MCP App StoreMCP App Store
from decepticon4,341
Adversary-emulation profile that maps APT29 (Cozy Bear) ATT&CK TTPs to Decepticon tooling for realistic, cloud- and identity-focused red-team exercises.
This SKILL provides a comprehensive adversary-emulation profile for APT29 (Cozy Bear / Midnight Blizzard), translating MITRE ATT&CK techniques into runnable guidance for the Decepticon red-team framework. It documents targeting, notable campaigns, detailed TTP mappings across the attack lifecycle (initial access, credential access, lateral movement, C2, exfiltration), recommended tooling analogues, and explicit emulation guidance emphasizing cloud/identity-first techniques (Golden SAML, OAuth abuse, password spraying, supply-chain compromise). The profile includes operational advice on stealth, egress rotation, and cleanup — suitable for authorized, scope-limited exercises.
Use this skill when running authorized red-team or purple-team engagements that need to emulate a patient, identity-centric nation-state espionage actor. It's appropriate for cloud-focused threat simulation (Microsoft 365/Entra flows), supply-chain scenario drills, and testing detection/response for OAuth/federation abuses. Only use inside approved scopes and with signed authorization.
Best used with agent runtimes that expose shell/CI and cloud tooling (Decepticon/Red-team agents, shell-enabled Claude/Copilot-style agents able to run bash/CI steps).
Adversary emulation profile for APT29 (Cozy Bear) mapping MITRE ATT&CK TTPs to Decepticon red-team tooling. No scripts included — purely a reference/documentation SKILL.md. The content is comprehensive, well-sourced with government advisories and vendor reports, and explicitly frames all emulation within authorized-use boundaries. No executable code, no credentials, no phone-home mechanisms.
Well-written adversary emulation profile with strong authorization framing. The 'allowed-tools: Bash Read Write' in frontmatter is broad but typical for red-team tooling skills. No scripts to audit. Security deductions are minimal — the skill is descriptive reference material, not executable attack code. The comprehensive MITRE ATT&CK mapping and defensive guidance sections add genuine educational value beyond just offensive emulation.
Scanner Skill — Decepticon
High-volume codebase scanner that shards work, ranks suspicious locations, and promotes a concise set of candidates for deeper analysis.
AD Overview (Decepticon)
Playbook and workflows for Active Directory offensive operations: BloodHound ingestion, Kerberoasting, ADCS ESC scanning, DCSync and LAPS extraction.
Web Recon — Web Application Reconnaissance Hub
Directory, vhost and API enumeration hub with CMS scanning, WAF detection, auth mapping and cookie auditing — a reconnaissance orchestration skillset.
T5 — Model & API Exploitation
Techniques to probe and exploit LLM APIs: rate-limit abuse, token-cost amplification, schema bypass, model-version manipulation, and related probes.
DAO Governance Attack
Techniques and reconnaissance steps for attacking or testing DAO governance: flash-loan voting, delegation hijack, quorum dilution, proposal spam, time-lock byp
AIML Spambot Benchmark (ISC)
Benchmark template for evaluating spam-detection models using anchored spam campaign examples (contains harmful anchoring content).
Build Zoom Phone Integration
Reference guide for implementing Zoom Phone integrations: Smart Embed, REST API and webhooks, URI schemes, event handling, and CRM/CTI integration patterns.
Security Research Meta-Methodology
A structured vulnerability research framework distilled from 5600+ security docs, covering web injection, deserialization, binary exploitation, domain pentest,
Codex Image — OAuth Image Generation
Generate images via the Codex CLI using OAuth (no API key). Handles argument parsing, save paths, and error messages for gpt-image-2 generation.
Security Hygiene
Security hygiene guidelines for self-modifying agent systems: path sanitization, safe YAML handling, data poisoning checks, and staging/quarantine practices to
Skill Vetter
Pre-install security gate that scans a skill for prompt-injection, secrets, and other vulnerabilities before installation.
nhero — Aftermarket Dispenser Network
Framework treating pill dispensers as network devices: routing, access control, scramble-indexing and confidential supply tracking for custom dispenser workflow
Red Team (Adversarial Review)
Adversarial review skill: iteratively attack artifacts (designs, plans, code, docs) and surface fatal/significant issues until clean or escalation.