Agent skills

Analyzes network traffic captures and flow data to identify adversary activity during security incidents, including

Analyzes network traffic generated by malware during sandbox execution

Captures and analyzes network packet data using Wireshark and tshark

Calculate NFT rarity scores and rank tokens by trait uniqueness.

Process perform on-chain analysis including whale tracking, token flows,

Parse Microsoft Outlook PST and OST files using libpff and pst-utils to extract message content, headers, attachments, deleted items, and…

Identifies and unpacks UPX-packed malware samples, including binaries with modified UPX magic bytes or headers that block automated…

Scan Linux systems for persistence mechanisms including crontab/systemd entries, LD_PRELOAD injection, shell profile modifications…

Safely monitor ransomware group Tor-hosted data leak sites (DLS) to collect and extract structured victim posting data, track group…

Identify ransomware-related network indicators, including C2 beaconing patterns, TOR exit node connections, data exfiltration flows, and…

Investigate supply chain attack artifacts including trojanized software

This skill enables Claude to analyze the sentiment of text data.

Systematically map threat actor behavior and observed IOCs to the MITRE ATT&CK framework, build technique coverage heatmaps with the…

Analyzes structured and unstructured threat intelligence feeds to extract

Query a MISP (Malware Information Sharing Platform) instance via PyMISP

Queries Certificate Transparency logs via crt.sh and pycrtsh to detect

Generate domain permutations with dnstwist and check DNS resolution

Analyzes UEFI bootkit persistence (SPI flash implants, ESP modifications,

Analyze unfamiliar codebases systematically to produce subsystem catalog entries - emphasizes strict contract compliance and confidence…

Correlate Windows registry keys (USBSTOR, MountedDevices), Event Logs,

Parse Apache and Nginx access logs to detect SQL injection attempts,