4,624 skills sorted by stars.
Detect DCSync attacks (MITRE ATT&CK T1003.006) by analyzing Windows Event ID 4662 (AccessMask 0x100) for DS-Replication-...
Hunt for DNS-based persistence mechanisms including DNS hijacking, dangling CNAME records, wildcard DNS abuse, and unaut...
Detect domain fronting C2 traffic by analyzing SNI vs HTTP Host header mismatches in proxy logs and TLS certificate disc...
Detect WMI-based lateral movement by analyzing Windows Event ID 4688 process creation and Sysmon Event ID 1 for WmiPrvSE...
Detect NTLM relay attacks by analyzing Windows Event 4624 logon type 3 with NTLMSSP authentication, identifying IP-to-ho...
Detects NTLM relay attacks (MITRE T1557.001) by analyzing Windows Event ID 4624 logon type 3 with NTLMSSP authentication...
Hunt for MITRE ATT&CK T1098 account manipulation including shadow admin creation, SID history injection, group membershi...
Hunt for unusual network connections by analyzing outbound traffic patterns, rare destinations, non-standard ports, and...
Detect suspicious Windows service installations (MITRE ATT&CK T1543.003) by parsing System event logs for Event ID 7045,...
Hunt for web shell deployments on internet-facing servers by analyzing file creation in web directories, suspicious proc...
Hunts for Kerberoasting and related ticket attacks by analyzing Kerberos service ticket request events (4769) for weak e...
Hunts for malicious scheduled task persistence by analyzing task registration events (4698) and schtasks process creatio...
<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
Hypervisor-Enforced Code Integrity (Memory Integrity): a **Virtualization-Based Security (VBS)** feature where the Secur...
Combine sparse keyword search (BM25) with dense vector embeddings using Reciprocal Rank Fusion (RRF).
Use when enforcing defensive coding practices that treat all data as untrusted — regardless of source. Covers sanitizati...
Configure Inter-Integrated Circuit (I2C) master/slave transactions, clock stretching, bus arbitration, and pull-ups.
Infrastructure as Code (IaC) security scanning using Checkov with 750+ built-in policies for Terraform, CloudFormation,...
Performs a security review of Infrastructure as Code templates against the OWASP IaC Security Cheat Sheet, SLSA v1.0, an...
Infrastructure as Code security scanning and policy enforcement for Terraform, CloudFormation, Kubernetes, and Pulumi
Scan Terraform, Kubernetes, CloudFormation, ARM templates, and Dockerfiles for security misconfigurations using 790 Terr...
Design role-based and attribute-based access control (RBAC/ABAC), temporary credentials, and federation.
Atua como especialista em AWS IAM e controle de acesso, cobrindo IAM Policies (JSON), Permission Boundaries, SCPs (AWS O...
Create iam binding creator operations. Auto-activating skill for GCP Skills. Triggers on: iam binding creator, iam bindi...
IAM least privilege gap. Defense-only Security OS skill. Use for ASSESS-ONLY gap/control work.
Iam Policy Reviewer - Auto-activating skill for Security Advanced.Triggers on: iam policy reviewer, iam policy reviewerP...
Iam Privilege Audit. Professional enterprise agent for Iam Privilege Audit within the Security sector.
Ics Ics Scada Attack.
Use this skill when a bank, payment or e-money institution, investment firm, insurer, crypto-asset service provider or o...
Review test cases for ID Token validation. Covers ID Token structure, required/conditional claims, signature validation...
User identity, OAuth connections, and device management
Implement identity and access management. Use when designing authentication, authorization, or user management. Covers O...
Identity assurance for mid-2026 — NIST 800-63 AAL/IAL/FAL, FIDO2/WebAuthn passkeys, OIDC/SAML/SCIM, agent-as-principal i...
Use for authorized assessment of federated identity systems including SAML, OIDC, OAuth2 flows, SSO misconfiguration, an...
Review identity and access management across all platforms
IDOR — detection, authorization enforcement, ID strategy.
This skill should be used when the user asks to "test for insecure direct object references," "find IDOR vulnerabilities...
Hunt Insecure Direct Object Reference (IDOR) — test horizontal and vertical privilege escalation across user IDs, org ID...
Provide systematic methodologies for identifying and exploiting Insecure Direct Object Reference (IDOR) vulnerabilities...
ALWAYS read this skill before touching any Irish Capital Gains Tax work. Trigger on phrases like "Ireland CGT", "33% cap...
Apply IEC 62443 concepts (secure development lifecycle, component requirements, security levels) to networked medical de...
Use this skill whenever the user asks for an HTML-first visual design deliverable or design judgment: interactive protot...
Instagram の公開状態をライブのグリッド＋プランナーと照合し（現状確認）、ローカル SoT (posted.json/status.json) のドリフトを是正し、未公開パックを安全に予約投稿まで運ぶ運用スキル。 CI 週次 sna...
Generate a cross-platform multi-model audit (Trident) on a diff, brief, or artifact. Trigger: 'cross audit', 'Trident',...
JWT identity protection, bcrypt hashing, OWASP top 10 compliance
Load this skill whenever the project contains <img> elements, inline SVGs used as content images, CSS background images...