Results for “spl”

Automates ingestion, normalization, deduplication, and distribution of threat intelligence feeds from STIX/TAXII, open-source, and commercial sources into SIEM platforms for real-time IOC matching and alerting.

口令「分仓」触发：将 DEV-workspace 中 app/code/Weline 模块同步到项目兄弟目录“框架-分仓” 下的独立 Composer 分仓；本地缺仓库时自动从 Gitee/GitHub clone，递增 git tag 后推送并刷新 Packagist。 仅在用户明确说出口令「分仓」时加载；不得因闲聊、发布、部署等相近词自动触发。 Keywords: 分仓, fencang, split-repo, composer sync, weline mirror.

Reduce an oversized SKILL.md by checking whether an existing skill already covers the excess sub-workflow before creating a new child skill only when none fits. Load when a skill exceeds 200 lines and compress-skill determines excess content is genuinely CORE, when the same sub-workflow appears in multiple skills, or when universal-skill-creator or improve-skills identifies a coherent sub-capability. Also triggers on "split this skill", "extract a sub-skill", "this skill is doing too much", or "make this skill reusable". Always checks for an existing home before creating a new skill.

Analyze network traffic, logs, and data flows to detect potential data exfiltration via DNS tunneling, cloud storage uploads, encrypted channels, and other indicators of compromise.

Hunt for adversary persistence through Windows Management Instrumentation event subscriptions by monitoring WMI consumer, filter, and binding creation events that execute malicious code triggered by system events.

Use when splitting a working tree into atomic commits, or when changes need to be distributed across new commits and/or edits to prior commits on the branch. Especially relevant when changes within a single file belong in different commits.

Analyze A/B test results with statistical significance, sample size validation, confidence intervals, and ship/extend/stop recommendations. Use when evaluating experiment results, checking if a test reached significance, interpreting split test data, or deciding whether to ship a variant.

Automates enrichment of raw indicators of compromise with multi-source threat intelligence context using SOAR platforms, Python pipelines, or TIP playbooks to reduce analyst triage time and standardize enrichment outputs.

Handle files and binary data in n8n workflows correctly, covering the $binary vs $json split, reading/writing binary, preserving binary across transforms, and the agent-tool binary boundary.

Analyze RNA velocity in single-cell RNA-seq data with scVelo, estimating cell state transitions from unspliced/spliced mRNA dynamics, inferring trajectory directions, computing latent time, and identifying driver genes.

Manage R&D program budgets with F&A splits, track burn rate and runway against milestones, and route capitalize-vs-expense decisions to a named finance owner.

Builds SOC performance metrics and KPI tracking dashboards measuring Mean Time to Detect (MTTD), Mean Time to Respond (MTTR), alert quality ratios, analyst productivity, and detection coverage using SIEM data.

Executes Atomic Red Team tests mapped to MITRE ATT&CK techniques, performs coverage gap analysis, and runs detection validation loops to measure blue team visibility.

Use for creating, splitting, reviewing, or debugging GitHub Copilot custom instructions in Visual Studio Code, including .github/copilot-instructions.md, .github/instructions/*.instructions.md, and AGENTS.md. Do not use for slash commands, Agent Skills, custom agents, hooks, or ordinary project documentation.

When the user wants to plan, design, or implement an A/B test or experiment. Also use when the user mentions "A/B test," "split test," "experiment," "test this change," "variant copy," "multivariate test," or "hypothesis." For tracking implementation, see analytics-tracking.

When the user wants to plan, design, or implement an A/B test or experiment. Also use when the user mentions "A/B test," "split test," "experiment," "test this change," "variant copy," "multivariate test," or "hypothesis." For tracking implementation, see analytics-tracking.

Official GSAP skill for GSAP plugins — registration, ScrollToPlugin, ScrollSmoother, Flip, Draggable, Inertia, Observer, SplitText, ScrambleText, SVG and physics plugins, CustomEase, EasePack, CustomWiggle, CustomBounce, GSDevTools. Use when the user asks about a GSAP plugin, scroll-to, flip animations, draggable, SVG drawing, or plugin registration.

Deploy and configure the Dragos Platform for OT network monitoring, leveraging industrial protocol parsers, threat detection analytics, and asset visibility to protect ICS environments.

Detect abuse of elevation control mechanisms including UAC bypass, sudo exploitation, and setuid/setgid manipulation by monitoring registry modifications, process elevation flags, and unusual parent-child process relationships.

Triages security incidents by classifying type, assigning severity based on business impact, enriching with threat intelligence, and routing to appropriate response teams using NIST SP 800-61r3 and SANS PICERL frameworks.

When the user wants to plan, design, or implement an A/B test or experiment. Also use when the user mentions "A/B test," "split test," "experiment," "test this change," "variant copy," "multivariate test," or "hypothesis." For tracking implementation, see data-and-funnel-analytics.

Drafts commercial office lease agreements with rent schedules, expense allocations, maintenance splits, and protective provisions for landlord and tenant. Covers NNN, gross, and modified gross structures. Use when drafting office leases, commercial lease agreements, landlord-tenant contracts, or space rental agreements for commercial office premises.

Detect DNS tunneling and data exfiltration by analyzing Zeek dns.log for high-entropy subdomain queries, excessive query volume, long query lengths, and unusual DNS record types indicating covert channel communication.

Identifies lateral movement techniques in enterprise networks by analyzing authentication logs, network flows, SMB traffic, and RDP sessions using Zeek, Velociraptor, and SIEM correlation rules to detect attackers moving between systems.

Identify command-and-control beaconing patterns in network traffic by applying statistical frequency analysis, jitter calculation, and coefficient of variation scoring to detect periodic callbacks from compromised endpoints.

Hunt for adversary abuse of Living Off the Land Binaries (LOLBins) by analyzing endpoint process creation logs for suspicious execution patterns of legitimate Windows system binaries used for malicious purposes.

Establishes recurring vulnerability scanning workflows using Nessus, Qualys, or OpenVAS, prioritizes findings with risk scoring and CISA KEV data, integrates with SIEM for exploitation detection, and tracks remediation via SLA-based dashboards and automated ticketing.

Detect Golden Ticket attacks in Active Directory by analyzing Kerberos TGT anomalies including mismatched encryption types, impossible ticket lifetimes, non-existent accounts, and forged PAC signatures in domain controller event logs.

Tactical negotiation framework based on Chris Voss's "Never Split the Difference." Use when preparing for negotiations, during live negotiation scenarios, analyzing counterpart behavior, crafting responses to difficult conversations, handling objections, salary/contract negotiations, or when asked about negotiation techniques like mirroring, labeling, calibrated questions, or the Ackerman method.

Delivers a daily DeFi regime verdict (RISK-ON/NEUTRAL/RISK-OFF) from five named inputs, top TVL movers with causal reasoning, and a sustainable-vs-incentive yield split to distinguish real product-market fit from emissions-pumped APY.

When the user wants to plan, design, or implement an A/B test or experiment. Also use when the user mentions "A/B test," "split test," "experiment," "test this change," "variant copy," "multivariate test," "hypothesis," "conversion experiment," "statistical significance," or "test this." For tracking implementation, see analytics-tracking.

Design and implement real-time audio processing chains using Audio Toolbox streaming objects. Use when building frame-based audio processing loops, multiband filters, dynamic range control, parametric EQ, level metering, loudness metering, SPL metering, octave-band analysis, sample rate conversion, frequency-domain filtering (long impulse responses, custom filter banks), or audio chains in Simulink. Covers visualization (visualize method), interactive tuning (parameterTuner), MIDI control, and Audio Toolbox Simulink blocks. Use when the user says "real-time audio", "streaming audio", "audio filter", "compressor", "equalizer", "level meter", "loudness meter", "SPL meter", "octave bands", "crossover filter", "audio chain", "MIDI control", "convolution reverb", "impulse response streaming", "frequency-domain filter", or asks to process audio frame-by-frame.

Detect NTLM relay attacks through Windows Security Event correlation by analyzing Event 4624 LogonType 3 for IP-to-hostname mismatches, identifying Responder/LLMNR poisoning artifacts, and auditing SMB and LDAP signing enforcement.

Professional Ziwei Doushu consultation skill with offline, Beijing-standard calculation rules. Use when the user wants a polished Ziwei report from birth date and time, including life palace structure, twelve palaces, four transformations, major luck cycles, yearly triggers, optional chart images, and a clear split between chart facts and traditional interpretation.

Analyse and shrink JavaScript bundle size for any web app. Use when asked to "reduce bundle size", "analyse bundle", "tree shaking", "lazy loading", "code splitting", "slow initial load", "large JS", "chunk size", "build performance", "LCP caused by JS", "why is the bundle so big", or "first load JS too large".

A/B and multivariate testing methodology. Design experiments, calculate sample sizes, determine statistical significance, avoid common pitfalls, and interpret results. Platform-agnostic framework applicable to landing pages, emails, ads, pricing, and product features. Use when the user asks about A/B testing, split testing, experiment design, statistical significance, or conversion experiments.