Agent skills

Detect lateral movement in Azure AD/Entra ID environments using Microsoft

Audit Azure Blob and ADLS storage accounts for public access exposure, weak

Performs statistical analysis of Zeek conn.log connection intervals

Detects and analyzes Bluetooth Low Energy (BLE) security attacks including

Detect and test for OWASP API3:2023 Broken Object Property Level Authorization

Detect Business Email Compromise (BEC) fraud, where attackers impersonate

Deploy AI and NLP-powered detection systems to identify business email

Detect command-and-control (C2) traffic tunneled over DNS from tools like

Detect compromised cloud credentials across AWS, Azure, and GCP by analyzing

Detects unauthorized runtime drift in containers by monitoring binary execution, filesystem changes, and configuration deviation from the…

Detects container escape at runtime across tooling - namespace manipulation, capability abuse, kernel exploits, sensitive host mounts, and…

Detect AI-generated deepfake audio used in voice phishing (vishing) by extracting spectral features (MFCC, spectral centroid, spectral…

This skill enables Claude to detect infrastructure drift from a desired state.

Detect Living Off the Land Binaries (LOLBins/LOLBAS) abuse including

Detect malicious scheduled task creation and modification using Sysmon

Detect command injection against Modbus TCP/RTU in ICS/SCADA environments by monitoring unauthorized writes, anomalous function codes…

Detects MSBuild projects with conflicting OutputPath or IntermediateOutputPath.

Detect and block spearphishing emails that use personalized, researched

Detect process injection techniques (T1055) - including DLL injection, process

Detect abuse of elevation control mechanisms (T1548), including Windows UAC

Detects typosquatting attacks in npm and PyPI package registries by