Top Agent Skills

Read, extract, merge, split, rotate, watermark, encrypt, and OCR PDF files using Python libraries and command-line tools.

Query 20+ bioinformatics databases from the command line or Python for gene information, sequences, protein structures, enrichment analysis, and more.

Build discrete-event simulations of systems with processes, queues, resources, and time-based events using SimPy in Python.

Perform exact symbolic mathematics in Python — algebra, calculus, equation solving, symbolic linear algebra, and code generation via lambdify or LaTeX.

Run standard single-cell RNA-seq analysis pipelines: QC, normalization, dimensionality reduction, clustering, differential expression, and visualization using Scanpy.

Estimate cell state transitions from unspliced/spliced mRNA dynamics using scVelo, infer trajectory directions, compute latent time, and identify driver genes in single-cell RNA-seq data.

Create, read, manipulate, and store annotated data matrices using the AnnData Python package, designed for single-cell genomics and general-purpose annotated data workflows.

Read, write, and modify DICOM medical imaging files, including pixel data extraction, metadata manipulation, anonymization, and format conversion.

Create, analyze, and visualize complex networks and graphs in Python with NetworkX, including graph algorithms, community detection, synthetic network generation, and multiple I/O formats.

Manipulate biological sequences, parse FASTA/GenBank/PDB files, access NCBI databases, run BLAST searches, and perform phylogenetics using the Biopython library.

Process and analyze physiological signals including ECG, EEG, EDA, RSP, PPG, EMG, and EOG using Python.

Train quantum circuits like neural networks with automatic differentiation, device-independent programming, and integration with PyTorch or JAX.

Build and train graph neural networks for drug discovery, protein modeling, and molecular science using PyTorch-native tools.

Manipulate phylogenetic trees, detect evolutionary events, integrate NCBI taxonomy, and create publication-quality visualizations using the ETE toolkit.

Provides deep generative models for single-cell omics analysis, including probabilistic batch correction, transfer learning, differential expression, and multi-modal integration.

Query 40+ bioinformatics services (UniProt, KEGG, ChEMBL, Reactome) with a unified Python interface for cross-database analysis, identifier mapping, and sequence analysis.

Build and evaluate machine learning models using scikit-learn for classification, regression, clustering, dimensionality reduction, and preprocessing.

Analyze any text to extract a cognitive fingerprint across 12 dimensions, revealing reasoning patterns, decision styles, and thinking signatures.

Write competitive research proposals for NSF, NIH, DOE, DARPA, and Taiwan NSTC with agency-specific formatting, review criteria, budget preparation, and compliance guidance.

Perform survival analysis and time-to-event modeling in Python using scikit-survival, including Cox models, random survival forests, gradient boosting, survival SVMs, and evaluation metrics like concordance index and Brier score.

Query the CZ CELLxGENE Census programmatically for versioned public single-cell and spatial transcriptomics data, enabling efficient access to cell metadata, gene expression slices, summary counts, and embeddings without downloading whole datasets.

Analyze and engineer protein glycosylation by scanning sequences for N-glycosylation sequons, predicting O-glycosylation hotspots, and accessing curated glycoengineering tools for therapeutic antibody optimization and vaccine design.

Design experiments and studies before data collection — choosing a design, randomizing, blocking, and laying out treatment combinations so results are interpretable.

Integrate with Benchling's Python SDK and REST API to manage registry entities, inventory, ELN entries, workflows, and Data Warehouse queries for life sciences R&D automation.

Create publication-quality scientific diagrams using AI generation with smart iterative refinement and quality review.

Prepare ISO 13485:2016 certification documentation for medical device Quality Management Systems, including gap analysis, template-based document creation, and compliance checklists.

Integrates with the protocols.io API v3 to search, create, update, and publish scientific protocols, manage steps and materials, handle discussions, organize workspaces, and upload files.

Implements OAuth 2.0/2.1 authorization flows in Fastify applications, including authorization code with PKCE, client credentials, device flow, refresh token rotation, JWT validation, and token introspection/revocation endpoints.

Guides development of Fastify Node.js backend servers and REST APIs using TypeScript or JavaScript, covering routes, plugins, validation, error handling, authentication, testing, performance, logging, deployment, and more.

Creates, structures, and reviews technical documentation using the Diátaxis framework, organizing content into tutorials, how-to guides, reference material, and explanations.

Automates enrichment of raw indicators of compromise with multi-source threat intelligence context using SOAR platforms, Python pipelines, or TIP playbooks to reduce analyst triage time and standardize enrichment outputs.

Detect WMI event subscription persistence by analyzing Sysmon Event IDs 19, 20, and 21 for malicious EventFilter, EventConsumer, and FilterToConsumerBinding creation.

Maps intrusion activity to the Lockheed Martin Cyber Kill Chain framework to identify adversary phase completion, detection gaps, and defensive controls for post-incident analysis and prevention.

Detects rootkit presence on compromised systems by identifying hidden processes, hooked system calls, modified kernel structures, hidden files, and covert network connections using memory forensics, cross-view detection, and integrity checking techniques.

Assess JSON Web Token implementations for cryptographic weaknesses, algorithm confusion attacks, and authorization bypass vulnerabilities during security engagements.

Analyzes malicious Linux ELF binaries including botnets, cryptominers, ransomware, and rootkits targeting servers, containers, and cloud infrastructure. Covers static analysis, dynamic tracing, and reverse engineering of x86_64 and ARM ELF samples.

Detects and responds to OAuth token theft and replay attacks in cloud environments, focusing on Microsoft Entra ID token protection, conditional access policies, and sign-in anomaly detection.

Simulates real-world adversary operations to test an organization's detection and response capabilities through the full attack lifecycle, from reconnaissance to objective completion.

Run NVIDIA garak probe suites against an LLM endpoint to test for jailbreaks, prompt injection, data leakage, and toxic generation, then interpret the hit-rate report for triage and reporting.

Prepare a defense-contractor environment for CMMC Level 2 certification by scoping CUI and FCI, implementing NIST SP 800-171 Rev 2 requirements, computing SPRS scores, managing POA&Ms, and readying for C3PAO assessment.

Parses API Gateway access logs (AWS API Gateway, Kong, Nginx) to detect BOLA/IDOR attacks, rate limit bypass, credential scanning, and injection attempts using pandas for statistical analysis and anomaly detection.

Perform comprehensive forensic analysis of disk images using Autopsy to recover files, examine artifacts, and build investigation timelines.

Detect and analyze heap spray attacks in memory dumps using Volatility3 plugins to identify NOP sled patterns, shellcode landing zones, and suspicious large allocations in process virtual address space.

Enumerate Microsoft Entra ID tenants using ROADrecon and acquire/exchange tokens with roadtx for authorized red-team operations.

Deploys and monitors ransomware canary files across critical directories using Python's watchdog library for real-time filesystem event detection, triggering alerts via email, Slack, or syslog when decoy files are accessed.

Detect and prevent API enumeration attacks including BOLA and IDOR exploitation by monitoring sequential identifier access patterns and authorization failures.

Detect DLL side-loading attacks where adversaries place malicious DLLs alongside legitimate applications to hijack execution flow for defense evasion.

Analyzes mobile applications for malicious behavior through static analysis, runtime monitoring, and network traffic inspection to identify malware indicators.

Analyze Windows Security Event Logs to detect RDP brute force attacks by parsing Event ID 4625 and 4624 entries, identifying source IP frequency, and generating detection reports.

Detect and exploit HTTP request smuggling vulnerabilities caused by Content-Length and Transfer-Encoding parsing discrepancies between front-end and back-end servers.

Detect Cobalt Strike beacon network activity using TLS certificate signatures, JA3/JA3S/JARM fingerprints, HTTP C2 profile matching, beacon jitter analysis, and named pipe detection via Zeek, Suricata, and Python PCAP analysis.

Hunt for DNS-based persistence mechanisms including DNS hijacking, dangling CNAME records, wildcard DNS abuse, and unauthorized zone modifications using passive DNS databases, SecurityTrails API, and DNS audit log analysis.

Implement Okta as a centralized identity provider for cloud environments, configure SSO with AWS, Azure, and GCP, deploy phishing-resistant MFA, automate user lifecycle management, and enforce adaptive access policies.

Automate red team operations using the Covenant C2 framework's REST API for authorized adversary simulation, including listener setup, grunt deployment, task execution, and lateral movement tracking.

Audits HTTP security headers including CSP, HSTS, X-Frame-Options, and cookie attributes to identify missing or misconfigured browser-level protections.

Executes structured recovery from a ransomware incident following NIST and CISA frameworks, including environment isolation, forensic evidence preservation, clean infrastructure rebuild, prioritized system restoration from verified backups, credential reset, and validation against re-infection.

Test web applications for HTTP Host header injection vulnerabilities to identify password reset poisoning, web cache poisoning, SSRF, and virtual host routing manipulation risks.

Triages and enriches indicators of compromise (IPs, domains, file hashes, URLs, email artifacts) from phishing emails, security alerts, or threat feeds, assigning confidence scores and dispositions using VirusTotal, AbuseIPDB, MalwareBazaar, and MISP.

Audit AWS S3 bucket permissions to identify publicly accessible buckets, overly permissive ACLs, misconfigured bucket policies, and missing encryption settings using AWS CLI, Prowler, and IAM Access Analyzer.

Detects cyber attacks targeting SCADA systems, including man-in-the-middle, command injection, HMI compromise, historian manipulation, and DoS, using OT-specific intrusion detection and protocol anomaly analysis.