evo-suricata-custom-exfil
From the author
Generates and validates Suricata 7.0 rules for detecting data exfiltration hidden in HTTP telemetry traffic, using sticky buffers, exact URI matching, header inspection, and PCRE body pattern matching.
Install
npx skills add OpenLAIR/OpenSkill --skill evo-suricata-custom-exfil -a claude-code
Installs to .claude/skills/evo-suricata-custom-exfil/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
Want your agent to suggest skills while you type? See how to use skills from your IDE.
Safety checks on SKILL.md
- Ships scripts we have not reviewedLow
Why 75
aiqbench computes the trust score from public signals. It is not a security audit, so read a skill before you install it.
Similar skills
Closest to this one by what they do and when they are used.
- utila-webhookshookdeck/webhook-skillsReceive and verify Utila webhooks. Use when setting up Utila webhook handlers, debugging x-utila-signature RSA/PSS verification, or handling Utila digital-asset events like TRANSACTION_CREATED, TRANSACTION_STATE_UPDATED, WALLET_CREATED, WALLET_ADDRESS_CREATED, and TRANSACTION_AML_SCREENING_RESULT_READY.Engineering★ 97
- covert-channel-assessmentzero-lab-ai/skillsAssesses covert-channel and data-egress exposure, then plans or records bounded purple-team validation with synthetic data. Use when evaluating DNS, web, cloud, ICMP, tunnel, timing, steganographic, or dead-drop paths without turning a plausible route into a claim of successful exfiltration.Planning★ 286
- ecto-constraint-debugoliver-kriska/claude-elixir-phoenixDebug Ecto constraint violations - trace triggers, check migrations, find duplicate data. Use when seeing unique_constraint, foreign_key_constraint, or check_constraint errors.Engineering★ 573
- hunt-smugglingEncod3d-Sec/TORCHHTTP request smuggling / desync hunting - CL.TE, TE.CL, TE.TE, CL.0, and HTTP/2 downgrade. Timing-based detection, differential confirmation, no-blind-claims. Wiki-first, FIND schema output.Other★ 338
- audit-secretsJoviDeCroock/prachtDetect environment variables and secrets reaching the client bundle via loader return values, hydration state, or server-only modules imported from client code paths. Use for "audit secrets", "find leaked env vars", "is my API key exposed", "scan for credential leaks".Engineering★ 106
- secops-detection-engineeringgoogle/skillsAuthor, validate, test, and deploy YARA-L 2.0 detection rules and evaluate end-to-end detection coverage gaps in Google SecOps. Use when writing new detection rules, tuning existing rules, validating syntax, testing logic against historical telemetry, or evaluating detection coverage against threat intelligence blogs, CVE disclosures, and Threat Detection Opportunities (TDOs) using synthetic UDM events and long-running coverage analysis. Don't use for alert triage (use secops-triage), deep forensic event reconstruction on infected hosts (use secops-investigate), or case management operations (use secops-cases).OfficialSecurity★ 21.9K
Ratings & reviews
—
no reviews
Tried this skill? Rate it to help others. Sign in
Discussion
Join the discussion. Sign in