菜单
Takes the active conversation as reference to understand how a skill can be created, with all the lessons learned from the users need in the conversation.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Live endpoint threat hunting skill. Systematically scans a system for malicious activity across all categories (Process, File, Network, Persistence, User Account, Registry, etc.) using only native OS tools. Covers macOS, Linux, and Windows at T1 (no privs) and T2 (sudo/admin) levels. Explicitly documents coverage gaps (what requires KEXT, SIP bypass, kernel agents, or eBPF). Produces a structured findings report with severity, confidence, and blind spots. Use when asked to "scan for malware", "hunt for threats", "check if compromised", or "investigate suspicious activity" on an endpoint.
Generate a security audit scope document from one or more GitHub repo URLs and/or API access descriptions. Outputs a 3-line protocol narrative (mission, user story, attacker story) followed by a scope table with NSLOC, focus areas, and days. Use when scoping a new audit engagement.
Audit codebase to uncover critical issues explicitly without false positives
Sweeps DeFi protocol Safe multisig wallets for governance misconfigurations and security weaknesses. Given a protocol name, Safe address, or "sweep all", fetches live config and tx history from the Safe Transaction Service API, scores each Safe against a finding pattern library, and produces an audit-ready ranked report. Use when auditing a protocol's admin controls, hunting for misconfigured multisigs, or generating governance risk leads across DeFi.
Commits github changes to repository safely and professionally. use this before any commit made to github.
Expert blockchain forensics assistant for investigators and auditors. Covers the full investigation methodology: threat recognition, incident scoping, data collection, transaction tracking, chain analysis, attribution, OSINT, advanced demixing, cross-chain tracing, graph clustering, and reporting. Guides users through investigations via targeted questions. Free and open-source tools are preferred and instructed at point of need. Paid tools are acknowledged but not required. Use when investigating hacks, stolen funds, laundering routes, wallet attribution, or crypto fraud.
| name | context-window-to-skill |
| description | Takes the active conversation as reference to understand how a skill can be created, with all the lessons learned from the users need in the conversation. |
User had finished working on his feature or task successfully, but had to tweak lots of stuff in the behavior of the agent prior to completion - we now want to create a skill that in the next time will make this task a breeze
Steps:
Results:
