Detect Cobalt Strike beacon network activity using default TLS certificate signatures (serial 8BB00EE), JA3/JA3S/JARM
Score 70/100
Detect C2 beaconing patterns in network traffic using frequency analysis, jitter detection, and domain reputation
Score 70/100
Hunt for data exfiltration through network traffic analysis, detecting unusual data flows, DNS tunneling, cloud
Score 70/100
Detect data staging activity before exfiltration by monitoring for archive creation with 7-Zip/RAR, unusual temp
Score 70/100
Hunt for DCOM-based lateral movement by detecting abuse of MMC20.Application, ShellBrowserWindow, and ShellWindows
Score 70/100
Detect NTFS timestamp manipulation (MITRE T1070.006) by comparing $STANDARD_INFORMATION vs $FILE_NAME timestamps
Score 70/100
Hunt for DNS-based persistence mechanisms including DNS hijacking, dangling CNAME records, wildcard DNS abuse,
Score 70/100
Detect DNS tunneling and data exfiltration by analyzing Zeek dns.log for high-entropy subdomain queries, excessive
Score 70/100
Detect domain fronting C2 traffic by analyzing SNI vs HTTP Host header mismatches in proxy logs and TLS certificate
Score 70/100
Detect WMI-based lateral movement by analyzing Windows Event ID 4688 process creation and Sysmon Event ID 1 for
Score 70/100
Hunt for adversary abuse of legitimate cloud services for C2, data staging, and exfiltration including abuse
Score 70/100
Proactively hunt for adversary abuse of legitimate system binaries (LOLBins) to execute malicious payloads while
Score 70/100
Hunt for adversary abuse of Living Off the Land Binaries (LOLBins) by analyzing endpoint process creation logs
Score 70/100
Systematically hunt for adversary persistence mechanisms across Windows endpoints including registry, services,
Score 70/100
Hunt for adversary persistence through Windows Management Instrumentation event subscriptions by monitoring WMI
Score 70/100
Detect process injection techniques (T1055) including CreateRemoteThread, process hollowing, and DLL injection
Score 70/100
Hunt for registry-based persistence mechanisms including Run keys, Winlogon modifications, IFEO injection, and
Score 70/100
Detect MITRE ATT&CK T1547.001 registry Run key persistence by analyzing Sysmon Event ID 13 logs and registry
Score 70/100
Hunt for adversary persistence via Windows Scheduled Tasks by analyzing task creation events, suspicious task
Score 70/100
Detect T1547.001 startup folder persistence by monitoring Windows startup directories for suspicious file creation,
Score 70/100
Hunt for supply chain compromise indicators including trojanized software updates, compromised dependencies,
Score 70/100
Hunt for adversary persistence and execution via Windows scheduled tasks by analyzing task creation events, suspicious
Score 70/100
Hunt for MITRE ATT&CK T1098 account manipulation including shadow admin creation, SID history injection, group
Score 70/100
Hunt for unusual network connections by analyzing outbound traffic patterns, rare destinations, non-standard
Score 70/100
Detect suspicious Windows service installations (MITRE ATT&CK T1543.003) by parsing System event logs for Event
Score 70/100
Session retrospective with AI-KPT framework. Reviews AI autonomous actions, detects omissions via counterfactual reasoning, persists learnings.
Score 70/100
Print the orchestrator's intended approach for an item, slice, or milestone — files it would touch, files it would create, tests it would add, assumptions it's making, known…
Score 70/100
Capture bugs, features, and tasks into TODO.md without executing them. Classifies each item, assigns priority/size, mints zero-padded IDs ([B01], [F01], [T01]).
Score 70/100
Change hv-skills configuration interactively — pick which settings to edit from a checklist showing current values, then choose new values from the same options used at init.
Score 70/100
Systematic root-cause investigation for a bug — reads the TODO entry + detail file, consults KNOWLEDGE.md, reproduces, hypothesizes, verifies, fixes with one atomic commit, and…
Score 70/100
Capture a hard-boundary decision into .hv/DECISIONS.md — manually confirmed, never auto-invoked. Decisions differ from learnings in KNOWLEDGE.md by being active commitments with…
Score 70/100
Scaffold and maintain a public-facing user guide under / (default docs/) — aimed at consumers, not contributors.
Score 70/100
Capture one item and immediately implement it — combines /hv-capture and /hv-work, skipping the /hv-next review.
Score 70/100
Initialize the .hv/ folder structure with TODO.md, KNOWLEDGE.md, counters.json, config.json, status.json, and CLI helpers.
Score 70/100
Extract durable session learnings (gotchas, conventions, constraints) into .hv/KNOWLEDGE.md grouped by topic, and update the CLAUDE.md topic index.
Score 70/100
Review the backlog, reconcile active work against git state, archive old completions, show sorted tables with relationship clusters, suggest the next item, and route to /hv-work.
Score 70/100
Write an implementation plan as a first-class artifact before execution — keyed by milestone and slice or item (M01-S01.md, M01-B07.md).
Score 70/100
Cut a release — bump version (major/minor/patch), generate categorized release notes from commits since the last tag, prepend a section to CHANGELOG.md, create an annotated git…
Score 70/100
Reorient after a context clear or a fresh session — shows active work streams reconciled against git, recent commits per stream, backlog counts, and routes to /hv-work, /hv-ship,…
Score 70/100
Bundle completed work on a feature branch into a PR (or direct merge) — extracts commits, resolved item IDs with titles, optionally runs /hv-review, and calls hv-pr or hv-merge.
Score 70/100
Compact project-state overview — backlog counts, active work, recent completions, knowledge topics. Read-only and fast.
Score 70/100
Check for a newer hv-skills release on GitHub and tell the user how to update — detects install type (plugin, stow, repo clone), compares plugin.json version against the latest…
Score 70/100
Orchestrator-driven parallel implementation — plans tasks, dispatches worker subagents, verifies, commits atomically per task.
Score 70/100
Adaptive routing strategies for distributed systems with multi-channel communication
Score 70/100
Detects hybrid agent anti-pattern where agents perform execution work directly instead of delegating to skills
Score 70/100
Expert hybrid cloud architect specializing in complex multi-cloud solutions across AWS/Azure/GCP and private clouds (OpenStack/VMware).
Score 70/100
Configure secure, high-performance connectivity between on-premises and cloud environments using VPN, Direct Connect, and ExpressRoute.
Score 70/100
Combine vector and keyword search for improved retrieval. Use when implementing RAG systems, building search engines, or when neither approach alone provides sufficient recall.
Score 70/100
Combine vector and keyword search for improved retrieval. Use when implementing RAG systems, building search engines, or when neither approach alone provides sufficient recall.
Score 70/100
Reciprocal Rank Fusion for merging full-text and vector search results in this project. Convex native searchIndex + vectorIndex integration with admin-toggleable hybrid search.
Score 70/100
Use when a task should run through Hydra's Lead-driven workflow for multi-agent orchestration, or when an existing workflow must be inspected or cleaned up.
Score 70/100
Debug and resolve complex hydration mismatches that cause UI thrashing and content layout shifts.
Score 70/100
Next.js SSR hydration patterns and best practices. Use when fixing hydration mismatches, implementing client-only features, or working with localStorage/browser APIs.
Score 70/100
Hydrodynamic analysis using BEM, RAOs, added mass, damping, and wave loads for offshore structures
Score 70/100
Automate Hypeauditor tasks via Rube MCP (Composio). Always search tools first for current schemas.
Score 70/100
On-chain GF(3) entropy storage via Aptos Move - bulk-boundary correspondence where entropy lives in the interior and observables project to agents
Score 70/100
Automate Hyperbrowser tasks via Rube MCP (Composio). Always search tools first for current schemas.
Score 70/100
Generates HyperExecute YAML configurations for blazing-fast test orchestration on LambdaTest's TestMu AI cloud. Framework-agnostic — works with any test framework.
Score 70/100
HyperFrames CLI tool — hyperframes init, lint, inspect, preview, render, transcribe, tts, doctor, browser, info, upgrade, compositions, docs, benchmark.
Score 70/100
Install and wire registry blocks and components into HyperFrames compositions. Use when running hyperframes add, installing a block or component, wiring an installed item into…
Score 70/100