Detection engineering skill for writing, testing, and tuning Sigma, YARA, YARA-L, Suricata, Snort, Zeek, KQL, SPL, EQL, Chronicle, and Elastic detection rules. Covers ATT&CK coverage mapping, telemetry gap analysis, false-positive tuning, detection-as-code pipelines, and validation with Atomic Red Team and Caldera. Use to design durable detections backed by tests.
インストールする前に、エージェントに与えられる指示の中身を確認できます。
rules/<platform>/<id>.yml with metadata block.tests/<id>/ with positive and negative pcaps, EVTX, or JSON.coverage.csv: ATT&CK × rule × status × last_validated.runbooks/<id>.md: analyst playbook.release-notes.md: what changed, why, expected volume delta.title: Suspicious encoded PowerShell
status: experimental
logsource:
product: windows
category: process_creation
detection:
selection:
Image|endswith: '\\powershell.exe'
CommandLine|contains: ' -enc '
condition: selection
falsepositives:
- admin scripts, SCCM
level: medium
KQL equivalent (untested):
DeviceProcessEvents
| where FileName =~ "powershell.exe"
| where ProcessCommandLine has " -enc "
まだレビューはありません。使ってみた感想をお寄せください。
概要と使いどころ
AI and LLM red-teaming skill for evaluating prompt injection, jailbreak, data exfiltration, tool abuse, agent hijack, RAG poisoning, model denial of service, and unsafe tool-use chains in Gemini, Claude, GPT, and open-weight models. Use to build evaluation harnesses, attack corpora, defensive guardrails, and red-team reports for AI systems you own or are authorized to test.
日本語の概要は準備中です。原文の説明を表示しています。
API security automation skill for REST, GraphQL, gRPC, and WebSocket APIs. Covers OpenAPI/AsyncAPI ingestion, authenticated fuzzing, OWASP API Top 10 (BOLA, BFLA, mass assignment, SSRF), schema diffing, GraphQL introspection abuse, JWT and OAuth misuse, rate-limit and replay testing. Use to automate API assessments with safe, scoped, evidence-backed findings.
日本語の概要は準備中です。原文の説明を表示しています。
Assembly programming and low-level debugging skill for reading, writing, explaining, optimizing, and reviewing assembly across x86, x86-64, ARM, AArch64, RISC-V, calling conventions, ABI boundaries, inline assembly, disassembly, stack frames, registers, and binary-level behavior. Use for .s/.asm files, compiler output, reverse-engineering snippets, low-level performance, and crash analysis.
日本語の概要は準備中です。原文の説明を表示しています。
Bug bounty workflow skill for program scope mapping, recon-to-report automation, deduplication against prior submissions, and high-signal reporting on HackerOne, Bugcrowd, Intigriti, YesWeHack, and self-hosted programs. Use to organize bounty work end to end while staying inside program rules.
日本語の概要は準備中です。原文の説明を表示しています。
Assistant-behavior design skill for approximating a Claude-like analytical, careful, conversational style without claiming to be Claude or Anthropic. Use when the user asks to duplicate, emulate, adapt, or recreate a Claude-style "mythos" or persona for prompts, agent specs, writing style, reasoning discipline, safety posture, or UX behavior.
日本語の概要は準備中です。原文の説明を表示しています。
Cloud security posture skill for AWS, Azure, GCP, and multi-cloud. Covers IAM least-privilege, key and secret hygiene, network exposure, data protection, logging coverage, IaC scanning (Terraform, CloudFormation, Bicep, Pulumi), CSPM remediation, and landing-zone hardening. Use for misconfig discovery, IaC review, and automated drift-and-fix workflows on cloud accounts you own.
日本語の概要は準備中です。原文の説明を表示しています。