Agent skills

Extract and analyze Cobalt Strike beacon configuration from PE files

Parse and analyze Cobalt Strike Malleable C2 profiles with dissect.cobaltstrike (profiles and beacon-payload configs) and pyMalleableC2…

This skill analyzes project dependencies for security vulnerabilities, outdated packages, and license compliance issues.

Perform comprehensive forensic analysis of raw (dd), E01, or AFF disk images with Autopsy and The Sleuth Kit, recovering deleted files…

Investigate compromised Docker containers by analyzing images, layers,

Analyze session replay patterns across experiment variants to understand user behavior differences.

Analyzes git commits and changes within a timeframe or commit range, providing structured summaries for code review, retrospectives, work…

Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo

Runtime iOS app security testing with Objection (Frida): inspect keychain and filesystem data, explore app internals at runtime, and…

Perform static analysis of malicious PDF documents using peepdf, pdfid,

Analyze cryptocurrency market sentiment using Fear & Greed Index, news

Performs Linux memory acquisition using LiME (Linux Memory Extractor)

Monitor blockchain mempools for pending transactions, front-running, and MEV opportunities.

Analyze the NTFS Master File Table ($MFT) with MFTECmd, analyzeMFT,

Parse NetFlow v9 and IPFIX records to detect volumetric anomalies, port

This skill enables Claude to analyze network latency and optimize request patterns within an application.

Analyzes network traffic generated by malware during sandbox execution

Parse Microsoft Outlook PST and OST files using libpff and pst-utils to extract message content, headers, attachments, deleted items, and…

Analyzes malicious PDF files using PDFiD, pdf-parser, and peepdf to

PDN DC voltage/current analysis, IR drop, design rule checking, and multi-net batch analysis on imported PCB layouts.

Detect PowerShell Empire post-exploitation framework artifacts in Windows Script Block Logging (Event ID 4104) and Module Logging (Event…