数据处理
数据转换、清洗与 ETL
dev.to
vm0-ai
Dev.to API via curl. Use this skill to publish and manage articles on Dev.to.
discord-webhook
vm0-ai
Discord Webhook API via curl. Use this skill to send messages, embeds, and files to Discord channels without a bot.
pdforge
vm0-ai
PDForge (PDF Noodle) API for generating PDFs from templates or HTML via curl.
monorepo-management
HermeticOrmus
Master monorepo management with Turborepo, Nx, and pnpm workspaces to build efficient, scalable multi-package repositories with optimized builds and dependency management. Use when setting up monorepos, optimizing builds, or managing shared dependencies.
database-migration
HermeticOrmus
Execute database migrations across ORMs and platforms with zero-downtime strategies, data transformation, and rollback procedures. Use when migrating databases, changing schemas, performing data transformations, or implementing zero-downtime deployment strategies.
bee-cli
bee-computer
"Access real-time context and life overview from Bee wearable AI. ALWAYS start with 'bee now' to get the last 10 hours of conversations with full utterances - this is the most valuable context for relevant assistance. Use this skill when: (1) You need to understand what's happening RIGHT NOW - recent conversations, current context, what was just discussed, (2) The user asks about something that just happened or someone they just talked to, (3) You need life context - who the owner is, their relationships, work, preferences, (4) Searching past conversations, managing facts/todos, or syncing Bee data."
Exploitability Validation Skill
gadievron
This analysis is performed for defensive purposes, in a lab environment. Full permission has been provided.
analyzing-malware-sandbox-evasion-techniques
mukul975
Detect sandbox evasion techniques in malware samples by analyzing timing checks, VM artifact queries, user interaction
analyzing-windows-registry-for-artifacts
mukul975
Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.
analyzing-slack-space-and-file-system-artifacts
mukul975
Examine file system slack space, MFT entries, USN journal, and alternate data streams to recover hidden data and reconstruct file activity on NTFS volumes.
analyzing-windows-lnk-files-for-artifacts
mukul975
Parse Windows LNK shortcut files to extract target paths, timestamps, volume information, and machine identifiers for forensic timeline reconstruction.
auditing-aws-s3-bucket-permissions
mukul975
Systematically audit AWS S3 bucket permissions to identify publicly accessible buckets, overly permissive ACLs, misconfigured bucket policies, and missing encryption settings using AWS CLI, S3audit, and Prowler to enforce least-privilege data access controls.
analyzing-golang-malware-with-ghidra
mukul975
Reverse engineer Go-compiled malware using Ghidra with specialized scripts for function recovery, string extraction, and type reconstruction in stripped Go binaries.
analyzing-command-and-control-communication
mukul975
Analyzes malware command-and-control (C2) communication protocols to understand beacon patterns, command structures, data encoding, and infrastructure. Covers HTTP, HTTPS, DNS, and custom protocol C2 analysis for detection development and threat intelligence. Activates for requests involving C2 analysis, beacon detection, C2 protocol reverse engineering, or command-and-control infrastructure mapping.
analyzing-linux-elf-malware
mukul975
Analyzes malicious Linux ELF (Executable and Linkable Format) binaries including botnets, cryptominers, ransomware, and rootkits targeting Linux servers, containers, and cloud infrastructure. Covers static analysis, dynamic tracing, and reverse engineering of x86_64 and ARM ELF samples. Activates for requests involving Linux malware analysis, ELF binary investigation, Linux server compromise assessment, or container malware analysis.
analyzing-malware-family-relationships-with-malpedia
mukul975
Use the Malpedia platform and API to research malware family relationships, track variant evolution, link families to threat actors, and integrate YARA rules for detection across malware lineages.
analyzing-cloud-storage-access-patterns
mukul975
Detect abnormal access patterns in AWS S3, GCS, and Azure Blob Storage by analyzing CloudTrail Data Events, GCS
analyzing-network-flow-data-with-netflow
mukul975
Parse NetFlow v9 and IPFIX records to detect volumetric anomalies, port scanning, data exfiltration, and C2 beaconing
analyzing-pdf-malware-with-pdfid
mukul975
Analyzes malicious PDF files using PDFiD, pdf-parser, and peepdf to identify embedded JavaScript, shellcode, exploits, and suspicious objects without opening the document. Determines the attack vector and extracts embedded payloads for further analysis. Activates for requests involving PDF malware analysis, malicious document analysis, PDF exploit investigation, or suspicious attachment triage.
analyzing-ransomware-leak-site-intelligence
mukul975
Monitor and analyze ransomware group data leak sites (DLS) to track victim postings, extract threat intelligence on group tactics, and assess sector-specific ransomware risk for proactive defense.
analyzing-malicious-pdf-with-peepdf
mukul975
Perform static analysis of malicious PDF documents using peepdf, pdfid, and pdf-parser to extract embedded JavaScript,
analyzing-typosquatting-domains-with-dnstwist
mukul975
Detect typosquatting, homograph phishing, and brand impersonation domains using dnstwist to generate domain permutations and identify registered lookalike domains targeting your organization.
analyzing-mft-for-deleted-file-recovery
mukul975
Analyze the NTFS Master File Table ($MFT) to recover metadata and content of deleted files by examining MFT record entries, $LogFile, $UsnJrnl, and MFT slack space using MFTECmd, analyzeMFT, and X-Ways Forensics.
analyzing-network-traffic-for-incidents
mukul975
Analyzes network traffic captures and flow data to identify adversary activity during security incidents, including command-and-control communications, lateral movement, data exfiltration, and exploitation attempts. Uses Wireshark, Zeek, and NetFlow analysis techniques. Activates for requests involving network traffic analysis, packet capture investigation, PCAP analysis, network forensics, C2 traffic detection, or exfiltration detection.