deobfuscating-powershe…
Systematically deobfuscates multi-layer PowerShell malware using AST analysis, dynamic tracing, and tools like PSDecode and PowerDecode to reveal hidden…
A skill ships inside a plugin. Install the plugin, and a skill that gets Auto-invokedWhat is this?This plugin ships a FLOW.md router the engine fires, so the matching skill runs itself. No slash command to remember.Learn how → runs itself when your prompt calls for it.
40,077 skills across 2,408 plugins. 1,867 of them fire as you prompt.
Systematically deobfuscates multi-layer PowerShell malware using AST analysis, dynamic tracing, and tools like PSDecode and PowerDecode to reveal hidden…
Detect unusual API call patterns in AWS CloudTrail logs using boto3, statistical baselining, and behavioral analysis
Detecting exposed AWS credentials in source code repositories, CI/CD pipelines, and configuration files using
Automate AWS GuardDuty threat detection findings processing using EventBridge and Lambda to enable real-time
Deploys deception-based honeytokens in Active Directory including fake
Deploy cloud-native deception across AWS, Azure, and GCP using decoy (honey) resources whose only purpose is to generate a high-fidelity alert the instant an…
Deploys Cloudflare Access with Cloudflare Tunnel for zero trust access to self-hosted apps, configuring identity-aware policies, device posture checks, and…
Detect AWS IAM privilege escalation paths using boto3 and Cloudsplaining policy analysis to identify overly permissive
Detect lateral movement in Azure AD/Entra ID environments using Microsoft Graph API audit logs, Azure Sentinel
Detect and investigate Azure service principal abuse including privilege escalation, credential compromise, admin
Deploys canary files (honeytokens) across file systems to detect ransomware
Deploys and configures CrowdStrike Falcon EDR agents across enterprise
Plants Canarytokens-based decoy artifacts (honey credentials, DNS tokens, web-bug URLs, AWS keys, documents, kubeconfigs) using Thinkst's open-source…
Audit Azure Blob and ADLS storage accounts for public access exposure, weak or long-lived SAS tokens, missing
Performs statistical analysis of Zeek conn.log connection intervals to detect C2 beaconing patterns. Uses the
Detects and analyzes Bluetooth Low Energy (BLE) security attacks including sniffing, replay attacks, GATT enumeration
Deploys and configures osquery for real-time endpoint monitoring using
Deploys Palo Alto Networks Prisma Access for SASE-based zero trust network access, configuring GlobalProtect agents, ZTNA Connectors, security policy…
Deploys and monitors ransomware canary files using Python's watchdog library, placing decoy files mimicking high-value targets (financial records, credentials,…
Detect and test for OWASP API3:2023 Broken Object Property Level Authorization vulnerabilities including excessive
Business Email Compromise (BEC) is a sophisticated fraud scheme where attackers impersonate executives, vendors,
Deploy AI and NLP-powered detection systems to identify business email compromise attacks by analyzing writing
Deploys a Software-Defined Perimeter per the CSA v2.0 specification, configuring Single Packet Authorization, mutual TLS, and SDP controller/gateway components…
Deploys and configures Tailscale (or self-hosted Headscale) as a WireGuard-based zero trust mesh VPN, setting up identity-aware ACLs, exit nodes, subnet…
Plan, run, and measure an adversary engagement operation using the MITRE Engage framework so that deployed deception is driven by strategy instead of deployed…
This skill teaches security teams how to deploy and operationalize Amazon GuardDuty for continuous threat detection
Detects command-and-control (C2) communications tunneled through DNS protocol including DNS tunneling tools
Detecting compromised cloud credentials across AWS, Azure, and GCP by analyzing anomalous API activity, impossible
Detects prompt injection using regex signature matching, heuristic scoring for structural anomalies, and DeBERTa-based transformer classification, flagging…
Deploys anomaly detection for OT/ICS environments using machine learning on OT network baselines, physics-based process models, and Modbus/DNP3/OPC UA traffic…
Detect unauthorized modifications to running containers by monitoring for binary execution drift, file system
Container escape is a critical attack technique where an adversary breaks out of container isolation to access
© 2026 Flowy · Free and open source
Built for Claude Code · Not affiliated with Anthropic