← all publishers

gabrielmoreira

@gabrielmoreira source repo

Report this profile Claim this profile

• 21k skills
• 0 followers
• 17 repo stars
• 2 weeks ago last updated

1. ▌
   Exploiting Stack Buffer Overflows · gabrielmoreira

   Methodology for discovering and exploiting stack-based buffer overflows in native binaries during authorized engagements, covering crash triage, offset discovery with De Bruijn patterns, control of the saved return address, and escalation paths (ret2win, stack shellcode, ROP) depending on which mitigations are present.
   17 repo stars
2. ▌
   Detecting AWS Iam Privilege Escalation · gabrielmoreira

   Detect AWS IAM privilege escalation paths using boto3 and Cloudsplaining policy analysis to identify overly permissive policies, dangerous permission combinations, and least-privilege violations
   17 repo stars
3. ▌
   Implementing Cloud Workload Protection · gabrielmoreira

   Implements cloud workload protection using boto3 and google-cloud APIs for runtime security monitoring, process anomaly detection, and file integrity checking on EC2/GCE instances. Scans for cryptomining, reverse shells, and unauthorized binaries. Use when building runtime security controls for cloud compute workloads.
   17 repo stars
4. ▌
   Analyzing Security Logs With Splunk · gabrielmoreira

   Leverages Splunk Enterprise Security and SPL (Search Processing Language) to investigate security incidents through log correlation, timeline reconstruction, and anomaly detection. Covers Windows event logs, firewall logs, proxy logs, and authentication data analysis. Activates for requests involving Splunk investigation, SPL queries, SIEM log analysis, security event correlation, or log-based incident investigation.
   17 repo stars
5. ▌
   Collecting Indicators Of Compromise · gabrielmoreira

   Systematically collects, categorizes, and distributes indicators of compromise (IOCs) during and after security incidents to enable detection, blocking, and threat intelligence sharing. Covers network, host, email, and behavioral indicators using STIX/TAXII formats and threat intelligence platforms. Activates for requests involving IOC collection, indicator extraction, threat indicator sharing, compromise indicators, STIX export, or IOC enrichment.
   17 repo stars
6. ▌
   Bypassing Macos Gatekeeper Tcc And Sip · gabrielmoreira

   Assessing and bypassing macOS userland and platform security controls during authorized engagements - Gatekeeper/quarantine notarization checks, the TCC (Transparency, Consent & Control) privacy database, System Integrity Protection (SIP/rootless), and the App Sandbox - using codesign, spctl, xattr, sqlite3 against TCC.db, csrutil, sandbox-exec, and AppleEvents/Automation abuse.
   17 repo stars
7. ▌
   Analyzing Network Traffic Of Malware · gabrielmoreira

   Analyzes network traffic generated by malware during sandbox execution or live incident response to identify C2 protocols, data exfiltration channels, payload downloads, and lateral movement patterns using Wireshark, Zeek, and Suricata. Activates for requests involving malware network analysis, C2 traffic decoding, malware PCAP analysis, or network-based malware detection.
   17 repo stars
8. ▌
   Detecting Lateral Movement With Zeek · gabrielmoreira

   Detect lateral movement in network traffic using Zeek (formerly Bro) log analysis. Parses conn.log, smb_mapping.log, smb_files.log, dce_rpc.log, kerberos.log, and ntlm.log to identify SMB file transfers, NTLM account spray activity, remote service execution, and anomalous internal connections.
   17 repo stars
9. ▌
   Analyzing Malicious Url With Urlscan · gabrielmoreira

   URLScan.io is a free service for scanning and analyzing suspicious URLs. It captures screenshots, DOM content, HTTP transactions, JavaScript behavior, and network connections of web pages in an isolat
   17 repo stars
10. ▌
    Performing Credential Access With Lazagne · gabrielmoreira

    Extract stored credentials from compromised endpoints using the LaZagne post-exploitation tool to recover passwords from browsers, databases, system vaults, and applications during authorized red team operations.
    17 repo stars
11. ▌
    Analyzing API Gateway Access Logs · gabrielmoreira

    Parses API Gateway access logs (AWS API Gateway, Kong, Nginx) to detect BOLA/IDOR attacks, rate limit bypass, credential scanning, and injection attempts. Uses pandas for statistical analysis of request patterns and anomaly detection. Use when investigating API abuse or building API-specific threat detection rules.
    17 repo stars
12. ▌
    Analyzing Windows Event Logs In Splunk · gabrielmoreira

    Analyzes Windows Security, System, and Sysmon event logs in Splunk to detect authentication attacks, privilege escalation, persistence mechanisms, and lateral movement using SPL queries mapped to MITRE ATT&CK techniques. Use when SOC analysts need to investigate Windows-based threats, build detection queries, or perform forensic timeline analysis of Windows endpoints and domain controllers.
    17 repo stars
13. ▌
    Performing Malware Ioc Extraction · gabrielmoreira

    Malware IOC extraction is the process of analyzing malicious software to identify actionable indicators of compromise including file hashes, network indicators (C2 domains, IP addresses, URLs), regist
    17 repo stars
14. ▌
    Bypassing Two Factor And Otp · gabrielmoreira

    Identifying and exploiting flaws in two-factor authentication and one-time password verification including response manipulation, code leakage, brute force, race conditions, and delivery-target tampering.
    17 repo stars
15. ▌
    Performing Xs Search Attacks · gabrielmoreira

    Performing XS-Search / XS-Leaks attacks that extract cross-origin information through side channels — using inclusion methods (frames, pop-ups, HTML elements, fetch) and leak techniques (event handlers, timing, error events, global limits like connection-pool and event-loop, CORB, postMessage, Performance API) to distinguish two states of a victim page and exfiltrate secrets. Activates when assessing cross-origin information disclosure, search endpoints, or state-dependent responses.
    17 repo stars
16. ▌
    Testing Password Reset Flaws · gabrielmoreira

    Identifying and exploiting weaknesses in password reset flows including weak reset tokens, host header poisoning, IDOR on the identification parameter, missing session invalidation, and account enumeration.
    17 repo stars
17. ▌
    Generate Prompt Request · gabrielmoreira

    This skill should be used to generate a "prompt request" one-pager that summarizes the current session for a pull request. It produces one consolidated User block folding together every ask and decision from the session, plus one Assistant block summarizing what was built. Use it when the user asks to "generate a prompt request", recap or summarize the session for a PR, or capture what was requested. Also use it automatically when opening a pull request or writing a PR description, so the PR body includes the asks and decisions behind the change. Works on the current session only and outputs inline markdown ready to paste into a PR.
    17 repo stars
18. ▌
    Chengfeng Check Updates · gabrielmoreira

    剪辑环境的唯一管理者：就绪检查（skills 是否最新 → Runtime 是否配套）、Skills 更新激活、Runtime 安装与体检。用户说检查更新、安装剪辑环境、装播放器、检查剪辑环境、剪辑环境就绪了吗、配置转录凭证时使用；业务 Skill（剪口播/字幕/画面/导出）第 0 步也引用本 Skill 的就绪检查。不用于剪辑、字幕、画面、导出本身或项目数据迁移。
    17 repo stars
19. ▌
    Statistical Theory Analysis · gabrielmoreira

    Analyze theoretical properties of statistical methods under the formal formulation: identifiability, bias, variance, consistency, asymptotics, coverage, error bounds, robustness, and limitations.
    17 repo stars
20. ▌
    Methods Section Writer · gabrielmoreira

    Turns your protocol and analysis workflow into publication-ready Methods text. Use when writing or revising the Methods section of a biomedical manuscript, ensuring it complies with reporting guidelines (CONSORT, STROBE, PRISMA, TRIPOD), matches what is in the Results section, and satisfies journal-specific word limits and declarations. Also triggers on "write my methods", "revise my methods section", "how to report my statistics", "what do I need to include in methods for [study type]", or "make my methods CONSORT-compliant".
    17 repo stars
21. ▌
    Results Section Writer · gabrielmoreira

    Writes the full Results section of a biomedical manuscript from a sufficiently clear result structure, figure inventory, or analysis summary while preserving evidence boundaries and result hierarchy.
    17 repo stars
22. ▌
    Table Narrative Writer · gabrielmoreira

    Converts biomedical table content into clear manuscript or presentation narrative by prioritizing meaningful patterns, contrasts, and interpretation boundaries rather than restating every number.
    17 repo stars
23. ▌
    Target Journal Matcher · gabrielmoreira

    Matches your study to appropriate journals based on topic, design, and evidence strength. Use when deciding where to submit a manuscript, comparing journal options by impact factor vs scope fit vs method tolerance, or finding a realistic submission target after a rejection. Also triggers on "where should I submit this paper", "which journal is best for my study", "find journals for my manuscript", "is this a good fit for [journal]", or "I need a journal with IF around X".
    17 repo stars
24. ▌
    External Model Validation · gabrielmoreira

    Use when validating an existing prognostic risk signature on an external bulk expression cohort with survival outcomes, producing risk scores, Kaplan-Meier curves, risk distribution plots, heatmap, and time-dependent ROC curves. NOT for: model training, feature selection, nomogram construction, calibration analysis, or single-cell data.
    17 repo stars
25. ▌
    Study Objective Refiner · gabrielmoreira

    Refines broad, vague, or aspirational biomedical research objectives into clear, bounded, measurable, executable, and downstream-ready study objective statements. Always use this skill when a user has a general aim such as “explore a mechanism,” “study prognosis,” “investigate biomarkers,” or “look at treatment response,” but the objective is still too broad, non-operational, or too ambiguous to support protocol framing, design selection, analysis planning, or hypothesis design. Never assume that polished wording alone means the objective is actionable. Focus first on objective type, missing operational elements, scope discipline, and downstream-ready formulation.
    17 repo stars
26. ▌
    Cohort Study Quality Assessment Nos · gabrielmoreira

    Evaluates the quality of cohort studies using the Newcastle-Ottawa Scale (NOS). Use when the user provides a cohort study article or text and needs a quality assessment report.
    17 repo stars
27. ▌
    Cross Disciplinary Bridge Finder · gabrielmoreira

    Use when identifying collaboration opportunities across fields, finding experts in complementary disciplines, translating methodologies between scientific domains, or building interdisciplinary research teams. Identifies synergies between scientific disciplines, matches researchers with complementary expertise, and facilitates cross-domain collaborations. Supports interdisciplinary grant applications and innovative research team formation.
    17 repo stars
28. ▌
    AI Act Compliance · gabrielmoreira

    Check construction AI systems against the EU AI Act (Regulation 2024/1689): classify risk of estimation, scheduling, CV and agent tools, document transparency, keep human oversight. Use when deploying or auditing AI in construction.
    17 repo stars
29. ▌
    Az Cost Optimize · gabrielmoreira

    Analyze Azure resources used in the app (IaC files and/or resources in a target rg) and optimize costs - creating GitHub issues for identified optimizations.
    17 repo stars
30. ▌
    Microsoft Fabric · gabrielmoreira

    Microsoft Fabric workspace management, governance, REST API patterns, and medallion architecture implementation
    17 repo stars
31. ▌
    Biome Powerbi Query · gabrielmoreira

    Execute read-only DAX queries against Power BI semantic models via the Power BI MCP server -- metadata discovery with INFO.VIEW functions and data retrieval with EVALUATE.
    17 repo stars
32. ▌
    Data Driven Layouts · gabrielmoreira

    Template-driven layouts require code changes for structural updates:
    17 repo stars
33. ▌
    Career Development · gabrielmoreira

    Resume crafting, interview preparation, job search strategy, and professional growth planning.
    17 repo stars
34. ▌
    Typography Selector · gabrielmoreira

    Browse and select fonts from Google Fonts or curated pairings. Use to find the perfect typography for a design project.
    17 repo stars
35. ▌
    Compile Brain · gabrielmoreira

    Create or improve a Markdown instruction, skill, prompt, or agent from an explicitly selected file or user-identified text. Use when a user asks to optimize an existing brain artifact or create one for consistent future execution.
    17 repo stars
36. ▌
    Vscode Environment · gabrielmoreira

    Optimal workspace setup for productivity.
    17 repo stars
37. ▌
    Version Management · gabrielmoreira

    Semver discipline for Alex_ACT_Edition — bump rules, breaking-change classification, fleet rollout sequencing
    17 repo stars
38. ▌
    Code Explorer · gabrielmoreira

    Explores the repository to locate primary source files, coupled UI components, and test files for bug reports or feature requests.
    17 repo stars
39. ▌
    Generate Doc Template · gabrielmoreira

    Generates on-brand document and deck templates — letterhead, slide, and one-pager — as SVG from the active brand profile, with editable title, subtitle, and body zones. Vector output needs no account, key, or network. Use when a user asks for a letterhead, a slide or deck master, or a branded one-pager. Trigger with "make a letterhead", "branded slide", or "/brand-make letterhead".
    17 repo stars
40. ▌
    Find Cybersecurity Firm · gabrielmoreira

    Use whenever the user wants to find, shortlist, vet, or enrich US cybersecurity firms — pen-testing/red team, security audits, vCISO, SOC 2 readiness, incident response, managed SOC, IAM, cloud security, and AppSec. Triggers on "find me a pen-testing firm for our SOC 2 audit", "shortlist three vCISO services for our healthcare-tech startup", "we need an incident response retainer", or "pull contact info for these 8 security firm domains", even when described indirectly (we got breached, prepare us for the compliance audit, get us SOC 2 ready). Drives the ServiceGraph API (api.servicegraph.co) — a 100k+ US firm catalog filterable by industry, services, location, size, ratings. Skip in-house security hires, "how do I patch CVE-X" or "configure firewall Y" DIY questions, security-product reviews (CrowdStrike vs SentinelOne, etc.), generic security knowledge questions, consumer/personal security advice, non-US firms, individual freelancers and bug-bounty hunters.
    17 repo stars
41. ▌
    Find Software Developer · gabrielmoreira

    Use whenever the user wants to find, shortlist, vet, or enrich US software development firms — custom software, web development, mobile app development, backend/API development, DevOps/cloud, system integration, and hosting. Triggers on "find a software dev shop in Austin", "shortlist three custom-software firms with healthcare experience", "we need a mobile app developer for our iOS launch", or "pull contact info for these 10 dev shop domains", even when described indirectly (build a tool, ship a feature, technical partner). Drives the ServiceGraph API (api.servicegraph.co) — a 100k+ US firm catalog filterable by industry, services, location, size, ratings. Defer to find-web-developer for strictly website/landing-page projects. Defer AI/ML, ML pipelines, model building, and data-engineering asks — those are a sibling industry, not software development. Skip in-house engineer hires, code-writing/debugging tasks, cloud-product comparisons, hardware/civil engineering, non-US firms, individual freelancers.
    17 repo stars
42. ▌
    Product Brief · gabrielmoreira

    Structured product brief and PRD creation assistant. Use when the user needs to write a product brief, PRD, feature spec, or any document that defines what to build and why. Triggers include "product brief", "PRD", "spec", "feature doc", "write a brief", "define this feature", or when scoping work for engineering.
    17 repo stars
43. ▌
    Adobe Sdk Patterns · gabrielmoreira

    Apply production-ready patterns for Adobe Firefly Services SDK, PDF Services SDK, and raw REST API usage in TypeScript and Python. Use when implementing Adobe integrations, refactoring SDK usage, or establishing team coding standards for Adobe APIs. Trigger with phrases like "adobe SDK patterns", "adobe best practices", "adobe code patterns", "idiomatic adobe", "adobe typescript".
    17 repo stars
44. ▌
    Attio Sdk Patterns · gabrielmoreira

    Production-ready patterns for the Attio REST API: typed client, retry with backoff, pagination iterators, and multi-tenant factory. Trigger: "attio SDK patterns", "attio best practices", "attio client wrapper", "idiomatic attio", "attio TypeScript patterns".
    17 repo stars
45. ▌
    Clari Sdk Patterns · gabrielmoreira

    Production-ready Clari API client patterns in Python and TypeScript. Use when building reusable Clari clients, implementing export pipelines, or wrapping the Clari v4 API for team use. Trigger with phrases like "clari API patterns", "clari client wrapper", "clari Python client", "clari TypeScript client".
    17 repo stars
46. ▌
    Miro CI Integration · gabrielmoreira

    Configure CI/CD pipelines for Miro REST API v2 integrations with GitHub Actions, test board isolation, and automated validation. Trigger with phrases like "miro CI", "miro GitHub Actions", "miro automated tests", "CI miro", "miro pipeline".
    17 repo stars
47. ▌
    Create Test Run · gabrielmoreira

    Create a Kobiton test run from a test case or suite, then offer to monitor it. When the user gives only partial details (or just a test case id), fill the rest with sensible defaults that match the createTestRun schema, show a summary of what will run, and ask to proceed or customize before creating. After the run is created, offer monitoring in a single prompt — monitor + auto-open live remediation (only when the org's live-remediation flag is ON), monitor only, or don't monitor — and hand off to the monitor-test-run skill if chosen. Use when the user asks to "create / kick off / start / run a test run", "run test case X on N devices", or similar. Wraps the createTestRun MCP tool (and getOrgSettings / listDevices for defaults); delegates the watch to monitor-test-run.
    17 repo stars
48. ▌
    Detecting SQL Injection Vulnerabilities · gabrielmoreira bundle

    Detect and analyze SQL injection vulnerabilities in application code and database queries. Use when you need to scan code for SQL injection risks, review query construction, validate input sanitization, or implement secure query patterns. Trigger with phrases like "detect SQL injection", "scan for SQLi vulnerabilities", "review database queries", or "check SQL security".
    17 repo stars
49. ▌
    Kubernetes Deployment Creator · gabrielmoreira

    Create kubernetes deployment creator operations. Auto-activating skill for DevOps Advanced. Triggers on: kubernetes deployment creator, kubernetes deployment creator Part of the DevOps Advanced skill category. Use when deploying applications or services. Trigger with phrases like "kubernetes deployment creator", "kubernetes creator", "deploy kubernetes ment creator".
    17 repo stars
50. ▌
    Code Injection Detector · gabrielmoreira

    Detect code injection detector operations. Auto-activating skill for Security Fundamentals. Triggers on: code injection detector, code injection detector Part of the Security Fundamentals skill category. Use when working with code injection detector functionality. Trigger with phrases like "code injection detector", "code detector", "code".
    17 repo stars
51. ▌
    Password Hash Generator · gabrielmoreira

    Generate password hash generator operations. Auto-activating skill for Security Fundamentals. Triggers on: password hash generator, password hash generator Part of the Security Fundamentals skill category. Use when working with password hash generator functionality. Trigger with phrases like "password hash generator", "password generator", "password".
    17 repo stars
52. ▌
    Zapier Integration Helper · gabrielmoreira

    Assist with zapier integration helper operations. Auto-activating skill for Business Automation. Triggers on: zapier integration helper, zapier integration helper Part of the Business Automation skill category. Use when working with APIs or building integrations. Trigger with phrases like "zapier integration helper", "zapier helper", "zapier".
    17 repo stars
53. ▌
    Change Request Generator · gabrielmoreira

    Generate change request generator operations. Auto-activating skill for Enterprise Workflows. Triggers on: change request generator, change request generator Part of the Enterprise Workflows skill category. Use when working with change request generator functionality. Trigger with phrases like "change request generator", "change generator", "change".
    17 repo stars
54. ▌
    Calculate Labor Requirements · gabrielmoreira bundle

    Calculate warehouse labor requirements from workload, productivity, shifts, breaks, service windows, and capacity assumptions.
    17 repo stars
55. ▌
    Identify Logistics Constraints · gabrielmoreira bundle

    Identify operational constraints across capacity, labor, equipment, systems, service, product, and safety boundaries.
    17 repo stars
56. ▌
    Analyze Logistics Data Quality · gabrielmoreira bundle

    Analyze logistics data quality across master data, transactions, scan events, integrations, identifiers, lineage, controls, and operational impact.
    17 repo stars
57. ▌
    Analyze Throughput · gabrielmoreira bundle

    Analyze logistics throughput from units, orders, lines, time, capacity, process scope, and source records.
    17 repo stars
58. ▌
    Research Canadian Logistics Documents · gabrielmoreira

    Prepare Canadian logistics documentation research briefs for warehouse, transport, TDG, customs, import, export, carrier, and audit records.
    17 repo stars
59. ▌
    Plan Fefo Inventory Rotation · gabrielmoreira

    Plan first-expired-first-out food inventory rotation using lot, expiry, status, hold, location, and order evidence while preserving release boundaries.
    17 repo stars
60. ▌
    Triage Temperature Excursion · gabrielmoreira

    Triage food cold-chain temperature excursions by evidence, affected lots, custody points, hold status, escalation needs, and blocked release decisions.
    17 repo stars
61. ▌
    Dotnet Testing Advanced Aspnet Integration Testing · gabrielmoreira bundle

    ASP.NET Core 整合測試的專門技能。當需要測試 Web API 端點、HTTP 請求/回應、中介軟體、依賴注入時使用。涵蓋 WebApplicationFactory、TestServer、HttpClient 測試、記憶體資料庫配置等。 Make sure to use this skill whenever the user mentions ASP.NET Core integration testing, WebApplicationFactory, TestServer, HTTP endpoint testing, or middleware testing, even if they don't explicitly ask for integration testing guidance. Keywords: integration testing, 整合測試, web api testing, WebApplicationFactory, TestServer, HttpClient testing, controller testing, endpoint testing, 端點測試, RESTful API testing, Microsoft.AspNetCore.Mvc.Testing, CreateClient, ConfigureWebHost, AwesomeAssertions.Web, Be200Ok, Be404NotFound, middleware testing, 中介軟體測試, dependency injection testing
    17 repo stars
62. ▌
    Dotnet Testing Advanced Webapi Integration Testing · gabrielmoreira bundle

    ASP.NET Core WebApi 整合測試完整指南。當需要對 WebApi 端點進行整合測試或驗證 ProblemDetails 錯誤格式時使用。涵蓋 WebApplicationFactory、IExceptionHandler、Testcontainers 多容器編排、Flurl URL 建構與 AwesomeAssertions HTTP 驗證。 Make sure to use this skill whenever the user mentions WebApi integration testing, ProblemDetails, IExceptionHandler, Flurl, Respawn, or multi-container test orchestration, even if they don't explicitly ask for WebApi testing guidance. Keywords: webapi integration testing, WebApplicationFactory, asp.net core integration test, webapi 整合測試, IExceptionHandler, ProblemDetails, ValidationProblemDetails, AwesomeAssertions, Flurl, Respawn, Be201Created, Be400BadRequest, 多容器測試, Collection Fixture, 全域例外處理
    17 repo stars
63. ▌
    Dotnet Testing Autofixture Nsubstitute Integration · gabrielmoreira bundle

    AutoFixture 與 NSubstitute 整合指南 - 實現自動模擬 (Auto-Mocking)。當需要自動建立 Mock 物件、簡化複雜相依性注入測試時使用。涵蓋 AutoNSubstituteDataAttribute、Frozen 機制、Greedy 建構策略。包含 IMapper (AutoMapper/Mapster) 等特殊相依性的客製化處理。 Make sure to use this skill whenever the user mentions AutoFixture with NSubstitute, auto-mocking, AutoNSubstituteCustomization, Frozen attribute, or AutoNSubstituteDataAttribute, even if they don't explicitly ask for integration guidance. Keywords: autofixture nsubstitute, auto mocking, AutoNSubstituteDataAttribute, 自動模擬, Frozen, AutoNSubstituteCustomization, AutoFixture.AutoNSubstitute, Greedy, fixture.Freeze, Received(), Returns(), IMapper, AutoMapper, Mapster, mapper testing
    17 repo stars
64. ▌
    Indian Foreign Investment Approval Assessment Siddhi Kudalka · gabrielmoreira bundle

    Assess whether Government of India approval is required for foreign investment in an Indian company under Foreign Exchange Management Act, 1999 and the Non-Debt Instruments Rules, 2019. The skill systematically gathers transaction details, evaluates sectoral entry routes and caps, assesses land border country restrictions under applicable laws, and delivers a preliminary compliance note. Produces clear guidance on whether the investment falls within Automatic Route or requires Government approval.
    17 repo stars
65. ▌
    Outside Counsel Billing Performance Reviewer · gabrielmoreira bundle

    Reviews outside counsel invoices and related billing data for an in-house legal department, including LEDES or e-billing exports, OCGs, approved rates, discounts, budgets, AFAs, and staffing rules. Starts with internal comparisons before bringing in external data. Produces invoice review findings, MBR/QBR scorecards, dispute logs, and management reports. For demonstration purposes only and not professional advice.
    17 repo stars
66. ▌
    Generate Requirement Drafts · gabrielmoreira

    Generates draft requirements from Simulink models. Use when drafting or updating requirement artifacts from a model. Prefers Requirements Toolbox (.slreqx) when available; falls back to structured YAML.
    17 repo stars
67. ▌
    Implementing API Abuse Detection With Rate Limiting · gabrielmoreira bundle

    Implements API abuse detection using token bucket, sliding window, and fixed window rate-limiting algorithms backed by Redis, including adaptive limits that tighten during detected attacks and relax during normal traffic. Use when defending APIs against DDoS, brute force login attempts, credential stuffing, or scraping abuse and you need to design or tune rate-limiting logic.
    17 repo stars
68. ▌
    Implementing Cloud Vulnerability Posture Management · gabrielmoreira bundle

    Implement multi-cloud CSPM to detect cloud-native misconfigurations and vulnerabilities (IAM over-permissions, exposed storage, unencrypted data, missing network controls) using AWS Security Hub, Azure Defender for Cloud, and open-source Prowler and ScoutSuite scans, then aggregate results across clouds. Use when auditing multi-cloud environments for misconfiguration-driven vulnerabilities or building a consolidated cross-cloud posture report.
    17 repo stars
69. ▌
    Implementing Container Network Policies With Calico · gabrielmoreira bundle

    Uses Calico's own policy CRDs beyond the upstream Kubernetes API - GlobalNetworkPolicy, HostEndpoint, NetworkSet, policy tiers, and DNS-based egress rules - applied and audited with calicoctl. Use when a policy must span namespaces or protect the host itself, when egress has to be expressed by domain name, or when ordering policies into tiers. Keywords: calicoctl, GlobalNetworkPolicy, HostEndpoint, NetworkSet, tier, DNS egress, order. Do not use for portable upstream NetworkPolicy - use implementing-network-policies-for-kubernetes; for installing Calico and writing standard policy with it use implementing-kubernetes-network-policy-with-calico.
    17 repo stars
70. ▌
    Implementing Passwordless Auth With Microsoft Entra · gabrielmoreira bundle

    Implements passwordless authentication using Microsoft Entra ID with FIDO2 security keys, Windows Hello for Business, Microsoft Authenticator passkeys, and certificate-based authentication to eliminate password-based attacks. Use when deploying passwordless sign-in, configuring FIDO2 passkeys, enforcing phishing-resistant MFA, or setting Microsoft Entra authentication method policies.
    17 repo stars
71. ▌
    Implementing Passwordless Authentication With Fido2 · gabrielmoreira bundle

    Deploy FIDO2/WebAuthn passwordless authentication using security keys and platform authenticators, covering WebAuthn API integration, FIDO2 server configuration, passkey enrollment, biometric authentication, and migration from password-based systems aligned with NIST SP 800-63B AAL3. Use when implementing passkey login, configuring a FIDO2/WebAuthn server, or replacing passwords with phishing-resistant authentication.
    17 repo stars
72. ▌
    Implementing Zero Trust Network Access With Zscaler · gabrielmoreira bundle

    Configures Zero Trust Network Access using Zscaler Private Access (ZPA) to broker identity-based, context-aware connections between authenticated users and internal applications through the Zscaler Zero Trust Exchange, without placing users on the corporate network. Use when replacing traditional VPN architectures with ZTNA, or when brokering secure per-application access for remote and hybrid users via Zscaler.
    17 repo stars
73. ▌
    Performing AWS Account Enumeration With Scout Suite · gabrielmoreira bundle

    Run the agentless, open-source ScoutSuite tool (via pip install and the `scout` CLI) against an AWS account to enumerate resources across services, identify misconfigurations, and generate an interactive HTML security report. Use when assessing an AWS account's overall security posture with read-only IAM credentials, such as during a cloud security audit or compliance review.
    17 repo stars
74. ▌
    Performing Kubernetes Cis Benchmark With Kube Bench · gabrielmoreira bundle

    Turns kube-bench output into a finished CIS Kubernetes Benchmark audit: interpreting PASS/FAIL/WARN per control, judging which failures are genuine on a managed cluster, writing remediation, and packaging evidence for SOC 2 or PCI DSS. Use when conducting a scheduled compliance audit, triaging kube-bench results, deciding which controls are not applicable on EKS, GKE, or AKS, or producing hardening evidence for an auditor. Keywords: CIS Kubernetes Benchmark, control plane, remediation, compliance evidence, SOC 2, PCI DSS, managed cluster exception. Do not use for installing and running the tool - use benchmarking-kubernetes-with-kube-bench.
    17 repo stars
75. ▌
    Performing Ot Vulnerability Assessment With Claroty · gabrielmoreira bundle

    Perform OT vulnerability assessments using the Claroty xDome platform for asset discovery, risk scoring, and vulnerability correlation, combining passive traffic-based identification and active safe device querying with CVE/ICS-CERT advisory correlation for remediation prioritization. Use for scheduled IEC 62443 or NERC CIP OT vulnerability assessments, initial xDome deployment, or generating CIP-010-4 compliance evidence; not for active PLC scanning or penetration testing.
    17 repo stars
76. ▌
    Performing Threat Modeling With Owasp Threat Dragon · gabrielmoreira bundle

    Uses OWASP Threat Dragon (web or desktop) to build data flow diagrams, identify threats with STRIDE, LINDDUN, CIA, DIE, or PLOT4ai methodologies via its auto-generation rule engine, and produce PDF threat model reports. Use during secure design review of an application architecture to build a formal threat model and document mitigations for GRC compliance.
    17 repo stars
77. ▌
    Tencent Meeting MCP · gabrielmoreira

    腾讯会议：会议管理与音视频协作助手。预约/创建/修改/取消会议、查询会议详情与会议号转换、查看参会成员/受邀人/等候室成员、查询用户会议列表（即将开始/进行中/已结束）、查询录制列表与下载地址、获取转写全文/段落/搜索、获取AI智能纪要（支持多语言翻译）、录制权限申请（预览+提交两步流程）、时间转换与版本检查、Agent意见箱反馈上报。当用户需要预约或管理腾讯会议、查看参会人员、查询会议录制或转写内容、获取智能纪要时使用；当用户访问录制相关内容（下载地址/转写/智能纪要）出现无权限错误时，自动发起录制权限申请流程；当Agent遇到以下任何情况时必须立即触发submit_feedback：工具缺失（功能不存在）、工具报错（返回错误码）、能力不足（参数/功能限制）、结果不符预期（数据异常）、改进建议（功能优化）；如果用户提供的是9位会议号而非meeting_id，优先使用get_meeting_by_code转换后再操作。不要在以下场景触发：日程管理（非腾讯会议日程）、即时通讯/聊天、腾讯文档操作、企业微信审批流程、电话/PSTN拨号、视频剪辑或视频编辑、其他视频会议平台（Zoom/Teams/飞书/钉钉）。
    17 repo stars
78. ▌
    Bkn Modeling Advisor · gabrielmoreira

    指导业务知识网络（BKN）建模，输出符合 BKN 2.0.0 的对象类型、关系类型、操作类型、风险类型与概念分组定义。适用于用户提出本体设计、知识网络建模、实体关系梳理、Action 设计、Schema 评审、从文档提取初稿或扩展现有 BKN 的场景。
    17 repo stars
79. ▌
    AI Coding Agents Release Distribution · gabrielmoreira

    Designs release and distribution systems for coding-agent CLIs. Use when modeling packaging, auto-update channels, plugin compatibility, cache migrations, or install footprints.
    17 repo stars
80. ▌
    Detecting S3 Data Exfiltration Attempts · gabrielmoreira

    Detecting data exfiltration attempts from AWS S3 buckets by analyzing CloudTrail S3 data events, VPC Flow Logs, GuardDuty findings, Amazon Macie alerts, and S3 access patterns to identify unauthorized bulk downloads and cross-account data transfers.
    17 repo stars
81. ▌
    Detecting Serverless Function Injection · gabrielmoreira

    Detects and prevents code injection attacks targeting serverless functions (AWS Lambda, Azure Functions, Google Cloud Functions) through event source poisoning, malicious layer injection, runtime command execution, and IAM privilege escalation via function modification. The analyst combines static analysis of function code, CloudTrail event correlation, runtime behavior monitoring, and IAM policy auditing to identify injection vectors across the expanded serverless attack surface including API Gateway, S3, SQS, DynamoDB Streams, and CloudWatch event triggers. Activates for requests involving Lambda security assessment, serverless injection detection, function event poisoning analysis, or serverless privilege escalation investigation.
    17 repo stars
82. ▌
    Performing Sca Dependency Scanning With Snyk · gabrielmoreira

    This skill covers implementing Software Composition Analysis (SCA) using Snyk to detect vulnerable open-source dependencies in CI/CD pipelines. It addresses scanning package manifests and lockfiles, automated fix pull request generation, license compliance checking, continuous monitoring of deployed applications, and integration with GitHub, GitLab, and Jenkins pipelines.
    17 repo stars
83. ▌
    Deploying Edr Agent With Crowdstrike · gabrielmoreira

    Deploys and configures CrowdStrike Falcon EDR agents across enterprise endpoints to enable real-time threat detection, behavioral analysis, and automated response. Use when onboarding endpoints to EDR coverage, configuring detection policies, or integrating Falcon telemetry with SIEM platforms. Activates for requests involving CrowdStrike deployment, Falcon sensor installation, EDR policy configuration, or endpoint detection and response.
    17 repo stars
84. ▌
    Performing IOS App Security Assessment · gabrielmoreira

    Performs comprehensive iOS application security assessments using Frida for dynamic instrumentation, Objection for runtime exploration, SSL pinning bypass for traffic interception, keychain extraction for credential analysis, and IPA static analysis for binary-level review. Use when conducting authorized iOS penetration tests, evaluating mobile app security posture against OWASP MASTG, or assessing iOS app data protection and transport security controls. Activates for requests involving iOS app pentesting, Frida-based iOS instrumentation, mobile app SSL pinning bypass, or IPA reverse engineering.
    17 repo stars
85. ▌
    Reverse Engineering IOS App With Frida · gabrielmoreira

    Reverse engineers iOS applications using Frida dynamic instrumentation to understand internal logic, extract encryption keys, bypass security controls, and discover hidden functionality without source code access. Use when performing authorized iOS penetration testing, analyzing proprietary protocols, understanding obfuscated logic, or extracting runtime secrets from iOS binaries. Activates for requests involving iOS reverse engineering, Frida iOS hooking, Objective-C/Swift method tracing, or iOS binary analysis.
    17 repo stars
86. ▌
    Detecting Lateral Movement In Network · gabrielmoreira

    Identifies lateral movement techniques in enterprise networks by analyzing authentication logs, network flows, SMB traffic, and RDP sessions using Zeek, Velociraptor, and SIEM correlation rules to detect attackers moving between systems.
    17 repo stars
87. ▌
    Detecting Port Scanning With Fail2ban · gabrielmoreira

    Configures Fail2ban with custom filters and actions to detect port scanning activity, SSH brute force attempts, and network reconnaissance, automatically banning offending IP addresses and alerting security teams to suspicious network probing.
    17 repo stars
88. ▌
    Pentesting Docker Registry · gabrielmoreira

    Testing Docker Registry / Distribution services (default 5000/TCP, HTTP or HTTPS) for unauthenticated catalog access, image and blob/manifest extraction, weak basic-auth, and supply-chain image backdooring (push poisoned WordPress/SSH images) during authorized engagements.
    17 repo stars
89. ▌
    Performing Iot Security Assessment · gabrielmoreira

    Performs comprehensive security assessments of IoT devices and their ecosystems by testing hardware interfaces, firmware, network communications, cloud APIs, and companion mobile applications. The tester uses firmware extraction and analysis, hardware debugging via UART and JTAG, network protocol analysis, and runtime exploitation to identify vulnerabilities across all layers of the IoT stack. Activates for requests involving IoT security testing, embedded device assessment, firmware security analysis, or smart device penetration testing.
    17 repo stars
90. ▌
    Conducting Social Engineering Pretext Call · gabrielmoreira

    Plan and execute authorized vishing (voice phishing) pretext calls to assess employee susceptibility to social engineering and evaluate security awareness controls.
    17 repo stars
91. ▌
    Performing Dns Tunneling Detection · gabrielmoreira

    Detects DNS tunneling by computing Shannon entropy of DNS query names, analyzing query length distributions, inspecting TXT record payloads, and identifying high subdomain cardinality. Uses scapy for packet capture analysis and statistical methods to distinguish legitimate DNS from covert channels. Use when hunting for data exfiltration.
    17 repo stars
92. ▌
    Building Detection Rule With Splunk Spl · gabrielmoreira

    Build effective detection rules using Splunk Search Processing Language (SPL) correlation searches to identify security threats in SOC environments.
    17 repo stars
93. ▌
    Investigating Insider Threat Indicators · gabrielmoreira

    Investigates insider threat indicators including data exfiltration attempts, unauthorized access patterns, policy violations, and pre-departure behaviors using SIEM analytics, DLP alerts, and HR data correlation. Use when SOC teams receive insider threat referrals from HR, detect anomalous data movement by employees, or need to build investigation timelines for potential insider threats.
    17 repo stars
94. ▌
    Detecting Living Off The Land Attacks · gabrielmoreira

    Detect abuse of legitimate Windows binaries (LOLBins) used for living off the land attacks. Monitors process creation, command-line arguments, and parent-child relationships to identify suspicious LOLBin execution patterns.
    17 repo stars
95. ▌
    Analyzing Indicators Of Compromise · gabrielmoreira

    Analyzes indicators of compromise (IOCs) including IP addresses, domains, file hashes, URLs, and email artifacts to determine maliciousness confidence, campaign attribution, and blocking priority. Use when triaging IOCs from phishing emails, security alerts, or external threat feeds; enriching raw IOCs with multi-source intelligence; or making block/monitor/whitelist decisions. Activates for requests involving VirusTotal, AbuseIPDB, MalwareBazaar, MISP, or IOC enrichment pipelines.
    17 repo stars
96. ▌
    Bypassing Captcha Protections · gabrielmoreira

    Identifying weaknesses in CAPTCHA implementations and bypassing them via replay, field removal, method/content-type manipulation, missing server-side validation, and weak OCR-solvable challenges to defeat anti-automation controls.
    17 repo stars
97. ▌
    Testing Cors Misconfiguration · gabrielmoreira

    Identifying and exploiting Cross-Origin Resource Sharing misconfigurations that allow unauthorized cross-domain data access and credential theft during security assessments.
    17 repo stars
98. ▌
    Safe Refactoring · gabrielmoreira

    Execute behavior-preserving or intentionally scoped refactors safely. Use this for multi-file renames, component/service extraction, state-management changes, API migrations, concurrency refactors, or any request where unrelated user work and subtle contracts must be preserved.
    17 repo stars
99. ▌
    Author Response Builder · gabrielmoreira

    Turns reviewer comments into structured, professional point-by-point responses linked to manuscript revisions, clarifications, rebuttals, and additional analyses.
    17 repo stars
100. ▌
     Roc Diagnostic Performance · gabrielmoreira

     Use when evaluating diagnostic biomarker performance from case-control expression data with logistic regression and ROC curves, exporting coefficient and AUC tables together with a ROC PDF. NOT for: survival analysis, time-to-event outcomes, multiclass classification, calibration curves, decision-curve analysis, or nomogram construction.
     17 repo stars