Claude Skills by thedixitjain

'Detecting compromised cloud credentials across AWS, Azure, and GCP by analyzing anomalous API activity, impossible travel patterns, unauthorized resource provisioning, and credential abuse indicators using GuardDuty, Defender for Identity, and SCC Event Threat Detection. '

Detect unauthorized modifications to running containers by monitoring for binary execution drift, file system changes, and configuration deviations from the original container image.

Container escape is a critical attack technique where an adversary breaks out of container isolation to access the host system or other containers. Detection involves monitoring for escape indicators

Detect container escape attempts in real-time using Falco runtime security rules that monitor syscalls, file access, and privilege escalation.

Write and deploy Falco rules with the modern eBPF driver to detect container escape, namespace abuse, privileged mounts, and anomalous syscalls at runtime in Kubernetes and Docker.

'This skill teaches security teams how to detect and respond to unauthorized cryptocurrency mining operations in cloud environments. It covers identifying cryptomining indicators through compute usage anomalies, network traffic patterns to mining pools, GuardDuty CryptoCurrency findings, and runtime process monitoring on EC2, ECS, EKS, and Azure Automation workloads. '

Detect DCSync attacks where adversaries abuse Active Directory replication privileges to extract password hashes by monitoring for non-domain-controller accounts requesting directory replication via DsGetNCChanges.

Detect data exfiltration through DNS tunneling by analyzing query entropy, subdomain length, query volume, TXT record abuse, and response payload sizes using passive DNS monitoring.

'Execute use when detecting infrastructure drift from desired state. Trigger with phrases like \"check for drift\", \"infrastructure drift detection\", \"compare actual vs desired state\", or \"detect configuration changes\". Identifies discrepancies between current infrastructure and IaC definitions using terraform plan, cloudformation drift detection, or manual comparison. '

Detect Kerberoasting attacks by monitoring for anomalous Kerberos TGS requests targeting service accounts with SPNs for offline password cracking.

'Detecting misconfigured Azure Storage accounts including publicly accessible blob containers, missing encryption settings, overly permissive SAS tokens, disabled logging, and network access violations using Azure CLI, PowerShell, and Microsoft Defender for Storage. '

'Detect command injection attacks against Modbus TCP/RTU protocol in ICS environments by monitoring for unauthorized write operations, anomalous function codes, malformed frames, and deviations from established communication baselines using ICS-aware IDS and protocol deep packet inspection. '

'This skill covers detecting anomalies in Modbus/TCP and Modbus RTU communications in industrial control systems. It addresses function code monitoring, register range validation, timing analysis, unauthorized client detection, and deep packet inspection for malformed Modbus frames. The skill leverages Zeek with Modbus protocol analyzers, Suricata IDS with OT rules, and custom Python-based detection using Markov chain models for normal Modbus transaction sequences. '

Detect model stealing, model inversion, and membership inference performed through inference-API abuse by monitoring query patterns, applying output perturbation, and red-teaming your own model's extractability.

Detect privilege escalation attempts including token manipulation, UAC bypass, unquoted service paths, kernel exploits, and sudo/doas abuse across Windows and Linux.

Detect and prevent privilege escalation in Kubernetes pods by monitoring security contexts, capabilities, and syscall patterns with Falco and OPA policies.

'Detects and prevents code injection attacks targeting serverless functions (AWS Lambda, Azure Functions, Google Cloud Functions) through event source poisoning, malicious layer injection, runtime command execution, and IAM privilege escalation via function modification. The analyst combines static analysis of function code, CloudTrail event correlation, runtime behavior monitoring, and IAM policy auditing to identify injection vectors across the expanded serverless attack surface including A...

Detect unauthorized SaaS and cloud service usage (shadow IT) by analyzing proxy logs, DNS query logs, and netflow data using Python pandas for traffic pattern analysis and domain classification.

'This skill covers detecting sophisticated cyber-physical attacks that follow the Stuxnet attack pattern of modifying PLC logic while spoofing sensor readings to hide the manipulation from operators. It addresses PLC logic integrity monitoring, physics-based process anomaly detection, engineering workstation compromise indicators, USB-borne attack vectors, and multi-stage attack chain detection spanning IT-to-OT lateral movement through to process manipulation. '

Detect abuse of elevation control mechanisms including UAC bypass, sudo exploitation, and setuid/setgid manipulation by monitoring registry modifications, process elevation flags, and unusual parent-child process relationships.

CI/CD pipeline design with GitHub Actions, Docker, Kubernetes, Helm, and GitOps patterns

DevOps e deploy de aplicacoes — Docker, CI/CD com GitHub Actions, AWS Lambda, SAM, Terraform, infraestrutura como codigo e monitoramento.

> 作为 Team Skills Platform 中的 DevOps Engineer（运维工程师），负责环境变更、发布执行、监控、回滚与运行保障。 当用户明确点名该角色，或当前任务需要该角色承担主责时使用。

Generate comprehensive rollout plans with preflight checks, step-by-step deployment, verification signals, rollback procedures, and communication plans for infrastructure and application changes

部署流程和CI/CD配置，确保安全可靠的部署

监控告警配置，确保系统稳定运行

Implement distributed tracing with Jaeger and Tempo to track requests across microservices and identify performance bottlenecks. Use when debugging microservices, analyzing request flows, or implementing observability for distributed systems.

Implement distributed tracing with Jaeger and Tempo for request flow visibility across microservices.

Make Django deployment changes test-driven across Docker, production settings, Gunicorn, WhiteNoise/static files, environment variables, Ansible/server setup, staging smoke tests, and release checks. Use when containerizing Django, preparing production config, debugging staging, automating deploys, or deciding what deployment behavior functional tests should verify.

Docker best practices including multi-stage builds, compose patterns, image optimization, and security

'Create docker compose creator operations. Auto-activating skill for DevOps Basics. Triggers on: docker compose creator, docker compose creator Part of the DevOps Basics skill category. Use when working with docker compose creator functionality. Trigger with phrases like \"docker compose creator\", \"docker creator\", \"docker\". '

'Manage docker container basics operations. Auto-activating skill for DevOps Basics. Triggers on: docker container basics, docker container basics Part of the DevOps Basics skill category. Use when working with docker container basics functionality. Trigger with phrases like \"docker container basics\", \"docker basics\", \"docker\". '

Docker and container development agent skill and plugin for Dockerfile optimization, docker-compose orchestration, multi-stage builds, and container security hardening. Use when: user wants to optimize a Dockerfile, create or improve docker-compose configurations, implement multi-stage builds, audit container security, reduce image size, or follow container best practices. Covers build performance, layer caching, secret management, and production-ready container patterns.

../../../engineering/docker-development/skills/docker-development/SKILL.md

You are an advanced Docker containerization expert with comprehensive, practical knowledge of container optimization, security hardening, multi-stage builds, orchestration patterns, and production deployment strategies based on current industry best practices.

Automate Docker Hub tasks via Rube MCP (Composio): repositories, images, tags, and container registry management. Always search tools first for current schemas.

Automate Docker Hub operations -- manage organizations, repositories, teams, members, and webhooks via the Composio MCP integration.

Manage Docker containers, images, volumes, and Compose.

Docker イメージの構築、最適化、マルチステージビルド、ネットワーク、ボリューム管理。本番環境デプロイメント用のベストプラクティス。

Yerel geliştirme, konteyner güvenliği, ağ, volume stratejileri ve multi-servis orkestrasyon için Docker ve Docker Compose kalıpları.

用于本地开发的Docker和Docker Compose模式，包括容器安全、网络、卷策略和多服务编排。

Docker and Docker Compose patterns for local development, container security, networking, volume strategies, and multi-service orchestration.

Patrones de Docker y Docker Compose para desarrollo local, seguridad de contenedores, networking, estrategias de volúmenes y orquestación de múltiples servicios.

> Docker and Docker Compose patterns for local development, container security, networking, volume strategies, and multi-service orchestration. Use when setting up containerized development environments or reviewing Docker configurations.

Convert Docker Compose files or installation docs into production-grade Sealos templates with role-specific personal low-load resource sizing. Use when user has a docker-compose.yml and wants a Sealos or Kubernetes template, wants to migrate from Docker Compose to Sealos, needs to convert container orchestration configs to Sealos format, or mentions compose-to-template conversion. Also triggers on \"/docker-to-sealos\".

'Generate dockerfile generator operations. Auto-activating skill for DevOps Basics. Triggers on: dockerfile generator, dockerfile generator Part of the DevOps Basics skill category. Use when working with dockerfile generator functionality. Trigger with phrases like \"dockerfile generator\", \"dockerfile generator\", \"dockerfile\". '

'Configure CI/CD pipelines for Documenso integrations. Use when setting up automated testing, deployment pipelines, or continuous integration for Documenso projects. Trigger with phrases like \"documenso CI\", \"documenso GitHub Actions\", \"documenso pipeline\", \"documenso automated testing\". '

'Deploy Documenso integrations across different platforms and environments. Use when deploying to cloud platforms, containerizing applications, or setting up infrastructure for Documenso integrations. Trigger with phrases like \"deploy documenso\", \"documenso docker\", \"documenso kubernetes\", \"documenso cloud deployment\". '

'Implement monitoring, logging, and tracing for Documenso integrations. Use when setting up observability, implementing metrics collection, or debugging production issues. Trigger with phrases like \"documenso monitoring\", \"documenso metrics\", \"documenso logging\", \"documenso tracing\", \"documenso observability\". '

'Manage dotenv manager operations. Auto-activating skill for DevOps Basics. Triggers on: dotenv manager, dotenv manager Part of the DevOps Basics skill category. Use when working with dotenv manager functionality. Trigger with phrases like \"dotenv manager\", \"dotenv manager\", \"dotenv\". '