Recently Added
Fresh skills just added to the collection. Be the first to try them out!
analyzing-network-traffic-of-malware
by mukul975
'Analyzes network traffic generated by malware during sandbox execution or live incident response to identify
analyzing-heap-spray-exploitation
by mukul975
Detect and analyze heap spray attacks in memory dumps using Volatility3 plugins to identify NOP sled patterns,
analyzing-azure-activity-logs-for-threats
by mukul975
'Queries Azure Monitor activity logs and sign-in logs via azure-monitor-query to detect suspicious administrative
analyzing-network-flow-data-with-netflow
by mukul975
Parse NetFlow v9 and IPFIX records to detect volumetric anomalies, port scanning, data exfiltration, and C2 beaconing
analyzing-api-gateway-access-logs
by mukul975
'Parses API Gateway access logs (AWS API Gateway, Kong, Nginx) to detect BOLA/IDOR attacks, rate limit bypass,
analyzing-linux-audit-logs-for-intrusion
by mukul975
'Uses the Linux Audit framework (auditd) with ausearch and aureport utilities to detect intrusion attempts, unauthorized
analyzing-ethereum-smart-contract-vulnerabilities
by mukul975
Perform static and symbolic analysis of Solidity smart contracts using Slither and Mythril to detect reentrancy,
analyzing-malware-sandbox-evasion-techniques
by mukul975
Detect sandbox evasion techniques in malware samples by analyzing timing checks, VM artifact queries, user interaction
analyzing-malicious-pdf-with-peepdf
by mukul975
Perform static analysis of malicious PDF documents using peepdf, pdfid, and pdf-parser to extract embedded JavaScript,
analyzing-android-malware-with-apktool
by mukul975
Perform static analysis of Android APK malware samples using apktool for decompilation, jadx for Java source
analyzing-kubernetes-audit-logs
by mukul975
'Parses Kubernetes API server audit logs (JSON lines) to detect exec-into-pod, secret access, RBAC modifications,
writing-skills
by PostHog
'Guide for writing PostHog agent skills — job-to-be-done templates that teach agents how to use MCP tools to achieve a goal. Use when adding new product functionality that agents should know how to work with, creating a new skill, or updating existing skills in products/*/skills/.'
playwright-test
by PostHog
Write a playwright test, make sure it runs, and is not flaky.
isolating-product-facade-contracts
by PostHog
Plan and execute product isolation migrations to a facade plus contract layer in PostHog, following the Visual review architecture. Use when a product still exposes internals (models/logic/views) across boundaries and needs migration toward contracts.py + facade/api.py + presentation separation, with a PR strategy that minimizes review latency and conflicts with parallel work.
implementing-mcp-tools
by PostHog
'Guide for exposing PostHog product endpoints as MCP tools. Use when creating new or updating API endpoints, adding MCP tool definitions, scaffolding YAML configs, or writing serializers with good descriptions. Covers the full pipeline from Django serializer to generated TypeScript tool handler.'
blog-repurpose
by AgriciDaniel
Repurpose blog posts for social media, email, YouTube, Reddit, and LinkedIn. Generates Twitter/X threads, LinkedIn articles, YouTube scripts, Reddit discussion posts, email newsletter excerpts. Adapts tone for each platform. Use when user says "repurpose", "blog repurpose", "share blog", "social media", "twitter thread", "linkedin post", "youtube script", "reddit post".
blog-outline
by AgriciDaniel
SERP-informed outline generation with H2/H3 heading hierarchy, competitive content gap analysis, section-by-section word count targets, chart and image placement markers, FAQ question planning, and internal linking zones. Lighter than a full content brief — generates article skeleton and structure only, ready for /blog write to consume. Use when user says "outline", "blog outline", "content outline", "structure blog", "plan sections", "article skeleton", "heading structure", "SERP analysis", "competitive outline", "plan article".
analyzing-memory-dumps-with-volatility
by mukul975
'Analyzes RAM memory dumps from compromised systems using the Volatility framework to identify malicious processes,
analyzing-malware-behavior-with-cuckoo-sandbox
by mukul975
Executes malware samples in Cuckoo Sandbox to observe runtime behavior including process creation, file system modifications, registry changes, network communications, and API calls. Generates comprehensive behavioral reports for malware classification and IOC extraction. Activates for requests involving dynamic malware analysis, sandbox detonation, behavioral analysis, or automated malware execution.
analyzing-command-and-control-communication
by mukul975
Analyzes malware command-and-control (C2) communication protocols to understand beacon patterns, command structures, data encoding, and infrastructure. Covers HTTP, HTTPS, DNS, and custom protocol C2 analysis for detection development and threat intelligence. Activates for requests involving C2 analysis, beacon detection, C2 protocol reverse engineering, or command-and-control infrastructure mapping.
analyzing-typosquatting-domains-with-dnstwist
by mukul975
Detect typosquatting, homograph phishing, and brand impersonation domains using dnstwist to generate domain permutations and identify registered lookalike domains targeting your organization.
analyzing-windows-registry-for-artifacts
by mukul975
Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.
analyzing-email-headers-for-phishing-investigation
by mukul975
Parse and analyze email headers to trace the origin of phishing emails, verify sender authenticity, and identify
analyzing-ios-app-security-with-objection
by mukul975
'Performs runtime mobile security exploration of iOS applications using Objection, a Frida-powered toolkit that