oyi77/1ai-skills - الصفحة ٢

find-skills

Use when automatically discover, evaluate, and activate community skills when local skills don't cover user needs. Includes credibility scoring and safety checks for complete OpenClaw self-sufficiency.

لغة النص الأصلي: الإنجليزية

kb-memory

Use when knowledge base and memory system for AI agents. Covers company KB, persistent memory, session recall, and brain architecture for context preservation.

لغة النص الأصلي: الإنجليزية

ruvector

Use when generating and managing vector embeddings for semantic search and RAG retrieval across knowledge bases.

لغة النص الأصلي: الإنجليزية

analyzing-bootkit-and-rootkit-samples

Use when analyzing bootkit and advanced rootkit malware that infects the Master Boot Record (MBR), Volume Boot Record (VBR), or UEFI firmware to gain persistence below the operating system. Covers boot sector analysis, UEFI module inspection, and anti-rootkit…

لغة النص الأصلي: الإنجليزية

analyzing-campaign-attribution-evidence

Use when campaign attribution analysis involves systematically evaluating evidence to determine which threat actor or group is responsible for a cyber operation. This skill covers collecting and weighting attr

لغة النص الأصلي: الإنجليزية

analyzing-command-and-control-communication

Use when analyzing malware command-and-control (C2) communication protocols to understand beacon patterns, command structures, data encoding, and infrastructure. Covers HTTP, HTTPS, DNS, and custom protocol C2 analysis for detection development and threat…

لغة النص الأصلي: الإنجليزية

analyzing-linux-audit-logs-for-intrusion

Use when using the Linux Audit framework (auditd) with ausearch and aureport utilities to detect intrusion attempts, unauthorized access, privilege escalation, and suspicious system activity. Covers audit rule configuration, log querying, timeline…

لغة النص الأصلي: الإنجليزية

analyzing-linux-elf-malware

Use when analyzing malicious Linux ELF (Executable and Linkable Format) binaries including botnets, cryptominers, ransomware, and rootkits targeting Linux servers, containers, and cloud infrastructure. Covers static analysis, dynamic tracing, and reverse…

لغة النص الأصلي: الإنجليزية

analyzing-malware-behavior-with-cuckoo-sandbox

Use when executing malware samples in Cuckoo Sandbox to observe runtime behavior including process creation, file system modifications, registry changes, network communications, and API calls. Generates comprehensive behavioral reports for malware…

لغة النص الأصلي: الإنجليزية

analyzing-packed-malware-with-upx-unpacker

Use when identifying and unpacking UPX-packed and other packed malware samples to expose the original executable code for static analysis. Covers both standard UPX unpacking and handling modified UPX headers that prevent automated decompression. Activates for…

لغة النص الأصلي: الإنجليزية

analyzing-ransomware-encryption-mechanisms

Use when analyzing encryption algorithms, key management, and file encryption routines used by ransomware families to assess decryption feasibility, identify implementation weaknesses, and support recovery efforts. Covers AES, RSA, ChaCha20, and hybrid…

لغة النص الأصلي: الإنجليزية

analyzing-sbom-for-supply-chain-vulnerabilities

Use when parsing Software Bill of Materials (SBOM) in CycloneDX and SPDX JSON formats to identify supply chain vulnerabilities by correlating components against the NVD CVE database via the NVD 2.0 API. Builds dependency graphs, calculating risk scores,…

لغة النص الأصلي: الإنجليزية

analyzing-security-logs-with-splunk

Use when leverages Splunk Enterprise Security and SPL (Search Processing Language) to investigate security incidents through log correlation, timeline reconstruction, and anomaly detection. Covers Windows event logs, firewall logs, proxy logs, and…

لغة النص الأصلي: الإنجليزية

analyzing-threat-actor-ttps-with-mitre-attack

Use when MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics, techniques, and procedures (TTPs) based on real-world observations. This skill covers systematically mapping threat actor beh

لغة النص الأصلي: الإنجليزية

analyzing-threat-landscape-with-misp

Use when analyzing the threat landscape using MISP (Malware Information Sharing Platform) by querying event statistics, attribute distributions, threat actor galaxy clusters, and tag trends over time. Uses PyMISP to pull event data, compute IOC type…

لغة النص الأصلي: الإنجليزية

analyzing-tls-certificate-transparency-logs

Use when querying Certificate Transparency logs via crt.sh and pycrtsh to detect phishing domains, unauthorized certificate issuance, and shadow IT. Monitors newly issued certificates for typosquatting and brand impersonation using Levenshtein distance. Use…

لغة النص الأصلي: الإنجليزية

analyzing-typosquatting-domains-with-dnstwist

Use when detecting typosquatting, homograph phishing, and brand impersonation domains using dnstwist to generate domain permutations and identify registered lookalike domains targeting your organization.

لغة النص الأصلي: الإنجليزية

analyzing-uefi-bootkit-persistence

Use when analyzing UEFI bootkit persistence mechanisms including firmware implants in SPI flash, EFI System Partition (ESP) modifications, Secure Boot bypass techniques, and UEFI variable manipulation. Covers detection of known bootkit families (BlackLotus,…

لغة النص الأصلي: الإنجليزية

auditing-cloud-with-cis-benchmarks

Use when this skill details how to conduct cloud security audits using Center for Internet Security benchmarks for AWS, Azure, and GCP. It covers interpreting CIS Foundations Benchmark controls, running automated assessments with tools like Prowler and…

لغة النص الأصلي: الإنجليزية

building-adversary-infrastructure-tracking-system

Use when building an automated system to track adversary infrastructure using passive DNS, certificate transparency, WHOIS data, and IP enrichment to map and monitor threat actor command-and-control networks.

لغة النص الأصلي: الإنجليزية

building-cloud-siem-with-sentinel

Use when this skill covers deploying Microsoft Sentinel as a cloud-native SIEM and SOAR platform for centralized security operations. It details configuring data connectors for multi-cloud log ingestion, writing KQL detection queries, building automated…

لغة النص الأصلي: الإنجليزية

building-incident-response-playbook

Use when designs and documents structured incident response playbooks that define step-by-step procedures for specific incident types aligned with NIST SP 800-61r3 and SANS PICERL frameworks. Covers playbook structure, decision trees, escalation criteria,…

لغة النص الأصلي: الإنجليزية

building-ioc-defanging-and-sharing-pipeline

Use when building an automated pipeline to defang indicators of compromise (URLs, IPs, domains, emails) for safe sharing and distribute them in STIX format through TAXII feeds and threat intelligence platforms.

لغة النص الأصلي: الإنجليزية

building-ioc-enrichment-pipeline-with-opencti

Use when openCTI is an open-source platform for managing cyber threat intelligence knowledge, built on STIX 2.1 as its native data model. This skill covers building an automated IOC enrichment pipeline using O

لغة النص الأصلي: الإنجليزية

building-phishing-reporting-button-workflow

Use when implementing a phishing report button in email clients with automated triage workflow that analyzes user-reported suspicious emails and provides feedback to reporters.

لغة النص الأصلي: الإنجليزية

building-ransomware-playbook-with-cisa-framework

Use when building a structured ransomware incident response playbook aligned with the CISA StopRansomware Guide and NIST Cybersecurity Framework. Covers preparation, detection, containment, eradication, recovery, and post-incident phases with actionable…

لغة النص الأصلي: الإنجليزية

building-threat-feed-aggregation-with-misp

Use when deploying MISP (Malware Information Sharing Platform) to aggregate, correlate, and distribute threat intelligence feeds from multiple sources for centralized IOC management and automated SIEM integration.

لغة النص الأصلي: الإنجليزية

building-threat-intelligence-enrichment-in-splunk

Use when building automated threat intelligence enrichment pipelines in Splunk Enterprise Security using lookup tables, modular inputs, and the Threat Intelligence Framework.

لغة النص الأصلي: الإنجليزية

collecting-indicators-of-compromise

Use when systematically collects, categorizes, and distributes indicators of compromise (IOCs) during and after security incidents to enable detection, blocking, and threat intelligence sharing. Covers network, host, email, and behavioral indicators using…

لغة النص الأصلي: الإنجليزية

conducting-cloud-penetration-testing

Use when this skill outlines methodologies for performing authorized penetration testing against AWS, Azure, and GCP cloud environments. It covers understanding the shared responsibility model for testing scope, leveraging cloud-specific attack tools like…

لغة النص الأصلي: الإنجليزية

conducting-malware-incident-response

Use when responding to malware infections across enterprise endpoints by identifying the malware family, determining infection vectors, assessing spread, and executing eradication procedures. Covers the full lifecycle from detection through containment,…

لغة النص الأصلي: الإنجليزية

conducting-network-penetration-test

Conducts comprehensive network penetration tests against authorized target environments by performing host discovery, port scanning, service enumeration, vulnerability identification, and controlled exploitation to assess the security posture of network…

لغة النص الأصلي: الإنجليزية

conducting-phishing-incident-response

Use when responding to phishing incidents by analyzing reported emails, extracting indicators, assessing credential compromise, quarantining malicious messages across the organization, and remediating affected accounts. Covers email header analysis,…

لغة النص الأصلي: الإنجليزية

configuring-active-directory-tiered-model

Use when implementing Microsoft's Enhanced Security Admin Environment (ESAE) tiered administration model for Active Directory. Covers Tier 0/1/2 separation, privileged access workstations (PAWs), administrative f

لغة النص الأصلي: الإنجليزية

configuring-certificate-authority-with-openssl

Use when a Certificate Authority (CA) is the trust anchor in a PKI hierarchy, responsible for issuing, signing, and revoking digital certificates. This skill covers building a two-tier CA hierarchy (Root CA +

لغة النص الأصلي: الإنجليزية

configuring-ldap-security-hardening

Use when hardening LDAP directory services against common attacks including credential harvesting, LDAP injection, anonymous binding, and channel binding bypass. Covers LDAPS enforcement, channel binding, LDAP si

لغة النص الأصلي: الإنجليزية

configuring-multi-factor-authentication-with-duo

Use when deploying Cisco Duo multi-factor authentication across enterprise applications, VPN, RDP, and SSH access points. This skill covers Duo integration methods, adaptive authentication policies, device trust

لغة النص الأصلي: الإنجليزية

configuring-oauth2-authorization-flow

Use when configuring secure OAuth 2.0 authorization flows including Authorization Code with PKCE, Client Credentials, and Device Authorization Grant. This skill covers flow selection, PKCE implementation, token

لغة النص الأصلي: الإنجليزية

analyzing-cobaltstrike-malleable-c2-profiles

Use when parsing and analyzing Cobalt Strike Malleable C2 profiles using dissect.cobaltstrike and pyMalleableC2 to extract C2 indicators, detect evasion techniques, and generate network detection signatures.

لغة النص الأصلي: الإنجليزية

analyzing-threat-actor-ttps-with-mitre-navigator

Use when mapping advanced persistent threat (APT) group tactics, techniques, and procedures (TTPs) to the MITRE ATT&CK framework using the ATT&CK Navigator and attackcti Python library. The analyst queries STIX/TAXII data for group-technique associations,…

لغة النص الأصلي: الإنجليزية