Security · Linux

A skill your agent uses when the user is designing, prototyping, or rewriting a desktop app that must run on multiple OSes (macOS + Windows, optionally Linux) AND feel indistinguishable from a…

yetone/native-feel-skill

Launch, see and drive a real game so an agent can test its own mods.

rehan-remade/universal-modder

Write, debug, or validate a CVEhound detection rule (.cocci or .grep) for a Linux kernel CVE.

evdenis/cvehound

Linux 内核态 CVE 漏洞检测与 PoC 验证工具，专为 AI Agent 设计. An agent skill from aliyun/alibabacloud-ecs-troubleshoot-skills.

aliyun/alibabacloud-ecs-troubleshoot-skills

Linux 用户态安全入侵检测与取证工具，专为 AI Agent 设计。自动判断服务器是否被入侵， 提供完整证据链和可执行修复建议。51 个安全分析器覆盖进程/网络/认证/持久化/Rootkit/ 恶意软件/内存取证/容器逃逸等 12 类检测维度，10 个数据采集器全面采集系统状态， 映射 103+ MITRE ATT&CK 技术，支持 standalone/docker/k8s 三种部署模式。

aliyun/alibabacloud-ecs-troubleshoot-skills

Captures an analyzable sample from a live system when the target leaves no file on disk, by finding abnormal executable memory and the execution context that reached it.

dslsdzc/rev-skills

Provides cryptography attack techniques for CTF challenges. An agent skill from ljagiello/ctf-skills.

ljagiello/ctf-skills

Generates a CycloneDX Cryptographic Bill of Materials (CBOM) with the cdxgen cbom command, inventorying cryptographic algorithms, certificates, keys, and protocol usage from source code and hosts…

cdxgen/cdxgen

Review or implement security measures for the Static Web Server (SWS) project — path traversal prevention, TLS, security headers, CORS, and input validation

static-web-server/static-web-server

Manage users, groups, and permissions on Linux systems. An agent skill from sickn33/agentic-awesome-skills.

sickn33/agentic-awesome-skills

Collects live operating-system inventory (OBOM) and host hardware inventory (HBOM) as CycloneDX documents using the cdxgen obom and hbom commands, including osquery-backed runtime artifacts, Linux…

cdxgen/cdxgen

SQL-powered forensic investigation and system interrogation using osquery to query operating systems as relational databases.

AgentSecOps/SecOpsAgentKit

Run Bumblebee supply-chain inventory and exposure scans on macOS/Linux to detect compromised packages, extensions, and MCP host configs.

sickn33/agentic-awesome-skills

Configures host-based intrusion detection systems (HIDS) to monitor endpoint file integrity, system calls, and configuration changes for security violations.

mukul975/Anthropic-Cybersecurity-Skills

Configures Zscaler Private Access (ZPA) to replace traditional VPN with zero trust network access by deploying App Connectors, defining application segments, configuring identity- and…

mukul975/Anthropic-Cybersecurity-Skills

Detect privilege escalation attempts across Windows and Linux, including access token manipulation, UAC bypass, unquoted service path abuse, kernel exploits, and sudo/doas abuse.

mukul975/Anthropic-Cybersecurity-Skills

Detects and prevents privilege escalation inside Kubernetes pods by combining admission control (OPA policies), runtime monitoring (Falco), and audit log analysis of security contexts, Linux…

mukul975/Anthropic-Cybersecurity-Skills

Detect abuse of elevation control mechanisms (T1548), including Windows UAC bypass via auto-elevating binaries like fodhelper.exe and Linux sudo/setuid/setgid exploitation, by monitoring registry…

mukul975/Anthropic-Cybersecurity-Skills

Hardens Linux endpoints using CIS Benchmark recommendations for Ubuntu, RHEL, and CentOS to reduce attack surface, enforce security baselines, and meet compliance requirements.

mukul975/Anthropic-Cybersecurity-Skills

Configure NextDNS as an encrypted (DoH/DoT) zero trust DNS resolver that blocks malicious, phishing, and cryptojacking domains via real-time threat intelligence, detects DNS rebinding and CNAME…

mukul975/Anthropic-Cybersecurity-Skills

Invoke for 等保2.0 full-lifecycle assessment on corporate networks on Kali Linux: classification, gap analysis, baseline audit, vuln scanning, penetration testing, and compliance reporting per GB/T…

openocta/openocta_skills

Create forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash verification (MD5/SHA) during acquisition.

mukul975/Anthropic-Cybersecurity-Skills

Performs Linux memory acquisition using LiME (Linux Memory Extractor) kernel module and analysis with Volatility 3 framework.

mukul975/Anthropic-Cybersecurity-Skills

Detect UEFI Secure Boot bypasses and bootkits such as BlackLotus and Bootkitty by verifying Secure Boot state, checking dbx revocation currency, and hashing EFI boot binaries against known-bad sets…

mukul975/Anthropic-Cybersecurity-Skills

Implements eBPF-based security monitoring using Cilium Tetragon for real-time process execution tracking, network connection observability, file access auditing, and runtime enforcement.

mukul975/Anthropic-Cybersecurity-Skills

Implements Sigstore-based software signing and verification using Cosign keyless signing, Rekor transparency log verification, and Fulcio certificate authority integration to establish cryptographic…

mukul975/Anthropic-Cybersecurity-Skills

Deploy and configure Velociraptor for scalable endpoint forensic artifact collection during incident response using VQL queries, hunts, and pre-built artifact packs across Windows, Linux, and macOS…

mukul975/Anthropic-Cybersecurity-Skills

Configure and execute agentless vulnerability scanning using network protocols, cloud snapshot analysis, and API-based discovery to assess systems without installing endpoint agents.

mukul975/Anthropic-Cybersecurity-Skills

Analyze memory dumps using Volatility3 plugins to detect injected code, rootkits, credential theft, and malware artifacts in Windows, Linux, and macOS memory images.

mukul975/Anthropic-Cybersecurity-Skills

Analyze Linux, SteamOS, Steam Deck, Wine, or Proton game-security boundaries.

gmh5225/awesome-game-security

Uses the Linux Audit framework (auditd) with ausearch and aureport utilities to detect intrusion attempts, unauthorized access, privilege escalation, and suspicious system activity.

mukul975/Anthropic-Cybersecurity-Skills

Detect kernel-level rootkits in Linux memory dumps using Volatility3 linux plugins (checksyscall, lsmod, hiddenmodules), rkhunter system scanning, and /proc vs /sys discrepancy analysis to identify…

mukul975/Anthropic-Cybersecurity-Skills

Analyzes RAM memory dumps from compromised systems using the Volatility framework to identify malicious processes, injected code, network connections, loaded modules, and extracted credentials.

mukul975/Anthropic-Cybersecurity-Skills

Performs memory forensics analysis using Volatility 3 to extract evidence of malware execution, process injection, network connections, and credential theft from RAM dumps captured during incident…

mukul975/Anthropic-Cybersecurity-Skills

Configures AIDE (Advanced Intrusion Detection Environment) for file integrity monitoring on Linux, covering baseline database creation, scheduled integrity checks via cron, change detection, and…

mukul975/Anthropic-Cybersecurity-Skills

Conduct wireless network security assessments using Kismet to detect rogue access points, hidden SSIDs, weak encryption, and unauthorized clients through passive RF monitoring.

mukul975/Anthropic-Cybersecurity-Skills

Orchestrate end-to-end CVE remediation for the Linux CCM, CNM, and health-probe-proxy images on cloud-provider-azure master or a release-X.Y branch, including builds, repeated Trivy verification…

kubernetes-sigs/cloud-provider-azure

Dump process memory and scan for secrets, license keys, decryption keys, tokens, and crypto artifacts.

ptn1411/skill

Run authorized network reconnaissance with Nmap on Windows (or Linux).

ptn1411/skill

Scan Linux systems for persistence mechanisms including crontab/systemd entries, LDPRELOAD injection, shell profile modifications (.bashrc, .profile), and SSH authorizedkeys backdoors, then…

mukul975/Anthropic-Cybersecurity-Skills

Expert security auditor for AI Skills and Bundles. An agent skill from sickn33/agentic-awesome-skills.

sickn33/agentic-awesome-skills

Configure and execute authenticated (credentialed) vulnerability scans using OpenVAS/Greenbone Vulnerability Management (GVM) with SSH, SMB, or ESXi credentials to detect local vulnerabilities…

mukul975/Anthropic-Cybersecurity-Skills

Plan and run authenticated (credentialed) vulnerability scans with scanners such as Nessus, Qualys, OpenVAS, or Rapid7 InsightVM, using SSH, SMB, WinRM, or SNMPv3 credentials to inspect installed…

mukul975/Anthropic-Cybersecurity-Skills

Analyze malicious Linux ELF binaries — botnets, cryptominers, ransomware, and rootkits targeting Linux servers, containers, and cloud infrastructure — through static analysis, dynamic tracing, and…

mukul975/Anthropic-Cybersecurity-Skills

Memory forensics playbook using Volatility 2/3. An agent skill from yaklang/hack-skills.

yaklang/hack-skills

Systematically map and remove malware, backdoors, and attacker persistence mechanisms (registry Run keys, scheduled tasks, WMI subscriptions, services, cron/init.d) from infected Windows and Linux…

mukul975/Anthropic-Cybersecurity-Skills

Extract stored credentials from compromised endpoints using the LaZagne post-exploitation tool to recover passwords from browsers, databases, system vaults, and applications during authorized red…

mukul975/Anthropic-Cybersecurity-Skills

Fetches and extracts payloads from PayloadsAllTheThings on demand.

transilienceai/communitytools