Data & Analytics

Detects anomalous authentication patterns using UEBA analytics, statistical baselines, and machine learning models to identify impossible travel, credential stuffing, brute force, password spraying, and compromised account behaviors across authentication logs. Activates for requests involving authentication anomaly detection, login behavior analysis, UEBA implementation, or suspicious sign-in investigation.

This skill covers deploying anomaly detection systems for industrial control environments using machine learning models trained on OT network baselines, physics-based process models, and behavioral analysis of industrial protocol communications. It addresses building normal behavior profiles for SCADA polling patterns, detecting deviations in Modbus/DNP3/OPC UA traffic, identifying rogue devices, and correlating network anomalies with physical process data from historians.

Critical opalescence at phase transitions: diverging correlation length, light scattering, and the visual signature of criticality in fluids, proteins, and complex systems

Correlates disparate security incidents, IOCs, and adversary behaviors across time and organizations to identify unified threat campaigns, attribute them to common threat actors, and extract shared indicators for improved detection. Use when multiple incidents exhibit overlapping indicators, when sector-wide attack campaigns require cross-organizational analysis, or when building campaign-level intelligence products. Activates for requests involving campaign analysis, incident clustering, cro...

Searches and explores Burp Suite project files (.burp) from the command line. Use when searching response headers or bodies with regex patterns, extracting security audit findings, dumping proxy history or site map data, or analyzing HTTP traffic captured in a Burp project.

Builds SOC performance metrics and KPI tracking dashboards measuring Mean Time to Detect (MTTD), Mean Time to Respond (MTTR), alert quality ratios, analyst productivity, and detection coverage using SIEM data. Use when SOC leadership needs operational visibility, continuous improvement tracking, or executive-level reporting on security operations effectiveness.

Apply bottom-up and top-down role mining techniques to discover optimal RBAC roles from existing user-permission assignments, reducing role explosion and enforcing least privilege.

BigQuery Expert Engineer Skill - Comprehensive guide for GoogleSQL queries, data management, performance optimization, and cost management Use when: - Running bq commands (query, load, extract) - Writing GoogleSQL queries (functions, JOINs, CTEs) - Designing partitioned/clustered tables - Using BigQuery ML or external data sources

Captures and analyzes network packet data using Wireshark and tshark to identify malicious traffic patterns, diagnose protocol issues, extract artifacts, and support incident response investigations on authorized network segments.

Skill: Reafference & Corollary Discharge (von Holst Neuroscience)

**Category**: Behavioral Verification | Neural Mechanism Implementation **Level**: Advanced (Requires understanding of: reafference theory, signal processing, corollary discharge) **Status**: ✓ COMPLETE & OPERATIONAL **Trit Assignment**: +1 (PLUS) - Active threat detection & signal amplification **Propagates To**: codex, claude, amp, cursor, copilot ---

**Category:** Phase 3 Core - Alternative Learning Paradigms **Status:** Skeleton Implementation **Dependencies:** None (standalone learning framework)

MemberSim generates realistic synthetic claims and payer data for testing claims processing systems, payment integrity, and benefits administration.

Generate realistic clinical trial synthetic data including study definitions, sites, subjects, visits, adverse events, efficacy assessments, and disposition. Use when user requests: clinical trial data, CDISC/SDTM/ADaM datasets, trial cohorts (Phase I/II/III/IV), FDA submission test data, or specific therapeutic areas like oncology or biologics/CGT.

MemberSim generates realistic synthetic claims and payer data for testing claims processing systems, payment integrity, and benefits administration.

Conversation-driven specification and execution of healthcare data generation at scale. Use when building profiles, generating cohorts, creating journeys, batch generation, specifying distributions, or any at-scale data generation task.

**Role**: Step 2.7 — After the research plan is written, fetch a lightweight 8-metric snapshot for each `peer_tickers[]` so that the Mode C Peer Comparison table renders with real `[Portal]` Grade C numbers instead of `[Est] peer reference` placeholders. **Triggered by**: market-router Step 2.7 (Mode C and Mode D only — never Mode A or Mode B) **Reads**: `output/runs/{run_id}/{ticker}/research-plan.json` → `peer_tickers[]` **Writes**: `output/runs/{run_id}/peers/{TICKER}.json` (run-local) AND...

**Role**: Step 3 — Execute Financial Datasets MCP and FMP MCP API calls to collect structured financial data. Enhanced Mode only. **Triggered by**: CLAUDE.md when `data_mode = "enhanced"` after Step 2 **Reads**: run-local `research-plan.json`, `references/api-endpoints.md` **Writes**: `output/runs/{run_id}/{ticker}/tier1-raw.json` **References**: `api-endpoints.md` ---

Excel spreadsheet generation using openpyxl and xlsxwriter. Convert Claude output, data analysis results, and tabular data into formatted .xlsx files with charts, formulas, conditional formatting, and multiple sheets. Use for generating Excel reports programmatically.

Differential gene expression analysis (Python DESeq2). Identify DE genes from bulk RNA-seq counts, Wald tests, FDR correction, volcano/MA plots, for RNA-seq analysis.

Query PubChem via PUG-REST API/PubChemPy (110M+ compounds). Search by name/CID/SMILES, retrieve properties, similarity/substructure searches, bioactivity, for cheminformatics.

Fast in-memory DataFrame library for datasets that fit in RAM. Use when pandas is too slow but data still fits in memory. Lazy evaluation, parallel execution, Apache Arrow backend. Best for 1-100GB datasets, ETL pipelines, faster pandas replacement. For larger-than-RAM data use dask or vaex.

Interactive visualization library. Use when you need hover info, zoom, pan, or web-embeddable charts. Best for dashboards, exploratory analysis, and presentations. For static publication figures use matplotlib or scientific-visualization.

Hardware-agnostic quantum ML framework with automatic differentiation. Use when training quantum circuits via gradients, building hybrid quantum-classical models, or needing device portability across IBM/Google/Rigetti/IonQ. Best for variational algorithms (VQE, QAOA), quantum neural networks, and integration with PyTorch/JAX/TensorFlow. For hardware-specific optimizations use qiskit (IBM) or cirq (Google); for open quantum systems use qutip.