misconfigurations, vulnerabilities, and Toxic Combinations. Use when asked to fix, remediate, or mitigate a Security Command Center finding or address attack paths. Don't use for general IAM policy querying without a Security Command Center finding. For runtime threat detections, this skill provides containment and investigation guidance rather than automated configuration fixes.
TDD Orchestrator — Master TDD orchestrator specializing in red-green-refactor discipline, multi-agent workflow coordination, and comprehensive test-driven development practices.
Network Packet Crafting — Craft custom TCP/UDP/ICMP packets using hping3 for network troubleshooting, firewall testing, and service probing on controlled systems.
Proofpoint Sandbox Implementation — This skill guides security professionals through configuring Proofpoint Targeted Attack Protection to detect zero-day malware and evasive phishing threats within email environments.
Cyber Kill Chain Analyst — This tool helps security professionals map intrusion activities to the Cyber Kill Chain to identify defensive gaps and improve incident response strategies.
Hunt Ato — Hunt account takeover taxonomy
Executing Active Directory Attack Simulation — Executes authorized attack simulations against Active Directory environments
Linux Hardening — Apply CIS benchmarks and secure Linux servers.
Template Deck Builder — Builds and edits PowerPoint decks bound to a company's own .pptx or .potx template, with a consulting-grade storyline and a rendered visual QA pass. Maps the template's masters, layouts, placeholders, theme colors and fonts; drafts a storyboard of action titles (pyramid principle, SCR) for approval; fills the template's own placeholders instead of drawing text boxes; adds native charts in theme colors, tables sized to placeholders, speaker notes and source lines; then renders every slide to PNG and checks text overflow, off-slide and overlapping shapes, off-theme fonts and colors, empty placeholders and weak titles. Use whenever the user says use our template, company deck, brand or corporate template, make slides, build a deck, pptx, potx, consulting-style deck, board or client presentation, action titles, or fix my deck formatting, and whenever an existing deck must be edited without breaking its masters. Complements the generic pptx skill.
Ransomware Canary Deployer — This tool deploys and monitors decoy files to provide early-warning ransomware detection for security professionals protecting file servers, NAS devices, and endpoints.
MITRE ATT&CK Mapper — This tool maps adversary behaviors and security alerts to MITRE ATT&CK techniques, helping security teams quantify detection coverage and prioritize control improvements.
Customer Review Analyst — This tool helps founders identify market pain points and competitor gaps by synthesizing user feedback from major review platforms and online communities.
Rust Malware Analyst — Analyzes Rust-compiled malware for security researchers by decoding complex fat pointers, monomorphized generics, and unique calling conventions within IDA Pro and Ghidra.
Detecting T1055 Process Injection With Sysmon — Detect process injection techniques (T1055) - including DLL injection, process
Beaconing Frequency Analyzer — This tool helps cybersecurity analysts detect command-and-control beaconing patterns in network traffic using statistical frequency analysis and jitter calculation techniques.
Logic Analysis Assistant — This tool provides deep logical code reviews for developers, identifying complex bugs, security vulnerabilities, and algorithmic flaws that standard linters typically overlook.
Entra Offensive Tool Hunter — This skill utilizes KQL to identify offensive Entra ID enumeration tools within Microsoft Sentinel logs, assisting security analysts in detecting unauthorized reconnaissance activity.
C2 Beaconing Detector — This tool identifies compromised endpoints by analyzing network traffic for C2 beaconing patterns, helping security analysts proactively detect adversary infrastructure communication.
Test-Driven Development — Guides building a feature or fixing a bug test-first with the red-green-refactor cycle: agree a list of behaviours, write one failing test, make it pass with the least code, tidy up while green, repeat. Covers reproducing bugs with a failing test, pinning down untested legacy code before changing it, and choosing what to replace with test doubles. Use when the user says "use TDD", "write the test first", "red-green-refactor", "test-drive this function", "add a regression test before fixing", or asks how to add tests while building.
Conducting Wireless Network Penetration Test — Conducts authorized wireless network penetration tests to assess the
Process Hollowing Detector — This tool assists threat hunters in identifying process hollowing techniques by analyzing memory-mapped sections and system telemetry to uncover malicious code injection.
Certificate Transparency Monitor — This tool queries Certificate Transparency logs to help security professionals detect phishing domains, unauthorized certificate issuance, and potential shadow IT infrastructure.
Secrets Encryptor — Encrypts configuration files and secrets for developers and DevOps teams.
Detecting T1003 Credential Dumping With Edr — Detect OS credential dumping (MITRE T1003) targeting LSASS memory, the SAM
AWS MCP Setup — Configure AWS MCP servers for documentation search and API access. Use when setting up AWS MCP, configuring AWS documentation tools, troubleshooting MCP connectivity, or when user mentions aws-mcp, awsdocs, uvx setup, or MCP server configuration.