Security & Auditing Skills

Skill pack

AGENT SKILLS ATLAS

Security & Auditing Skills

Includes Abusing Dpapi for Credential Access, Abusing Shadow Credentials for Privesc, Analyzing Android Malware with Apktool, and other workflows.

Install with

Claude Code

Codex

Cursor

GitHub Copilot

Gemini CLI

Supported by the Atlas install prompt. Skill-specific requirements vary.

Pack stats

Skills100CategorysecurityStars0

What’s included

Abusing Dpapi for Credential Access

Extract DPAPI-protected secrets such as credentials and browser data offline and online.

Abusing Shadow Credentials for Privesc

Take over Active Directory user and computer accounts by writing alternate certificate keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, and Certipy, then authenticate via PKINIT.

Analyzing Android Malware with Apktool

Perform static analysis of Android APK malware samples using apktool for decompilation, jadx for Java source

Analyzing API Gateway Access Logs

Parses API Gateway access logs (AWS API Gateway, Kong, Nginx) to detect BOLA/IDOR attacks, rate limit bypass,

Analyzing Azure Activity Logs for Threats

Queries Azure Monitor activity logs and sign-in logs via azure-monitor-query to detect suspicious administrative

Analyzing Bootkit and Rootkit Samples

Analyzes bootkit and advanced rootkit malware that infects the Master Boot Record (MBR), Volume Boot Record

Analyzing Campaign Attribution Evidence

Campaign attribution analysis involves systematically evaluating evidence to determine which threat actor or

Analyzing Certificate Transparency for Phishing

Monitor Certificate Transparency logs using crt.sh and Certstream to detect phishing domains, lookalike certificates,

Analyzing Cloud Storage Access Patterns

Detect abnormal access patterns in AWS S3, GCS, and Azure Blob Storage by analyzing CloudTrail Data Events, GCS

Analyzing Cobaltstrike Malleable C2 Profiles

Parse and analyze Cobalt Strike Malleable C2 profiles using dissect.cobaltstrike and pyMalleableC2 to extract

Analyzing Command and Control Communication

Analyzes malware command-and-control (C2) communication protocols to understand beacon patterns, command structures,

Analyzing Cyber Kill Chain

Analyzes intrusion activity against the Lockheed Martin Cyber Kill Chain framework to identify which phases

Analyzing Dns Logs for Exfiltration

Analyzes DNS query logs to detect data exfiltration via DNS tunneling, DGA domain communication, and covert

Analyzing Email Headers for Phishing Investigation

Parse and analyze email headers to trace the origin of phishing emails, verify sender authenticity, and identify

Analyzing Ethereum Smart Contract Vulnerabilities

Perform static and symbolic analysis of Solidity smart contracts using Slither and Mythril to detect reentrancy,

Analyzing Golang Malware with Ghidra

Reverse engineer Go-compiled malware using Ghidra with specialized scripts for function recovery, string extraction,

Analyzing Heap Spray Exploitation

Detect and analyze heap spray attacks in memory dumps using Volatility3 plugins to identify NOP sled patterns,

Analyzing Indicators of Compromise

Analyzes indicators of compromise (IOCs) including IP addresses, domains, file hashes, URLs, and email artifacts

Analyzing Ios App Security with Objection

Performs runtime mobile security exploration of iOS applications using Objection, a Frida-powered toolkit that

Analyzing Kubernetes Audit Logs

Parses Kubernetes API server audit logs (JSON lines) to detect exec-into-pod, secret access, RBAC modifications,

Analyzing Linux Elf Malware

Analyzes malicious Linux ELF (Executable and Linkable Format) binaries including botnets, cryptominers, ransomware,

Analyzing Lnk File and Jump List Artifacts

Analyze Windows LNK shortcut files and Jump List artifacts to establish evidence of file access, program execution,

Analyzing Macro Malware in Office Documents

Analyzes malicious VBA macros embedded in Microsoft Office documents (Word, Excel, PowerPoint) to identify download

Analyzing Malicious URL with Urlscan

URLScan.io is a free service for scanning and analyzing suspicious URLs. It captures screenshots, DOM content,

Showing 24 of 100 skills. Use the list’s page controls above to explore the rest.

Quick start

Choose your skills. Select individual skills above, or choose the entire pack.
Copy the install prompt. Use Copy install prompt above the list.
Send it to your agent. Paste into your coding agent’s chat. Your agent reviews the source and guides the setup.

Try it with your agent

After installation, start with a request like:

Example request

Use the Abusing Dpapi for Credential Access skill to help with my task.
Ask me for the context you need before getting started.

Requirements & license

A coding agent that can access your project files and install skills.
Your agent checks each skill’s instructions, dependencies, and permissions during setup.
Reported license for the skills shown: Apache-2.0. The author’s terms apply.

Installation guide →Skill review & security →