Skip to content

Marketplace

Everything your AI needs, in one place.

Ready-made agents, skills, personas, prompts, templates and tools. Each one is checked before it goes live, works with any model, and installs in a click. Rate what you use so the best rises to the top.

146.7K
listings
1
installs
0
reviews
40.4K
publishers
30 results
Skill

analyzing-campaign-attribution-evidence

Systematically evaluate cyber-campaign evidence to attribute an operation to a threat actor, using the Diamond Model and Analysis of Competing Hypotheses (ACH) to weigh infrastructure overlaps, TTP co

by mukul975skills.sh
Not rated yet
Free
Skill

analyzing-threat-actor-ttps-with-mitre-attack

Systematically map threat actor behavior and observed IOCs to the MITRE ATT&CK framework, build technique coverage heatmaps with the ATT&CK Navigator, identify detection gaps, and produce actionable t

by mukul975skills.sh
Not rated yet
Free
Skill

analyzing-threat-intelligence-feeds

Analyzes structured and unstructured threat intelligence feeds to extract actionable indicators, adversary tactics, and campaign context. Use when ingesting commercial or open-source CTI feeds, evalua

by mukul975skills.sh
Not rated yet
Free
Skill

analyzing-threat-landscape-with-misp

Query a MISP (Malware Information Sharing Platform) instance via PyMISP to compute event statistics, IOC type breakdowns, threat actor galaxy clusters, and tag trends, and generate threat landscape re

by mukul975skills.sh
Not rated yet
Free
Skill

automating-ioc-enrichment

Automates the enrichment of raw indicators of compromise with multi-source threat intelligence context using SOAR platforms, Python pipelines, or TIP playbooks to reduce analyst triage time and standa

by mukul975skills.sh
Not rated yet
Free
Skill

building-ioc-enrichment-pipeline-with-opencti

Build an automated IOC enrichment pipeline on OpenCTI (STIX 2.1 native threat intel platform) using its internal enrichment connectors to pull context from VirusTotal, Shodan, AbuseIPDB, and GreyNoise

by mukul975skills.sh
Not rated yet
Free
Skill

building-threat-intelligence-platform

Design and deploy a Threat Intelligence Platform (TIP) by integrating open-source CTI tools (MISP, OpenCTI, TheHive, Cortex) into a unified system with feed ingestion pipelines, enrichment workflows,

by mukul975skills.sh
Not rated yet
Free
Skill

collecting-threat-intelligence-with-misp

Deploy MISP, configure threat feeds (MISP community, freetext, TAXII, CSV), and use the PyMISP API to programmatically fetch, add, and search events and IOCs, building automated collection pipelines t

by mukul975skills.sh
Not rated yet
Free
Skill

correlating-threat-campaigns

Correlates disparate security incidents, IOCs, and adversary behaviors across time and organizations to identify unified threat campaigns, attribute them to common threat actors, and extract shared in

by mukul975skills.sh
Not rated yet
Free
Skill

generating-threat-intelligence-reports

Generates structured cyber threat intelligence reports at strategic, operational, and tactical levels tailored to specific audiences including executives, security operations teams, and technical anal

by mukul975skills.sh
Not rated yet
Free
Skill

implementing-diamond-model-analysis

The Diamond Model of Intrusion Analysis provides a structured framework for analyzing cyber intrusions by examining four core features - Adversary, Capability, Infrastructure, and Victim. This skill c

by mukul975skills.sh
Not rated yet
Free
Skill

implementing-stix-taxii-feed-integration

Implements a STIX 2.1/TAXII 2.1 threat-intelligence feed consumer and producer in Python, covering TAXII server discovery, collection polling, parsing STIX bundles with the stix2 library, and standing

by mukul975skills.sh
Not rated yet
Free
Skill

implementing-taxii-server-with-opentaxii

Deploy and configure a TAXII 2.1 server (Medallion) with Docker, publish and consume STIX 2.1 bundles across collections, and integrate the feed with SIEM/SOAR platforms for automated indicator exchan

by mukul975skills.sh
Not rated yet
Free
Skill

managing-intelligence-lifecycle

Manages the end-to-end cyber threat intelligence lifecycle from planning and direction through collection, processing, analysis, dissemination, and feedback to ensure intelligence products meet stakeh

by mukul975skills.sh
Not rated yet
Free
Skill

modeling-threats-with-opencti

Deploy OpenCTI (Filigran) via Docker Compose and use the pycti Python client to model threat actors, intrusion sets, campaigns, and indicators as a STIX 2.1 knowledge graph with relationships (uses, a

by mukul975skills.sh
Not rated yet
Free
Skill

monitoring-darkweb-sources

Monitors dark web forums, marketplaces, paste sites, and ransomware leak sites for mentions of organizational assets, leaked credentials, threatened attacks, and threat actor communications to provide

by mukul975skills.sh
Not rated yet
Free
Skill

performing-dark-web-monitoring-for-threats

Dark web monitoring involves systematically scanning Tor hidden services, underground forums, paste sites, and dark web marketplaces to identify threats targeting an organization, including leaked cre

by mukul975skills.sh
Not rated yet
Free
Skill

performing-indicator-lifecycle-management

Tracks IOCs through discovery, enrichment/validation (VirusTotal, Shodan, passive DNS), deployment to SIEM/IDS watchlists, hit-rate and false-positive monitoring, confidence-score decay, and automated

by mukul975skills.sh
Not rated yet
Free
Skill

performing-malware-ioc-extraction

Malware IOC extraction is the process of analyzing malicious software to identify actionable indicators of compromise including file hashes, network indicators (C2 domains, IP addresses, URLs), regist

by mukul975skills.sh
Not rated yet
Free
Skill

performing-threat-landscape-assessment-for-sector

Conducts a sector-specific threat landscape assessment (financial, healthcare, energy, government, etc.) by profiling targeting threat actors, mapping attack vectors and MITRE ATT&CK TTPs with the att

by mukul975skills.sh
Not rated yet
Free
Skill

processing-stix-taxii-feeds

Processes STIX 2.1 threat intelligence bundles delivered via TAXII 2.1 servers, normalizing objects into platform-native schemas and routing them to appropriate consuming systems. Use when onboarding

by mukul975skills.sh
Not rated yet
Free
Skill

tracking-threat-actor-infrastructure

Discovers and maps adversary-controlled infrastructure (C2 servers, phishing domains, exploit-kit hosts, bulletproof hosting) by pivoting across passive DNS, certificate transparency logs, Shodan/Cens

by mukul975skills.sh
Not rated yet
Free
Skill

implementing-diamond-model-analysis

The Diamond Model of Intrusion Analysis provides a structured framework for analyzing cyber intrusions by examining four core features - Adversary, Capability, Infrastructure, and Victim. This skill c

by theheavenlyd3monGitHub
Not rated yet
Free
Skill

analyzing-campaign-attribution-evidence

Campaign attribution analysis involves systematically evaluating evidence to determine which threat actor or group is responsible for a cyber operation. This skill covers collecting and weighting attr

by Razor25000GitHub
Not rated yet
Free
1

Find

Search or browse by kind. Every card shows who made it, how many people installed it and what they think.

2

Install

One click. You get a manifest the router understands, plus copy-paste snippets for the CLI, Python and YAML.

3

Rate and publish

Leave a star rating after you have used it. Made something useful? Publish it - free listings go live immediately.

Prefer the terminal? osr stack apply registry://starter installs the starter template.