agentflocks
- 52 skills
- 0 followers
- 4 hours ago last updated
- ▌ Ndr Alert Analysis 2 · agentflocks bundle用于 NDR（网络检测与响应）告警的自动化研判分析，按照标准流程进行情报查询、资产关联、漏洞分析、payload 解析和综合研判。
- ▌ Analyzing Linux Kernel Rootkits · agentflocks bundleDetect kernel-level rootkits in Linux memory dumps using Volatility3 linux plugins (check_syscall, lsmod, hidden_modules), rkhunter system scanning, and /proc vs /sys discrepancy analysis to identify hooked syscalls, hidden kernel modules, and tampered system structures.
- ▌ Analyzing Disk Image With Autopsy · agentflocks bundlePerform comprehensive forensic analysis of disk images using Autopsy to recover files, examine artifacts, and build investigation timelines.
- ▌ Analyzing Indicators Of Compromise · agentflocks bundleAnalyzes indicators of compromise (IOCs) including IP addresses, domains, file hashes, URLs, and email artifacts to determine maliciousness confidence, campaign attribution, and blocking priority. Use when triaging IOCs from phishing emails, security alerts, or external threat feeds; enriching raw IOCs with multi-source intelligence; or making block/monitor/whitelist decisions. Activates for requests involving VirusTotal, AbuseIPDB, MalwareBazaar, MISP, or IOC enrichment pipelines.
- ▌ Performing User Behavior Analytics · agentflocks bundlePerforms User and Entity Behavior Analytics (UEBA) to detect anomalous user activities including impossible travel, unusual access patterns, privilege abuse, and insider threats using SIEM-based behavioral baselines and statistical analysis. Use when SOC teams need to identify compromised accounts or insider threats through deviation from established behavioral norms.
- ▌ Analyzing Dns Logs For Exfiltration · agentflocks bundleAnalyzes DNS query logs to detect data exfiltration via DNS tunneling, DGA domain communication, and covert C2 channels using entropy analysis, query volume anomalies, and subdomain length detection in SIEM platforms. Use when SOC teams need to identify DNS-based threats that bypass traditional network security controls.
- ▌ Analyzing Windows Amcache Artifacts · agentflocks bundleParses and analyzes the Windows Amcache.hve registry hive to extract evidence of program execution, application installation, and driver loading for digital forensics investigations. Uses Eric Zimmerman's AmcacheParser and Timeline Explorer for artifact extraction, SHA-1 hash correlation with threat intel, and timeline reconstruction. Activates for requests involving Amcache forensics, program execution evidence, Windows artifact analysis, or application compatibility cache investigation.
- ▌ Analyzing Active Directory Acl Abuse · agentflocks bundleDetect dangerous ACL misconfigurations in Active Directory using ldap3 to identify GenericAll, WriteDACL, and WriteOwner abuse paths
- ▌ Analyzing Docker Container Forensics · agentflocks bundleInvestigate compromised Docker containers by analyzing images, layers, volumes, logs, and runtime artifacts to identify malicious activity and evidence.
- ▌ Analyzing Network Packets With Scapy · agentflocks bundleCraft, send, sniff, and dissect network packets using Scapy for protocol analysis, network reconnaissance, and traffic anomaly detection in authorized security testing
- ▌ Analyzing Windows Shellbag Artifacts · agentflocks bundleAnalyze Windows Shellbag registry artifacts to reconstruct folder browsing activity, detect access to removable media and network shares, and establish user interaction with directories even after deletion using SBECmd and ShellBags Explorer.
- ▌ Performing Container Escape Detection · agentflocks bundleDetects container escape attempts by analyzing namespace configurations, privileged container checks, dangerous capability assignments, and host path mounts using the kubernetes Python client. Identifies CVE-2022-0492 style escapes via cgroup abuse. Use when auditing container security posture or investigating escape attempts.
- ▌ Analyzing Windows Prefetch With Python · agentflocks bundleParse Windows Prefetch files using the windowsprefetch Python library to reconstruct application execution history, detect renamed or masquerading binaries, and identify suspicious program execution patterns.
- ▌ Recovering Deleted Files With Photorec · agentflocks bundleRecover deleted files from disk images and storage media using PhotoRec's file signature-based carving engine regardless of file system damage.
- ▌ Reverse Engineering IOS App With Frida · agentflocks bundleReverse engineers iOS applications using Frida dynamic instrumentation to understand internal logic, extract encryption keys, bypass security controls, and discover hidden functionality without source code access. Use when performing authorized iOS penetration testing, analyzing proprietary protocols, understanding obfuscated logic, or extracting runtime secrets from iOS binaries. Activates for requests involving iOS reverse engineering, Frida iOS hooking, Objective-C/Swift method tracing, or iOS binary analysis.
- ▌ Analyzing Cloud Storage Access Patterns · agentflocks bundleDetect abnormal access patterns in AWS S3, GCS, and Azure Blob Storage by analyzing CloudTrail Data Events, GCS audit logs, and Azure Storage Analytics. Identifies after-hours bulk downloads, access from new IP addresses, unusual API calls (GetObject spikes), and potential data exfiltration using statistical baselines and time-series anomaly detection.
- ▌ Analyzing Mft For Deleted File Recovery · agentflocks bundleAnalyze the NTFS Master File Table ($MFT) to recover metadata and content of deleted files by examining MFT record entries, $LogFile, $UsnJrnl, and MFT slack space using MFTECmd, analyzeMFT, and X-Ways Forensics.
- ▌ Analyzing Usb Device Connection History · agentflocks bundleInvestigate USB device connection history from Windows registry, event logs, and setupapi logs to track removable media usage and potential data exfiltration.
- ▌ Analyzing Network Flow Data With Netflow · agentflocks bundleParse NetFlow v9 and IPFIX records to detect volumetric anomalies, port scanning, data exfiltration, and C2 beaconing patterns. Uses the Python netflow library to decode flow records, builds traffic baselines, and applies statistical analysis to identify flows with abnormal byte counts, connection durations, and periodic timing patterns.
- ▌ Analyzing Windows Registry For Artifacts · agentflocks bundleExtract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.
- ▌ Conducting Post Incident Lessons Learned · agentflocks bundleFacilitate structured post-incident reviews to identify root causes, document what worked and failed, and produce actionable recommendations to improve future incident response.
- ▌ Analyzing Azure Activity Logs For Threats · agentflocks bundleQueries Azure Monitor activity logs and sign-in logs via azure-monitor-query to detect suspicious administrative operations, impossible travel, privilege escalation, and resource modifications. Builds KQL queries for threat hunting in Azure environments. Use when investigating suspicious Azure tenant activity or building cloud SIEM detections.
- ▌ Analyzing Outlook Pst For Email Forensics · agentflocks bundleAnalyze Microsoft Outlook PST and OST files for email forensic evidence including message content, headers, attachments, deleted items, and metadata using libpff, pst-utils, and forensic email analysis tools for legal investigations and incident response.
- ▌ Analyzing Powershell Script Block Logging · agentflocks bundleParse Windows PowerShell Script Block Logs (Event ID 4104) from EVTX files to detect obfuscated commands, encoded payloads, and living-off-the-land techniques. Uses python-evtx to extract and reconstruct multi-block scripts, applies entropy analysis and pattern matching for Base64-encoded commands, Invoke-Expression abuse, download cradles, and AMSI bypass attempts.
- ▌ Analyzing Browser Forensics With Hindsight · agentflocks bundleAnalyze Chromium-based browser artifacts using Hindsight to extract browsing history, downloads, cookies, cached content, autofill data, saved passwords, and browser extensions from Chrome, Edge, Brave, and Opera for forensic investigation.
- ▌ Performing Access Review And Certification · agentflocks bundleConduct systematic access reviews and certifications to ensure users have appropriate access rights aligned with their roles. This skill covers review campaign design, reviewer selection, risk-based p
- ▌ Performing Privileged Account Access Review · agentflocks bundleConduct systematic reviews of privileged accounts to validate access rights, identify excessive permissions, and enforce least privilege across PAM infrastructure.
- ▌ Analyzing Prefetch Files For Execution History · agentflocks bundleParse Windows Prefetch files to determine program execution history including run counts, timestamps, and referenced files for forensic investigation.
- ▌ Performing Access Recertification With Saviynt · agentflocks bundleConfigure and execute access recertification campaigns in Saviynt Enterprise Identity Cloud to validate user entitlements, revoke excessive access, and maintain compliance with SOX, SOC2, and HIPAA.
- ▌ Analyzing Slack Space And File System Artifacts · agentflocks bundleExamine file system slack space, MFT entries, USN journal, and alternate data streams to recover hidden data and reconstruct file activity on NTFS volumes.
- ▌ Performing Entitlement Review With Sailpoint Iiq · agentflocks bundlePerforms entitlement review and access certification campaigns using SailPoint IdentityIQ including manager certifications, targeted entitlement reviews, role-based access validation, SOD violation remediation, and automated revocation workflows. Activates for requests involving access reviews, entitlement certifications, SailPoint IIQ governance, or periodic user access recertification.
- ▌ Analyzing Memory Forensics With Lime And Volatility · agentflocks bundlePerforms Linux memory acquisition using LiME (Linux Memory Extractor) kernel module and analysis with Volatility 3 framework. Extracts process lists, network connections, bash history, loaded kernel modules, and injected code from Linux memory images. Use when performing incident response on compromised Linux systems.
- ▌ Workflow Builder · agentflocks bundle根据自然语言描述生成 flocks 内置工作流（workflow.md, workflow.json）。当用户提出创建/设计/生成/搭建工作流或任何多步骤流程（如告警调查、事件响应、SOP/Runbook 自动化）时使用本 skill。
- ▌ Skyeye Sensor Use · agentflocks bundle使用天眼 SkyEye Sensor 传感器侧精简 CLI 查询告警列表和告警统计。适用于用户提到"SkyEye Sensor""天眼流量传感器告警"场景。
- ▌
- ▌ Webui Page Builder · agentflocksGuide users to create, develop, hide, or delete WebUI page plugins that appear in the WebUI left navigation under Home, with live preview and no restart required. Also guide development of page-scoped backend APIs through the WebUI Page Backend API Runtime when built-in APIs are insufficient. Trigger when the user asks to create, remove, or delete a WebUI contract page, WebUI page, dashboard, navigation tab, integrate custom APIs for a page, or sends messages such as "create a WebUI contract page", "delete WebUI contract page", "remove WebUI page", "创建WebUI 契约页面", "删除WebUI 契约页面", "用户WebUI 契约页面", "WebUI 契约页面", "左侧导航页面", "首页下面的页面", "页面数据来源", "自定义 API", or wants help understanding how WebUI contract pages work in Flocks.
- ▌
- ▌
- ▌ Device Integration Guide · agentflocks指导 Flocks 新建、添加和接入安全设备。Use when the user asks to create, add, onboard, or connect a new security device.
- ▌ Tdp Use · agentflocks bundle用于处理 TDP 威胁检测平台相关任务，支持通过API或者结合浏览器进行操作。只要用户提到需要 打开/操作/获取/浏览 TDP、微步 NDR等需求时，必须先加载本 skill。本 skill 是 TDP 平台操作的唯一决策入口：在未阅读本 skill 并完成模式判断前，不要直接调用任何 `tdp_*` tool。
- ▌ Web2cli · agentflocks bundle使用统一的 Web2CLI 流程捕获网站的 XHR/Fetch 请求，并生成可复用的 CLI、Markdown 文档。通过浏览器的 `cdp-direct` 模式复用用户 Chromium 系浏览器登录态与 CDP 能力。适用于复现登录后操作、沉淀接口调用样例，或基于页面操作生成自动化工具时。
- ▌ Onboarding · agentflocksGuide new users through the complete Flocks setup process via conversation — covering ThreatBook MCP/API, security tool APIs, IM channels, and scenario demos. Also runs system health inspection for returning users. Trigger when the user sends "请启动新手引导流程", "start onboarding", or any similar request to begin setup/configuration.
- ▌ Onesec Use · agentflocks bundle用于处理 OneSEC/OneDNS 终端安全平台相关任务，支持通过API或者结合浏览器进行操作。只要用户提到 OneSEC、微步 EDR等相关操纵需求时，必须先加载本 skill。本 skill 是 OneSEC 平台操作的唯一决策入口：在未阅读本 skill 并完成模式判断前，不要直接调用任何 `onesec_*` tool。
- ▌ Onesig Use · agentflocks bundle用于处理 OneSIG（安全互联网网关 / Secure Internet Gateway）相关任务，支持通过API或者结合浏览器进行操作。只要用户提到 OneSIG、SIG、微步互联网网关等相关操作时，必须先加载本 skill。本 skill 是 OneSIG 平台操作的唯一决策入口：在未阅读本 skill 并完成模式判断前，不要直接调用任何 `onesig_*` tool。
- ▌ Skyeye Use · agentflocks bundle用于处理 SkyEye/天眼/网神分析平台相关任务，支持通过API或者结合浏览器进行操作。只要用户提到 SkyEye、天眼、网神分析平台的相关操作时，必须先加载本 skill。本 skill 是 天眼 平台操作的唯一决策入口：在未阅读本 skill 并完成模式判断前，不要直接调用任何 `skyeye_*` tool。
- ▌ Browser Use · agentflocks bundle统一处理浏览器使用任务，支持可见浏览器 CDP 直连、专用 headless CDP、agent-browser。Use when the user asks to browse websites, interact with pages, fill forms, capture screenshots, reuse an existing Chrome/Chromium/Edge login session, work with an already-open browser/sidebar browser, access login-only/internal/dynamic pages, or automate browser actions.
- ▌ Qingteng Use · agentflocks bundle用于处理青藤云安全平台相关任务，支持通过API或者结合浏览器进行操作。只要用户提到青藤、青藤云安全、青藤主机安全的相关操作时，必须先加载本 skill。本 skill 是 青藤 平台操作的唯一决策入口：在未阅读本 skill 并完成模式判断前，不要直接调用任何 `qingteng_*` tool。
- ▌
- ▌ Agent Builder · agentflocksCreate new sub-agents (subagents) by generating YAML config and prompt files in ~/.flocks/plugins/agents/. The created agent can be delegated to by Rex via delegate_task. Use when the user asks to create, add, or generate a new agent.
- ▌ Skill Builder · agentflocks bundleCreate or improve skill. Use when the user asks to create, add, generate, update, refactor, package, or test a skill, convert a repeated workflow into a reusable skill, write a `SKILL.md`, or add `references/`, `scripts/` for a skill.
- ▌ Sangfor Edr Use · agentflocks bundle深信服 EDR 登录态管理、首页仪表盘、威胁资产分析、资产清点和高级威胁 API 采集。用户提到深信服 EDR、EDR、资产清点、高级威胁或 sangfor EDR 时必须先加载本 skill。
- ▌ Sangfor Xdr Use · agentflocks bundle用于处理深信服 XDR（扩展检测与响应）相关任务，支持通过 API 或者结合浏览器操作。只要用户提到 深信服 XDR、XDR、sangfor XDR 等需求时，必须先加载本 skill。本 skill 是 XDR 平台操作的唯一决策入口：在未阅读本 skill 并完成模式判断前，不要直接调用任何 `sangfor_xdr_*` tool 或使用 browser-use skill。