Security

dimillian Bundle

Launches four parallel read-only sub-agents to review a git diff or file scope for regressions, security risks, performance issues, and contract gaps, then aggregates findings into a prioritized fix path.

dimillian Bundle

Analyze a project's past sessions, memory files, and existing local skills to recommend the highest-value skills to create or update.

dimillian Bundle

Diagnose and fix SwiftUI performance issues like slow rendering, janky scrolling, and high CPU/memory usage through code review and profiling guidance.

k-dense-ai Bundle

Explain machine learning model predictions using SHAP values, compute feature importance, and generate visualizations including waterfall, beeswarm, bar, scatter, force, and heatmap plots.

k-dense-ai Bundle

Simulate and analyze open quantum systems using QuTiP, including master equations, Lindblad dynamics, decoherence, and quantum optics.

k-dense-ai Bundle

Extends pandas for geospatial vector data analysis, including reading/writing shapefiles, GeoJSON, GeoPackage, and PostGIS, performing spatial joins, geometric operations, coordinate transformations, and creating static or interactive maps.

k-dense-ai Bundle

Process and analyze physiological signals including ECG, EEG, EDA, RSP, PPG, EMG, and EOG using Python.

k-dense-ai Bundle

Systematically evaluate scholarly work using the ScholarEval framework, providing structured assessment across research quality dimensions including problem formulation, methodology, analysis, and writing with quantitative scoring and actionable feedback.

k-dense-ai Bundle

Write scientific manuscripts in full paragraphs using IMRAD structure, with citations (APA/AMA/Vancouver), figures/tables, and reporting guidelines (CONSORT/STROBE/PRISMA) for research papers and journal submissions.

k-dense-ai Bundle

Prepare ISO 13485:2016 certification documentation for medical device Quality Management Systems, including gap analysis, template-based document creation, and compliance checklists.

k-dense-ai Bundle

Create publication-ready scientific figures with multi-panel layouts, significance annotations, error bars, colorblind-safe palettes, and journal-specific formatting using matplotlib, seaborn, and plotly.

mcollina Bundle

Implements OAuth 2.0/2.1 authorization flows in Fastify applications, including authorization code with PKCE, client credentials, device flow, refresh token rotation, JWT validation, and token introspection/revocation endpoints.

mcollina Bundle

Guides development of Fastify Node.js backend servers and REST APIs using TypeScript or JavaScript, covering routes, plugins, validation, error handling, authentication, testing, performance, logging, deployment, and more.

mukul975 Bundle

Build and operate a Havoc C2 framework for authorized red-team engagements, including team server deployment, evasive Demon agent generation, and post-exploitation.

mukul975 Bundle

Stand up a Sliver C2 server and listeners, generate cross-platform implants and beacons, and run post-exploitation, pivoting, and BOF/.NET tooling via the armory for adversary emulation.

mukul975 Bundle

Executes containment strategies to stop active adversary operations and prevent lateral movement during a confirmed security breach, using network segmentation, endpoint isolation, credential revocation, and access control modifications.

mukul975 Bundle

Use Pacu modules for AWS privilege escalation, persistence, and backdooring during authorized penetration tests.

mukul975 Bundle

Automates enrichment of raw indicators of compromise with multi-source threat intelligence context using SOAR platforms, Python pipelines, or TIP playbooks to reduce analyst triage time and standardize enrichment outputs.

mukul975 Bundle

Detect WMI event subscription persistence by analyzing Sysmon Event IDs 19, 20, and 21 for malicious EventFilter, EventConsumer, and FilterToConsumerBinding creation.

mukul975 Bundle

Maps intrusion activity to the Lockheed Martin Cyber Kill Chain framework to identify adversary phase completion, detection gaps, and defensive controls for post-incident analysis and prevention.

mukul975 Bundle

Detects rootkit presence on compromised systems by identifying hidden processes, hooked system calls, modified kernel structures, hidden files, and covert network connections using memory forensics, cross-view detection, and integrity checking techniques.

mukul975 Bundle

Hunt for threats in Windows Event Logs using Chainsaw, a fast Rust-based forensic tool that runs Sigma rules, keyword searches, and artifact analysis offline.

mukul975 Bundle

Detect DCSync attacks by analyzing Windows Event ID 4662 for unauthorized DS-Replication-Get-Changes requests from non-domain-controller accounts.

mukul975 Bundle

Monitors dark web forums, marketplaces, paste sites, and ransomware leak sites for mentions of organizational assets, leaked credentials, threatened attacks, and threat actor communications to provide early warning intelligence.

mukul975 Bundle

Assess JSON Web Token implementations for cryptographic weaknesses, algorithm confusion attacks, and authorization bypass vulnerabilities during security engagements.

mukul975 Bundle

Triages security incidents by classifying type, assigning severity based on business impact, enriching with threat intelligence, and routing to appropriate response teams using NIST SP 800-61r3 and SANS PICERL frameworks.

mukul975 Bundle

Collect and parse forensic artifacts from Windows systems using KAPE for rapid DFIR triage.

mukul975 Bundle

Analyzes malicious Linux ELF binaries including botnets, cryptominers, ransomware, and rootkits targeting servers, containers, and cloud infrastructure. Covers static analysis, dynamic tracing, and reverse engineering of x86_64 and ARM ELF samples.

mukul975 Bundle

Detects and responds to OAuth token theft and replay attacks in cloud environments, focusing on Microsoft Entra ID token protection, conditional access policies, and sign-in anomaly detection.

mukul975 Bundle

Exploit privileged pods, host mounts, runC CVEs, and exposed Docker sockets to break out of a container and reach the underlying host during authorized container-security assessments.

mukul975 Bundle

Simulates real-world adversary operations to test an organization's detection and response capabilities through the full attack lifecycle, from reconnaissance to objective completion.

mukul975 Bundle

Processes STIX 2.1 threat intelligence bundles from TAXII 2.1 servers, normalizing objects into platform-native schemas and routing them to consuming systems.

mukul975 Bundle

Run NVIDIA garak probe suites against an LLM endpoint to test for jailbreaks, prompt injection, data leakage, and toxic generation, then interpret the hit-rate report for triage and reporting.

mukul975 Bundle

Coerce a domain controller to authenticate to an attacker-controlled host and relay that NTLM authentication to an AD CS web enrollment endpoint to obtain a certificate for the DC machine account, enabling full domain compromise via DCSync.

mukul975 Bundle

Audits Google Cloud Platform IAM permissions to identify overly permissive bindings, primitive role usage, service account key proliferation, and cross-project access risks using gcloud CLI, Policy Analyzer, and IAM Recommender.

mukul975 Bundle

Correlates disparate security incidents, IOCs, and adversary behaviors across time and organizations to identify unified threat campaigns and attribute them to common threat actors.