Researches malware analysis, CVEs, attribution reports, and hacker community sources. Use when the album subject involves cybersecurity incidents or threat actors.
GLAW Investigations Bureau — the Cyber Intelligence Agent. The digital-evidence specialist: triages malware artifacts (read-only), plans defensible forensic imaging and hashing…
Write and test YARA rules for malware detection and threat hunting. Use when creating YARA signatures, detecting malware families, scanning files or memory for indicators of…
Pre-add risk gate for a new dependency — composes vuln history (`vdb vulns`), AI-malware check (`vdb ai-malware`), license compatibility, EOL status, maintainer health,…
Bir tanık veya taraf (isticvap) için duruşma/ifade soru taslağı (outline) hazırlar — şirket içi belgeleri veya UYAP evraklarını çeker, hukuki teori etrafında başlıkları düzenler…
Heuristic security scan of installed skills — prompt-injection phrases, hidden unicode instructions, credential-store access, network-pipe-to-shell and payload-smuggling patterns.
Android APK analysis using GDA.exe. AI drives analysis by tracing code paths, extracting IOCs (including encrypted), and producing structured malware reports.
Pixa.com (eski Pixelcut) — Claude'a MCP-native baglanan yaratici AI araclari. Arka plan kaldir, gorsel olustur, kalite iyilestir, video olustur, nesne sil. API anahtari gerekmez.
Typosquat and malicious-package detection across installed dependencies (or a single prospective addition) — cross-checks AI-malware family intelligence, package-name similarity…
YARA rule creation, testing, and deployment
GitHub, Anthropic blog ve topluluk kaynaklarını tarayarak yeni Claude skill/MCP/tool keşfeder. REPO_CATALOG.md'ye ekler, /ai-upgrade'e hazır hale getirir.
Scan OpenBot/Clawdbot skills for security vulnerabilities, malicious code, and suspicious patterns before installing them.
Inspect captured RAM images to enumerate processes, modules, handles, and suspicious in-memory behavior before escalation or evidence handoff.
Perform static analysis of Android APK malware samples using apktool for decompilation, jadx for Java source
Analyzes bootkit and advanced rootkit malware that infects the Master Boot Record (MBR), Volume Boot Record
Reverse engineer Go-compiled malware using Ghidra with specialized scripts for function recovery, string extraction,
Performs runtime mobile security exploration of iOS applications using Objection, a Frida-powered toolkit that
Analyzes malicious Linux ELF (Executable and Linkable Format) binaries including botnets, cryptominers, ransomware,
Analyzes malicious VBA macros embedded in Microsoft Office documents (Word, Excel, PowerPoint) to identify download
Executes malware samples in Cuckoo Sandbox to observe runtime behavior including process creation, file system
Use Sysinternals Autoruns to systematically identify and analyze malware persistence mechanisms across registry
Detect sandbox evasion techniques in malware samples by analyzing timing checks, VM artifact queries, user interaction
Detect and analyze covert communication channels used by malware including DNS tunneling, ICMP exfiltration,
Identifies and unpacks UPX-packed and other packed malware samples to expose the original executable code for
Analyzes malicious PDF files using PDFiD, pdf-parser, and peepdf to identify embedded JavaScript, shellcode,
Analyzes encryption algorithms, key management, and file encryption routines used by ransomware families to
Monitor and analyze ransomware group data leak sites (DLS) to track victim postings, extract threat intelligence
Identify ransomware network indicators including C2 beaconing patterns, TOR exit node connections, data exfiltration
Traces ransomware cryptocurrency payment flows using blockchain analysis tools such as Chainalysis Reactor,
Investigate supply chain attack artifacts including trojanized software updates, compromised build pipelines,
Decompile Android APK, XAPK, JAR, and AAR files using jadx or Fernflower/Vineflower. Reverse engineer Android apps, extract HTTP API endpoints, trace call flows from UI to network…
Native macOS LOCAL MACHINE security audit — XProtect state, persistence mechanisms (LaunchAgents/Daemons, login items), network listeners, browser extensions, known-malware paths,…
End-to-end Android APK red-team pipeline — automated APK acquisition (Play Store + apkpure + apkmirror fallback), jadx decompilation, secret/URL/JWT/Firebase grep, pinned-cert…
Scan AI agent skills for malware, credential theft, prompt injection, and dangerous permissions before installing them
Turn validated security behavior into tested detection content. Use for Sigma, osquery, YARA-X routing, endpoint queries, SIEM rules, cloud or application detections, correlation…
Author, test, tune, and document YARA-X detection rules from validated artifact evidence. Use when malware, suspicious files, scripts, documents, or binary features need local…
Set up a backup system that actually protects your photos, files, and devices — built on the 3-2-1 rule and, crucially, tested so it works when you need it.
Summarizes cybersecurity breach incidents into structured legal and compliance records. Trigger when synthesizing incident reports, forensics, logs, or notifications into a…
Builds an automated malware submission and analysis pipeline that collects suspicious files from endpoints and
Build structured communication templates for malware incidents including stakeholder notifications, executive
Builds a structured ransomware incident response playbook aligned with the CISA StopRansomware Guide and NIST
Builds a structured SOC incident response playbook for ransomware attacks covering detection, containment, eradication,
Authors, validates, and tests Cedar authorization policies and schemas for Sondera AI agent governance.
Static analysis of UEFI/BIOS firmware dumps using Intel's chipsec framework. Decode firmware structure, detect known malware and rootkits (LoJax, ThinkPwn, HackingTeam,…
Expert CIS Controls v8 (CIS Top 18) advisor — implementation group scoping (IG1/IG2/IG3), control gap assessments, safeguard-level guidance, asset inventory, software inv — from…
Expert CIS Controls v8 (CIS Top 18) advisor — implementation group scoping (IG1/IG2/IG3), control gap assessments, safeguard-level guidance, asset inventory, software inv — from…
Security scanner for OpenClaw skills. Detects malware and backdoors before execution, scores risk levels, and monitors file integrity through static code analysis.
Pure local 2026 ClawHub/OpenClaw skill scanner. Detects ClawHavoc malware, MCP backdoors, obfuscated payloads, and supply-chain attacks. 100% read-only analysis.
Gorev tipine gore dusunme modu secimi. 5 mod -- analytical (derin analiz), creative (yaratici cozum), systematic (adim adim), rapid (hizli aksiyon), debug (hata izleme).
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for malware configuration recovery, staged payload boundaries, beacon parameter extraction, a — from…
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for reverse engineering, malware, DFIR, firmware, pwnable, and native exploit challenges.
Responds to malware infections across enterprise endpoints by identifying the malware family, determining infection
Performs memory forensics analysis using Volatility 3 to extract evidence of malware execution, process injection,
Ordered first-response containment sequences for the most common MSP incident classes — compromised account, malware/ransomware detection, business email compromise, and exposed…
CryptoLens — AI-driven multi-coin crypto analysis. Compare 2-5 coins (relative performance, correlation matrix, volatility ranking), get single-coin technica...
Fetch live cryptocurrency prices with zero API keys — CoinGecko's public endpoints primary, Coinbase spot fallback, via plain curl.
Malware and network analysis techniques for CTF challenges. Use when analyzing obfuscated scripts, malicious packages, custom protocols, or C2 traffic.
60-günlük Görüntü İşleme / Üretken Modeller / RL müfredatının kişisel öğretmeni. Kullanıcı bir gün/konu sorduğunda (örn.
Read-only exposure audit of the user's machine and projects for a CVE, breach, malicious package, or other security advisory, then write a structured report to a local audit…
Reagiert auf Cyber-Incidents (Ransomware, Datenleck, APT) – DSGVO-Meldepflichten, forensische Sicherung, Behördenstrategie, Strafverfolgung im Internal Investigations Praxis.