Top Agent Skills

Plan, run, and measure adversary engagement operations using the MITRE Engage framework, covering the Engage Matrix, 10-Step Operational Process, and mapping Activities to ATT&CK techniques.

Exploit the Zerologon vulnerability (CVE-2020-1472) in the Netlogon Remote Protocol to achieve domain controller compromise by resetting the machine account password to empty.

Deploys DNS, HTTP, and AWS API key canary tokens across network infrastructure to detect unauthorized access and lateral movement, with webhook alerting to Slack, Teams, email, or generic HTTP endpoints.

Monitor paste sites like Pastebin and GitHub Gists for leaked credentials, API keys, and sensitive data using automated scraping and keyword matching to detect breaches early.

Executes Atomic Red Team tests for MITRE ATT&CK technique validation using the atomic-operator Python framework. Loads test definitions from YAML atomics, runs attack simulations, and validates detection coverage.

Perform reconnaissance, persistence, privilege escalation, and data pillaging on Microsoft 365/Entra ID tenants via the Microsoft Graph API using the GraphRunner PowerShell toolset.

Perform static and symbolic analysis of Solidity smart contracts using Slither and Mythril to detect reentrancy, integer overflow, access control, and other vulnerability classes before deployment to Ethereum mainnet.

Configure Google Workspace advanced phishing and malware protection settings including pre-delivery scanning, attachment protection, spoofing detection, and Enhanced Safe Browsing.

Automates static analysis of Android APK/AAB files using MobSF to identify hardcoded secrets, insecure permissions, vulnerable components, and weak cryptography for pre-deployment security assessments or CI/CD integration.

Scan container images, filesystems, and Kubernetes manifests for vulnerabilities, misconfigurations, exposed secrets, and license compliance issues using Aqua Security Trivy with SBOM generation and CI/CD integration.

Collect volatile forensic evidence from a compromised system following order of volatility, preserving memory, network connections, processes, and system state before they are lost.

Detect data exfiltration through DNS tunneling by analyzing query entropy, subdomain length, query volume, TXT record abuse, and response payload sizes using passive DNS monitoring.

Design and deploy IEC 62443-compliant conduit architecture for secure OT remote access, including jump servers, MFA gateways, session recording, and approval-based workflows for vendor and engineer access to industrial control systems.

Integrate AFL++ coverage-guided fuzz testing into CI/CD pipelines to discover memory corruption, input handling, and logic vulnerabilities in C/C++ and compiled applications.

Deploy Cisco Identity Services Engine for 802.1X wired and wireless authentication, MAC Authentication Bypass, posture assessment, and dynamic VLAN assignment for network access control.

Deploy FIDO2/WebAuthn passwordless authentication using security keys and platform authenticators, covering WebAuthn API integration, FIDO2 server configuration, passkey enrollment, biometric authentication, and migration from password-based systems aligned with NIST SP 800-63B AAL3.

Deploy Zero Trust Network Access using Zscaler Private Access (ZPA) to replace traditional VPN with identity-based, context-aware access to private applications through the Zscaler Zero Trust Exchange.

Enumerate AWS resources and identify misconfigurations using ScoutSuite to generate interactive security reports.

Conduct wireless network security assessments using Kismet to detect rogue access points, hidden SSIDs, weak encryption, and unauthorized clients through passive RF monitoring.

Validate and confirm exploitability of vulnerabilities using the Metasploit Framework for risk-based prioritization and patch verification.

Deploy Breach and Attack Simulation tools to continuously validate security control effectiveness by safely emulating real-world attack techniques across the kill chain.

Integrates endpoint health signals from CrowdStrike ZTA, Microsoft Intune, and Jamf into conditional access policies to enforce device compliance before granting resource access.

Deploy and operate Greenbone/OpenVAS vulnerability management using the python-gvm library to create scan targets, execute vulnerability scans, and parse scan reports via GMP protocol.

Design and implement network segmentation using firewall security zones, VLANs, ACLs, and microsegmentation policies to restrict lateral movement and enforce least-privilege network access.

Configure ModSecurity WAF with OWASP Core Rule Set for web application logging, tune rules to reduce false positives, and analyze audit logs for attack detection.

Deploy and monitor Canary Tokens via the Thinkst Canary API for deception-based breach detection using web bug tokens, DNS tokens, document tokens, and AWS key tokens.

Configure GitHub Advanced Security with CodeQL to perform automated static analysis and vulnerability detection across repositories at enterprise scale.

Hunt for threats in AWS environments using Detective behavior graphs, entity investigation timelines, GuardDuty finding correlation, and automated entity profiling across IAM users, EC2 instances, and IP addresses.

Parse and analyze Windows forensic artifacts including MFT, registry hives, prefetch files, event logs, LNK files, and jump lists using Eric Zimmerman's EZ Tools suite and KAPE.

Run customer interviews that uncover real problems using Mom Test rules: ask about their life, not your idea; focus on past specifics; and secure commitments instead of collecting compliments.

Engineer word-of-mouth and virality using the STEPPS framework (Social Currency, Triggers, Emotion, Public, Practical Value, Stories).

Design reliable, scalable, and maintainable data systems by applying principles from storage engines, replication, partitioning, transactions, and consistency models.

Craft messages that are understood, remembered, and drive action using the SUCCESs framework (Simple, Unexpected, Concrete, Credible, Emotional, Stories).

Optimize web performance by applying browser networking, protocol, and rendering principles to reduce latency and improve Core Web Vitals.

Apply meta-principles of software craftsmanship: DRY, orthogonality, tracer bullets, and design by contract to build systems that are easy to change, understand, and trust.

Safely change and test untested codebases using techniques from Feathers' 'Working Effectively with Legacy Code': seams, characterization tests, sprout/wrap, and dependency-breaking.

Manage software complexity through deep modules, information hiding, and strategic programming, with a scoring framework for evaluating design quality.

Inspect GitHub PR checks, fetch failing GitHub Actions logs, summarize failure context, then create a fix plan and implement after user approval.

Finds the open GitHub PR for the current branch and helps address review comments using the gh CLI.

Scaffolds an isolated cloud development box per agent using Crabbox and Daytona, with its own database, dev server, and in-box browser for parallel testing without port or state collisions.

Scaffold a one-command dev-local launcher for any codebase by investigating services, ports, and infra dependencies, then generating a single script with tmux session management.

Optimizes SQL queries, designs database schemas, and troubleshoots performance issues using execution plan analysis, indexing strategies, and set-based operations.

Develops custom WordPress themes and plugins, creates Gutenberg blocks, configures WooCommerce stores, implements REST API endpoints, and applies security hardening with nonces, sanitization, escaping, and capability checks.

Designs chaos experiments, creates failure injection frameworks, and facilitates game day exercises for distributed systems — producing runbooks, experiment manifests, rollback procedures, and post-mortem templates.

Develop firmware for microcontrollers, implement RTOS applications, and optimize power consumption for resource-constrained devices.

Design GraphQL schemas, implement Apollo Federation, and build real-time subscriptions with DataLoader patterns and query optimization.

Identifies security vulnerabilities, generates structured audit reports with severity ratings, and provides actionable remediation guidance for code, infrastructure, and cloud environments.

Guides implementing authentication, authorization, input validation, and OWASP Top 10 prevention with secure code patterns and validation checkpoints.

Generates Spring Boot 3.x configurations, REST controllers, Spring Security 6 authentication flows, Spring Data JPA repositories, and reactive WebFlux endpoints for building microservices and reactive Java applications.

Create and manage Kubernetes workloads with declarative YAML manifests, covering deployments, networking, security, storage, Helm charts, and troubleshooting.

Build and deploy applications on the inference.sh platform using Python or Node.js, with CLI scaffolding, local testing, and cloud deployment.

Uncover customer jobs, pains, and gains in a structured JTBD format to clarify unmet needs, reposition products, or improve discovery and messaging.

Create a comprehensive company research brief with executive quotes, product strategy, and organizational context for competitive analysis, partnership evaluation, interview preparation, or market entry decisions.

Evaluate an AI product idea across outcomes, hypotheses, risks, and positioning to decide whether it deserves investment or recommendation.

Calculate TAM, SAM, and SOM with explicit assumptions, methods, and caveats for market sizing.

Guide PMs through the transition to Director with adaptive coaching across preparing, interviewing, landing, and recalibrating phases.

Explains foundational concepts of context engineering: what context is, attention mechanics, the U-shaped attention curve, and why context quality matters more than quantity.

Extends effective context capacity through strategic compression, masking, caching, and partitioning techniques.

Build production RAG and semantic search systems with a high-performance vector database written in Rust, supporting hybrid search, filtering, and horizontal scaling.

Track ML experiments with open-source run logging, local or self-hosted dashboards, and media visualization using SwanLab.