Skill Claude CodeCodex
Generate log2timeline and Plaso super-timelines and triage them in Timesketch.
not rated 57
+2 14d ago B SkillSpector: warn 29 tokens
original MIT
57Stars on the repository
202Mods indexed here, across every type
14d agoLast push, which is what freshness is scored on
MITLicence, which decides whether bodies are shown
Skill Claude CodeCodex
Build a systematic threat hunt hypothesis framework that transforms threat intelligence, attack patterns, and environmental data into testable hunting hypotheses.
not rated 57
+2 14d ago A SkillSpector: pass 33 tokens
original MIT
Skill Claude CodeCodex
Systematically collects, categorizes, and distributes indicators of compromise (IOCs) during and after security incidents to enable detection, blocking, and threat intelligence sharing. Covers network, host, email, and behavioral indicators using STIX/TAXII formats and threat intelligence platforms. Activates for…
not rated 57
+2 14d ago A SkillSpector: pass 88 tokens
original MIT
Skill Claude CodeCodex
Responds to security incidents in cloud environments (AWS, Azure, GCP) by performing identity-based containment, cloud-native log analysis, resource isolation, and forensic evidence acquisition adapted for ephemeral cloud infrastructure. Activates for requests involving cloud incident response, AWS security incident…
not rated 57
+2 14d ago A SkillSpector: warn 76 tokens
original MIT
Skill Claude CodeCodex
Conduct a defensible cybersecurity risk assessment using the NIST SP 800-30 Rev 1 methodology: prepare scope and a risk model, identify threat sources and threat events, identify vulnerabilities and predisposing conditions, determine likelihood and impact, compute risk, and communicate results as a prioritized risk…
not rated 57
+2 14d ago A SkillSpector: pass 219 tokens
original MIT
Skill Claude CodeCodex
Executes containment strategies to stop active adversary operations and prevent lateral movement during a confirmed security breach. Implements short-term and long-term containment using network segmentation, endpoint isolation, credential revocation, and access control modifications. Activates for requests involving…
not rated 57
+2 14d ago A SkillSpector: warn 73 tokens
original MIT
Skill Claude CodeCodex
Wire Promptfoo and DeepTeam into CI/CD for automated regression red-teaming of LLM apps against OWASP LLM Top 10 and OWASP Agentic presets, failing the build when jailbreak or injection vulnerabilities regress.
not rated 57
+2 14d ago A SkillSpector: warn 56 tokens
original MIT
Skill Claude CodeCodex
Correlates security events in IBM QRadar SIEM using AQL (Ariel Query Language), custom rules, building blocks, and offense management to detect multi-stage attacks across network, endpoint, and application log sources. Use when SOC analysts need to investigate QRadar offenses, build correlation rules, or tune…
not rated 57
+2 14d ago A SkillSpector: warn 78 tokens
original MIT
Skill Claude CodeCodex
Deploy Llama Guard, NeMo Guardrails, and LLM Guard input/output scanners as runtime defenses.
not rated 57
+2 14d ago B SkillSpector: warn 31 tokens
original MIT
Skill Claude CodeCodex
Deobfuscates malicious JavaScript code used in web-based attacks, phishing pages, and dropper scripts by reversing encoding layers, eval chains, string manipulation, and control flow obfuscation to reveal the original malicious logic. Activates for requests involving JavaScript malware analysis, script deobfuscation…
not rated 57
+2 14d ago B SkillSpector: warn 82 tokens
original MIT
Skill Claude CodeCodex
Systematically deobfuscate multi-layer PowerShell malware using AST analysis, dynamic tracing, and tools like PSDecode and PowerDecode to reveal hidden payloads and C2 infrastructure.
not rated 57
+2 14d ago A SkillSpector: pass 48 tokens
original MIT
Skill Claude CodeCodex
Detects prompt injection attacks targeting LLM-based applications using a multi-layered defense combining regex pattern matching for known attack signatures, heuristic scoring for structural anomalies, and transformer-based classification with DeBERTa models. The detector analyzes user inputs before they reach the…
not rated 57
+2 14d ago B 153 tokens
copy · 91% MIT
Skill Claude CodeCodex
Detect unusual API call patterns in AWS CloudTrail logs using boto3, statistical baselining, and behavioral analysis to identify credential compromise, privilege escalation, and unauthorized resource access.
not rated 57
+2 14d ago A SkillSpector: pass 45 tokens
original MIT
Skill Claude CodeCodex
Performs statistical analysis of Zeek conn.log connection intervals to detect C2 beaconing patterns. Uses the ZAT library to load Zeek logs into Pandas DataFrames, calculates inter-arrival time standard deviation, and flags periodic connections with low jitter. Use when hunting for command-and-control callbacks in…
not rated 57
+2 14d ago A SkillSpector: pass 74 tokens
original MIT
Skill Claude CodeCodex
Identify poisoned training data and backdoored models across the ML pipeline.
not rated 57
+2 14d ago A SkillSpector: warn 23 tokens
original MIT
Skill Claude CodeCodex
Detect DCSync attacks where adversaries abuse Active Directory replication privileges to extract password hashes by monitoring for non-domain-controller accounts requesting directory replication via DsGetNCChanges.
not rated 57
+2 14d ago C 44 tokens
original MIT
Skill Claude CodeCodex
Detect and prevent public-over-private name resolution in npm, PyPI, and Maven.
not rated 57
+2 14d ago A SkillSpector: warn 24 tokens
original MIT
Skill Claude CodeCodex
Detect DLL side-loading attacks where adversaries place malicious DLLs alongside legitimate applications to hijack execution flow for defense evasion.
not rated 57
+2 14d ago A SkillSpector: pass 36 tokens
original MIT
Skill Claude CodeCodex
Detect compromised O365 and Google Workspace email accounts by analyzing inbox rule creation, suspicious sign-in locations, mail forwarding rules, and unusual API access patterns via Microsoft Graph and audit logs.
not rated 57
+2 14d ago A SkillSpector: pass 43 tokens
original MIT
Skill Claude CodeCodex
Detect malicious email forwarding rules created by adversaries to maintain persistent access to email communications for intelligence collection and BEC attacks.
not rated 57
+2 14d ago A SkillSpector: pass 34 tokens
original MIT
Skill Claude CodeCodex
Hunt AADGraphActivityLogs and MicrosoftGraphActivityLogs in Microsoft Sentinel/Log Analytics for fingerprints of offensive Entra ID tools such as ROADtools, AADInternals, and AzureHound.
not rated 57
+2 14d ago A SkillSpector: warn 54 tokens
original MIT
Skill Claude CodeCodex
Detects and analyzes fileless malware that operates entirely in memory using PowerShell, WMI, .NET reflection, registry-resident payloads, and living-off-the-land binaries (LOLBins) without writing traditional executable files to disk. Activates for requests involving fileless threat detection, in-memory malware…
not rated 57
+2 14d ago A SkillSpector: warn 83 tokens
original MIT
Skill Claude CodeCodex
Detect and defend against prompt injection hidden in documents, web pages, and images consumed by an agent.
not rated 57
+2 14d ago C 29 tokens
original MIT
Skill Claude CodeCodex
Detects insider data exfiltration by analyzing DLP policy violations, file access patterns, upload volume anomalies, and off-hours activity in endpoint and cloud logs. Uses pandas for behavioral analytics and statistical baselines. Use when investigating insider threats or building user behavior analytics for data…
not rated 57
+2 14d ago A SkillSpector: pass 70 tokens
original MIT
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: