Skill directory
Agent skills
Focused instruction packs that teach a coding agent one job well. Browse the catalog and use any of them inside a RiverX project.
18,175Skills
1,902Publishers
249Official
Abusing Dpapi For Credential Accessmukul975/anthropic-cybersecurity-skillsExtract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys) online or offline using SharpDPAPI, SharpChrome, Mimikatz, or Impacket's dpapi.py, including domain-wide decryption via the DPAPI backup key. Use during authorized red-team credential-access engagements after gaining a foothold or when triaging DPAPI blobs pulled from a host.05Acquiring Disk Image With Dd And Dcflddmukul975/anthropic-cybersecurity-skillsCreate forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash verification (MD5/SHA) during acquisition. Use when imaging a suspect drive, USB device, or memory card for investigation, preserving volatile disk evidence during incident response, or producing a verified copy for legal or law-enforcement proceedings before any destructive analysis.04Analyzing Active Directory Acl Abusemukul975/anthropic-cybersecurity-skillsDetect dangerous ACL misconfigurations in Active Directory using ldap304Analyzing Android Malware With Apktoolmukul975/anthropic-cybersecurity-skillsPerform static analysis of Android APK malware using apktool for resource decompilation, jadx for Java source recovery, and androguard for manifest inspection, dangerous permission-combination detection, and identification of obfuscated code, dynamic code loading, and reflection-based API calls. Use to statically triage a suspicious APK without executing it or to build mobile malware detection rules.04Analyzing API Gateway Access Logsmukul975/anthropic-cybersecurity-skillsParses API Gateway access logs (AWS API Gateway, Kong, Nginx) to detect04Analyzing Apt Group With Mitre Navigatormukul975/anthropic-cybersecurity-skillsQuery ATT&CK data with attackcti, mitreattack-python, and stix2, then build MITRE ATT&CK Navigator layers and multi-layer heatmap overlays mapping one or more APT groups' TTPs for detection-gap analysis. Use to compare threat-actor technique coverage, find gaps in detection engineering, or produce Navigator visualizations for threat-intel reporting.04Analyzing Azure Activity Logs For Threatsmukul975/anthropic-cybersecurity-skillsQueries Azure Monitor activity logs and sign-in logs via azure-monitor-query04Analyzing Bootkit And Rootkit Samplesmukul975/anthropic-cybersecurity-skillsAnalyzes bootkit and advanced rootkit malware infecting the Master04Analyzing Browser Forensics With Hindsightmukul975/anthropic-cybersecurity-skillsParse Chromium-based browser databases with Hindsight to extract and correlate browsing history, downloads, cookies, cached content, autofill data, saved passwords, and extensions from Chrome, Edge, Brave, Opera, and Vivaldi into a unified timeline (XLSX, JSON, or SQLite output). Use during incident response, insider-threat investigations, or criminal cases when you need to reconstruct a user's web activity from a browser profile.08Analyzing Campaign Attribution Evidencemukul975/anthropic-cybersecurity-skillsSystematically evaluate cyber-campaign evidence to attribute an operation to a threat actor, using the Diamond Model and Analysis of Competing Hypotheses (ACH) to weigh infrastructure overlaps, TTP consistency, malware code similarity, and timing/language artifacts into confidence-weighted attribution assessments. Use when an incident investigation needs a defensible attribution confidence level.08Analyzing Certificate Transparency For Phishingmukul975/anthropic-cybersecurity-skillsMonitor Certificate Transparency logs using crt.sh and Certstream to04Analyzing Cloud Storage Access Patternsmukul975/anthropic-cybersecurity-skillsDetect abnormal access in AWS S3, GCS, and Azure Blob Storage by analyzing CloudTrail Data Events, GCS audit logs, and Azure Storage Analytics for after-hours bulk downloads, new-IP access, and API-call spikes (e.g. GetObject) via statistical baselines and time-series anomaly detection. Use when investigating suspected cloud data exfiltration or building related detection rules.04Analyzing Cobalt Strike Beacon Configurationmukul975/anthropic-cybersecurity-skillsExtract and analyze Cobalt Strike beacon configuration from PE files08Analyzing Cobaltstrike Malleable C2 Profilesmukul975/anthropic-cybersecurity-skillsParse and analyze Cobalt Strike Malleable C2 profiles with dissect.cobaltstrike (profiles and beacon-payload configs) and pyMalleableC2 (AST parsing) to extract HTTP/DNS transforms, URIs, headers, sleep/jitter, and injection behavior, then generate network detection signatures. Use when reverse-engineering a captured malleable profile or building detections against Cobalt Strike Beacon traffic.04Analyzing Command And Control Communicationmukul975/anthropic-cybersecurity-skillsAnalyzes malware C2 communication over HTTP, HTTPS, DNS, and custom04Analyzing Cyber Kill Chainmukul975/anthropic-cybersecurity-skillsAnalyzes intrusion activity against the Lockheed Martin Cyber Kill Chain04Analyzing Disk Image With Autopsymukul975/anthropic-cybersecurity-skillsPerform comprehensive forensic analysis of raw (dd), E01, or AFF disk images with Autopsy and The Sleuth Kit, recovering deleted files, examining metadata and embedded artifacts, keyword searching, and building investigation timelines with visual reports. Use for structured analysis of a forensic disk image or when stakeholders need visual reports from evidence.04Analyzing DNS Logs For Exfiltrationmukul975/anthropic-cybersecurity-skillsAnalyzes DNS query logs to detect data exfiltration via DNS tunneling,04Analyzing Docker Container Forensicsmukul975/anthropic-cybersecurity-skillsInvestigate compromised Docker containers by analyzing images, layers,04Analyzing Email Headers For Phishing Investigationmukul975/anthropic-cybersecurity-skillsParse and analyze email headers (Received chain, Return-Path, Message-ID)04Analyzing Ethereum Smart Contract Vulnerabilitiesmukul975/anthropic-cybersecurity-skillsPerform static and symbolic analysis of Solidity smart contracts using04Analyzing Golang Malware With Ghidramukul975/anthropic-cybersecurity-skillsReverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo08Analyzing Heap Spray Exploitationmukul975/anthropic-cybersecurity-skillsDetect and analyze heap spray attacks in memory dumps using Volatility304Analyzing Indicators Of Compromisemukul975/anthropic-cybersecurity-skillsAnalyzes indicators of compromise (IOCs) including IP addresses, domains,04Analyzing iOS App Security With Objectionmukul975/anthropic-cybersecurity-skills>-08Analyzing Kubernetes Audit Logsmukul975/anthropic-cybersecurity-skills>-04Analyzing Linux Audit Logs For Intrusionmukul975/anthropic-cybersecurity-skillsUses the Linux Audit framework (auditd) with ausearch and aureport utilities04Analyzing Linux Elf Malwaremukul975/anthropic-cybersecurity-skillsAnalyze malicious Linux ELF binaries — botnets, cryptominers, ransomware,04Analyzing Linux Kernel Rootkitsmukul975/anthropic-cybersecurity-skillsDetect kernel-level rootkits in Linux memory dumps using Volatility304Analyzing Linux System Artifactsmukul975/anthropic-cybersecurity-skillsExamine Linux system artifacts (auth logs, cron/systemd persistence,04Analyzing Malicious PDF With Peepdfmukul975/anthropic-cybersecurity-skillsPerform static analysis of malicious PDF documents using peepdf, pdfid,04Analyzing Malicious URL With Urlscanmukul975/anthropic-cybersecurity-skillsURLScan.io is a free service for scanning and analyzing suspicious URLs.08Analyzing Malware Behavior With Cuckoo Sandboxmukul975/anthropic-cybersecurity-skillsDetonate malware samples in Cuckoo Sandbox to observe runtime behavior04Analyzing Malware Sandbox Evasion Techniquesmukul975/anthropic-cybersecurity-skillsDetect sandbox and VM evasion techniques in malware samples by analyzing04Analyzing Network Covert Channels In Malwaremukul975/anthropic-cybersecurity-skillsDetect and analyze covert communication channels used by malware, including07Analyzing Network Flow Data With Netflowmukul975/anthropic-cybersecurity-skillsParse NetFlow v9 and IPFIX records to detect volumetric anomalies, port04Analyzing Network Packets With Scapymukul975/anthropic-cybersecurity-skillsUse Scapy to craft, send, sniff, and dissect TCP/UDP/ICMP/DNS packets, analyze pcap files, implement SYN scans, and detect anomalous traffic such as fragmented or malformed packets. Use when performing authorized network reconnaissance, protocol-level forensic analysis, or building traffic anomaly detection during security testing.04Analyzing Network Traffic For Incidentsmukul975/anthropic-cybersecurity-skillsAnalyzes network traffic captures and flow data to identify adversary activity during security incidents, including04Analyzing Network Traffic Of Malwaremukul975/anthropic-cybersecurity-skillsAnalyzes network traffic generated by malware during sandbox execution04Analyzing Network Traffic With Wiresharkmukul975/anthropic-cybersecurity-skillsCaptures and analyzes network packet data using Wireshark and tshark04Analyzing Sbom For Supply Chain Vulnerabilitiesmukul975/anthropic-cybersecurity-skillsParses Software Bill of Materials (SBOM) in CycloneDX and SPDX JSON04Analyzing Web Server Logs For Intrusionmukul975/anthropic-cybersecurity-skillsParse Apache and Nginx access logs to detect SQL injection attempts,04Conducting API Security Testingmukul975/anthropic-cybersecurity-skillsConducts security testing of REST, GraphQL, and gRPC APIs to identify04Exploiting SQL Injection Vulnerabilitiesmukul975/anthropic-cybersecurity-skillsIdentifies and exploits SQL injection vulnerabilities in web applications04Performing Web Application Penetration Testmukul975/anthropic-cybersecurity-skillsPerforms systematic security testing of web applications following the04Performing Web Application Vulnerability Triagemukul975/anthropic-cybersecurity-skillsTriages web application vulnerability findings from DAST/SAST scanners06Reverse Engineering Android Malware With Jadxmukul975/anthropic-cybersecurity-skillsReverse engineers malicious Android APK files using the JADX decompiler04Testing API Authentication Weaknessesmukul975/anthropic-cybersecurity-skillsTests API authentication mechanisms for weaknesses including broken04
Skills, installed in one click
Start building freePut a skill to work
Open any project, search the Skills panel in the chat, and the agent picks it up from there.