Security · Linux · For devops and sre engineers

Write, debug, or validate a CVEhound detection rule (.cocci or .grep) for a Linux kernel CVE.

evdenis/cvehound

Linux 用户态安全入侵检测与取证工具，专为 AI Agent 设计。自动判断服务器是否被入侵， 提供完整证据链和可执行修复建议。51 个安全分析器覆盖进程/网络/认证/持久化/Rootkit/ 恶意软件/内存取证/容器逃逸等 12 类检测维度，10 个数据采集器全面采集系统状态， 映射 103+ MITRE ATT&CK 技术，支持 standalone/docker/k8s 三种部署模式。

aliyun/alibabacloud-ecs-troubleshoot-skills

Review or implement security measures for the Static Web Server (SWS) project — path traversal prevention, TLS, security headers, CORS, and input validation

static-web-server/static-web-server

Manage users, groups, and permissions on Linux systems. An agent skill from sickn33/agentic-awesome-skills.

sickn33/agentic-awesome-skills

Configures host-based intrusion detection systems (HIDS) to monitor endpoint file integrity, system calls, and configuration changes for security violations.

mukul975/Anthropic-Cybersecurity-Skills

Configures Zscaler Private Access (ZPA) to replace traditional VPN with zero trust network access by deploying App Connectors, defining application segments, configuring identity- and…

mukul975/Anthropic-Cybersecurity-Skills

Hardens Linux endpoints using CIS Benchmark recommendations for Ubuntu, RHEL, and CentOS to reduce attack surface, enforce security baselines, and meet compliance requirements.

mukul975/Anthropic-Cybersecurity-Skills

Create forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash verification (MD5/SHA) during acquisition.

mukul975/Anthropic-Cybersecurity-Skills

Detect UEFI Secure Boot bypasses and bootkits such as BlackLotus and Bootkitty by verifying Secure Boot state, checking dbx revocation currency, and hashing EFI boot binaries against known-bad sets…

mukul975/Anthropic-Cybersecurity-Skills

Implements eBPF-based security monitoring using Cilium Tetragon for real-time process execution tracking, network connection observability, file access auditing, and runtime enforcement.

mukul975/Anthropic-Cybersecurity-Skills

Implements Sigstore-based software signing and verification using Cosign keyless signing, Rekor transparency log verification, and Fulcio certificate authority integration to establish cryptographic…

mukul975/Anthropic-Cybersecurity-Skills

Deploy and configure Velociraptor for scalable endpoint forensic artifact collection during incident response using VQL queries, hunts, and pre-built artifact packs across Windows, Linux, and macOS…

mukul975/Anthropic-Cybersecurity-Skills

Configure and execute agentless vulnerability scanning using network protocols, cloud snapshot analysis, and API-based discovery to assess systems without installing endpoint agents.

mukul975/Anthropic-Cybersecurity-Skills

Detect kernel-level rootkits in Linux memory dumps using Volatility3 linux plugins (checksyscall, lsmod, hiddenmodules), rkhunter system scanning, and /proc vs /sys discrepancy analysis to identify…

mukul975/Anthropic-Cybersecurity-Skills

Configures AIDE (Advanced Intrusion Detection Environment) for file integrity monitoring on Linux, covering baseline database creation, scheduled integrity checks via cron, change detection, and…

mukul975/Anthropic-Cybersecurity-Skills

Conduct wireless network security assessments using Kismet to detect rogue access points, hidden SSIDs, weak encryption, and unauthorized clients through passive RF monitoring.

mukul975/Anthropic-Cybersecurity-Skills

Dump process memory and scan for secrets, license keys, decryption keys, tokens, and crypto artifacts.

ptn1411/skill

Scan Linux systems for persistence mechanisms including crontab/systemd entries, LDPRELOAD injection, shell profile modifications (.bashrc, .profile), and SSH authorizedkeys backdoors, then…

mukul975/Anthropic-Cybersecurity-Skills

Configure and execute authenticated (credentialed) vulnerability scans using OpenVAS/Greenbone Vulnerability Management (GVM) with SSH, SMB, or ESXi credentials to detect local vulnerabilities…

mukul975/Anthropic-Cybersecurity-Skills

Plan and run authenticated (credentialed) vulnerability scans with scanners such as Nessus, Qualys, OpenVAS, or Rapid7 InsightVM, using SSH, SMB, WinRM, or SNMPv3 credentials to inspect installed…

mukul975/Anthropic-Cybersecurity-Skills

Fetches and extracts payloads from PayloadsAllTheThings on demand.

transilienceai/communitytools

威胁情报查询与关联：VT/Any.run/hybrid-analysis、MISP. An agent skill from dslsdzc/rev-skills.

dslsdzc/rev-skills

主机安全CVE漏洞修复验证引擎。从主机漏扫报告(Excel)或CVE编号自动提取漏洞，查询威胁情报(NVD/EPSS/MSRC/OVAL)，生成修复脚本(fix.sh/fix.ps1)，SSH验证脚本可执行性，产出修复验证报告。覆盖 Linux(centos/ubuntu/debian/suse/amazon/fedora/alpine/arch) + Windows + Web-CMS…

infometa/workbuddyskills

Linux kernel security skill for LSM, hardening, and exploit mitigations.

mohitmishra786/low-level-dev-skills

加密算法识别：常量表指纹、自定义加密模式. An agent skill from dslsdzc/rev-skills.

dslsdzc/rev-skills

Guidance for Microsoft Defender for Containers — Kubernetes and container security across AKS, Azure Arc-enabled Kubernetes, EKS, GKE, and OpenShift.

vinayaklatthe/microsoft-security-skills

Guidance for designing and operating Microsoft Sentinel, the cloud-native SIEM and SOAR delivered through the Defender portal.

vinayaklatthe/microsoft-security-skills