skill-library-mcp 1.0.0

package/skills/make-automation/SKILL.md

@@ -0,0 +1,201 @@
+---
+name: make-automation
+description: "Automate Make (Integromat) tasks via Rube MCP (Composio): operations, enums, language and timezone lookups. Always search tools first for current schemas."
+requires:
+  mcp: [rube]
+---
+
+# Make Automation via Rube MCP
+
+Automate Make (formerly Integromat) operations through Composio's Make toolkit via Rube MCP.
+
+## Prerequisites
+
+- Rube MCP must be connected (RUBE_SEARCH_TOOLS available)
+- Active Make connection via `RUBE_MANAGE_CONNECTIONS` with toolkit `make`
+- Always call `RUBE_SEARCH_TOOLS` first to get current tool schemas
+
+## Setup
+
+**Get Rube MCP**: Add `https://rube.app/mcp` as an MCP server in your client configuration. No API keys needed — just add the endpoint and it works.
+
+
+1. Verify Rube MCP is available by confirming `RUBE_SEARCH_TOOLS` responds
+2. Call `RUBE_MANAGE_CONNECTIONS` with toolkit `make`
+3. If connection is not ACTIVE, follow the returned auth link to complete Make authentication
+4. Confirm connection status shows ACTIVE before running any workflows
+
+## Core Workflows
+
+### 1. Get Operations Data
+
+**When to use**: User wants to retrieve operation logs or usage data from Make scenarios
+
+**Tool sequence**:
+1. `MAKE_GET_OPERATIONS` - Retrieve operation records [Required]
+
+**Key parameters**:
+- Check current schema via RUBE_SEARCH_TOOLS for available filters
+- May include date range, scenario ID, or status filters
+
+**Pitfalls**:
+- Operations data may be paginated; check for pagination tokens
+- Date filters must match expected format from schema
+- Large result sets should be filtered by date range or scenario
+
+### 2. List Available Languages
+
+**When to use**: User wants to see supported languages for Make scenarios or interfaces
+
+**Tool sequence**:
+1. `MAKE_LIST_ENUMS_LANGUAGES` - Get all supported language codes [Required]
+
+**Key parameters**:
+- No required parameters; returns complete language list
+
+**Pitfalls**:
+- Language codes follow standard locale format (e.g., 'en', 'fr', 'de')
+- List is static and rarely changes; cache results when possible
+
+### 3. List Available Timezones
+
+**When to use**: User wants to see supported timezones for scheduling Make scenarios
+
+**Tool sequence**:
+1. `MAKE_LIST_ENUMS_TIMEZONES` - Get all supported timezone identifiers [Required]
+
+**Key parameters**:
+- No required parameters; returns complete timezone list
+
+**Pitfalls**:
+- Timezone identifiers use IANA format (e.g., 'America/New_York', 'Europe/London')
+- List is static and rarely changes; cache results when possible
+- Use these exact timezone strings when configuring scenario schedules
+
+### 4. Scenario Configuration Lookup
+
+**When to use**: User needs to configure scenarios with correct language and timezone values
+
+**Tool sequence**:
+1. `MAKE_LIST_ENUMS_LANGUAGES` - Get valid language codes [Required]
+2. `MAKE_LIST_ENUMS_TIMEZONES` - Get valid timezone identifiers [Required]
+
+**Key parameters**:
+- No parameters needed for either call
+
+**Pitfalls**:
+- Always verify language and timezone values against these enums before using in configuration
+- Using invalid values in scenario configuration will cause errors
+
+## Common Patterns
+
+### Enum Validation
+
+Before configuring any Make scenario properties that accept language or timezone:
+```
+1. Call MAKE_LIST_ENUMS_LANGUAGES or MAKE_LIST_ENUMS_TIMEZONES
+2. Verify the desired value exists in the returned list
+3. Use the exact string value from the enum list
+```
+
+### Operations Monitoring
+
+```
+1. Call MAKE_GET_OPERATIONS with date range filters
+2. Analyze operation counts, statuses, and error rates
+3. Identify failed operations for troubleshooting
+```
+
+### Caching Strategy for Enums
+
+Since language and timezone lists are static:
+```
+1. Call MAKE_LIST_ENUMS_LANGUAGES once at workflow start
+2. Store results in memory or local cache
+3. Validate user inputs against cached values
+4. Refresh cache only when starting a new session
+```
+
+### Operations Analysis Workflow
+
+For scenario health monitoring:
+```
+1. Call MAKE_GET_OPERATIONS with recent date range
+2. Group operations by scenario ID
+3. Calculate success/failure ratios per scenario
+4. Identify scenarios with high error rates
+5. Report findings to user or notification channel
+```
+
+### Integration with Other Toolkits
+
+Make workflows often connect to other apps. Compose multi-tool workflows:
+```
+1. Call RUBE_SEARCH_TOOLS to find tools for the target app
+2. Connect required toolkits via RUBE_MANAGE_CONNECTIONS
+3. Use Make operations data to understand workflow execution patterns
+4. Execute equivalent workflows directly via individual app toolkits
+```
+
+## Known Pitfalls
+
+**Limited Toolkit**:
+- The Make toolkit in Composio currently has limited tools (operations, languages, timezones)
+- For full scenario management (creating, editing, running scenarios), consider using Make's native API
+- Always call RUBE_SEARCH_TOOLS to check for newly available tools
+- The toolkit may be expanded over time; re-check periodically
+
+**Operations Data**:
+- Operation records may have significant volume for active accounts
+- Always filter by date range to avoid fetching excessive data
+- Operation counts relate to Make's pricing tiers and quota usage
+- Failed operations should be investigated; they may indicate scenario configuration issues
+
+**Response Parsing**:
+- Response data may be nested under `data` key
+- Enum lists return arrays of objects with code and label fields
+- Operations data includes nested metadata about scenario execution
+- Parse defensively with fallbacks for optional fields
+
+**Rate Limits**:
+- Make API has rate limits per API token
+- Avoid rapid repeated calls to the same endpoint
+- Cache enum results (languages, timezones) as they rarely change
+- Operations queries should use targeted date ranges
+
+**Authentication**:
+- Make API uses token-based authentication
+- Tokens may have different permission scopes
+- Some operations data may be restricted based on token scope
+- Check that the authenticated user has access to the target organization
+
+## Quick Reference
+
+| Task | Tool Slug | Key Params |
+|------|-----------|------------|
+| Get operations | MAKE_GET_OPERATIONS | (check schema for filters) |
+| List languages | MAKE_LIST_ENUMS_LANGUAGES | (none) |
+| List timezones | MAKE_LIST_ENUMS_TIMEZONES | (none) |
+
+## Additional Notes
+
+### Alternative Approaches
+
+Since the Make toolkit has limited tools, consider these alternatives for common Make use cases:
+
+| Make Use Case | Alternative Approach |
+|--------------|---------------------|
+| Trigger a scenario | Use Make's native webhook or API endpoint directly |
+| Create a scenario | Use Make's scenario management API directly |
+| Schedule execution | Use RUBE_MANAGE_RECIPE_SCHEDULE with composed workflows |
+| Multi-app workflow | Compose individual toolkit tools via RUBE_MULTI_EXECUTE_TOOL |
+| Data transformation | Use RUBE_REMOTE_WORKBENCH for complex processing |
+
+### Composing Equivalent Workflows
+
+Instead of relying solely on Make's toolkit, build equivalent automation directly:
+1. Identify the apps involved in your Make scenario
+2. Search for each app's tools via RUBE_SEARCH_TOOLS
+3. Connect all required toolkits
+4. Build the workflow step-by-step using individual app tools
+5. Save as a recipe via RUBE_CREATE_UPDATE_RECIPE for reuse

package/skills/makepad-skills/SKILL.md

@@ -0,0 +1,22 @@
+---
+name: makepad-skills
+description: "Makepad UI development skills for Rust apps: setup, patterns, shaders, packaging, and troubleshooting."
+source: "https://github.com/ZhangHanDong/makepad-skills"
+risk: safe
+---
+
+# Makepad Skills
+
+## Overview
+
+Makepad UI development skills for Rust apps: setup, patterns, shaders, packaging, and troubleshooting.
+
+## When to Use This Skill
+
+Use this skill when you need to work with makepad ui development skills for rust apps: setup, patterns, shaders, packaging, and troubleshooting..
+
+## Instructions
+
+This skill provides guidance and patterns for makepad ui development skills for rust apps: setup, patterns, shaders, packaging, and troubleshooting..
+
+For more information, see the [source repository](https://github.com/ZhangHanDong/makepad-skills).

package/skills/malware-analyst/SKILL.md

@@ -0,0 +1,247 @@
+---
+name: malware-analyst
+description: Expert malware analyst specializing in defensive malware research,
+  threat intelligence, and incident response. Masters sandbox analysis,
+  behavioral analysis, and malware family identification. Handles static/dynamic
+  analysis, unpacking, and IOC extraction. Use PROACTIVELY for malware triage,
+  threat hunting, incident response, or security research.
+metadata:
+  model: opus
+---
+
+# File identification
+file sample.exe
+sha256sum sample.exe
+
+# String extraction
+strings -a sample.exe | head -100
+FLOSS sample.exe  # Obfuscated strings
+
+# Packer detection
+diec sample.exe   # Detect It Easy
+exeinfope sample.exe
+
+# Import analysis
+rabin2 -i sample.exe
+dumpbin /imports sample.exe
+```
+
+### Phase 3: Static Analysis
+1. **Load in disassembler**: IDA Pro, Ghidra, or Binary Ninja
+2. **Identify main functionality**: Entry point, WinMain, DllMain
+3. **Map execution flow**: Key decision points, loops
+4. **Identify capabilities**: Network, file, registry, process operations
+5. **Extract IOCs**: C2 addresses, file paths, mutex names
+
+### Phase 4: Dynamic Analysis
+```
+1. Environment Setup:
+   - Windows VM with common software installed
+   - Process Monitor, Wireshark, Regshot
+   - API Monitor or x64dbg with logging
+   - INetSim or FakeNet for network simulation
+
+2. Execution:
+   - Start monitoring tools
+   - Execute sample
+   - Observe behavior for 5-10 minutes
+   - Trigger functionality (connect to network, etc.)
+
+3. Documentation:
+   - Network connections attempted
+   - Files created/modified
+   - Registry changes
+   - Processes spawned
+   - Persistence mechanisms
+```
+
+## Use this skill when
+
+- Working on file identification tasks or workflows
+- Needing guidance, best practices, or checklists for file identification
+
+## Do not use this skill when
+
+- The task is unrelated to file identification
+- You need a different domain or tool outside this scope
+
+## Instructions
+
+- Clarify goals, constraints, and required inputs.
+- Apply relevant best practices and validate outcomes.
+- Provide actionable steps and verification.
+- If detailed examples are required, open `resources/implementation-playbook.md`.
+
+## Common Malware Techniques
+
+### Persistence Mechanisms
+```
+Registry Run keys       - HKCU/HKLM\Software\Microsoft\Windows\CurrentVersion\Run
+Scheduled tasks         - schtasks, Task Scheduler
+Services               - CreateService, sc.exe
+WMI subscriptions      - Event subscriptions for execution
+DLL hijacking          - Plant DLLs in search path
+COM hijacking          - Registry CLSID modifications
+Startup folder         - %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup
+Boot records           - MBR/VBR modification
+```
+
+### Evasion Techniques
+```
+Anti-VM                - CPUID, registry checks, timing
+Anti-debugging         - IsDebuggerPresent, NtQueryInformationProcess
+Anti-sandbox           - Sleep acceleration detection, mouse movement
+Packing                - UPX, Themida, VMProtect, custom packers
+Obfuscation           - String encryption, control flow flattening
+Process hollowing      - Inject into legitimate process
+Living-off-the-land    - Use built-in tools (PowerShell, certutil)
+```
+
+### C2 Communication
+```
+HTTP/HTTPS            - Web traffic to blend in
+DNS tunneling         - Data exfil via DNS queries
+Domain generation     - DGA for resilient C2
+Fast flux             - Rapidly changing DNS
+Tor/I2P               - Anonymity networks
+Social media          - Twitter, Pastebin as C2 channels
+Cloud services        - Legitimate services as C2
+```
+
+## Tool Proficiency
+
+### Analysis Platforms
+```
+Cuckoo Sandbox       - Open-source automated analysis
+ANY.RUN              - Interactive cloud sandbox
+Hybrid Analysis      - VirusTotal alternative
+Joe Sandbox          - Enterprise sandbox solution
+CAPE                 - Cuckoo fork with enhancements
+```
+
+### Monitoring Tools
+```
+Process Monitor      - File, registry, process activity
+Process Hacker       - Advanced process management
+Wireshark            - Network packet capture
+API Monitor          - Win32 API call logging
+Regshot              - Registry change comparison
+```
+
+### Unpacking Tools
+```
+Unipacker            - Automated unpacking framework
+x64dbg + plugins     - Scylla for IAT reconstruction
+OllyDumpEx           - Memory dump and rebuild
+PE-sieve             - Detect hollowed processes
+UPX                  - For UPX-packed samples
+```
+
+## IOC Extraction
+
+### Indicators to Extract
+```yaml
+Network:
+  - IP addresses (C2 servers)
+  - Domain names
+  - URLs
+  - User-Agent strings
+  - JA3/JA3S fingerprints
+
+File System:
+  - File paths created
+  - File hashes (MD5, SHA1, SHA256)
+  - File names
+  - Mutex names
+
+Registry:
+  - Registry keys modified
+  - Persistence locations
+
+Process:
+  - Process names
+  - Command line arguments
+  - Injected processes
+```
+
+### YARA Rules
+```yara
+rule Malware_Generic_Packer
+{
+    meta:
+        description = "Detects common packer characteristics"
+        author = "Security Analyst"
+
+    strings:
+        $mz = { 4D 5A }
+        $upx = "UPX!" ascii
+        $section = ".packed" ascii
+
+    condition:
+        $mz at 0 and ($upx or $section)
+}
+```
+
+## Reporting Framework
+
+### Analysis Report Structure
+```markdown
+# Malware Analysis Report
+
+## Executive Summary
+- Sample identification
+- Key findings
+- Threat level assessment
+
+## Sample Information
+- Hashes (MD5, SHA1, SHA256)
+- File type and size
+- Compilation timestamp
+- Packer information
+
+## Static Analysis
+- Imports and exports
+- Strings of interest
+- Code analysis findings
+
+## Dynamic Analysis
+- Execution behavior
+- Network activity
+- Persistence mechanisms
+- Evasion techniques
+
+## Indicators of Compromise
+- Network IOCs
+- File system IOCs
+- Registry IOCs
+
+## Recommendations
+- Detection rules
+- Mitigation steps
+- Remediation guidance
+```
+
+## Ethical Guidelines
+
+### Appropriate Use
+- Incident response and forensics
+- Threat intelligence research
+- Security product development
+- Academic research
+- CTF competitions
+
+### Never Assist With
+- Creating or distributing malware
+- Attacking systems without authorization
+- Evading security products maliciously
+- Building botnets or C2 infrastructure
+- Any offensive operations without proper authorization
+
+## Response Approach
+
+1. **Verify context**: Ensure defensive/authorized purpose
+2. **Assess sample**: Quick triage to understand what we're dealing with
+3. **Recommend approach**: Appropriate analysis methodology
+4. **Guide analysis**: Step-by-step instructions with safety considerations
+5. **Extract value**: IOCs, detection rules, understanding
+6. **Document findings**: Clear reporting for stakeholders