Security & Testing Agent Skills for Windsurf (legacy)

Detect NTLM relay attacks (T1557.001) by correlating Windows Event 4624 LogonType 3 for IP-to-hostname mismatches, identifying…

Detect Pass-the-Hash (T1550.002) attacks by analyzing NTLM authentication patterns, flagging Type 3 logons using NTLM where Kerberos would…

Detect Kerberos Pass-the-Ticket (PtT) attacks by analyzing Windows Event IDs 4768, 4769, and 4771 for anomalous ticket usage patterns…

Configures Fail2ban with custom filters and actions to detect port scanning

Detect process hollowing (MITRE T1055.012) by analyzing memory-mapped

Detects and analyzes process injection techniques used by malware including

Detects rootkit presence on compromised systems by identifying hidden

Detecting data exfiltration attempts from AWS S3 buckets by analyzing

Detects and prevents code injection attacks targeting serverless functions

Detect abuse of service accounts by hunting for anomalous interactive

Scans GitHub Actions workflows and CI/CD pipeline configurations for

Detect risky OAuth application consent grants in Azure AD / Microsoft

Detect WMI event subscription persistence (MITRE T1546.003) by analyzing Sysmon

When to activate: DevSecOps, SAST, DAST, shift-left, security pipeline, container scanning, dependency audit, policy as code

Skill for the Dfd area of Securacy. 58 symbols across 7 files.

Use when diagnosing or fixing functional bugs, flaky tests, regressions, crashes, data corruption symptoms, production incidents, or…

Agent-only procedure for diagnosing reported bugs.

Security-focused code review for PRs, commits, and diffs.

External recon for software supply-chain attack surface — package-namespace squatting candidates, dependency-confusion vulnerabilities…

Exploratory QA of web apps: find bugs, evidence, reports.

Get SARIF from `dotnet build` via the compiler ErrorLog property, using a per-project relative path so later projects do not overwrite…