Claude Code CyberSecurity Skill plugin for Grok Build

Skills (22)

• 01-recon-osint — Passive and active reconnaissance, subdomain enumeration, DNS analysis, technology fingerprinting, and OSINT data correlation for authorized security assessments
• 02-vulnerability-scanner — Dependency auditing, CVE detection, configuration security review, CVSS scoring, and prioritized vulnerability reporting
• 03-exploit-development — Proof-of-concept development, payload crafting, shellcode analysis, and exploitation technique research for authorized security testing
• 04-reverse-engineering — Binary analysis, assembly interpretation, disassembly, decompilation, firmware RE, and protocol reverse engineering
• 05-malware-analysis — Static and dynamic malware analysis, YARA rule generation, sandbox configuration, behavioral profiling, and malware family classification
• 06-threat-hunting — IOC extraction, threat intelligence correlation, MITRE ATT&CK mapping, hunt hypothesis generation, and detection rule creation
• 07-incident-response — IR playbook execution, evidence collection, forensic timeline analysis, memory forensics, and post-incident reporting following NIST SP 800-61 and SANS PICERL methodology
• 08-network-security — Network traffic analysis, PCAP parsing, IDS/IPS rule creation, firewall configuration auditing, and network anomaly detection
• 09-web-security — OWASP Top 10 testing, injection vulnerability detection, API security assessment, authentication testing, and web vulnerability reporting for authorized assessments
• 10-cloud-security — AWS/Azure/GCP security auditing, container and Kubernetes hardening, Infrastructure as Code scanning, and cloud compliance assessment
• 11-csoc-automation — SOC alert triage, incident playbook automation, escalation workflows, shift reporting, and SOC KPI tracking
• 12-log-analysis — Security log parsing, anomaly detection, SIEM query building, Sigma rule creation, and correlation rule development across Splunk, Elastic, QRadar, and Microsoft Sentinel
• 13-crypto-analysis — SSL/TLS auditing, cipher suite analysis, hash algorithm identification, encryption implementation review, and cryptographic weakness detection in code
• 14-red-team-ops — Authorized red team engagement planning, C2 architecture design, attack methodology, lateral movement strategy, OPSEC, and professional reporting
• 15-blue-team-defense — System hardening, detection engineering, security baseline monitoring, patch management, defense-in-depth architecture, and security posture improvement
• 16-ai-llm-security — LLM and AI application security testing — prompt injection, jailbreak resistance, OWASP LLM Top 10 (2025), RAG and agent/tool-use security, model supply chain, and AI red teaming for authorized assessments
• 17-mobile-security — Android and iOS application security testing — static and dynamic analysis, APK/IPA inspection, OWASP MASVS/MASTG verification, secure-storage and transport review, and mobile malware triage for authorized assessments
• 18-ot-ics-security — Operational Technology and industrial control system security — Purdue model segmentation, industrial protocol analysis (Modbus, DNP3, S7, EtherNet/IP), PLC/HMI exposure, IEC 62443 alignment, and MITRE ATT&CK for ICS, for authorized and saf
• 19-grc-compliance — Governance, risk, and compliance — risk assessment and scoring, control mapping across NIST CSF 2.0 / ISO 27001:2022 / SOC 2 / CIS Controls v8, gap analysis, audit evidence preparation, and security policy generation
• 20-supply-chain-security — Software supply chain security — SBOM generation and analysis, dependency confusion and typosquatting detection, malicious package indicators, CI/CD pipeline hardening, and artifact provenance/signing (SLSA, Sigstore)
• 21-threat-intelligence — Cyber threat intelligence production — the intelligence cycle, IOC extraction/normalization/enrichment, STIX/TAXII and MISP, structured analytic models (Diamond, Kill Chain, ATT&CK), source scoring, actor/campaign tracking, and finished int
• 22-purple-team — Collaborative purple-team operations — threat-informed adversary emulation planning (ATT&CK, CTID, Atomic Red Team, CALDERA), the detect-tune-validate loop, detection coverage measurement (DeTT&CT/Navigator), safe execution and deconflictio