Results for “pattern”

Identify command-and-control beaconing patterns in network traffic by applying statistical frequency analysis, jitter calculation, and coefficient of variation scoring to detect periodic callbacks from compromised endpoints.

Hunt for adversary abuse of Living Off the Land Binaries (LOLBins) by analyzing endpoint process creation logs for suspicious execution patterns of legitimate Windows system binaries used for malicious purposes.

Analyzes and recreates Uber's design language: a black-and-white palette, custom geometric display and text fonts, pill-shaped interactive elements, and editorial 4:3 illustrations for transportation and delivery interfaces.

Python code-quality anti-patterns and review checks: exception-hierarchy correctness, singleton identity comparison, narrow exception handling, wildcard-import avoidance, magic-number naming, and dead-local removal. Use when reviewing or self-reviewing Python code for correctness and readability defects that linters and reviewers should catch.

Implement signal-based reactive state management in Angular v20+. Use for creating reactive state with signal(), derived state with computed(), dependent state with linkedSignal(), and side effects with effect(). Triggers on state management questions, converting from BehaviorSubject/Observable patterns to signals, or implementing reactive data flows.

Read BEFORE writing any code that builds or simulates OFDM systems. The default MATLAB patterns for OFDM (e.g., direct ifft/fft, awgn with 0 dBW power, missing symOffset) produce subtly incorrect results — always use ofdmmod/ofdmdemod instead of direct IFFT/FFT. This skill specifies the correct calling conventions for ofdmmod, ofdmdemod, ofdmChannelResponse, ofdmEqualize, and critical anti-patterns that must be avoided. Use when building OFDM transmitters or receivers, allocating subcarriers and guard bands, inserting pilots, computing SNR for OFDM, configuring fading channels (Rayleigh/Rician), estimating and equalizing channels, implementing timing and frequency synchronization, adding LDPC coding, designing resource grids, or setting up OFDM link simulations.

Detects credential stuffing attacks by analyzing authentication logs for login velocity anomalies, ASN diversity, password spray patterns, and geographic distribution of failed logins using statistical analysis on Splunk or raw log data.

Guides the agent to research existing tools, libraries, and patterns before writing custom code, using parallel searches across package registries, MCP servers, skills, and GitHub, then evaluating and deciding to adopt, extend, or build.

Manage project learnings. Review, search, prune, and export what gstack has learned across sessions. Use when asked to "what have we learned", "show learnings", "prune stale learnings", or "export learnings". Proactively suggest when the user asks about past patterns or wonders "didn't we fix this before?"

Justfile authoring, reviewing, and planning for the just command runner. Use when creating new justfiles, adding recipes, reviewing existing justfiles for quality, planning recipe sets for new projects, or upgrading justfiles as projects mature. Covers syntax patterns, module system, recipe groups, language-specific templates, and maturity assessment.

BISON v2.0 — Conviction Holder (Hardened). Top 10 assets by volume. All signals are score contributors — no hard gates. Scanner enters via create_position internally (Wolverine pattern). RatchetStop exits. Thesis exit REMOVED. v2.0: every hard gate converted to score contributor, ensureExecutionAsTaker=false, conviction-scaled margin 25-37%.

Writing maintainable code - readability principles, SOLID patterns applied pragmatically, and the judgment to know when rules should bendUse when "code quality, clean code, readability, naming, SOLID, refactor, code review, best practices, maintainable, how should I structure, clean-code, solid, readability, maintainability, code-review, naming, functions, principles" mentioned.

Migrates legacy AEM (6.x, AMS, on-prem) to AEM as a Cloud Service using BPA CSV or CAM/MCP target discovery, with one-pattern-per-session workflow for scheduler, replication, event listener, HTL lint, dialog, and custom widget migration.

Detect NTLM relay attacks by analyzing Windows Event 4624 logon type 3 with NTLMSSP authentication, identifying IP-to-hostname mismatches, Responder traffic signatures, SMB signing status, and suspicious authentication patterns across the domain.

Foundational Java patterns covering core syntax, object-oriented programming, generics, collections, streams, lambdas, and modern Java features. Use when writing Java code, understanding the type system, working with collections/streams, or needing guidance on which specialized Java skill to use. This is the entry point for Java development.

C++-specific library development patterns. Use when creating C++ libraries, designing header-only vs compiled libraries, configuring CMake for library targets, managing ABI stability and versioning, integrating with Conan/vcpkg, documenting with Doxygen, or testing with GoogleTest/Catch2. Extends meta-library-dev with C++ tooling and idioms.

Detect anomalies in DNP3 protocol communications used in SCADA systems by monitoring for unauthorized control commands, firmware update attempts, protocol violations, and deviations from baseline traffic patterns using deep packet inspection and machine learning approaches.

Detect WMI-based lateral movement by analyzing Windows Event ID 4688 process creation and Sysmon Event ID 1 for WmiPrvSE.exe child process patterns, remote process execution, and WMI event subscription persistence.

Detect process injection techniques (T1055) including classic DLL injection, process hollowing, and APC injection by analyzing Sysmon events for cross-process memory operations, remote thread creation, and anomalous DLL loading patterns.

Call Apex methods imperatively from Lightning Web Components for button clicks, lifecycle hooks, and conditional logic, covering import syntax, cacheable vs non-cacheable methods, async/await patterns, error handling, loading states, and parallel calls with Promise.all.

Remove signs of AI-generated writing from text. Use when editing or reviewing text to make it sound more natural and human-written. Detects and fixes patterns including: inflated symbolism, promotional language, superficial analyses, vague attributions, em dash overuse, rule of three, AI vocabulary words, negative parallelisms, and excessive conjunctive phrases.

Remove signs of AI-generated writing from text. Use when editing or reviewing text to make it sound more natural and human-written. Detects and fixes patterns including: inflated symbolism, promotional language, superficial analyses, vague attributions, em dash overuse, rule of three, AI vocabulary words, negative parallelisms, and excessive conjunctive phrases.

Provides domain-specific best practices for Node.js development with TypeScript, covering type stripping, async patterns, error handling, streams, modules, testing, performance, caching, logging, and more. Use when setting up Node.js projects with native TypeScript support, configuring type stripping (--experimental-strip-types), writing Node 22+ TypeScript without a build step, or when the user mentions 'native TypeScript in Node', 'strip types', 'Node 22 TypeScript', '.ts files without compilation', 'ts-node alternative', or needs guidance on error handling, graceful shutdown, flaky tests, profiling, or environment configuration in Node.js. Helps configure tsconfig.json for type stripping, set up package.json scripts, handle module resolution and import extensions, and apply robust patterns across the full Node.js stack.

Detect data staging activity before exfiltration by monitoring for archive creation with 7-Zip/RAR, unusual temp folder access, large file consolidation, and staging directory patterns via EDR and process telemetry.

Reference for foundational C++ patterns covering core syntax, classes, templates, RAII, move semantics, and modern C++ features (C++11/14/17/20). Use when writing C++ code, understanding the type system, memory management, or needing guidance on which specialized C++ skill to use.

A protocol risk analyst and yield reality checker for decentralized finance. Evaluates protocol safety before deposit. Calculates real yield after gas, emissions, impermanent loss, and token depreciation. Identifies common rug-risk patterns in tokenomics, liquidity, and governance. Advisory only—no wallet access, no private key handling, no transaction signing, no on-chain execution.

Generates assisted setup wizard pages for Business Central setup tables following Guided Experience patterns. Creates NavigatePage with step-based navigation using visibility controls, banner images (WIP/Finished from Media Repository), temporary source table, footer actions (Back/Next/Finish with InFooterBar), OnOpenPage trigger (InitRecord, EnableControls, LoadSetupBanner), OnQueryClosePage trigger with unsaved changes confirmation, navigation procedures (NextStep with Step Option variable, EnableControls with Case statement, SetControlsStepXX boolean updates), commit procedure using TransferFields pattern, and registration codeunit with OnRegisterAssistedSetup event subscriber for Guided Experience. Integrates with Assisted Setup page and Extension Management. Supports multi-step workflows with welcome step, configuration step(s), and review/finish step. Uses InstructionalText for user guidance. Completes setup via GuidedExperience.CompleteAssistedSetup. Use when creating setup wizards, implementing assist

Migrate an existing web React app to a native iOS/Android app with Expo, screen by screen, using a strangler-fig pattern that ships the web UI in a DOM-component shell on day one and nativizes screens by value.

Write, review, or improve SwiftUI code following best practices for state management, view composition, performance, macOS-specific APIs, and iOS 26+ Liquid Glass adoption. Use when building new SwiftUI features, refactoring existing views, reviewing code quality, or adopting modern SwiftUI patterns.

Knowledge graph and smart memory management using graphify + Obsidian-inspired patterns. Use when: setting up a knowledge graph, managing memory health, cross-linking notes, compiling wiki pages from scattered notes, adding structured frontmatter, or running memory health checks. Triggers on: 'knowledge graph', 'graphify', 'wiki', 'cross-link', 'memory health', 'frontmatter', 'compile notes', 'wikilinks'.

Expert in creating opening lines, thumbnails, and hooks that stop the scroll. Covers curiosity gaps, pattern interrupts, emotional triggers, and platform-specific hooks. Knows how to earn attention in the first 3 seconds without resorting to clickbait. Use when "hook, opening line, scroll stopper, headline, first line, attention grab, thumbnail, clickable, " mentioned.

Optimizes React and Next.js performance with 70+ rules across 8 priority categories, covering waterfalls, bundle size, server-side, client fetching, re-renders, rendering, JS micro-perf, and advanced patterns. Use when writing, reviewing, or refactoring React/Next.js code.

This skill should be used for time series machine learning tasks including classification, regression, clustering, forecasting, anomaly detection, segmentation, and similarity search. Use when working with temporal data, sequential patterns, or time-indexed observations requiring specialized algorithms beyond standard ML approaches. Particularly suited for univariate and multivariate time series analysis with scikit-learn compatible APIs.

This skill should be used for time series machine learning tasks including classification, regression, clustering, forecasting, anomaly detection, segmentation, and similarity search. Use when working with temporal data, sequential patterns, or time-indexed observations requiring specialized algorithms beyond standard ML approaches. Particularly suited for univariate and multivariate time series analysis with scikit-learn compatible APIs.

This skill should be used for time series machine learning tasks including classification, regression, clustering, forecasting, anomaly detection, segmentation, and similarity search. Use when working with temporal data, sequential patterns, or time-indexed observations requiring specialized algorithms beyond standard ML approaches. Particularly suited for univariate and multivariate time series analysis with scikit-learn compatible APIs.

Detect PowerShell Empire framework artifacts in Windows event logs by identifying Base64 encoded launcher patterns, default user agents, staging URL structures, stager IOCs, and known Empire module signatures in Script Block Logging events.