Agent skills for Codex CLI

Detect dangerous ACL misconfigurations in Active Directory using ldap3

Query ATT&CK data with attackcti, mitreattack-python, and stix2, then build MITRE ATT&CK Navigator layers and multi-layer heatmap overlays…

Queries Azure Monitor activity logs and sign-in logs via azure-monitor-query

Parse Chromium-based browser databases with Hindsight to extract and correlate browsing history, downloads, cookies, cached content…

This skill enables Claude to analyze capacity requirements and plan for future growth.

Monitor Certificate Transparency logs using crt.sh and Certstream to

Detect abnormal access in AWS S3, GCS, and Azure Blob Storage by analyzing CloudTrail Data Events, GCS audit logs, and Azure Storage…

Extract and analyze Cobalt Strike beacon configuration from PE files

Parse and analyze Cobalt Strike Malleable C2 profiles with dissect.cobaltstrike (profiles and beacon-payload configs) and pyMalleableC2…

Analyses customer and user feedback in Dcipher - reviews, support tickets, survey responses, call transcripts, chat logs, community posts…

Analyzes intrusion activity against the Lockheed Martin Cyber Kill Chain

Analyzes DNS query logs to detect data exfiltration via DNS tunneling,

Investigate compromised Docker containers by analyzing images, layers,

Parse and analyze email headers (Received chain, Return-Path, Message-ID)

Perform static and symbolic analysis of Solidity smart contracts using

Analyze session replay patterns across experiment variants to understand user behavior differences.

Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo

Detect and analyze heap spray attacks in memory dumps using Volatility3

Analyzes indicators of compromise (IOCs) including IP addresses, domains,

Analyze PostHog insights, dashboards, or teams beyond the current project by querying the prod Postgres replicas synced into the dogfood…

Runtime iOS app security testing with Objection (Frida): inspect keychain and filesystem data, explore app internals at runtime, and…