Skills
97,222 packaged capabilities and playbooks for agents. Install any of them with one command.
Security
Guides creation of detection rules using Sigma rule specification and the Palantir Alerting and Detection Strategy (ADS) framework, mapped to MITRE ATT&CK v16 techniques. Auto-invoked when the user discusses detection logic, Sigma rules, ATT&CK coverage gaps, or asks "how do I detect this technique?" Produces Sigma-formatted detection rules, ADS documentation, and coverage heatmap methodology for systematic detection program management.
Guidance for Microsoft Entra ID Protection — risk-based identity security that detects user and sign-in risk and automates remediation. Covers risk detections, risk-based Conditional Access, self-remediation via MFA / secure password change, risky-user investigation, and streaming risk to Sentinel. WHEN: Entra ID Protection, identity risk policy, risky users, risky sign-ins, user risk policy, sign-in risk policy, risk-based Conditional Access, leaked credentials, anonymous IP detection, atypical travel, automate identity remediation, alert about leaked credentials, user flagged as risky, force password reset for compromised accounts, block sign-in when identity risk is high, EID P2 risk policy. DO NOT USE for on-prem AD attack detection (use defender-for-identity), CA policy authoring without risk signals (use conditional-access-mfa), or PIM activation (use azure-pim).
Performs a GCP security posture review against the CIS Google Cloud Platform Foundation Benchmark v2.0.0. Auto-invoked when reviewing GCP infrastructure, IAM bindings, VPC firewall rules, Cloud Audit Logs, or GCS bucket security. Walks through all seven benchmark sections, evaluates each recommendation, and produces a prioritized findings report with remediation guidance mapped to specific CIS control IDs.
Executes a structured incident response workflow based on NIST SP 800-61 Rev 2 and the SANS Incident Handler's Handbook. Auto-invoked when the user reports a security incident, asks how to respond to a breach, or needs help with incident classification, containment decisions, stakeholder notification, or evidence preservation. Produces an incident response plan with severity determination, containment decision tree, communication templates, and escalation criteria.
Performs a NIST Cybersecurity Framework 2.0 assessment across all six functions (Govern, Identify, Protect, Detect, Respond, Recover) and their categories and subcategories. Auto-invoked when discussing cybersecurity maturity, risk posture evaluation, or NIST CSF alignment. Develops current and target organizational profiles, assesses maturity tiers, maps informative references, and produces a prioritized improvement roadmap.
Prioritizes patches and manages remediation SLAs using SSVC 2.1 decision outcomes, EPSS v3 trend analysis, and CISA KEV catalog cross-referencing. Covers SLA frameworks by severity tier, compensating controls assessment, patch window scheduling, risk acceptance criteria, and exception management. Auto-invoked when users ask about patch scheduling, SLA compliance, risk exceptions, or remediation backlogs.
Guidance for Microsoft Purview Audit (Standard and Premium) - logging and searching user/admin activity across Microsoft 365 for investigations and compliance. Covers tier differences, default and extended retention, high-value events, audit search UX, Office 365 Management Activity API / Microsoft Graph audit API, and Sentinel/SIEM integration. WHEN: Purview Audit, audit log search, Microsoft 365 audit, Audit Premium, investigate user activity, audit log retention, Microsoft Graph audit API, forensic logging, crucial audit events, MailItemsAccessed.
Reverse engineering binaries using radare2 (r2). Analyze executables, disassemble code, find functions, extract strings, patch binaries, debug programs, and explore firmware. Supports persistent sessions for large binaries to avoid re-analysis. Use when the user wants to reverse engineer, disassemble, analyze, debug, or patch any binary file including ELF, PE, Mach-O, firmware, or shellcode.
Rate limiting patterns for ASP.NET Core Razor Pages applications. Covers fixed window, sliding window, token bucket algorithms, and distributed rate limiting with Redis. Use when implementing rate limiting in ASP.NET Core applications, choosing between different rate limiting algorithms, or setting up distributed rate limiting with Redis.
Internal security review pass of the agentic-workflow review pack — composed in-turn by review-change and product-audit; not a menu entry. Checks secrets, input validation, injection, authn/authz, PII exposure, and dependency risk on the changed surface. Findings only; never edits code.
This skill should be used when the user asks to "triage security findings", "fix an Aikido finding", "review Aikido issues", "dismiss a false positive", "check SAST/IaC alerts", or needs to work with Aikido feed issues, GitHub Dependabot alerts, or GitHub secret scanning alerts.
Provides structured incident containment strategies mapped to NIST SP 800-61 Rev 2 and MITRE ATT&CK techniques. Auto-invoked when a confirmed incident requires isolation decisions, credential revocation, network segmentation, or DNS sinkholing. Produces a containment plan with short-term and long-term actions, business impact assessment, and ATT&CK-mapped countermeasures.
Use when the user wants to drive the CrowdSec Console **Service API (SAPI)** — the premium cloud REST API at admin.api.crowdsec.net — to programmatically manage blocklists (add/remove/bulk IPs, share, subscribe engines), allowlists, firewall/appliance integrations (Palo Alto, Fortinet, Cisco, F5, Sophos, pfSense/OPNsense…), remediation ROI metrics, and org-level decisions. Acts on the user's behalf with their API key. This is the cloud/API skill — for the local engine, cscli, and bouncers use the `crowdsec` skill.
Guides multimodal media authentication and deepfake forensics using provenance checks, metadata review, PRNU/noise analysis, temporal consistency, semantic forensics, and evidence reporting. Use when the user asks to verify images, audio, or video, investigate synthetic media, assess fake or manipulated content, or prepare a media authenticity report.
Guidance for Microsoft Defender XDR — the unified extended detection and response suite that correlates signals across endpoints, identities, email, and cloud apps into prioritised incidents with attack-graph context. Covers onboarding the four core workloads, incident investigation, advanced hunting in KQL, custom detection rules, automatic attack disruption, AIR, and unified RBAC. WHEN: Microsoft Defender XDR, XDR incident investigation, correlate alerts across workloads, advanced hunting KQL, automatic attack disruption, AIR, Defender portal incidents, cross-domain detection, how do I investigate an attack across multiple Microsoft 365 products, alert correlation across endpoint and identity, unified incident view, attack graph, custom detection rule, unified RBAC. DO NOT USE when the need is SIEM log ingestion or custom KQL detections from third-party sources (use sentinel), merging Sentinel into the Defender portal (use unified-secops-platform), or endpoint-only EDR (use defender-for-endpoint).
Integrate DFlow Proof — a Solana wallet identity-verification primitive (Stripe Identity under the hood) — to gate your own app's features behind KYC. Use when the user asks "how do I KYC a wallet?", "check if a wallet is verified", "add KYC to my DeFi app", "redirect to dflow.net/proof", or "gate a feature by jurisdiction or identity". Do NOT use for geoblocking (separate concern), for age gating (Proof doesn't currently verify age), or for spot swaps (no KYC required).
DICOM and NIfTI medical image processing pipeline. Triggers on DICOM, NIfTI, dcm2niix, de-identification, pydicom, DICOM header, conversion, anonymization, BIDS, DICOM tags, medical image format conversion, "DICOM to NIfTI", "burned-in PHI", "SeriesInstanceUID", "nibabel", "DICOM anonymization".
P3 phase skill for Headless Ghidra metadata discovery. Use after P2, or after a P4 batch exposes missing context, to enrich function names, signatures, types, constants, strings, and hotpath metadata in YAML before serialized CLI apply.
Use when designing multi-tenant OCI environments, setting up production landing zones, implementing compartment hierarchies, or establishing governance foundations. Covers Landing Zone reference architectures, compartment strategy, network topology patterns (hub-spoke vs multi-VCN), IAM structure, tagging standards, and cost segregation.
XSS audit tool for PHP web source code. Identifies user input entering output contexts (HTML/attribute/JS/URL/template), analyzes escaping and protection strategies, and outputs exploitability grading, PoCs, and remediation suggestions (omission not allowed).
Conducts a structured post-incident review following NIST SP 800-61 Rev 2 Post-Incident Activity guidance. Auto-invoked when an incident has been resolved and the team needs to conduct a blameless retrospective, reconstruct the timeline, perform root cause analysis, document lessons learned, and track remediation actions. Produces a PIR report with metrics (MTTD, MTTR, MTTC), control failure mapping, and actionable improvement plan.
Develop evidence-backed structural security hardening proposals from disclosures, findings, source code, or Codex Security scans. Use for systemic improvements, alternatives beyond individual patches, architectural tradeoffs, or implementation planning. Also use when a top-level scan requests final-report hardening guidance
Performs a SOC 2 Type II readiness gap analysis against AICPA Trust Services Criteria. Auto-invoked when discussing SOC 2 compliance, audit preparation, or security program maturity. Walks through all Common Criteria (CC1-CC9) plus selected additional criteria, identifies gaps, and produces a remediation roadmap with evidence requirements and 90-day action plan.
Use for any password, API key, token, credential, secret, or 1Password task, including finding credentials, injecting them into commands or env files, saving new API keys, checking or updating login passwords, auditing vaults, and setting up unattended access. Prefer the 2password CLI over raw op whenever it covers the task.
Static security review for authentication and authorization vulnerabilities. Use when the user invokes /auth-review, asks to audit auth, find identity breaches, review access control, hunt for IDOR/BOLA, or check authorization. Framework- and vendor-agnostic. Enumerates every route/endpoint, builds an authorization matrix, applies a vulnerability catalog, and writes a triage report ready to turn into issues or PRs.
Writes and tunes Falco rule syntax for container escape detection - conditions, macros, lists, priorities, and output fields - covering host filesystem mounts, sensitive host path access, kernel module loading, and privileged capability abuse, including how to drive down false positives. Use when authoring or tuning a specific Falco rule for breakout behaviour, or triaging a noisy escape-related Falco alert. Keywords: Falco rule, macro, list, condition, priority, falco_rules.local.yaml, tuning, false positive. Do not use for deploying and operating Falco itself - use detecting-container-runtime-threats-with-falco; for tool-agnostic escape signals use detecting-container-escape-attempts.
Detect privilege escalation attempts across Windows and Linux, including access token manipulation, UAC bypass, unquoted service path abuse, kernel exploits, and sudo/doas abuse. Use when threat hunting for T1068-style privilege escalation, triaging EDR/SIEM alerts on suspicious privilege changes, scoping compromise during incident response, or validating detection coverage in a purple team exercise.
Detects and prevents privilege escalation inside Kubernetes pods by combining admission control (OPA policies), runtime monitoring (Falco), and audit log analysis of security contexts, Linux capabilities, and syscall patterns. Use when investigating a pod running as root or privileged, hardening workloads against in-pod escalation, or hunting for containers exceeding their intended scope. Keywords: allowPrivilegeEscalation, runAsRoot, capabilities, securityContext, OPA, Falco, audit log. Do not use for escalation through RBAC and service-account permissions - use auditing-kubernetes-rbac-privilege-escalation.
OpenHarmony soft bus code security review expert - comprehensively checks C/C++ code against secure coding and logging standards. Covers 40+ security rules, including pointer safety, memory management, lock management, and sensitive information protection. Provides cross-file call analysis and control flow analysis, and generates detailed code review reports. Triggered only when user input contains "软总线安全卫士". Important: this skill is a read-only review tool and does not modify source files.
Exploits Kerberos Constrained Delegation misconfigurations in Active Directory using Impacket's findDelegation.py and getST.py (or Rubeus/Kekeo on Windows) to abuse S4U2Self and S4U2Proxy and impersonate privileged users. Use during authorized Active Directory penetration tests or red-team engagements for lateral movement and privilege escalation after finding an account trusted for constrained delegation.
Analyze real projects and generate or revise secure, verifiable GitHub Actions workflows; use when the user asks to create CI, test matrices, builds, releases, deployments, caching, Secrets, OIDC, PR automation, or to troubleshoot workflow configuration
P1 phase skill for Headless Ghidra baseline and runtime evidence. Use after P0 when the target must be imported into Ghidra, auto-analyzed, exported to baseline YAML, and given reproducible runtime or hotpath observations without decompiling function bodies.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.