Security & Testing Agent Skills for Claude Code

Correlates disparate security incidents, IOCs, and adversary behaviors

Deobfuscates malicious JavaScript code used in web-based attacks, phishing

Systematically deobfuscate multi-layer PowerShell malware using AST analysis,

Deploys deception-based honeytokens in Active Directory including fake

Deploys canary files (honeytokens) across file systems to detect ransomware

Deploys and configures CrowdStrike Falcon EDR agents across enterprise

Deploys and configures osquery for real-time endpoint monitoring using

Deploying Palo Alto Networks Prisma Access for SASE-based zero trust

Deploys and monitors ransomware canary files across critical directories

Deploy and configure Tailscale as a WireGuard-based zero trust mesh VPN

Detects prompt injection attacks targeting LLM-based applications using

This skill covers deploying anomaly detection systems for industrial

Detects anomalous authentication patterns using UEBA analytics, statistical

Detect and prevent API enumeration attacks including BOLA and IDOR exploitation

Detect and prevent ARP spoofing attacks using ARPWatch, Dynamic ARP Inspection,

This skill covers detecting cyber attacks targeting Supervisory Control

Detect unusual API call patterns in AWS CloudTrail logs using boto3,

Automate AWS GuardDuty threat detection findings processing using EventBridge

Detects and analyzes Bluetooth Low Energy (BLE) security attacks including

Deploy AI and NLP-powered detection systems to identify business email

Container escape is a critical attack technique where an adversary breaks