MCP App StoreMCP App Store
from MITRE ATT&CK Agent Skills24
Defensive analysis skill for MITRE ATT&CK T1560.003: helps map observations, produce detection ideas, and create triage and mitigation briefs for custom archive
This skill equips an agent to analyse and explain the ATT&CK sub-technique T1560.003 (Archive via Custom Method). It guides defensive workflows: scoping an investigation, mapping evidence to ATT&CK, producing prioritized detection suggestions, drafting incident-response notes, and creating coverage assessment or hunt-plan templates. The skill bundles machine-readable metadata, detection & mitigation notes, templates, and a small rendering script to produce a structured brief.
Use this skill when you suspect data compression/encryption or custom archival behavior prior to exfiltration, when building detection logic for collection tactics, during threat hunting focused on unusual archive/encryption patterns, or when preparing safe adversary-emulation exercises and coverage assessments. It is tailored for triage, detection engineering, hunting, mitigation planning, and incident-response mapping.
scripts/render_brief.py).Best suited for security-focused agent deployments (agents with code/script access and file reading), e.g., Claude/Copilot-style assistants or custom security automation agents that can run simple Python helpers.
MITRE ATT&CK defensive analysis skill for T1560.003 (Archive via Custom Method). Well-structured SKILL.md with clear workflow, bundled resource references, and templates. The single script (render_brief.py) is clean but failed at runtime because the referenced technique-profile.json file was not bundled — it expects a ../references/ directory that isn't included. No security concerns; script only reads local files and outputs markdown.
Defensive-focused skill with no offensive capabilities. Script is a simple markdown renderer for technique profiles. Failure is due to missing bundled reference file, not a code defect. Path resolution uses Path(__file__).resolve().parent which is safe.
MITRE ATT&CK T1098 — Account Manipulation
Defensive analysis and guidance for MITRE ATT&CK technique T1098 (Account Manipulation): detection, triage, hunting, and mitigation planning for enterprise envi
MITRE ATT&CK — T1569.001 Launchctl
Defensive analysis skill for MITRE ATT&CK T1569.001 (Launchctl): detection, triage, and mitigation guidance for macOS adversary activity.
MITRE ATT&CK T1557.001: Name Resolution Poisoning & SMB Relay
Defensive analysis skill for MITRE ATT&CK T1557.001: helps triage, detection engineering, hunting, and incident response for name-resolution poisoning and SMB r
MITRE ATT&CK — Hidden Files & Directories (T1564.001)
Defensive analysis aid for MITRE ATT&CK T1564.001 to help triage, detection engineering, hunting, and incident response around hidden files and directories.
MITRE ATT&CK T1633.001 — System Checks
Defensive analysis skill for MITRE ATT&CK T1633.001 (System Checks) — aids triage, detection engineering, hunting, and emulation planning for mobile platforms.
MITRE ATT&CK T1074: Data Staged
Analyze and detect the T1074 'Data Staged' technique in enterprise environments, supporting TTP triage and detection engineering.
MITRE ATT&CK T1583.006: Web Services
Analyzes the T1583.006 sub-technique (Web Services) for triage, detection engineering, and incident response mapping.
Reverse Engineer
Provides step-by-step guidance and best practices for binary reverse engineering: static analysis, dynamic tracing, disassembly, and documentation workflows for
Sandbox0 Integration
Guidance and templates for integrating Sandbox0 sandboxing into AI agents — CLI/SDK patterns, templates, volumes, network policy, and deployment choices.
CTF Write-up Generator
Generate a concise, reproducible submission-style CTF writeup with a one-path solution script, metadata, and a short checklist for fast verification.
Azure External Attack Surface Management
Provides expert guidance for Azure External Attack Surface Management (EASM): quotas, configuration, integrations, and exporting inventory to analytics platform
Node.js Best Practices
Guidelines and decision-making for Node.js architecture, runtime, async patterns, security, validation, and testing to inform framework and system choices.
radar — Smart Contract AST & Security Analysis
Multi-framework AST generator and static analysis tool for smart contracts (Rust/Anchor/Stylus and Solidity/Foundry) with a template DSL for writing detection r
Bash Pro
Defensive, production-grade Bash scripting patterns and CI/CD best practices: strict mode, safe argument parsing, testing with Bats, and tooling (ShellCheck/shf
Analyzing Ransomware Leak Site Intelligence
Collect and analyze ransomware data-leak site (DLS) posts to extract victim, group, sector and geographic trends for threat intelligence and proactive defense.