← all publishers

micsapp

@micsapp source repo

Report this profile Claim this profile

• 3.2k skills
• 0 followers
• 3 repo stars
• last month last updated

1. ▌
   Precommit Setup · micsapp

   Configure three-layer pre-commit system with linting, type checking, and testing hooks. Use for quality gate setup and code standards. Skip if pre-commit is optimally configured.
   3 repo stars
2. ▌
   Clear Context · micsapp bundle

   Automatic context management with graceful handoff to continuation subagent. Use when Context usage approaches 80% during long-running tasks. This skill enables automatic continuation without manual /clear. The key insight: Subagents have fresh context windows. By delegating remaining work to a continuation subagent, we achieve effective "auto-clear" without stopping the workflow.
   3 repo stars
3. ▌
   Workflow Monitor · micsapp bundle

   automatically create GitHub issues for workflow improvements via /fix-workflow. Use when workflows fail, timeout, or show inefficient patterns. Do not use when normal workflow execution, simple command errors.
   3 repo stars
4. ▌
   Damage Control · micsapp bundle

   Recovery protocols for agents encountering broken state: crash recovery, context overflow, merge conflict resolution, and state reconciliation. Provides triage decision trees and step-by-step procedures to restore forward progress without losing work.
   3 repo stars
5. ▌
   Error Patterns · micsapp bundle

   Standardized error handling patterns with classification, recovery, and logging strategies. error handling, error recovery, graceful degradation, resilience.
   3 repo stars
6. ▌
   Unified Review · micsapp bundle

   Use this skill when orchestrating multiple review types. Use when general review needed without knowing which specific skill applies, full multi-domain review desired, integrated reporting needed. Do not use when specific review type known - use bug-review, test-review, etc. DO NOT use when: architecture-only focus - use architecture-review.
   3 repo stars
7. ▌
   Browser Recording · micsapp bundle

   Record browser sessions using Playwright for web UI tutorials, converts video to GIF.
   3 repo stars
8. ▌
   Media Composition · micsapp

   Combine media assets (GIFs, videos) into composite tutorials with vertical/horizontal layouts.
   3 repo stars
9. ▌
   Task Planning · micsapp bundle

   Generate phased, dependency-ordered tasks from specs. Identifies parallelization opportunities. task planning, dependency ordering, phased breakdown, parallel tasks Use when: converting specifications to implementation tasks DO NOT use when: writing specs - use spec-writing. Not for execution - use speckit-implement.
   3 repo stars
10. ▌
    Gh Dash · micsapp

    Provides a GitHub pull request dashboard directly in the terminal. Use when the user wants to view PR status, check CI/CD progress, review bot comments, or merge pull requests without leaving Claude Code. Trigger with phrases like "show PR dashboard", "PR status", "check CI progress", "merge this PR", or "review pull request".
    3 repo stars
11. ▌
    Apim Policy Authoring · micsapp bundle

    Creates production-ready Azure API Management policy XML for authentication (OAuth 2.0, JWT validation, subscription keys), rate limiting, CORS configuration, error handling, and API transformations. Use when implementing API security, access control, or request/response processing logic.
    3 repo stars
12. ▌
    Analyzing Kubernetes Audit Logs · micsapp bundle

    Parses Kubernetes API server audit logs (JSON lines) to detect exec-into-pod, secret access, RBAC modifications, privileged pod creation, and anonymous API access. Builds threat detection rules from audit event patterns. Use when investigating Kubernetes cluster compromise or building k8s-specific SIEM detection rules.
    3 repo stars
13. ▌
    Analyzing Linux Kernel Rootkits · micsapp bundle

    Detect kernel-level rootkits in Linux memory dumps using Volatility3 linux plugins (check_syscall, lsmod, hidden_modules), rkhunter system scanning, and /proc vs /sys discrepancy analysis to identify hooked syscalls, hidden kernel modules, and tampered system structures.
    3 repo stars
14. ▌
    Conducting API Security Testing · micsapp bundle

    Conducts security testing of REST, GraphQL, and gRPC APIs to identify vulnerabilities in authentication, authorization, rate limiting, input validation, and business logic. The tester uses the OWASP API Security Top 10 as the testing framework, combining Burp Suite interception with Postman collections and custom scripts to test endpoint security at every privilege level. Activates for requests involving API security testing, REST API pentest, GraphQL security assessment, or API vulnerability testing.
    3 repo stars
15. ▌
    Configuring Hsm For Key Storage · micsapp bundle

    Hardware Security Modules (HSMs) are tamper-resistant physical devices that safeguard cryptographic keys and perform cryptographic operations in a hardened environment. Keys stored in an HSM never lea
    3 repo stars
16. ▌
    Detecting Cryptomining In Cloud · micsapp bundle

    This skill teaches security teams how to detect and respond to unauthorized cryptocurrency mining operations in cloud environments. It covers identifying cryptomining indicators through compute usage anomalies, network traffic patterns to mining pools, GuardDuty CryptoCurrency findings, and runtime process monitoring on EC2, ECS, EKS, and Azure Automation workloads.
    3 repo stars
17. ▌
    Detecting Golden Ticket Forgery · micsapp bundle

    Detect Kerberos Golden Ticket forgery by analyzing Windows Event ID 4769 for RC4 encryption downgrades (0x17), abnormal ticket lifetimes, and krbtgt account anomalies in Splunk and Elastic SIEM
    3 repo stars
18. ▌
    Detecting Kerberoasting Attacks · micsapp bundle

    Detect Kerberoasting attacks by monitoring for anomalous Kerberos TGS requests targeting service accounts with SPNs for offline password cracking.
    3 repo stars
19. ▌
    Detecting Pass The Hash Attacks · micsapp bundle

    Detect Pass-the-Hash attacks by analyzing NTLM authentication patterns, identifying Type 3 logons with NTLM where Kerberos is expected, and correlating with credential dumping.
    3 repo stars
20. ▌
    Detecting Service Account Abuse · micsapp bundle

    Detect abuse of service accounts through anomalous interactive logons, privilege escalation, lateral movement, and unauthorized access patterns.
    3 repo stars
21. ▌
    Detecting Shadow It Cloud Usage · micsapp bundle

    Detect unauthorized SaaS and cloud service usage (shadow IT) by analyzing proxy logs, DNS query logs, and netflow data using Python pandas for traffic pattern analysis and domain classification.
    3 repo stars
22. ▌
    Detecting Stuxnet Style Attacks · micsapp bundle

    This skill covers detecting sophisticated cyber-physical attacks that follow the Stuxnet attack pattern of modifying PLC logic while spoofing sensor readings to hide the manipulation from operators. It addresses PLC logic integrity monitoring, physics-based process anomaly detection, engineering workstation compromise indicators, USB-borne attack vectors, and multi-stage attack chain detection spanning IT-to-OT lateral movement through to process manipulation.
    3 repo stars
23. ▌
    Exploiting Idor Vulnerabilities · micsapp bundle

    Identifying and exploiting Insecure Direct Object Reference vulnerabilities to access unauthorized resources by manipulating object identifiers in API requests and URLs.
    3 repo stars
24. ▌
    Exploiting Ipv6 Vulnerabilities · micsapp bundle

    Identifies and exploits IPv6-specific vulnerabilities including SLAAC spoofing, Router Advertisement flooding, and IPv6 tunneling during authorized assessments to test dual-stack security controls and IPv6-aware network defenses.
    3 repo stars
25. ▌
    Implementing Saml Sso With Okta · micsapp bundle

    Implement SAML 2.0 Single Sign-On (SSO) using Okta as the Identity Provider (IdP). This skill covers end-to-end configuration of SAML authentication flows, attribute mapping, certificate management, a
    3 repo stars
26. ▌
    Managing Intelligence Lifecycle · micsapp bundle

    Manages the end-to-end cyber threat intelligence lifecycle from planning and direction through collection, processing, analysis, dissemination, and feedback to ensure intelligence products meet stakeholder requirements and continuously improve. Use when establishing or maturing a CTI program, defining intelligence requirements with business stakeholders, or building feedback loops between intelligence consumers and producers. Activates for requests involving CTI program maturity, intelligence requirements, PIRs, or intelligence lifecycle management.
    3 repo stars
27. ▌
    Mapping Mitre Attack Techniques · micsapp bundle

    Maps observed adversary behaviors, security alerts, and detection rules to MITRE ATT&CK techniques and sub-techniques to quantify detection coverage and guide control prioritization. Use when building an ATT&CK-based coverage heatmap, tagging SIEM alerts with technique IDs, aligning security controls to adversary playbooks, or reporting threat exposure to executives. Activates for requests involving ATT&CK Navigator, Sigma rules, MITRE D3FEND, or coverage gap analysis.
    3 repo stars
28. ▌
    Performing Kerberoasting Attack · micsapp bundle

    Kerberoasting is a post-exploitation technique that targets service accounts in Active Directory by requesting Kerberos TGS (Ticket Granting Service) tickets for accounts with Service Principal Names
    3 repo stars
29. ▌
    Performing Purple Team Exercise · micsapp bundle

    Performs purple team exercises by coordinating red team adversary emulation with blue team detection validation using MITRE ATT&CK-mapped attack scenarios, real-time detection testing, and collaborative gap remediation. Use when SOC teams need to validate detection capabilities, improve analyst skills, and close detection gaps through structured offensive-defensive collaboration.
    3 repo stars
30. ▌
    Performing Ssl Stripping Attack · micsapp bundle

    Simulates SSL stripping attacks using sslstrip, Bettercap, and mitmproxy in authorized environments to test HSTS enforcement, certificate validation, and HTTPS upgrade mechanisms that protect users from downgrade attacks on encrypted connections.
    3 repo stars
31. ▌
    Securing Helm Chart Deployments · micsapp bundle

    Secure Helm chart deployments by validating chart integrity, scanning templates for misconfigurations, and enforcing security contexts in Kubernetes releases.
    3 repo stars
32. ▌
    Testing For Xss Vulnerabilities · micsapp bundle

    Tests web applications for Cross-Site Scripting (XSS) vulnerabilities by injecting JavaScript payloads into reflected, stored, and DOM-based contexts to demonstrate client-side code execution, session hijacking, and user impersonation. The tester identifies all injection points and output contexts, crafts context-appropriate payloads, and bypasses sanitization and CSP protections. Activates for requests involving XSS testing, cross-site scripting assessment, client-side injection testing, or JavaScript injection vulnerability testing.
    3 repo stars
33. ▌
    Data Visualization · micsapp

    Create effective data visualizations with Python (matplotlib, seaborn, plotly). Use when building charts, choosing the right chart type for a dataset, creating publication-quality figures, or applying design principles like accessibility and color theory.
    3 repo stars
34. ▌
    Account Research · micsapp

    Research a company or person and get actionable sales intel. Works standalone with web search, supercharged when you connect enrichment tools or your CRM. Trigger with "research [company]", "look up [person]", "intel on [prospect]", "who is [name] at [company]", or "tell me about [company]".
    3 repo stars
35. ▌
    Modular Skills · micsapp bundle

    Architect skills as modular blocks to control token usage and complexity. Use when creating skills >150 lines, breaking down monolithic skills, or planning new architecture. Do not use for evaluating existing skills (use skills-eval) or writing human-facing prose (use writing-clearly-and-concisely). Check this skill before starting any new skill development.
    3 repo stars
36. ▌
    Project Planning · micsapp

    Transform specifications into implementation plans with architecture design and dependency-ordered tasks. Use for spec-to-plan conversion, task breakdown, effort estimation. Skip if no spec exists.
    3 repo stars
37. ▌
    Delegation Core · micsapp bundle

    Delegate tasks to external LLM services (Gemini, Qwen) with quota, logging, and error handling. Use when tasks exceed context window or need cheaper processing. Do not use when task requires reasoning by Claude.
    3 repo stars
38. ▌
    Qwen Delegation · micsapp bundle

    Qwen CLI delegation workflow implementing delegation-core for Alibaba's Qwen models. Use when delegation-core selected Qwen, need Qwen's large context capabilities, batch processing required. Do not use when deciding which model to use (use delegation-core first), qwen CLI not installed.
    3 repo stars
39. ▌
    Bloat Detector · micsapp bundle

    Detect codebase bloat through progressive analysis: dead code, duplication, complexity, documentation bloat. Use when context usage high, quarterly maintenance, pre-release cleanup, before refactoring. Do not use when active feature development, time-sensitive bugs, codebase < 1000 lines.
    3 repo stars
40. ▌
    Smart Sourcing · micsapp

    balancing accuracy with token efficiency.
    3 repo stars
41. ▌
    Structured Output · micsapp

    Consult this skill when formatting final review deliverables. Use when formatting final review outputs, ensuring consistent deliverable structure, making findings comparable across reviews. Do not use when capturing evidence during analysis - use proof-of-work. DO NOT use when: reviewing changes - use diff-analysis or review-core first.
    3 repo stars
42. ▌
    Code Refinement · micsapp bundle

    Analyze and improve living code quality: duplication, algorithmic efficiency, clean code principles, architectural fit, anti-slop patterns, and error handling robustness. Use when improving code quality, reducing AI slop, refactoring for clarity, optimizing algorithms, applying clean code principles. Do not use when removing dead/unused code (use conserve:bloat-detector). reviewing for bugs (use pensive:bug-review). selecting architecture paradigms (use archetypes skills). This skill actively improves living code, complementing bloat detection (dead code removal) with quality refinement (living code improvement).
    3 repo stars
43. ▌
    Makefile Review · micsapp bundle

    Use this skill for Makefile audit and optimization. Use when auditing Makefiles, reviewing build system, checking portability, eliminating recipe duplication. Do not use when creating new Makefiles - use abstract:make-dogfood. DO NOT use when: architecture review - use architecture-review.
    3 repo stars
44. ▌
    Commit Messages · micsapp bundle

    Generate conventional commit messages from staged changes with correct type/scope. Use when generating commit messages in conventional commits format. DO NOT use when: full PR preparation - use pr-prep instead.
    3 repo stars
45. ▌
    Version Updates · micsapp

    Use this skill for version management and release preparation. Use when bumping project versions, updating changelogs, preparing releases, coordinating version changes across files. Do not use when just documentation updates - use doc-updates. DO NOT use when: full PR preparation - use pr-prep.
    3 repo stars
46. ▌
    Drawio MCP Diagramming · micsapp bundle

    Create and edit architecture diagrams using Draw.io MCP (`drawio/create_diagram`) with reliable Azure and AWS icon rendering guidance and troubleshooting. Supports Azure2 and AWS4 icon libraries. Requires Python 3 and internet access to refresh icon catalogs (periodic, not per-run).
    3 repo stars
47. ▌
    Analyzing Linux System Artifacts · micsapp bundle

    Examine Linux system artifacts including auth logs, cron jobs, shell history, and system configuration to uncover evidence of compromise or unauthorized activity.
    3 repo stars
48. ▌
    Analyzing PDF Malware With Pdfid · micsapp bundle

    Analyzes malicious PDF files using PDFiD, pdf-parser, and peepdf to identify embedded JavaScript, shellcode, exploits, and suspicious objects without opening the document. Determines the attack vector and extracts embedded payloads for further analysis. Activates for requests involving PDF malware analysis, malicious document analysis, PDF exploit investigation, or suspicious attachment triage.
    3 repo stars
49. ▌
    Auditing Kubernetes Cluster Rbac · micsapp bundle

    Auditing Kubernetes cluster RBAC configurations to identify overly permissive roles, wildcard permissions, dangerous ClusterRoleBindings, service account abuse, and privilege escalation paths using kubectl, rbac-tool, KubiScan, and Kubeaudit.
    3 repo stars
50. ▌
    Deobfuscating Javascript Malware · micsapp bundle

    Deobfuscates malicious JavaScript code used in web-based attacks, phishing pages, and dropper scripts by reversing encoding layers, eval chains, string manipulation, and control flow obfuscation to reveal the original malicious logic. Activates for requests involving JavaScript malware analysis, script deobfuscation, web skimmer analysis, or obfuscated dropper investigation.
    3 repo stars
51. ▌
    Detecting Azure Lateral Movement · micsapp bundle

    Detect lateral movement in Azure AD/Entra ID environments using Microsoft Graph API audit logs, Azure Sentinel KQL hunting queries, and sign-in anomaly correlation to identify privilege escalation, token theft, and cross-tenant pivoting.
    3 repo stars
52. ▌
    Hunting For Shadow Copy Deletion · micsapp bundle

    Hunt for Volume Shadow Copy deletion activity that indicates ransomware preparation or anti-forensics by monitoring vssadmin, wmic, and PowerShell shadow copy commands.
    3 repo stars
53. ▌
    Implementing Zero Trust In Cloud · micsapp bundle

    This skill guides organizations through implementing zero trust architecture in cloud environments following NIST SP 800-207 and Google BeyondCorp principles. It covers identity-centric access controls, micro-segmentation, continuous verification, device trust assessment, and deploying Identity-Aware Proxy to eliminate implicit network trust in AWS, Azure, and GCP environments.
    3 repo stars
54. ▌
    Performing Osint With Spiderfoot · micsapp bundle

    Automate OSINT collection using SpiderFoot REST API and CLI for target profiling, module-based reconnaissance, and structured result analysis across 200+ data sources
    3 repo stars
55. ▌
    Performing Service Account Audit · micsapp bundle

    Audit service accounts across enterprise infrastructure to identify orphaned, over-privileged, and non-compliant accounts. This skill covers discovery of service accounts in Active Directory, cloud pl
    3 repo stars
56. ▌
    Performing Soc Tabletop Exercise · micsapp bundle

    Performs tabletop exercises for SOC teams simulating security incidents through discussion-based scenarios to test incident response procedures, communication workflows, and decision-making under pressure without impacting production systems. Use when organizations need to validate IR playbooks, train analysts, or meet compliance requirements for incident response testing.
    3 repo stars
57. ▌
    Reverse Engineering Rust Malware · micsapp bundle

    Reverse engineer Rust-compiled malware using IDA Pro and Ghidra with techniques for handling non-null-terminated strings, crate dependency extraction, and Rust-specific control flow analysis.
    3 repo stars
58. ▌
    Shared Patterns · micsapp bundle

    Reference these patterns to validate consistency across the ecosystem. Use when creating new skills or hooks that need consistent patterns, implementing validation logic, setting up error handling, creating test scaffolding, referencing standard workflow structures. Do not use when pattern is specific to one skill only. DO NOT use when: pattern is still evolving - wait for stability. DO NOT use when: pattern is context-dependent requiring variations.
    3 repo stars
59. ▌
    Skill Authoring · micsapp bundle

    Guide to effective Claude Code skill authoring using TDD methodology and persuasion principles. Use when creating new skills, improving compliance, or validating quality before deployment. Do not use for evaluating existing skills (use skills-eval) or analyzing architecture (use modular-skills). Follow the Iron Law: write a failing test before writing any skill.
    3 repo stars
60. ▌
    Project Execution · micsapp

    Execute implementation plans with checkpoint validation, progress tracking, and quality gates. Use for task implementation, plan execution, progress tracking. Skip if no plan exists.
    3 repo stars
61. ▌
    Decisive Action · micsapp

    Guidance on when to ask clarifying questions vs proceed with standard approaches. Reduces interaction rounds while preventing wrong assumptions.
    3 repo stars
62. ▌
    Rigorous Reasoning · micsapp bundle

    Prevents sycophantic reasoning through checklist-based analysis, categorical integrity, and evidence-following to uncomfortable conclusions. Red Flags: "I agree that", "You are right", "Great point", "Absolutely", "That is a fair point", "I can see why", agreement without validation, softening conclusions, hedging without evidence, retracting under pressure. Use when analyzing conflicts, evaluating ethical claims, or noticing sycophantic thought patterns. Do not use for routine implementation or simple factual questions. CRITICAL: This skill overrides conversational tendencies toward politeness. Agreement requires validity and accuracy.
    3 repo stars
63. ▌
    Quota Management · micsapp bundle

    Quota tracking, threshold monitoring, and graceful degradation for rate-limited API services. quota, rate limiting, usage limits, thresholds.
    3 repo stars
64. ▌
    Service Registry · micsapp bundle

    Consult this skill when implementing service registry patterns. Use when managing multiple external services, implementing health checks, centralizing service configuration, unified service execution. Do not use when single service integration without registry needs.
    3 repo stars
65. ▌
    Tutorial Updates · micsapp bundle

    Orchestrate tutorial generation from VHS tapes and Playwright specs to dual-tone markdown with GIF recording. tutorial update, gif generation, tape recording, update tutorial, regenerate gifs, tutorial manifest Use when: regenerating tutorial GIFs, updating documentation demos, creating tutorials from tape files DO NOT use when: only updating text - use doc-updates.
    3 repo stars
66. ▌
    Roc Curve Plotter · micsapp

    Manage roc curve plotter operations. Auto-activating skill for ML Training. Triggers on: roc curve plotter, roc curve plotter Part of the ML Training skill category. Use when working with roc curve plotter functionality. Trigger with phrases like "roc curve plotter", "roc plotter", "roc".
    3 repo stars
67. ▌
    Azure Apim Architecture · micsapp

    Analyzes and explains Azure API Management architecture decisions for enterprise API marketplace implementations using VNet Internal mode, Front Door, hybrid authentication, and multi-environment strategies. Use when discussing APIM component selection, network topology, cost optimization, or comparing alternatives like workspaces vs instances, VNet Internal vs External mode, or Front Door vs Application Gateway.
    3 repo stars
68. ▌
    Analyzing API Gateway Access Logs · micsapp bundle

    Parses API Gateway access logs (AWS API Gateway, Kong, Nginx) to detect BOLA/IDOR attacks, rate limit bypass, credential scanning, and injection attempts. Uses pandas for statistical analysis of request patterns and anomaly detection. Use when investigating API abuse or building API-specific threat detection rules.
    3 repo stars
69. ▌
    Analyzing Disk Image With Autopsy · micsapp bundle

    Perform comprehensive forensic analysis of disk images using Autopsy to recover files, examine artifacts, and build investigation timelines.
    3 repo stars
70. ▌
    Analyzing Heap Spray Exploitation · micsapp bundle

    Detect and analyze heap spray attacks in memory dumps using Volatility3 plugins to identify NOP sled patterns, shellcode landing zones, and suspicious large allocations in process virtual address space.
    3 repo stars
71. ▌
    Building Cloud Siem With Sentinel · micsapp bundle

    This skill covers deploying Microsoft Sentinel as a cloud-native SIEM and SOAR platform for centralized security operations. It details configuring data connectors for multi-cloud log ingestion, writing KQL detection queries, building automated response playbooks with Logic Apps, and leveraging the Sentinel data lake for petabyte-scale threat hunting across AWS, Azure, and GCP security telemetry.
    3 repo stars
72. ▌
    Conducting Pass The Ticket Attack · micsapp bundle

    Pass-the-Ticket (PtT) is a lateral movement technique that uses stolen Kerberos tickets (TGT or TGS) to authenticate to services without knowing the user's password. By extracting Kerberos tickets fro
    3 repo stars
73. ▌
    Deploying Ransomware Canary Files · micsapp bundle

    Deploys and monitors ransomware canary files across critical directories using Python's watchdog library for real-time filesystem event detection. Places strategically named decoy files that mimic high-value targets (financial records, credentials, database exports) in locations ransomware typically enumerates first. Monitors for any read, modify, rename, or delete operations on canary files and triggers immediate alerts via email, Slack webhook, or syslog when interaction is detected, providing early warning before full encryption begins.
    3 repo stars
74. ▌
    Detecting API Enumeration Attacks · micsapp bundle

    Detect and prevent API enumeration attacks including BOLA and IDOR exploitation by monitoring sequential identifier access patterns and authorization failures.
    3 repo stars
75. ▌
    Detecting Dll Sideloading Attacks · micsapp bundle

    Detect DLL side-loading attacks where adversaries place malicious DLLs alongside legitimate applications to hijack execution flow for defense evasion.
    3 repo stars
76. ▌
    Detecting Dnp3 Protocol Anomalies · micsapp bundle

    Detect anomalies in DNP3 (Distributed Network Protocol 3) communications used in SCADA systems by monitoring for unauthorized control commands, firmware update attempts, protocol violations, and deviations from baseline traffic patterns using deep packet inspection and machine learning approaches.
    3 repo stars
77. ▌
    Detecting Mobile Malware Behavior · micsapp bundle

    Detects and analyzes malicious behavior in mobile applications through behavioral analysis, permission abuse detection, network traffic monitoring, and dynamic instrumentation. Use when analyzing suspicious mobile applications for data exfiltration, command-and-control communication, credential stealing, SMS interception, or other malware indicators. Activates for requests involving mobile malware analysis, app behavior monitoring, trojan detection, or suspicious app investigation.
    3 repo stars
78. ▌
    Detecting Pass The Ticket Attacks · micsapp bundle

    Detect Kerberos Pass-the-Ticket (PtT) attacks by analyzing Windows Event IDs 4768, 4769, and 4771 for anomalous ticket usage patterns in Splunk and Elastic SIEM
    3 repo stars
79. ▌
    Detecting Rdp Brute Force Attacks · micsapp bundle

    Detect RDP brute force attacks by analyzing Windows Security Event Logs for failed authentication patterns (Event ID 4625), successful logons after failures (Event ID 4624), NLA failures, and source IP frequency analysis.
    3 repo stars
80. ▌
    Exploiting HTTP Request Smuggling · micsapp bundle

    Detecting and exploiting HTTP request smuggling vulnerabilities caused by Content-Length and Transfer-Encoding parsing discrepancies between front-end and back-end servers.
    3 repo stars
81. ▌
    Exploiting OAUTH Misconfiguration · micsapp bundle

    Identifying and exploiting OAuth 2.0 and OpenID Connect misconfigurations including redirect URI manipulation, token leakage, and authorization code theft during security assessments.
    3 repo stars
82. ▌
    Hunting For Cobalt Strike Beacons · micsapp bundle

    Detect Cobalt Strike beacon network activity using default TLS certificate signatures (serial 8BB00EE), JA3/JA3S/JARM fingerprints, HTTP C2 profile pattern matching, beacon jitter analysis, and named pipe detection via Zeek, Suricata, and Python PCAP analysis.
    3 repo stars
83. ▌
    Hunting For Dcom Lateral Movement · micsapp bundle

    Hunt for DCOM-based lateral movement by detecting abuse of MMC20.Application, ShellBrowserWindow, and ShellWindows COM objects through Sysmon Event ID 1 (process creation) and Event ID 3 (network connection) correlation, WMI event analysis, RPC endpoint mapper traffic on port 135, and DCOM-specific parent-child process relationships.
    3 repo stars
84. ▌
    Hunting For Dns Based Persistence · micsapp bundle

    Hunt for DNS-based persistence mechanisms including DNS hijacking, dangling CNAME records, wildcard DNS abuse, and unauthorized zone modifications using passive DNS databases, SecurityTrails API, and DNS audit log analysis.
    3 repo stars
85. ▌
    Implementing Siem Use Case Tuning · micsapp bundle

    Tune SIEM detection rules to reduce false positives by analyzing alert volumes, creating whitelists, adjusting thresholds, and measuring detection efficacy metrics in Splunk and Elastic
    3 repo stars
86. ▌
    Managing Cloud Identity With Okta · micsapp bundle

    This skill covers implementing Okta as a centralized identity provider for cloud environments, configuring SSO integration with AWS, Azure, and GCP, deploying phishing- resistant MFA with Okta FastPass, managing lifecycle automation for user provisioning and deprovisioning, and enforcing adaptive access policies based on device posture and risk signals.
    3 repo stars
87. ▌
    Performing Csrf Attack Simulation · micsapp bundle

    Testing web applications for Cross-Site Request Forgery vulnerabilities by crafting forged requests that exploit authenticated user sessions during authorized security assessments.
    3 repo stars
88. ▌
    Performing Malware Ioc Extraction · micsapp bundle

    Malware IOC extraction is the process of analyzing malicious software to identify actionable indicators of compromise including file hashes, network indicators (C2 domains, IP addresses, URLs), regist
    3 repo stars
89. ▌
    Performing Red Team With Covenant · micsapp bundle

    Conduct red team operations using the Covenant C2 framework for authorized adversary simulation, including listener setup, grunt deployment, task execution, and lateral movement tracking.
    3 repo stars
90. ▌
    Performing Security Headers Audit · micsapp bundle

    Auditing HTTP security headers including CSP, HSTS, X-Frame-Options, and cookie attributes to identify missing or misconfigured browser-level protections.
    3 repo stars
91. ▌
    Recovering From Ransomware Attack · micsapp bundle

    Executes structured recovery from a ransomware incident following NIST and CISA frameworks, including environment isolation, forensic evidence preservation, clean infrastructure rebuild, prioritized system restoration from verified backups, credential reset, and validation against re-infection. Covers Active Directory recovery, database restoration, and application stack rebuild in dependency order. Activates for requests involving ransomware recovery, post-encryption restoration, or disaster recovery from ransomware.
    3 repo stars
92. ▌
    Scanning Docker Images With Trivy · micsapp bundle

    Trivy is a comprehensive open-source vulnerability scanner by Aqua Security that detects vulnerabilities in OS packages, language-specific dependencies, misconfigurations, secrets, and license violati
    3 repo stars
93. ▌
    Securing API Gateway With AWS Waf · micsapp bundle

    Securing API Gateway endpoints with AWS WAF by configuring managed rule groups for OWASP Top 10 protection, creating custom rate limiting rules, implementing bot control, setting up IP reputation filtering, and monitoring WAF metrics for security effectiveness.
    3 repo stars
94. ▌
    Securing Github Actions Workflows · micsapp bundle

    This skill covers hardening GitHub Actions workflows against supply chain attacks, credential theft, and privilege escalation. It addresses pinning actions to SHA digests, minimizing GITHUB_TOKEN permissions, protecting secrets from exfiltration, preventing script injection in workflow expressions, and implementing required reviewers for workflow changes.
    3 repo stars
95. ▌
    Testing For Broken Access Control · micsapp bundle

    Systematically testing web applications for broken access control vulnerabilities including privilege escalation, missing function-level checks, and insecure direct object references.
    3 repo stars
96. ▌
    Testing For Host Header Injection · micsapp bundle

    Test web applications for HTTP Host header injection vulnerabilities to identify password reset poisoning, web cache poisoning, SSRF, and virtual host routing manipulation risks.
    3 repo stars
97. ▌
    Testing Mobile API Authentication · micsapp bundle

    Tests authentication and authorization mechanisms in mobile application APIs to identify broken authentication, insecure token management, session fixation, privilege escalation, and IDOR vulnerabilities. Use when performing API security assessments against mobile app backends, testing JWT implementations, evaluating OAuth flows, or assessing session management. Activates for requests involving mobile API auth testing, token security assessment, OAuth mobile flow testing, or API authorization bypass.
    3 repo stars
98. ▌
    Subagent Testing · micsapp bundle

    TDD-style testing methodology for skills using fresh subagent instances to prevent priming bias and validate skill effectiveness. Use when validating skill improvements, testing skill effectiveness, preventing priming bias, measuring skill impact on behavior. Do not use when implementing skills (use skill-authoring instead), creating hooks (use hook-authoring instead).
    3 repo stars
99. ▌
    Gemini Delegation · micsapp bundle

    Gemini CLI delegation workflow implementing delegation-core for Google's Gemini models. Use when delegation-core selected Gemini, need Gemini's 1M+ token context window, batch processing required. Do not use when deciding which model to use (use delegation-core first), gemini CLI not installed.
    3 repo stars
100. ▌
     Install Watchdog · micsapp

     Install the egregore watchdog daemon using the OS-native scheduler. Creates a launchd plist (macOS) or systemd timer (Linux) that checks every 5 minutes if egregore needs relaunching.
     3 repo stars