Security & Testing Agent Skills for OpenAI Agents SDK

Parse Office 365 Unified Audit Logs via Microsoft Graph API to detect

Parse Microsoft Outlook PST and OST files using libpff and pst-utils to extract message content, headers, attachments, deleted items, and…

Identifies and unpacks UPX-packed malware samples, including binaries with modified UPX magic bytes or headers that block automated…

Analyzes malicious PDF files using PDFiD, pdf-parser, and peepdf to

Detect PowerShell Empire post-exploitation framework artifacts in Windows Script Block Logging (Event ID 4104) and Module Logging (Event…

Parse Windows Prefetch files (versions 17, 23, 26, 30) with tools like PECmd, WinPrefetchView, or python-prefetch to determine program…

Analyzes encryption algorithms, key management, and file encryption

Identify ransomware-related network indicators, including C2 beaconing patterns, TOR exit node connections, data exfiltration flows, and…

Parses Software Bill of Materials (SBOM) in CycloneDX and SPDX JSON

Examine NTFS slack space, MFT entries, the USN Change Journal, and Alternate Data Streams (ADS) to recover hidden or residual data…

Investigate supply chain attack artifacts including trojanized software

This skill analyzes code coverage metrics to identify untested code and generate comprehensive coverage reports.

Use to audit test quality with SRE scrutiny - identifies weak tests, missing cases, and creates task docs for improvements

Systematically map threat actor behavior and observed IOCs to the MITRE ATT&CK framework, build technique coverage heatmaps with the…

Query a MISP (Malware Information Sharing Platform) instance via PyMISP

Analyzes UEFI bootkit persistence (SPI flash implants, ESP modifications,

Parse Windows LNK shortcut files to extract target paths, MAC timestamps,

Vitest fast unit testing framework powered by Vite with Jest-compatible API.

Cross-cutting review of recent work — catches gaps between specialists.

Detect Broken Authentication abuse (API2:2023) against an API from auth-endpoint telemetry and token-validation events — invalid-signature…

Detect Broken Object Level Authorization (BOLA / API1:2023) abuse against a REST or GraphQL API from access logs, gateway telemetry, and…