Loading...
Loading...
Found 147 Skills
Comprehensive persistence tradecraft for authorized red team engagements covering Windows and Linux mechanisms. Windows techniques include registry Run/RunOnce keys, scheduled tasks, WMI event subscriptions, DLL search order hijacking, COM object hijacking, Startup folder drops, service creation, Security Support Provider (SSP) DLL injection, and Active Directory persistence (AdminSDHolder abuse, DCShadow, Golden Ticket, Silver Ticket, Skeleton Key, SID History injection). Linux techniques include cron and at jobs, systemd timers and services, SSH authorized_keys injection, shell profile backdoors (.bashrc/.bash_profile), PAM module backdoors, LD_PRELOAD hijacking, kernel module rootkits, web shells, and Git hook abuse. Provides operator-ready command sequences for SharPersist, Impacket ticketer, schtasks, sc.exe, crontab, and systemctl with OPSEC considerations for each method. Maps to MITRE ATT&CK T1547 (Boot or Logon Autostart), T1053 (Scheduled Task/Job), T1546 (Event Triggered Execution), T1556 (Modify Authentication Process), and sub-techniques. Includes detection indicators and a rapid engagement cheatsheet.
Scan Linux systems for persistence mechanisms including crontab/systemd entries, LD_PRELOAD injection, shell profile modifications (.bashrc, .profile), and SSH authorized_keys backdoors, then correlate findings with auditd logs into an installation timeline. Use during incident response or threat hunting to detect or confirm how an adversary maintained access to a compromised Linux host.
Provision a Runpod Pod for interactive, development or training use and tell the user exactly how to connect to it. Reads stock before creating, picks the image and GPU class from the catalog reads, exposes only the ports the workload needs, hands back the working proxy URL or SSH address, and for training co-locates a network volume so checkpoints outlive the Pod. Also covers creating a Pod and stopping it immediately, so that only its disk bills until the user comes back. Use when the user wants a GPU or CPU machine of their own (a web app, Jupyter, SSH, a training box) rather than a Serverless endpoint, through the Runpod MCP tools.
Deploy a docker-compose app via a Jenkins INBOUND AGENT running on the target server (no SSH from controller), with Docker-secrets "L3" hardening — runtime secrets live on tmpfs and never appear in `docker inspect` nor in `.env`. Use when the user wants: "deploy via jenkins agent", "no-ssh deploy", "agent thay vì ssh", "docker secrets L3", "ẩn secret khỏi docker inspect", "secret không nằm trên đĩa", or is wiring a Jenkins pipeline that deploys docker-compose to a Linux host. Encodes the gotchas learned from a real 1:1 run (Java 21, 0444 secret perms, 0400 file-credential, agent user needs docker+sudo).
Plant und begleitet den Umzug eines Projekts von Albatros auf einen eigenen Server, erklärt mit dem Bild vom Umzug ins eigene Haus: Umzugsliste, Server mieten und einrichten (SSH nur mit Schlüssel, Firewall, Updates, Caddy für HTTPS), Logbuch zu GitHub mitnehmen, Fliessband dort mit eigenem Schlüssel per SSH auf das neue Ziel umstellen, Daten und Geheimnisse mitnehmen, testen, Adresse im DNS umstellen oder eine bei Albatros gekaufte Domain mit dem Auth-Code aus domain_mitnehmen zu einem neuen Registrar umziehen, Sicherungen selbst übernehmen. Nutze den Skill bei «eigener Server», «umziehen», «weg von Albatros», «Hetzner», «VPS», «selber hosten», «Landung», «was brauche ich für einen eigenen Server».
Add a Homebrew formula to a project using the in-repo local-tap pattern (private-repo first: local packed tarball, SSH git fallback). Generates Formula/<name>.rb, adds brew Makefile targets (tap, pack, install, start/stop/restart/status/logs, uninstall), and optionally sets up a private team tap. Use when asked to add Homebrew packaging, create a formula, make a project brew-installable, or add brew targets.
Provision a Runpod Pod for interactive, development or training use and tell the user exactly how to connect to it. Reads stock before creating, picks the image and GPU class from the catalog reads, exposes only the ports the workload needs, hands back the working proxy URL or SSH address, and for training co-locates a network volume so checkpoints outlive the Pod. Also covers creating a Pod and stopping it immediately, so that only its disk bills until the user comes back. Use when the user wants a GPU or CPU machine of their own (a web app, Jupyter, SSH, a training box) rather than a Serverless endpoint, through the Runpod MCP tools.
Create, verify by read-back, and manage the lifecycle of Runpod's reusable plumbing (templates, network and global volumes, container registry credentials, account secrets, the account's SSH public keys, and Instant Clusters), the account's audit trail and organization members (reads), plus staging large model files on a volume and diagnosing a private-image pull failure. Use when the user wants one of those resources created, changed, inspected or removed through the Runpod MCP tools, or asks where a volume should live so a GPU can mount it. Also use for an account cleanup request: only what this conversation created may be removed; everything else is reported for the user to decide.
Guide for Infisical Certificate Management (PKI) — issuing, renewing, revoking, and distributing X.509 certificates. Covers all 9 certificate authority types (internal root/intermediate CA, ACME including Let's Encrypt, AWS Private CA, AWS ACM Public CA, Microsoft ADCS, Azure ADCS, DigiCert, Venafi TPP, GoDaddy), Applications and Certificate Profiles, all 4 enrollment methods (API, ACME, EST, SCEP), all 12 PKI Syncs for pushing certs to AWS ACM / Azure Key Vault / Cloudflare / load balancers, certificate lifecycle and alerting, code signing with PKCS#11 and Windows KSP, certificate discovery, HSM connectors, CRL distribution, and post-quantum ML-DSA and SLH-DSA key algorithms. Use this skill when someone asks about: Infisical PKI, certificate authority, issuing a TLS certificate, mTLS certificates, ACME or Let's Encrypt with Infisical, EST or SCEP enrollment, certificate renewal, revocation, CRL, code signing certificates, or 'how do I manage certificates with Infisical'. For X.509/TLS certificates and code signing. Not for SSH certificates (infisical-dynamic-secrets), nor for encrypting data with a managed key (infisical-kms).
Install the Datadog Agent on Linux hosts - a single machine or a fleet - with support for cloud rollouts (AWS Systems Manager, GCP VM Manager, Azure Run Command), remote configuration management, proxy, FIPS, custom tags, and advanced configuration, with infrastructure metrics, logs, and the APM trace receiver on by default and host Single Step Instrumentation only when the user asks (for an SSI-first request, use `dd-apm/linux-ssi` `agent-install`). Use when the user wants to monitor their Linux servers, install the Datadog Agent on an Ubuntu or other Linux host, or roll the Agent out to an EC2 or other cloud VM fleet without SSHing in. Does not install the Agent on Windows, macOS, Docker, or Kubernetes (use dd-agent-install-windows, dd-agent-install-macos, dd-agent-install-docker, or dd-agent-install-kubernetes) and does not connect a cloud provider integration. Requires a Datadog account with a valid API key and application key; run `dd-account-setup` first if they are missing.
Terminal emulation, text rendering optimization, and SwiftTerm integration for modern Swift applications
Terminal/PTY automation with persistent sessions. Use to run and interact with TUI applications, debug terminal apps, automate CLI workflows, or any terminal interaction. Trigger phrases include "run the TUI", "start the app", "debug the terminal", "interact with", "send keys", "what's on screen".