Identify poisoned training data and backdoored ML models across the pipeline using IBM's Adversarial Robustness Toolbox (activation clustering, spectral signatures, trigger…
Process identify anomalies and outliers in datasets using machine learning algorithms. Use when analyzing data for unusual patterns, outliers, or unexpected deviations from normal…
Investigate outliers, rare events, spikes, and suspicious records in datasets. Use as an explicit anomaly-analysis helper when you want concrete anomaly-detection workflow…
Identifies unreachable functions, unused variables, and abandoned code in binary programs. Use when optimizing binary size, analyzing code coverage, or investigating abandoned…
Detect anomalies in DNP3 (Distributed Network Protocol 3) communications used in SCADA systems by monitoring
Detect data exfiltration through DNS tunneling by analyzing query entropy, subdomain length, query volume, TXT
Use when auditing documentation for low-value content — redundant, verbose, duplicated, or past its useful form — proposing pruning/condensing/distillation, and whenever bloat…
Use when auditing documentation against the code it describes, checking whether a README/CLAUDE.md/runbook is still accurate, or finding which doc passages a code change…
Show what changed since last validation for a specific artifact. Computes confidence without writing to frontmatter.
Detect compromised O365 and Google Workspace email accounts by analyzing inbox rule creation, suspicious sign-in
Hunt AADGraphActivityLogs and MicrosoftGraphActivityLogs in Microsoft Sentinel/Log Analytics for fingerprints of offensive Entra ID tools such as ROADtools, AADInternals, and…
Detects defense evasion techniques used by adversaries in endpoint logs including log tampering, timestomping,
Detect DNS-based data exfiltration by analyzing Zeek dns.log for high-entropy subdomains and anomalous query
Detects existing PR review threads to prevent duplicate comments. Use BEFORE posting any inline comments. Fetches resolved and open threads, then matches against planned findings.
Detects incorrect use of free() including freeing non-heap memory, invalid pointers, and mismatched allocators.
Detects incorrect use of memset() including wrong argument order, incorrect size calculations, and misunderstood behavior.
Detect and defend against prompt injection hidden in documents, web pages, and images consumed by an agent.
Detects insider data exfiltration by analyzing DLP policy violations, file access patterns, upload volume anomalies,
Identifies lateral movement techniques in enterprise networks by analyzing authentication logs, network flows,
Detect lateral movement in network traffic using Zeek (formerly Bro) log analysis. Parses conn.log, smb_mapping.log,
Detect Living Off the Land Binaries (LOLBins/LOLBAS) abuse including certutil, regsvr32, mshta, and rundll32
Detect malicious scheduled task creation and modification using Sysmon Event IDs 1 (Process Create for schtasks.exe),
Detect potential memory leaks and analyze memory usage patterns in code. Use when troubleshooting performance issues related to memory growth or identifying leak sources.
Detect Mimikatz execution through command-line patterns, LSASS access signatures, binary indicators, and in-memory
Detects off-by-one errors by identifying incorrect loop conditions, array indexing mistakes, and boundary condition problems.
Automatically detect performance regressions in CI/CD pipelines by comparing metrics against baselines. Use when validating builds or analyzing performance trends.
Detects unsafe pointer subtraction operations that can lead to incorrect size calculations and integer underflow.
Detect privilege escalation attempts including token manipulation, UAC bypass, unquoted service paths, kernel
Detect process hollowing (T1055.012) by analyzing memory-mapped sections, hollowed process indicators, and parent-child
Detects rootkit presence on compromised systems by identifying hidden processes, hooked system calls, modified
Detecting data exfiltration attempts from AWS S3 buckets by analyzing CloudTrail S3 data events, VPC Flow Logs,
Use whenever the urge to "also add X", "while I'm here", "since I'm already touching this" appears, or a capability not foreseen in the feature spec comes up.
Detect bootkits such as BlackLotus and Bootkitty and Secure Boot bypass via DBX and binary checks.
Detect abuse of service accounts through anomalous interactive logons, privilege escalation, lateral movement,
Discover and inventory shadow API endpoints that operate outside documented specifications using traffic analysis,
Detect unauthorized SaaS and cloud service usage (shadow IT) by analyzing proxy logs, DNS query logs, and netflow
Scan all artifacts for confidence metadata and report staleness using pure derived scoring.
Detect process injection techniques (T1055) including classic DLL injection, process hollowing, and APC injection
Flag misspelled, brandjacked, and typosquatted package names across npm, PyPI, and crates.io before installation using edit-distance, keyboard-proximity, and known-target corpus…
Detects unchecked return values of memory allocation functions like malloc, calloc, and realloc that can lead to null pointer dereferences.
Detect WMI event subscription persistence by analyzing Sysmon Event IDs 19, 20, and 21 for malicious EventFilter,
Use when writing or creating Sigma rules, reviewing detection rules, discussing detection coverage, or working with YAML detection files.
Use when when preparing metabolomics abundance tables with left-censored missingness (values below instrument detection limit or quantification limit) for imputation.
Expert knowledge for solving Kusto Detective Agency challenges at detective.kusto.io. Covers SPA navigation, challenge reading, answer submission, and KQL investigation patterns.
Detects SpecWeave context and provides workflow documentation for available commands. Use when learning SpecWeave commands, understanding available slash commands (/sw:increment,…
Use when determining the proper Polish court for a lawsuit — identifying the correct type of proceedings (civil/commercial/administrative/criminal), territorial jurisdict — from…
Use when choosing the Polish legal regime for letters, requests, applications, complaints, petitions, public-information requests, KPA filings, PPSA complaints, RODO access…
Use when determining the proper Ukrainian court for a lawsuit — identifying the correct type of proceedings (civil/commercial/administrative/criminal), territorial jurisdiction…
Use when choosing the Ukrainian legal regime for letters, requests, applications, complaints, consular status inquiries, public-information requests, administrative-service…
Use when calculating wartość przedmiotu sporu (WPS) under Polish KPC (art. 19–26) — determining its impact on subject-matter jurisdiction (rejonowy vs okręgowy), applicab — from…
Use when verifying outcomes with code instead of LLM judgment, versioning prompts with hashes, or ensuring reproducible agent behavior. Load for any critical verification.
Ephemeral invariance checker — run a command N times and prove byte-identical stdout + exit code (first-divergence diff on failure); --files sha256s listed artifacts per run;…
Turn a fuzzy repeatable job into a deterministic, versioned skill so the output is the same quality every single run — not "good when I'm watching, random when I'm not." One skill…
The determinism policy of RFC 0004, and how to satisfy it rather than route around it. Use when writing or reviewing any Rust in this workspace that reads a clock, draws…
Identify when agent, harness, skill, workflow, or AI system behavior needs deterministic controls instead of model judgment, and recommend production-grade implementation…
Deterministic, measurable design verification — render the UI and PROVE it's balanced and usable instead of trusting the model's eye.
Use when code chooses among multiple files, providers, releases, candidates, records, plugins, matches, or equally valid options and repeatability matters.
Track any detox with customizable counters, symptom logging, and progress milestones
Эксперт Detox тестирования. Используй для React Native E2E tests и mobile automation.
DeTrack integration. Manage Organizations, Users, Goals, Filters. Use when the user wants to interact with DeTrack data.