Agent skills

Parse NetFlow v9 and IPFIX records to detect volumetric anomalies, port

This skill enables Claude to analyze network latency and optimize request patterns within an application.

Use Scapy to craft, send, sniff, and dissect TCP/UDP/ICMP/DNS packets, analyze pcap files, implement SYN scans, and detect anomalous…

Analyzes network traffic generated by malware during sandbox execution

Captures and analyzes network packet data using Wireshark and tshark

Parse Microsoft Outlook PST and OST files using libpff and pst-utils to extract message content, headers, attachments, deleted items, and…

Identifies and unpacks UPX-packed malware samples, including binaries with modified UPX magic bytes or headers that block automated…

This skill enables Claude to analyze and optimize database query performance.

Safely monitor ransomware group Tor-hosted data leak sites (DLS) to collect and extract structured victim posting data, track group…

Identify ransomware-related network indicators, including C2 beaconing patterns, TOR exit node connections, data exfiltration flows, and…

Traces ransomware cryptocurrency payment flows using blockchain analysis tools such as Chainalysis Reactor, WalletExplorer, and…

This skill analyzes HTTP security headers of a given domain to identify potential vulnerabilities and misconfigurations.

Examine NTFS slack space, MFT entries, the USN Change Journal, and Alternate Data Streams (ADS) to recover hidden or residual data…

Investigate supply chain attack artifacts including trojanized software

This skill enables Claude to analyze and optimize system throughput.

This skill analyzes code coverage metrics to identify untested code and generate comprehensive coverage reports.

This skill enables Claude to analyze the sentiment of text data.

This skill enables Claude to perform natural language processing and text analysis using the nlp-text-analyzer plugin.

Analyzes structured and unstructured threat intelligence feeds to extract

Query a MISP (Malware Information Sharing Platform) instance via PyMISP

Queries Certificate Transparency logs via crt.sh and pycrtsh to detect