Security & Testing Agent Skills for Claude Code

Hunts for registry-based persistence mechanisms (MITRE T1547) in Windows

Runs a hypothesis-driven threat hunt for Windows Scheduled Task persistence (T1053), guiding SIEM/EDR queries against task creation events…

Runs a hypothesis-driven threat hunt for supply-chain compromise (T1195) by querying SIEM/EDR logs for trojanized software updates…

Hunts for adversary persistence and execution via Windows scheduled tasks (T1053.005) by analyzing Security Event ID 4698 task-creation…

Hunts for MITRE ATT&CK T1098 account manipulation - shadow admin creation, SID history injection, group membership changes, and credential…

Detects suspicious Windows service installations (MITRE ATT&CK T1543.003) by parsing System event log Event ID 7045, analyzing service…

Runs a hypothesis-driven threat hunt for web shell deployment (T1505.003) on internet-facing servers by analyzing file creation in web…

Drive and visually inspect a native GUI app (Iced, egui, GTK, winit…) on Hyprland through a headless output, leaving the user's desktop…

Audit the union of every IAM policy attached to one principal for privilege-escalation paths that no single statement reveals, and for…

IDA Pro Python scripting for reverse engineering.

This skill should be used when the user asks to "test for insecure direct object references," "find IDOR vulnerabilities," "exploit broken…

Implements API Security Posture Management (API-SPM) to continuously

Implements API security testing on the 42Crunch platform, combining

Implements API threat protection using Google Apigee reverse-proxy

Implements application whitelisting using Windows AppLocker to restrict

Implement RPKI-based BGP route origin validation by creating Route Origin

Deploys remote browser isolation (RBI) as a core component of a Zero

Deploys DNS, HTTP, and AWS API key canary tokens across network infrastructure

Assess, gap-analyze, and progressively implement the CISA Zero Trust

Implements cloud workload protection using boto3 and google-cloud APIs

Reduces container attack surface by building application images on Google distroless base images that ship only the application runtime…