Agent skills for Grok Build

Remove AI writing patterns from prose. Use this skill when writing, drafting, editing, reviewing, or revising any text to eliminate…

Generate destination code from analysis documents (OpenAPI or web-based) and user-selected actions

Remove project-local govctl integration through an ownership-aware dry run, archival plan, explicit confirmation, and recoverable edits

Writes and tunes Falco rule syntax for container escape detection - conditions, macros, lists, priorities, and output fields - covering…

Detect LSASS credential dumping, SAM database extraction, and NTDS.dit theft (e.g. via Mimikatz) using Sysmon Event ID 10 process-access…

This skill teaches security teams how to detect and respond to unauthorized

Probe a target for accidentally-public admin / debug / introspection endpoints — Spring Boot Actuator, Apache server-status, Prometheus…

Detect anomalies in DNP3 communications used in SCADA/ICS systems by monitoring unauthorized control commands, firmware update attempts…

Detect data exfiltration via DNS tunneling (tools like iodine, dnscat2, dns2tcp) by analyzing query entropy, subdomain length, query…

Detect compromised O365 and Google Workspace email accounts by analyzing Unified Audit Logs and Azure AD sign-in logs for impossible…

Detect malicious inbox/mail-flow forwarding rules that adversaries create to maintain

Detects defense evasion techniques used by adversaries in endpoint logs

Detect DNS-based data exfiltration by analyzing Zeek dns.log for high-entropy

Probe a target for accidentally-served secret-bearing files in the web root — .git/, .env, .DS_Store, backup files, database dumps, key…

Detects fileless malware and in-memory attacks that execute entirely

Detect Golden Ticket attacks in Active Directory using Splunk and KQL queries

Detect Kerberos Golden Ticket forgery (e.g.

This skill enables Claude to detect infrastructure drift from a desired state.

Implement User and Entity Behavior Analytics (UEBA) using Elasticsearch/OpenSearch

Detect adversary lateral movement across networks using Splunk SPL queries

Detect lateral movement in network traffic using Zeek (formerly Bro)