Live endpoint threat hunting skill. Systematically scans a system for malicious activity across all categories (Process, File, Network, Persistence, User Account, Registry, etc.) using only native OS tools. Covers macOS, Linux, and Windows at T1 (no privs) and T2 (sudo/admin) levels. Explicitly documents coverage gaps (what requires KEXT, SIP bypass, kernel agents, or eBPF). Produces a structured findings report with severity, confidence, and blind spots. Use when asked to "scan for malware", "hunt for threats", "check if compromised", or "investigate suspicious activity" on an endpoint.
Generate a security audit scope document from one or more GitHub repo URLs and/or API access descriptions. Outputs a 3-line protocol narrative (mission, user story, attacker story) followed by a scope table with NSLOC, focus areas, and days. Use when scoping a new audit engagement.
Audit codebase to uncover critical issues explicitly without false positives
Sweeps DeFi protocol Safe multisig wallets for governance misconfigurations and security weaknesses. Given a protocol name, Safe address, or "sweep all", fetches live config and tx history from the Safe Transaction Service API, scores each Safe against a finding pattern library, and produces an audit-ready ranked report. Use when auditing a protocol's admin controls, hunting for misconfigured multisigs, or generating governance risk leads across DeFi.
Commits github changes to repository safely and professionally. use this before any commit made to github.
Takes the active conversation as reference to understand how a skill can be created, with all the lessons learned from the users need in the conversation.
Expert blockchain forensics assistant for investigators and auditors. Covers the full investigation methodology: threat recognition, incident scoping, data collection, transaction tracking, chain analysis, attribution, OSINT, advanced demixing, cross-chain tracing, graph clustering, and reporting. Guides users through investigations via targeted questions. Free and open-source tools are preferred and instructed at point of need. Paid tools are acknowledged but not required. Use when investigating hacks, stolen funds, laundering routes, wallet attribution, or crypto fraud.
Comprehensive smart contract security audit framework with multi-expert analysis. Use for full audits of Ethereum / EVM Solidity and Vyper, Solana / SVM Anchor Rust, TON / FunC / Tact, or Sui / Move projects.