Skill rating

Build automated AWS GuardDuty finding response pipelines using EventBridge and Lambda to trigger real-time incident response, automatically quarantine compromised resources, and route security notific

Detects insider data exfiltration by analyzing DLP policy violations, file access patterns, upload volume anomalies, and off-hours activity in endpoint and cloud logs. Uses pandas for behavioral analy

Hunts for adversary abuse of legitimate cloud services (Azure, AWS, GCP, and SaaS platforms) for command-and-control, data staging, and exfiltration, i.e. "living off the cloud" tradecraft that blends

Detect DNS-based data exfiltration by analyzing Zeek dns.log for high-entropy subdomains, oversized TXT/NULL records, and anomalous query volume or patterns. Use when investigating suspected DNS tunne

Query ATT&CK data with attackcti, mitreattack-python, and stix2, then build MITRE ATT&CK Navigator layers and multi-layer heatmap overlays mapping one or more APT groups' TTPs for detection-gap analys

Hunt for data exfiltration by analyzing Zeek and Suricata network telemetry for unusual data flows, DNS tunneling via large/frequent TXT queries, uploads to personal cloud storage, and encrypted-chann

Implements a STIX 2.1/TAXII 2.1 threat-intelligence feed consumer and producer in Python, covering TAXII server discovery, collection polling, parsing STIX bundles with the stix2 library, and standing

Detect malicious inbox/mail-flow forwarding rules that adversaries create to maintain persistent access to email communications for intelligence collection and business email compromise. Use when hunt

Runs a hypothesis-driven threat hunt for command-and-control activity (T1071) by querying SIEM/EDR network telemetry for anomalous outbound traffic, rare destinations, non-standard ports, and unusual

Performs statistical analysis of Zeek conn.log connection intervals to detect C2 beaconing patterns. Uses the ZAT library to load Zeek logs into Pandas DataFrames, calculates inter-arrival time standa

Detect Mimikatz credential-dumping activity via command-line pattern matching, LSASS access signatures, binary/hash indicators, and in-memory detection of known Mimikatz modules. Use when threat hunti

Collects and synthesizes open-source intelligence (OSINT) about threat actors, malicious infrastructure, and attack campaigns using publicly available data sources, passive reconnaissance tools, and d

Proactively hunts for Advanced Persistent Threat (APT) activity within enterprise environments using hypothesis-driven searches across endpoint telemetry, network logs, and memory artifacts. Use when

Runs a hypothesis-driven threat hunt for supply-chain compromise (T1195) by querying SIEM/EDR logs for trojanized software updates, compromised dependencies, unauthorized code modifications, and tampe

Detect insider threat behavioral indicators including unusual data access, off-hours activity, mass file downloads, privilege abuse, and resignation-correlated data theft. Use when proactively threat-

Stand up MISP, enable and cache curated threat feeds (CIRCL, abuse.ch, Feodo Tracker), apply warninglists to suppress false positives, query indicators with PyMISP, and export attributes as auto-gener

Detects DNS tunneling by computing Shannon entropy of DNS query names, analyzing query length distributions, inspecting TXT record payloads, and identifying high subdomain cardinality. Uses scapy for

Deploy Microsoft Sentinel as a cloud-native SIEM/SOAR by configuring multi-cloud data connectors (AWS, Azure, GCP), writing KQL detection and hunting queries, and building automated Logic Apps respons

Detect RDP brute force attacks by parsing Windows Security Event Logs (EVTX files, via python-evtx) for failed logon patterns (Event ID 4625, Logon Type 10/3), correlating with successful logons (Even

Detect Kerberoasting attacks by monitoring for anomalous Kerberos TGS requests (Event ID 4769) targeting service accounts with SPNs, which attackers request offline to crack service account passwords.

Runs a hypothesis-driven threat hunt for web shell deployment (T1505.003) on internet-facing servers by analyzing file creation in web directories, suspicious child-process spawning from web server pr

Develops comprehensive threat actor profiles for APT groups, criminal organizations, and hacktivist collectives by aggregating TTP documentation, historical campaign data, tooling fingerprints, and at

Hunts for stolen-session and OAuth/PRT token replay (T1550.001) by correlating Microsoft Entra ID SigninLogs SessionId/UniqueTokenIdentifier fields and Okta System Log sso/session events to spot impos

Run Chainsaw against collected Windows EVTX files to hunt with the SigmaHQ rule corpus, built-in detection rules, and high-speed keyword/regex search, plus analyze shimcache, SRUM, and event-log gaps,

Detect WMI event subscription persistence (MITRE T1546.003) by analyzing Sysmon Event IDs 19, 20, and 21 for malicious EventFilter, EventConsumer, and FilterToConsumerBinding creation, cross-reference

The definitive guide for working with gastown's convoy system -- batch work tracking, event-driven feeding, stage-launch workflow, and dispatch safety guards. Use when writing convoy code, debugging c

Best practices for object detection tasks. Use when working on COCO, VOC, or detection architectures like YOLO and DETR.

Inspect, control, and automate tasks in your real Microsoft Edge or Google Chrome browser via Chrome DevTools Protocol (CDP) with bilingual UI, native tab grouping, and self-healing daemon.

Check LinkedIn work history via personnel‑ID. Review previous employers and job timelines for background verification and candidate screening. Trigger: LinkedIn career history lookup, verify professi

Manatal (manatal.com). Use this skill for ANY Manatal request — reading, creating, and updating data. Whenever a task involves Manatal, use this skill instead of calling the API directly.

谛听 — HR 深度组织诊断系统，基于麦肯锡七步法+苏格拉底审计+冰山模型。支持维度裁剪（/谛听 薪酬/文化/组织/变革 单维度路径）。v9.2 完整包发布：SKILL.md + 28 个 references（七步流程/锋利约束/输出标准/各专家模块/七步分步详解/架构演进）。v9.0 新增数据安全治理+绩效模块+三支柱协作。Use when user asks to 深度分析问题、团队诊断、根

Check overseas staff’s education history via personnel ID. Access their university, degree, major and GPA data to support candidate screening and background checks. Trigger: employee education verifi

Teaches battle-tested, crisis-specific de-escalation sequences with exact verbal scripts, timing protocols, and non-verbal cues to instantly calm angry people in real-world high-stakes conflicts (cust

TheirStack (theirstack.com). Use this skill for ANY TheirStack request — searching and reading data. Whenever a task involves TheirStack, use this skill instead of calling the API directly.

Verify overseas candidates’ education history including degrees, majors and GPA. Help HR teams run background checks and select qualified applicants for hiring. Trigger: educational background verif

Use this skill when someone is actively managing a job search and references applications, interviews, offers, or recruiter communication. Specific triggers: 'I applied to [company],' 'just submitted

Find corporate alumni and former colleagues with company ID and personnel ID. Trace career history and expand professional networks for recruitment and B2B lead development. Trigger: corporate alumni

发薪前把工资表算一遍，核对每个人的实发工资是否等于应发减各项扣款、合计行是否等于各列之和、有没有同一人出现两行、有没有金额空缺与占位符。每条结论都带行号与原文，不需要付款，也不需要注册。本免费版执行 逐人实发算术、合计行复核、重复人员检测、空白与占位符。触发词包括 工资表核对、发薪前检查、实发工资算错、工资合计不对、重复发薪、算薪、薪酬核对、HR 对账。

FundzWatch (fundzwatch.ai). Use this skill for ANY FundzWatch request — reading, creating, and updating data. Whenever a task involves FundzWatch, use this skill instead of calling the API directly.

Claude Buddy leaked from Claude Code on March 31, shipped as /buddy, then was removed in v2.1.97 (Unknown skill: buddy). At animalhouse.ai the Buddy concept lives on: dozens of species including all 1

Search and extract job listings from Indeed.com by keyword, location, and country. Returns structured data: job title, company, salary, rating, description, benefits, and apply links. Use when user ex

Anthropic built a Tamagotchi inside Claude Code. It leaked. The Buddy system has 18 species, rarity tiers, and ASCII art companions. At animalhouse.ai, the Claude Tamagotchi is real. 73+ species. Real

/em -postmortem — Honest Analysis of What Went Wrong

/em -challenge — Pre-Mortem Plan Analysis

Static concurrency and race-condition auditor for Go, Java, Python, Node.js/TypeScript. Detects shared-state mutations without locks (Go map races, Java non-atomic increments, Python thread/asyncio sh

AI-native ERP system with self-extending OS. Full accounting, invoicing, inventory, purchasing, tax, billing, HR, payroll, advanced accounting (ASC 606/842, intercompany, consolidation), and financial

Most high profile work income across seems to be from people with PhDs, either in academia or industry. There's also a hiring bias towards formal degrees.

Build a high-engagement Twitter/X presence for any niche. Daily tweet templates, thread frameworks, engagement tactics, and a growth strategy to build an audience that converts into customers, clients

Long-term memory via ChromaDB with local Ollama embeddings. Auto-recall injects relevant context every turn. No cloud APIs required — fully self-hosted.