Claude Skills by 26zl

'Configures Windows Event Logging with advanced audit policies to generate

'Configuring Zscaler Private Access (ZPA) to replace traditional VPN

'Executes containment strategies to stop active adversary operations

'Correlates security events in IBM QRadar SIEM using AQL (Ariel Query

'Correlates disparate security incidents, IOCs, and adversary behaviors

Use when solving a CTF cryptography challenge — RSA, AES, classical ciphers, ECC, hash crypto, PRNGs, or unknown ciphertext. Provides a decision tree, attack catalog, and tool ordering specific to this installer's crypto module. Triggers on "ctf crypto", "rsa challenge", "aes ctr", "decrypt", "crypto category".

Use when solving CTF forensics challenges — disk images, memory dumps, PCAPs, log analysis, file carving, deleted file recovery, NTFS/ext4 artifacts. Triggers on "ctf forensics", "memory dump", "pcap analysis", "disk image", "file carving", "log forensics".

Use when solving binary exploitation / pwn CTF challenges — buffer overflows, ROP, format strings, heap, kernel pwn. Provides a decision tree, exploit primitive catalog, and uses pwntools via the run_script(venv="pwntools") MCP path. Triggers on "ctf pwn", "binary exploit", "rop", "buffer overflow", "format string", "heap challenge".

Use when solving a CTF reverse engineering challenge — stripped binaries, packed binaries, anti-debug, custom VMs, .NET/Java decomp, Android dex, obfuscated JS, ELF/PE/Mach-O analysis. Provides workflow and tool ordering from the reversing module. Triggers on "ctf rev", "reversing", "reverse engineer", "decompile", "stripped binary".

Use when solving steganography CTF challenges — hidden data in images (PNG/JPG/BMP), audio (WAV/MP3), video, or text. Triggers on "ctf stego", "steganography", "hidden in image", "audio stego", "lsb".

Use when solving a CTF web challenge — SQLi, XSS, SSRF, SSTI, IDOR, auth bypass, file upload, deserialization, prototype pollution, race conditions, JWT attacks. Provides a decision tree and tool stack from this installer's web module. Triggers on "ctf web", "web challenge", "sqli", "xss", "ssti", "ssrf", "jwt".

CVE research, standalone PoC script and report generation. Given a CVE ID, researches NVD and advisories, generates a safe Python PoC, and writes a detailed vulnerability report.

'Deobfuscates malicious JavaScript code used in web-based attacks, phishing

Systematically deobfuscate multi-layer PowerShell malware using AST analysis,

'Deploys deception-based honeytokens in Active Directory including fake

'Deploying Cloudflare Access with Cloudflare Tunnel to provide zero trust

'Deploys canary files (honeytokens) across file systems to detect ransomware

'Deploys and configures CrowdStrike Falcon EDR agents across enterprise

'Deploys and configures osquery for real-time endpoint monitoring using

'Deploying Palo Alto Networks Prisma Access for SASE-based zero trust

'Deploys and monitors ransomware canary files across critical directories

Deploy a Software-Defined Perimeter using the CSA v2.0 specification

Deploy and configure Tailscale as a WireGuard-based zero trust mesh VPN

'Detects prompt injection attacks targeting LLM-based applications using

'This skill covers deploying anomaly detection systems for industrial

'Detects anomalous authentication patterns using UEBA analytics, statistical

Detect and prevent API enumeration attacks including BOLA and IDOR exploitation

Detect and prevent ARP spoofing attacks using ARPWatch, Dynamic ARP Inspection,

'Detect cyber attacks targeting OT historian servers (OSIsoft PI, Ignition,

'This skill covers detecting cyber attacks targeting Supervisory Control

Detect unusual API call patterns in AWS CloudTrail logs using boto3,

'Detecting exposed AWS credentials in source code repositories, CI/CD

Automate AWS GuardDuty threat detection findings processing using EventBridge

Detect AWS IAM privilege escalation paths using boto3 and Cloudsplaining

Detect lateral movement in Azure AD/Entra ID environments using Microsoft

Detect and investigate Azure service principal abuse including privilege

Audit Azure Blob and ADLS storage accounts for public access exposure,

'Performs statistical analysis of Zeek conn.log connection intervals

'Detects and analyzes Bluetooth Low Energy (BLE) security attacks including

Detect and test for OWASP API3:2023 Broken Object Property Level Authorization

Use for SAP and ERP security assessments, S/4HANA, NetWeaver, ABAP, HANA DB, RFC trust, SAP Gateway, ICM, transports, default users, authorization roles, SoD, patching, and business-critical ERP control review.

Creates custom Semgrep rules for detecting security vulnerabilities, bug patterns, and code patterns. Use when writing Semgrep rules or building custom static analysis detections.

Detects fail-open insecure defaults (hardcoded secrets, weak auth, permissive security) that allow apps to run insecurely in production. Use when auditing security, reviewing config management, or analyzing environment variable handling.

Use for IoT, embedded, firmware, hardware security, UART/JTAG/SWD, bootloader, secure boot, OTA update, radio protocol, device cloud, mobile companion app, and embedded Linux assessment work.

Behavioral coding-agent guidelines to reduce common LLM coding mistakes. Use when writing, reviewing, or refactoring code to avoid overcomplication, make surgical changes, surface assumptions, and define verifiable success criteria.

Use for mainframe, z/OS, RACF, ACF2, Top Secret, CICS, IMS, DB2, JCL, JES, APF libraries, USS, TN3270, privileged dataset, and legacy enterprise security assessment work.

Use when the MCP server may be out of sync with bash sources after editing tools_db.py, profiles.py, lib/common.sh MODULE_DESCRIPTIONS, lib/installers.sh ALL_DOCKER_IMAGES, or scripts/verify.sh _PIPX_BIN_NAMES. Triggers on "check mcp sync", "validate mcp", "is the python in sync".

Use when creating a brand new module file in modules/ for a new tool category. Generates the boilerplate with correct array prefix, install_module_<name>() function, and ensures it integrates with install.sh, profiles, and MCP server. Triggers on "new module", "add a module for X", "scaffold module".