Builds vendor-agnostic detection rules using the Sigma rule format for threat detection across SIEM platforms including Splunk, Elastic, and Microsoft Sentinel. Use when creating portable detection logic from threat intelligence, mapping rules to MITRE ATT&CK techniques, or converting community Sigma rules into platform-specific queries using sigmac or pySigma backends.

Leverages Splunk Enterprise Security and SPL (Search Processing Language) to investigate security incidents through log correlation, timeline reconstruction, and anomaly detection. Covers Windows event logs, firewall logs, proxy logs, and authentication data analysis. Activates for requests involving Splunk investigation, SPL queries, SIEM log analysis, security event correlation, or log-based incident investigation.

Identifies and unpacks UPX-packed malware samples, including binaries with modified UPX magic bytes or headers that block automated decompression, to recover the original executable for static analysis. Use when a sample shows high entropy, minimal imports, or only LoadLibrary/GetProcAddress in its import table, or when preparing a packed binary for disassembly in Ghidra or IDA.

Analyzes network traffic generated by malware during sandbox execution or live incident response to identify C2 protocols, data exfiltration channels, payload downloads, and lateral movement patterns using Wireshark, Zeek, and Suricata. Activates for requests involving malware network analysis, C2 traffic decoding, malware PCAP analysis, or network-based malware detection.

Analyzes network traffic captures and flow data to identify adversary activity during security incidents, including command-and-control communications, lateral movement, data exfiltration, and exploitation attempts. Uses Wireshark, Zeek, and NetFlow analysis techniques. Activates for requests involving network traffic analysis, packet capture investigation, PCAP analysis, network forensics, C2 traffic detection, or exfiltration detection.

Analyzes DNS query logs to detect data exfiltration via DNS tunneling, DGA domain communication, and covert C2 channels using entropy analysis, query volume anomalies, and subdomain length detection in SIEM platforms. Use when SOC teams need to identify DNS-based threats that bypass traditional network security controls.

Build, run, and customize a LaunchMyStore e-commerce store from natural language. Use when the user wants to scaffold an app, ship a storefront / checkout / admin extension, build and deploy a WASM Function, configure App Bridge actions (Toast, Modal, ResourcePicker, SessionToken, TitleBar...), manage products / orders / customers / themes via the LaunchMyStore MCP server, or write Aqua (Liquid-dialect) theme code. Triggers include: "build a LaunchMyStore app", "lms cli", "add a discount function", "set up app bridge", "manage my store with AI", "write a theme block", "install an extension", "deploy a function", "use launchmystore", "lms", or any mention of LaunchMyStore / launchmystore.io.

Environment validation checklist. Run this FIRST when starting a new Claude session to verify the environment is ready for optimization work. Checks Rust toolchain, ci/ scripts, build, benchmarking tools, profilers, memory tools, git state, and SMP CLI.

Finds a valid optimization target in lading. Returns a filled target.yaml template with pattern, technique, target, file, bench, and fingerprint. Use before /lading-optimize-hunt or when selecting a new optimization target.

Query ID graph to find individual IDs appearing in multiple canonical ID groups. Use when debugging over-stitching by checking whether a single ID has been stitched to more than one canonical ID.

Orchestrates multi-channel ad ideation for email, SMS, and Instagram campaigns using a structured creative direction workflow. Use when brainstorming campaign concepts, generating ad copy variations, developing creative directions, exploring messaging strategies, or generating promotional ideas for one or more channels.

Generates a morning briefing that triages your inbox and previews your day using the Superhuman Mail MCP server — acting as an AI chief of staff. Use this skill whenever someone asks to "brief me on my day", "triage my inbox", "what's important in my email", "summarize my unread emails", "what do I need to deal with today", "chief of staff briefing", "morning update", "inbox summary", "what emails need my attention", "clear my inbox", or any variation of wanting a prioritized view of their email and calendar before they start working. Also trigger when someone says "I just woke up, what's going on" or "catch me up on my inbox". Trigger broadly — if someone wants to understand the state of their inbox or day at a glance, this skill should activate.

Hunt for lateral movement using PsExec, WMI, or similar techniques. Use when proactively searching for attackers moving through your network using admin tools. Searches for service installations, remote process execution, and suspicious network correlations.

Migrate KMP projects from CocoaPods (kotlin("native.cocoapods")) to Swift Package Manager (swiftPMDependencies DSL) — replaces pod() with swiftPackage(), transforms cocoapods.* imports to swiftPMImport.*, and reconfigures the Xcode project.

Generate CHANGELOG.md entry from recent commits in conventional format. Also syncs the website changelog page. Use this skill whenever the user asks to: write release notes, generate a changelog, prepare a version release, document what changed between tags, or create a new CHANGELOG entry. If you see requests like "write the changelog for v0.17", "what changed since last release", or "prepare release notes", this is the skill to use. Do NOT manually edit CHANGELOG.md without this skill — it ensures proper formatting, user-perspective writing, and website changelog sync.

End-to-end Parallels smoke, upgrade, and rerun workflow for OpenClaw across macOS, Windows, and Linux guests. Use when Codex needs to run, rerun, debug, or interpret VM-based install, onboarding, gateway smoke tests, latest-release-to-main upgrade checks, fresh snapshot retests, or optional Discord roundtrip verification under Parallels.

使用本项目的 CMake 工作流构建 xTools 或指定的 X_APP 目标。当用户要求编译、重新构建或生成打包产物时使用此技能。

Run GPU workloads on Modal — training, fine-tuning, inference, batch processing. Zero-config serverless: no SSH, no Docker, auto scale-to-zero. Use when user says "modal run", "modal training", "modal inference", "deploy to modal", "need a GPU", "run on modal", "serverless GPU", or needs remote GPU compute.

Compile LaTeX paper to PDF, fix errors, and verify output. Use when user says "编译论文", "compile paper", "build PDF", "生成PDF", or wants to compile LaTeX into a submission-ready PDF.

Dr. Claw skill for OpenClaw project discovery, idea intake, waiting-session triage, structured session control, event-driven notifications, and mobile reporting through the local drclaw CLI.