Agent skills

Perform lateral movement across Windows networks using WMI-based remote

Collect, parse, and correlate system, application, and security logs

Perform structured log source onboarding into SIEM platforms (Splunk,

Enrich malware file hashes (MD5, SHA-1, SHA-256) using the VirusTotal

Systematically investigate all persistence mechanisms on Windows and

Automate network traffic analysis using tshark (Wireshark CLI) and pyshark to compute protocol distribution statistics, detect suspicious…

Conduct a NIST Cybersecurity Framework (CSF) 2.0 maturity assessment across the six core Functions (Govern, Identify, Protect, Detect…

Performs OAuth 2.0 scope minimization review to identify over-permissioned

Open Source Intelligence (OSINT) gathering is the first active phase

Automate OSINT collection with the SpiderFoot REST API and CLI (sf.py/spiderfoot-cli) across 200+ modules, selecting scan modes…

Deploy and run authorized phishing awareness campaigns with GoPhish, covering admin panel setup, SMTP sending profiles, email template and…

Discovers and inventories privileged accounts across enterprise infrastructure,

Executes Atomic Red Team tests mapped to MITRE ATT&CK via Invoke-AtomicRedTeam

Plans and facilitates tabletop exercises simulating ransomware incidents,

This skill empowers Claude to perform regression analysis and modeling using the regression-analysis-tool plugin.

Perform security analysis of Siemens S7comm and S7CommPlus protocols

Audit service accounts across enterprise infrastructure to identify orphaned,

Automates credential rotation for service accounts across Active Directory,

Simulates SSL stripping / HTTPS downgrade attacks using sslstrip, Bettercap, and mitmproxy in authorized lab environments to test HSTS…

Enumerate subdomains of target domains using ProjectDiscovery's Subfinder

Simulates and detects software supply chain attacks: typosquatting detection via Levenshtein distance against popular PyPI package names…