All authors
Claude Skills by plurigrid
github.com/plurigrid2,535 skills6 installs3,507 views
- Performing Csrf Attack SimulationTesting web applications for Cross-Site Request Forgery vulnerabilities by crafting forged requests that exploit authenticated user sessions during authorized security assessments.Votes: 0GitHub stars: 61
- Performing Cve Prioritization With Kev CatalogLeverage the CISA Known Exploited Vulnerabilities catalog alongside EPSS and CVSS to prioritize CVE remediation based on real-world exploitation evidence.Votes: 0GitHub stars: 61
- Performing Dark Web Monitoring For ThreatsDark web monitoring involves systematically scanning Tor hidden services, underground forums, paste sites, and dark web marketplaces to identify threats targeting an organization, including leaked creVotes: 0GitHub stars: 61
- Performing Deception Technology DeploymentDeploys deception technology including honeypots, honeytokens, and decoy systems to detect attackers who have bypassed perimeter defenses, providing high-fidelity alerts with near-zero false positive rates. Use when SOC teams need early warning of lateral movement, credential abuse, or internal reconnaissance by deploying convincing traps across the network.Votes: 0GitHub stars: 61
- Performing Directory Traversal TestingTesting web applications for path traversal vulnerabilities that allow reading or writing arbitrary files on the server by manipulating file path parameters.Votes: 0GitHub stars: 61
- Performing Disk Forensics InvestigationConducts disk forensics investigations using forensic imaging, file system analysis, artifact recovery, and timeline reconstruction to support incident response cases. Utilizes tools such as FTK Imager, Autopsy, and The Sleuth Kit for evidence acquisition, deleted file recovery, and artifact examination. Activates for requests involving disk forensics, hard drive analysis, forensic imaging, file recovery, evidence acquisition, or digital forensic investigation.Votes: 0GitHub stars: 61
- Performing Dmarc Policy Enforcement RolloutExecute a phased DMARC rollout from p=none monitoring through p=quarantine to p=reject enforcement, ensuring all legitimate email sources are authenticated before blocking unauthorized senders.Votes: 0GitHub stars: 61
- Performing Dns Enumeration And Zone TransferEnumerates DNS records, attempts zone transfers, brute-forces subdomains, and maps DNS infrastructure during authorized reconnaissance to identify attack surface, misconfigurations, and information disclosure in target domains.Votes: 0GitHub stars: 61
- Performing Dns Tunneling DetectionDetects DNS tunneling by computing Shannon entropy of DNS query names, analyzing query length distributions, inspecting TXT record payloads, and identifying high subdomain cardinality. Uses scapy for packet capture analysis and statistical methods to distinguish legitimate DNS from covert channels. Use when hunting for data exfiltration.Votes: 0GitHub stars: 61
- Performing Docker Bench Security AssessmentDocker Bench for Security is an open-source script that checks dozens of common best practices around deploying Docker containers in production. Based on the CIS Docker Benchmark, it audits host confiVotes: 0GitHub stars: 61
- Performing Dynamic Analysis Of Android AppPerforms runtime dynamic analysis of Android applications using Frida, Objection, and Android Debug Bridge to observe application behavior during execution, intercept function calls, modify runtime values, and identify vulnerabilities that static analysis misses. Use when testing Android apps for runtime security flaws, hooking sensitive methods, bypassing client-side protections, or analyzing obfuscated applications. Activates for requests involving Android dynamic analysis, runtime hooking,...Votes: 0GitHub stars: 61
- Performing Dynamic Analysis With Any RunPerforms interactive dynamic malware analysis using the ANY.RUN cloud sandbox to observe real-time execution behavior, interact with malware prompts, and capture process trees, network traffic, and system changes. Activates for requests involving interactive sandbox analysis, cloud-based malware detonation, real-time behavioral observation, or ANY.RUN usage.Votes: 0GitHub stars: 61
- Performing Endpoint Forensics InvestigationPerforms digital forensics investigation on compromised endpoints including memory acquisition, disk imaging, artifact analysis, and timeline reconstruction. Use when investigating security incidents, collecting evidence for legal proceedings, or analyzing endpoint compromise scope. Activates for requests involving endpoint forensics, memory analysis, disk forensics, or incident investigation.Votes: 0GitHub stars: 61
- Performing Endpoint Vulnerability RemediationPerforms vulnerability remediation on endpoints by prioritizing CVEs based on risk scoring, deploying patches, applying configuration changes, and validating fixes. Use when remediating findings from vulnerability scans, responding to critical CVE advisories, or maintaining endpoint compliance with patch management SLAs. Activates for requests involving vulnerability remediation, CVE patching, endpoint vulnerability management, or security fix deployment.Votes: 0GitHub stars: 61
- Performing Entitlement Review With Sailpoint IiqPerforms entitlement review and access certification campaigns using SailPoint IdentityIQ including manager certifications, targeted entitlement reviews, role-based access validation, SOD violation remediation, and automated revocation workflows. Activates for requests involving access reviews, entitlement certifications, SailPoint IIQ governance, or periodic user access recertification.Votes: 0GitHub stars: 61
- Performing External Network Penetration TestConduct a comprehensive external network penetration test to identify vulnerabilities in internet-facing infrastructure using PTES methodology, reconnaissance, scanning, exploitation, and reporting.Votes: 0GitHub stars: 61
- Performing False Positive Reduction In SiemPerform systematic SIEM false positive reduction through rule tuning, threshold adjustment, correlation refinement, and threat intelligence enrichment to combat alert fatigue.Votes: 0GitHub stars: 61
- Performing File Carving With ForemostRecover files from disk images and unallocated space using Foremost's header-footer signature carving to extract evidence regardless of file system state.Votes: 0GitHub stars: 61
- Performing Firmware Extraction With BinwalkPerforms firmware image extraction and analysis using binwalk to identify embedded filesystems, compressed archives, bootloaders, kernel images, and cryptographic material. Covers entropy analysis for detecting encrypted or compressed regions, recursive extraction of nested archives, SquashFS/CramFS/JFFS2 filesystem mounting, and string analysis for credential and configuration discovery. Activates for requests involving firmware reverse engineering, IoT device analysis, embedded system secur...Votes: 0GitHub stars: 61
- Performing Firmware Malware AnalysisAnalyzes firmware images for embedded malware, backdoors, and unauthorized modifications targeting routers, IoT devices, UEFI/BIOS, and embedded systems. Covers firmware extraction, filesystem analysis, binary reverse engineering, and bootkit detection. Activates for requests involving firmware security analysis, IoT malware investigation, UEFI rootkit detection, or embedded device compromise assessment.Votes: 0GitHub stars: 61
- Performing Fuzzing With AflplusplusPerform coverage-guided fuzzing of compiled binaries using AFL++ (American Fuzzy Lop Plus Plus) to discover memory corruption, crashes, and security vulnerabilities. The tester instruments target binaries with afl-cc/afl-clang-fast, manages input corpora with afl-cmin and afl-tmin, runs parallel fuzzing campaigns with afl-fuzz, and triages crashes using CASR or GDB scripts. Activates for requests involving binary fuzzing, crash discovery, coverage-guided testing, or AFL++ fuzzing campaigns.Votes: 0GitHub stars: 61
- Performing Gcp Penetration Testing With GcpbucketbrutePerform GCP security testing using GCPBucketBrute for storage bucket enumeration, gcloud IAM privilege escalation path analysis, and service account permission auditingVotes: 0GitHub stars: 61
- Performing Gcp Security Assessment With ForsetiPerforming comprehensive security assessments of Google Cloud Platform environments using Forseti Security, Security Command Center, and gcloud CLI to audit IAM policies, firewall rules, storage permissions, and compliance against CIS GCP Foundations Benchmark.Votes: 0GitHub stars: 61
- Performing Graphql Depth Limit AttackExecute and test GraphQL depth limit attacks using deeply nested recursive queries to identify denial-of-service vulnerabilities in GraphQL APIs.Votes: 0GitHub stars: 61
- Performing Graphql Introspection AttackPerforms GraphQL introspection attacks to extract the full API schema including types, queries, mutations, subscriptions, and field definitions from GraphQL endpoints. The tester uses introspection queries to map the attack surface, identifies sensitive fields and mutations, tests for query depth and complexity limits, and exploits GraphQL-specific vulnerabilities including batching attacks, alias-based brute force, and nested query DoS. Activates for requests involving GraphQL security testi...Votes: 0GitHub stars: 61
- Performing Graphql Security AssessmentAssessing GraphQL API endpoints for introspection leaks, injection attacks, authorization flaws, and denial-of-service vulnerabilities during authorized security tests.Votes: 0GitHub stars: 61
- Performing Hardware Security Module IntegrationIntegrate Hardware Security Modules (HSMs) using PKCS#11 interface for cryptographic key management, signing operations, and secure key storage with python-pkcs11, AWS CloudHSM, and YubiHSM2.Votes: 0GitHub stars: 61
- Performing Hash Cracking With HashcatHash cracking is an essential skill for penetration testers and security auditors to evaluate password strength. Hashcat is the world's fastest password recovery tool, supporting over 300 hash types wVotes: 0GitHub stars: 61
- Performing Http Parameter Pollution AttackExecute HTTP Parameter Pollution attacks to bypass input validation, WAF rules, and security controls by injecting duplicate parameters that are processed differently by front-end and back-end systems.Votes: 0GitHub stars: 61
- Performing Ics Asset Discovery With ClarotyPerform comprehensive ICS/OT asset discovery using Claroty xDome platform, leveraging passive monitoring, Claroty Edge active queries, and integration ecosystem to gain full visibility into industrial control system assets including PLCs, RTUs, HMIs, and network infrastructure across Purdue Model levels.Votes: 0GitHub stars: 61
- Performing Indicator Lifecycle ManagementIndicator lifecycle management tracks IOCs from initial discovery through validation, enrichment, deployment, monitoring, and eventual retirement. This skill covers implementing systematic processes fVotes: 0GitHub stars: 61
- Performing Initial Access With Evilginx3Perform authorized initial access using EvilGinx3 adversary-in-the-middle phishing framework to capture session tokens and bypass multi-factor authentication during red team engagements.Votes: 0GitHub stars: 61
- Performing Insider Threat InvestigationInvestigates insider threat incidents involving employees, contractors, or trusted partners who misuse authorized access to steal data, sabotage systems, or violate security policies. Combines digital forensics, user behavior analytics, and HR/legal coordination to build an evidence-based case. Activates for requests involving insider threat investigation, employee data theft, privilege misuse, user behavior anomaly, or internal threat detection.Votes: 0GitHub stars: 61
- Performing Ioc Enrichment AutomationAutomates Indicator of Compromise (IOC) enrichment by orchestrating lookups across VirusTotal, AbuseIPDB, Shodan, MISP, and other intelligence sources to provide contextual scoring and disposition recommendations. Use when SOC analysts need rapid multi-source enrichment of IPs, domains, URLs, and file hashes during alert triage or incident investigation.Votes: 0GitHub stars: 61
- Performing Ios App Security AssessmentPerforms comprehensive iOS application security assessments using Frida for dynamic instrumentation, Objection for runtime exploration, SSL pinning bypass for traffic interception, keychain extraction for credential analysis, and IPA static analysis for binary-level review. Use when conducting authorized iOS penetration tests, evaluating mobile app security posture against OWASP MASTG, or assessing iOS app data protection and transport security controls. Activates for requests involving iOS a...Votes: 0GitHub stars: 61
- Performing Iot Security AssessmentPerforms comprehensive security assessments of IoT devices and their ecosystems by testing hardware interfaces, firmware, network communications, cloud APIs, and companion mobile applications. The tester uses firmware extraction and analysis, hardware debugging via UART and JTAG, network protocol analysis, and runtime exploitation to identify vulnerabilities across all layers of the IoT stack. Activates for requests involving IoT security testing, embedded device assessment, firmware security...Votes: 0GitHub stars: 61
- Performing Ip Reputation Analysis With ShodanAnalyze IP address reputation using the Shodan API to identify open ports, running services, known vulnerabilities, and hosting context for threat intelligence enrichment and incident triage.Votes: 0GitHub stars: 61
- Performing Jwt None Algorithm AttackExecute and test the JWT none algorithm attack to bypass signature verification by manipulating the alg header field in JSON Web Tokens.Votes: 0GitHub stars: 61
- Performing Kerberoasting AttackKerberoasting is a post-exploitation technique that targets service accounts in Active Directory by requesting Kerberos TGS (Ticket Granting Service) tickets for accounts with Service Principal NamesVotes: 0GitHub stars: 61
- Performing Kubernetes Cis Benchmark With Kube BenchAudit Kubernetes cluster security posture against CIS benchmarks using kube-bench with automated checks for control plane, worker nodes, and RBAC.Votes: 0GitHub stars: 61
- Performing Kubernetes Etcd Security AssessmentAssess the security posture of Kubernetes etcd clusters by evaluating encryption at rest, TLS configuration, access controls, backup encryption, and network isolation.Votes: 0GitHub stars: 61
- Performing Kubernetes Penetration TestingKubernetes penetration testing systematically evaluates cluster security by simulating attacker techniques against the API server, kubelet, etcd, pods, RBAC, network policies, and secrets. Using toolsVotes: 0GitHub stars: 61
- Performing Lateral Movement DetectionDetects lateral movement techniques including Pass-the-Hash, PsExec, WMI execution, RDP pivoting, and SMB-based spreading using SIEM correlation of Windows event logs, network flow data, and endpoint telemetry mapped to MITRE ATT&CK Lateral Movement (TA0008) techniques.Votes: 0GitHub stars: 61
- Performing Lateral Movement With WmiexecPerform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.Votes: 0GitHub stars: 61
- Performing Linux Log Forensics InvestigationPerform forensic investigation of Linux system logs including syslog, auth.log, systemd journal, kern.log, and application logs to reconstruct user activity, detect unauthorized access, and establish event timelines on compromised Linux systems.Votes: 0GitHub stars: 61
- Performing Log Analysis For Forensic InvestigationCollect, parse, and correlate system, application, and security logs to reconstruct events and establish timelines during forensic investigations.Votes: 0GitHub stars: 61
- Performing Log Source Onboarding In SiemPerform structured log source onboarding into SIEM platforms by configuring collectors, parsers, normalization, and validation for complete security visibility.Votes: 0GitHub stars: 61
- Performing Malware Hash Enrichment With VirustotalEnrich malware file hashes using the VirusTotal API to retrieve detection rates, behavioral analysis, YARA matches, and contextual threat intelligence for incident triage and IOC validation.Votes: 0GitHub stars: 61
- Performing Malware Ioc ExtractionMalware IOC extraction is the process of analyzing malicious software to identify actionable indicators of compromise including file hashes, network indicators (C2 domains, IP addresses, URLs), registVotes: 0GitHub stars: 61
- Performing Malware Persistence InvestigationSystematically investigate all persistence mechanisms on Windows and Linux systems to identify how malware survives reboots and maintains access.Votes: 0GitHub stars: 61