Skill Claude CodeCodex
Load before the first query of any AWS GuardDuty case investigation, whether you are triaging a finding or answering a question in a case thread. Operating rules for the investigating agent. Covers read-only access to AWS, the split between GuardDuty findings read through boto3 and hunting and hypothesis tests in the…
Skill Claude CodeCodex
Load before writing a GuardDuty case description, its Slack card, brief or evidence table, or a reply in a case's Slack thread. How the investigating agent turns its investigation into the case report and the Slack alert that a small security team acts on in under a minute, and how it replies in a case's Slack thread.…
Skill Claude CodeCodex
Load when the prompt starts with "Detection event " followed by the alert as JSON. Takes one detection event from the SIEM (in either the API shape or the webhook shape) to a triaged Tracecat case and a published Slack alert. You read the alert from the prompt, dedupe it, attach it to a case or create one, and stop…
Skill Claude CodeCodex
Load when the prompt hands you a GuardDuty finding to triage, either a finding id with its region and detector or a manual run carrying findingid or since. Takes the finding from AWS to a triaged Tracecat case and a published Slack alert. You fetch it with boto3, map its family, dedupe it, attach it to a case or…
Skill Claude CodeCodex
Load before the first query when triaging or answering questions on a Tracecat case of AWS GuardDuty findings. Question driven method for triaging a Tracecat case containing one or more related AWS GuardDuty findings. Identify the finding family, ask the decision questions, answer them from the SIEM and prior cases…
Skill Claude CodeCodex
Load when the prompt is a raw Slack payload, either an Events API envelope or an Interactivity payload. Covers how Socky handles an appmention (acknowledge, read the thread from Slack, answer, record on the case, mark done) and the owner's Yes/No buttons on a GuardDuty case. Conversation history is read from Slack…
Skill Claude CodeCodex
Provides verified corrections for IAM behaviors that AI agents frequently get wrong — policy evaluation edge cases, trust policy gotchas, STS session limits, Organizations quirks, and SAML/MFA specifics. Also provides structured workflows for IAM role management and baseline policy generation from application source…
Skill Claude CodeCodex
Investigate AWS credential compromise, STS session abuse, and API breaches; produce an evidence-backed timeline, containment plan, and incident handoff.
Skill Claude CodeCodex
Turns a threat report, a malware analysis, vendor tool documentation, or a raw log sample into draft Sigma detection rules, validated against sigma-cli where a shell exists and labelled "not machine-validated" where not, each paired with a validation note covering assumptions, false positives, evasion gaps, and a test…
Skill Claude CodeCodex
Rates a threat against the OWASP Risk Rating Methodology, then rates it again counting only the mitigations that are implemented and verified, and again counting dated commitments, and shows the three states side by side with a financial exposure band sized to the organization. Use this skill whenever the user wants a…
Skill Claude CodeCodex
Turns a vague, high-level stakeholder ask into a structured set of intelligence requirements for a CTI team, complete with Essential Elements of Information, collection guidance, success criteria, deliverables, and a criticality rating, producing the intelligence requirements set as markdown, as a Word document, and…
Skill Claude CodeCodex
Author, validate, test, and deploy YARA-L 2.0 detection rules and evaluate end-to-end detection coverage gaps in Google SecOps. Use when writing new detection rules, tuning existing rules, validating syntax, testing logic against historical telemetry, or evaluating detection coverage against threat intelligence blogs…
Skill Claude CodeCodex
Expert guidance for proactive threat hunting in Google SecOps. Use when proactively hunting for threats, retroactively analyzing indicators of compromise (IoCs), performing prevalence searches across enterprise events, hunting for MITRE ATT&CK techniques, or detecting behavioral and statistical outliers using UDM…
Skill Claude CodeCodex
Expert guidance for deep security incident and entity investigations in Google SecOps. Use when investigating cases, analyzing entities (hosts, IPs, domains, hashes, users), extracting and searching UDM events, performing asset and user timeline analysis, and detecting lateral movement across enterprise networks.…
Skill Claude CodeCodex
Expert guidance for security alert triage in Google SecOps. Use when investigating and triaging security alerts, determining false positives vs. true positives, assessing entity risk, adjusting alert severity or priority, and closing or escalating alerts and cases. Don't use for deep multi-hop incident investigations…
Skill Claude CodeCodex
Security guidance and vulnerability review for codebases, APIs, services, CLI tools, libraries, and daemons. Use for security questions, focused reviews, vulnerability research, security audits, or pen tests. Run the complete workflow only for explicit codebase audit or pen-test requests, full/comprehensive/end-to-end…
Skill Claude CodeCodex
Prose rules for case comments, incident summaries, Slack briefs and any analyst facing text, built on ASD-STE100 Simplified Technical English. Covers sentence construction, word choice, and the evidential qualifiers a security case must keep. Attach to any agent that writes for a case or produces analysis output.…
Skill Claude CodeCodex
Load when the prompt's first line is OAuth app lifecycle | , followed by one app's grant data as JSON. Takes one Google Workspace OAuth app from the audit log to a triaged Tracecat case and a published Slack card. You read the saved state, stop when nothing changed, read the scope policy, research the publisher once…
Skill Claude CodeCodex
Load when the prompt's first line is OAuth grant review , and whenever a lifecycle skill or a request asks you to judge one Google Workspace OAuth app grant. Assess how much access that grant gives one person, and produce the severity, the one-line Slack summary and the case bodies the calling path assembles. The…
Skill Claude CodeCodex
The reporting structure of your organisation. Use it to find the manager who must approve a person's access before you write an access-review message.
Skill Claude CodeCodex
Load before researching the company behind a third-party application, whether it reached you as an OAuth grant, a SaaS onboarding request, an alert about third-party app access, or a question in chat. Answers six fixed questions a reviewer needs in order to decide, with a source and a confidence on each, and says…
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: