Top Agent Skills

Extract and analyze Cobalt Strike beacon configuration from PE files and memory dumps to identify C2 infrastructure, malleable profiles, and operator tradecraft.

Detect and analyze covert communication channels used by malware, including DNS tunneling, ICMP exfiltration, and protocol abuse for C2 and data exfiltration.

Design and enforce microsegmentation policies using workload identity and label-based rules to prevent lateral movement in zero trust architectures, with guidance for tools like VMware NSX, Illumio, and Calico.

Configures memory protection mechanisms including DEP, ASLR, CFG, and Windows Exploit Protection to harden endpoints against buffer overflows, ROP chains, and code injection.

Establish a structured patch management program for OT/ICS environments, covering vendor compatibility testing, risk-based prioritization, staged deployment, rollback procedures, and compensating controls for unpatchable systems.

Execute a wireless network penetration test to assess WiFi security by capturing handshakes, cracking WPA2/WPA3 keys, detecting rogue access points, and testing wireless segmentation using Aircrack-ng and related tools.

Build an automated IOC enrichment pipeline using OpenCTI's connector ecosystem to enrich indicators with context from VirusTotal, Shodan, AbuseIPDB, GreyNoise, and other sources.

Perform forensic acquisition and analysis of cloud storage services including Google Drive, OneDrive, Dropbox, and Box by collecting both API-based remote data and local sync client artifacts from endpoint devices.

Prioritizes and remediates endpoint vulnerabilities by importing scan results, applying patches via WSUS/SCCM/Intune, making configuration changes, and validating fixes.

Build a two-tier PKI hierarchy (Root CA + Intermediate CA) using OpenSSL and Python, including certificate issuance, CRL distribution, OCSP responder configuration, and certificate policy management.

Detect risky OAuth application consent grants in Azure AD / Microsoft Entra ID using Microsoft Graph API, audit logs, and permission analysis to identify illicit consent grant attacks.

Continuously monitor multi-cloud environments for misconfigurations, compliance violations, and security risks using Prowler, ScoutSuite, AWS Security Hub, Azure Defender, and GCP Security Command Center.

Build a multi-factor asset criticality scoring model to weight vulnerability prioritization based on business impact, data sensitivity, and operational importance.

Integrate the CISA Known Exploited Vulnerabilities catalog with EPSS and CVSS to prioritize CVE remediation based on real-world exploitation evidence.

Assesses organizational readiness for post-quantum cryptography migration per NIST FIPS 203/204/205 standards, performs cryptographic inventory scanning, evaluates hybrid TLS configurations, and validates CRYSTALS-Kyber and CRYSTALS-Dilithium readiness.

Develop precise YARA rules for malware detection by identifying unique byte patterns, strings, and behavioral indicators in executable files while minimizing false positives.

Configure rsyslog for centralized log collection with TLS encryption, custom templates, and log rotation. Generates server and client configuration files with GnuTLS stream drivers, x509 certificate authentication, per-host log segregation, and reliable queue settings for high-availability syslog infrastructure.

Enumerate subdomains of target domains using ProjectDiscovery's Subfinder passive reconnaissance tool to map the attack surface during security assessments.

Captures WPA/WPA2 handshakes and performs offline password cracking using aircrack-ng, hashcat, and dictionary attacks during authorized wireless security assessments to evaluate passphrase strength and wireless network security posture.

Scan source code repositories, CI/CD pipelines, and configuration files for exposed AWS credentials using TruffleHog, git-secrets, and AWS-native detection mechanisms to prevent credential theft and unauthorized account access.

Design and deploy IEC 62443-compliant conduit architecture for secure OT remote access, including jump servers, MFA gateways, session recording, and approval-based workflows for vendor and engineer access to industrial control systems.

Detect and respond to Adversary-in-the-Middle (AiTM) phishing attacks that use reverse proxy kits like EvilProxy, Evilginx, and Tycoon 2FA to bypass MFA and steal session tokens.

Enumerate and audit GCP storage buckets and IAM policies using GCPBucketBrute and gcloud CLI to identify privilege escalation paths and overly permissive access.

Integrate FIRST's Exploit Prediction Scoring System (EPSS) API to prioritize vulnerability remediation based on real-world exploitation probability within 30 days.

Run a structured 5-day process to prototype, test, and validate product ideas with real users. Covers mapping, sketching, deciding, prototyping, and testing across Monday-Friday.

Design native iOS interfaces following Apple Human Interface Guidelines, covering layout, typography, color, navigation, and controls for iPhone and iPad apps.

Analyze customer needs by identifying the 'job' they hire a product to do, covering job statements, forces of progress, and competitive landscapes.

Design the small details—triggers, rules, feedback, loops, and modes—that separate good products from great ones, based on Dan Saffer's framework.

Build a weekly cadence of customer touchpoints using Opportunity Solution Trees, assumption mapping, and interview snapshots to keep product decisions grounded in evidence.

Search and fetch Notion pages, synthesize findings, and publish structured briefs, summaries, comparisons, or reports with citations and source links.

Convert Notion specs into implementation plans, tasks, and progress tracking with linked Notion pages.

Scaffolds an isolated cloud development box per agent using Crabbox and Daytona, with its own database, dev server, and in-box browser for parallel testing without port or state collisions.

Designs and implements production-grade ML pipeline infrastructure: configures experiment tracking, creates orchestration DAGs, builds feature store schemas, deploys model registries, and automates retraining and validation workflows.

Build command-line tools with argument parsing, interactive prompts, progress indicators, and shell completions using frameworks like commander, click, typer, or cobra.

Designs and implements production-grade RAG systems by chunking documents, generating embeddings, configuring vector stores, building hybrid search pipelines, applying reranking, and evaluating retrieval quality.

Builds Vue 3 components, composables, and Vite projects using JavaScript with JSDoc type annotations instead of TypeScript.

Fine-tune LLMs using LoRA, QLoRA, and PEFT with Hugging Face, including dataset preparation, hyperparameter tuning, evaluation, and deployment.

Build real-time communication systems with WebSockets or Socket.IO, including bidirectional messaging, horizontal scaling with Redis, presence tracking, and room management.

Create zero-dependency, animation-rich HTML presentations from scratch or by converting PowerPoint files, with a fixed 16:9 stage and distinctive design.

Build AI applications with the inference.sh Python SDK: run apps, build agents, and integrate with 250+ models using sync/async, streaming, file uploads, and a tool builder API.

Control a headless browser to navigate pages, click elements, fill forms, take screenshots, record video, and execute JavaScript using Playwright and inference.sh.

Provides a canonical facilitation protocol for interactive skills: one step at a time with progress tracking, adaptive recommendations, and interruption handling.

Provides structured guidance for building production-grade AI agent systems through context engineering, covering fundamentals, architectural patterns, operational excellence, and evaluation.

Provides code examples and best practices for using Pinecone, a managed vector database for production RAG, recommendation, and semantic search applications.

Build LLM-powered applications with agents, chains, and RAG using a framework that supports multiple providers and 500+ integrations.

Visualize training metrics, debug models with histograms, compare experiments, visualize model graphs, and profile performance using TensorBoard.

Trace, evaluate, and monitor LLM applications with an open-source observability platform.

Train and run Mamba state-space models with O(n) complexity, achieving faster inference and longer context than Transformers.

Process large-scale ML datasets with distributed streaming execution across CPU/GPU, supporting Parquet, CSV, JSON, images, and integration with PyTorch, TensorFlow, and Ray Train.

Evaluates LLMs across 100+ benchmarks from 18+ harnesses (MMLU, HumanEval, GSM8K, safety, VLM) with multi-backend execution on local Docker, Slurm HPC, or cloud platforms.

Run LLM inference on CPU, Apple Silicon, and consumer GPUs without NVIDIA hardware. Use for edge deployment, M1/M2/M3 Macs, AMD/Intel GPUs, or when CUDA is unavailable. Supports GGUF quantization (1.5-8 bit) for reduced memory and 4-10× speedup vs PyTorch on CPU.

Expert guidance for implementing GRPO/RL fine-tuning with TRL for reasoning and task-specific model training.

Deploy a production self-hosted n8n instance on a fresh Linux VM over SSH, using Docker Compose behind a Caddy reverse proxy with automatic HTTPS.

Drafts, sends, and preserves email correspondence for existing ClawHub content rights cases using authenticated admin CLI commands.

Screen post-earnings gap-up stocks for Post-Earnings Announcement Drift patterns using weekly candle analysis to detect red candle pullbacks and breakout signals.

Analyze S&P 500 market breadth charts and CSV data to assess market health, identify trading signals, and generate positioning recommendations for different trader types.

Reads brand identity, ICP, and messaging files to produce on-brand social video with storyboard, reference images, and Seedance 2.0-optimized prompts.

Displays a quick-reference card for all caveman modes, skills, and commands. One-shot display, not a persistent mode.

Compares two code versions for semantic equivalence by tracing both side-by-side, identifying divergences, and producing a structured verdict.

Build reliable, fault-tolerant Go applications with DBOS durable workflows, covering installation, configuration, workflow/step structure, queues, and testing.