All authors
Claude Skills by Mikaru0Mystic
github.com/Mikaru0Mystic120 skills9 installs283 views
- Analyzing Slack Space And File System ArtifactsExamine file system slack space, MFT entries, USN journal, and alternate data streams to recover hidden dataVotes: 0GitHub stars: 11
- Analyzing Supply Chain Malware ArtifactsInvestigate supply chain attack artifacts including trojanized software updates, compromised build pipelines,Votes: 0GitHub stars: 11
- Analyzing Threat Actor Ttps With Mitre AttackMITRE ATT&CK is a globally-accessible knowledge base of adversary tactics, techniques, and procedures (TTPs)Votes: 0GitHub stars: 11
- Analyzing Threat Actor Ttps With Mitre Navigator'Map advanced persistent threat (APT) group tactics, techniques, and procedures (TTPs) to the MITRE ATT&CK frameworkVotes: 0GitHub stars: 11
- Analyzing Threat Intelligence Feeds'Analyzes structured and unstructured threat intelligence feeds to extract actionable indicators, adversary tactics,Votes: 0GitHub stars: 11
- Analyzing Threat Landscape With MispAnalyze the threat landscape using MISP (Malware Information Sharing Platform) by querying event statistics,Votes: 0GitHub stars: 11
- Analyzing Tls Certificate Transparency Logs'Queries Certificate Transparency logs via crt.sh and pycrtsh to detect phishing domains, unauthorized certificateVotes: 0GitHub stars: 11
- Analyzing Typosquatting Domains With DnstwistDetect typosquatting, homograph phishing, and brand impersonation domains using dnstwist to generate domain permutationsVotes: 0GitHub stars: 11
- Analyzing Uefi Bootkit Persistence'Analyzes UEFI bootkit persistence mechanisms including firmware implants in SPI flash, EFI System PartitionVotes: 0GitHub stars: 11
- Analyzing Usb Device Connection HistoryInvestigate USB device connection history from Windows registry, event logs, and setupapi logs to track removableVotes: 0GitHub stars: 11
- Analyzing Web Server Logs For IntrusionParse Apache and Nginx access logs to detect SQL injection attempts, local file inclusion, directory traversal,Votes: 0GitHub stars: 11
- Analyzing Windows Amcache Artifacts'Parses and analyzes the Windows Amcache.hve registry hive to extract evidence of program execution, applicationVotes: 0GitHub stars: 11
- Analyzing Windows Event Logs In Splunk'Analyzes Windows Security, System, and Sysmon event logs in Splunk to detect authentication attacks, privilegeVotes: 0GitHub stars: 11
- Analyzing Windows Lnk Files For ArtifactsParse Windows LNK shortcut files to extract target paths, timestamps, volume information, and machine identifiersVotes: 0GitHub stars: 11
- Analyzing Windows Prefetch With PythonParse Windows Prefetch files using the windowsprefetch Python library to reconstruct application execution history,Votes: 0GitHub stars: 11
- Analyzing Windows Registry For ArtifactsExtract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, andVotes: 0GitHub stars: 11
- Analyzing Windows Shellbag ArtifactsAnalyze Windows Shellbag registry artifacts to reconstruct folder browsing activity, detect access to removableVotes: 0GitHub stars: 11
- Auditing Aws S3 Bucket Permissions'Systematically audit AWS S3 bucket permissions to identify publicly accessible buckets, overly permissive ACLs,Votes: 0GitHub stars: 11
- Auditing Azure Active Directory Configuration'Auditing Microsoft Entra ID (Azure Active Directory) configuration to identify risky authentication policies,Votes: 0GitHub stars: 11
- Auditing Cloud With Cis Benchmarks'This skill details how to conduct cloud security audits using Center for Internet Security benchmarks for AWS,Votes: 0GitHub stars: 11
- Auditing Gcp Iam Permissions'Auditing Google Cloud Platform IAM permissions to identify overly permissive bindings, primitive role usage,Votes: 0GitHub stars: 11
- Auditing Kubernetes Cluster Rbac'Auditing Kubernetes cluster RBAC configurations to identify overly permissive roles, wildcard permissions, dangerousVotes: 0GitHub stars: 11
- Auditing Terraform Infrastructure For Security'Auditing Terraform infrastructure-as-code for security misconfigurations using Checkov, tfsec, Terrascan, andVotes: 0GitHub stars: 11
- Auditing Tls Certificate Transparency Logs'Monitors Certificate Transparency (CT) logs to detect unauthorized certificate issuance, discover subdomainsVotes: 0GitHub stars: 11
- Automating Ioc Enrichment'Automates the enrichment of raw indicators of compromise with multi-source threat intelligence context usingVotes: 0GitHub stars: 11
- Building Adversary Infrastructure Tracking SystemBuild an automated system to track adversary infrastructure using passive DNS, certificate transparency, WHOISVotes: 0GitHub stars: 11
- Building Attack Pattern Library From Cti ReportsExtract and catalog attack patterns from cyber threat intelligence reports into a structured STIX-based libraryVotes: 0GitHub stars: 11
- Building Automated Malware Submission Pipeline'Builds an automated malware submission and analysis pipeline that collects suspicious files from endpoints andVotes: 0GitHub stars: 11
- Building Cloud Siem With Sentinel'This skill covers deploying Microsoft Sentinel as a cloud-native SIEM and SOAR platform for centralized securityVotes: 0GitHub stars: 11
- Building Detection Rule With Splunk SplBuild effective detection rules using Splunk Search Processing Language (SPL) correlation searches to identifyVotes: 0GitHub stars: 11
- Building Devsecops Pipeline With Gitlab CiDesign and implement a comprehensive DevSecOps pipeline in GitLab CI/CD integrating SAST, DAST, container scanning,Votes: 0GitHub stars: 11
- Building Identity Federation With Saml Azure AdEstablish SAML 2.0 identity federation between on-premises Active Directory and Azure AD (Microsoft Entra ID)Votes: 0GitHub stars: 11
- Building Identity Governance Lifecycle Process'Builds comprehensive identity governance and lifecycle management processes including joiner-mover-leaver automation,Votes: 0GitHub stars: 11
- Building Incident Response Dashboard'Builds real-time incident response dashboards in Splunk, Elastic, or Grafana to provide SOC analysts and leadershipVotes: 0GitHub stars: 11
- Building Incident Response Playbook'Designs and documents structured incident response playbooks that define step-by-step procedures for specificVotes: 0GitHub stars: 11
- Building Incident Timeline With TimesketchBuild collaborative forensic incident timelines using Timesketch to ingest, normalize, and analyze multi-sourceVotes: 0GitHub stars: 11
- Building Ioc Defanging And Sharing PipelineBuild an automated pipeline to defang indicators of compromise (URLs, IPs, domains, emails) for safe sharingVotes: 0GitHub stars: 11
- Building Ioc Enrichment Pipeline With OpenctiOpenCTI is an open-source platform for managing cyber threat intelligence knowledge, built on STIX 2.1 as itsVotes: 0GitHub stars: 11
- Building Malware Incident Communication TemplateBuild structured communication templates for malware incidents including stakeholder notifications, executiveVotes: 0GitHub stars: 11
- Building Patch Tuesday Response ProcessEstablish a structured operational process to triage, test, and deploy Microsoft Patch Tuesday security updatesVotes: 0GitHub stars: 11
- Building Phishing Reporting Button WorkflowImplement a phishing report button in email clients with automated triage workflow that analyzes user-reportedVotes: 0GitHub stars: 11
- Building Ransomware Playbook With Cisa Framework'Builds a structured ransomware incident response playbook aligned with the CISA StopRansomware Guide and NISTVotes: 0GitHub stars: 11
- Building Red Team C2 Infrastructure With HavocDeploy and configure the Havoc C2 framework with teamserver, HTTPS listeners, redirectors, and Demon agents forVotes: 0GitHub stars: 11
- CybersecurityUltimate AI-powered cybersecurity code review skill. Performs comprehensive security audit across 8 dimensions: vulnerability detection (OWASP Top 10:2021, CWE Top 25:2024), secret scanning, dependency/supply chain analysis, IaC security, threat intelligence (malware/backdoor/C2 detection, MITRE ATT&CK mapping), authorization verification, AI-generated code audit, and compliance mapping. Spawns 8 parallel specialist agents with weighted scoring (0-100). Framework-aware false-positive suppress...Votes: 0GitHub stars: 11
- Ai Risk ManagementApply the NIST AI Risk Management Framework (AI RMF 1.0) and adjacent guidance to AI / ML systems — model lifecycle governance, fairness and bias evaluation, robustness, transparency, accountability, third-party model risk, monitoring for drift, and AI incident response. Broader than prompt-injection (which is the security slice). Use when the user mentions 'AI risk,' 'AI governance,' 'NIST AI RMF,' 'AI compliance,' 'ML governance,' 'model risk management,' 'AI fairness,' 'AI bias,' 'algorith...Votes: 0GitHub stars: 11
- Api AuditAudit REST, GraphQL, and RPC APIs against the OWASP API Security Top 10 (2023). Use when the user mentions 'API security,' 'API audit,' 'BOLA,' 'broken object level authorization,' 'BFLA,' 'function-level authorization,' 'mass assignment,' 'API rate limiting,' 'GraphQL security,' 'REST security,' 'API authentication,' 'API authorization,' 'excessive data exposure,' or needs to review API endpoints for security weaknesses.Votes: 0GitHub stars: 11
- Breach PatternsLearn from public breach disclosures — extract the audit question each one implies and check your own stack. Capital One IMDS abuse, LastPass vault exfiltration, Okta Lapsus$, Snowflake credential reuse, MOVEit, SolarWinds, Equifax, Target POS, Codecov, Uber, Twilio — what would you check now if your boss said 'could that happen to us?' Use when the user mentions 'breach analysis,' 'lessons learned,' 'security postmortem,' 'breach patterns,' 'breach lessons,' 'has this happened to us,' 'apply...Votes: 0GitHub stars: 11
- Cloud AuditAudit cloud infrastructure (AWS, GCP, Azure) for misconfigurations, excessive permissions, and security gaps. Use when the user mentions 'cloud security,' 'cloud audit,' 'AWS security,' 'GCP security,' 'Azure security,' 'IAM audit,' 'S3 bucket,' 'cloud misconfiguration,' 'cloud hardening,' or needs to review cloud infrastructure security.Votes: 0GitHub stars: 11
- Container AuditAudit container images, Dockerfiles, and Kubernetes manifests for misconfigurations, excessive privileges, exposed secrets, and runtime risks. Use when the user mentions 'container security,' 'Docker security,' 'Dockerfile audit,' 'Kubernetes security,' 'K8s security,' 'pod security,' 'container hardening,' 'kubectl audit,' 'image scanning,' 'distroless,' 'rootless containers,' 'pod security policy,' 'pod security standards,' 'PSS,' 'network policy,' 'OPA Gatekeeper,' 'Kyverno,' 'runtime secu...Votes: 0GitHub stars: 11
- Crypto AuditAudit cryptography implementation — algorithm choice, key sizes, KDF parameters, IV/nonce handling, signature verification, randomness, TLS configuration, and key rotation. Deeper than owasp-audit A02. Use when the user mentions 'crypto review,' 'cryptography audit,' 'encryption review,' 'KDF,' 'PBKDF2,' 'Argon2,' 'bcrypt cost,' 'IV reuse,' 'nonce reuse,' 'AES mode,' 'AES-GCM,' 'AES-ECB,' 'signature verification,' 'TLS configuration,' 'cipher suites,' 'key rotation,' 'libsodium,' 'BoringSSL,'...Votes: 0GitHub stars: 11