27 portable agentskills.io skills — one set, loaded unmodified by every skills-aware runtime (Hermes, Claude Code, pi, opencode). Each links to its SKILL.md playbook. See using skills & personas for how to invoke them.
| Skill |
Description |
Version |
Tags |
roll-up-ciso-risk |
Executive risk rollup across all security platforms |
1.0.0 |
security, ciso, risk, posture, cross-platform, executive |
triage-incident-cross-platform |
Triage a Defender incident across Entra, LimaCharlie & PA |
1.0.0 |
security, soc, incident-response, cross-platform, correlation |
validation-coverage-loop |
Weak techniques -> LC coverage -> retest recommendation |
1.0.0 |
security, detection-engineering, projectachilles, limacharlie, cross-platform |
| Skill |
Description |
Version |
Tags |
defender-posture-summary |
Summarize Defender security posture for leadership |
1.0.0 |
security, posture, defender, ciso, reporting |
defender-threat-hunt |
Run guided Microsoft Defender advanced hunting (KQL) |
1.0.0 |
security, threat-hunting, defender, kql |
triage-defender-incident |
Triage a Microsoft Defender incident end-to-end |
1.0.0 |
security, soc, defender, incident-response |
| Skill |
Description |
Version |
Tags |
audit-conditional-access |
Audit Entra conditional access policies for gaps |
1.0.0 |
security, identity, entra, conditional-access, hardening |
review-entra-identity-risk |
Review Entra ID Protection risky users and detections |
1.0.0 |
security, identity, entra, risk, identity-protection |
review-privileged-access |
Review Entra privileged directory role assignments |
1.0.0 |
security, identity, entra, privileged-access, hardening |
| Skill |
Description |
Version |
Tags |
intune-coverage-gap-review |
Find Intune device coverage and compliance gaps |
1.0.0 |
security, intune, compliance, gaps, endpoint, security-engineering |
intune-device-compliance-review |
Review Intune device compliance posture |
1.0.0 |
security, posture, intune, compliance, ciso, reporting |
intune-device-triage |
Check a device's Intune state during triage |
1.0.0 |
security, intune, soc, incident-response, endpoint, triage |
| Skill |
Description |
Version |
Tags |
review-detection-coverage |
Review LimaCharlie D&R coverage vs recent detections |
1.0.0 |
security, limacharlie, detection-engineering, coverage, edr |
investigate-lc-endpoint |
Investigate a LimaCharlie endpoint and its activity |
1.0.0 |
security, limacharlie, edr, endpoint, investigation |
limacharlie-threat-hunt |
Run guided LimaCharlie LCQL telemetry hunts |
1.0.0 |
security, limacharlie, threat-hunting, lcql, edr |
| Skill |
Description |
Version |
Tags |
analyze-coverage-gaps |
Find ProjectAchilles control gaps (unblocked attacks) |
1.0.0 |
security, projectachilles, detection-engineering, gaps, mitre |
review-defense-posture |
Review ProjectAchilles defense posture and trend |
1.0.0 |
security, projectachilles, posture, ciso, validation |
explore-test-catalog |
Explore the ProjectAchilles test catalog by technique/actor |
1.0.0 |
security, projectachilles, catalog, mitre, threat-intel |
run-validation-test |
Run or schedule a ProjectAchilles validation test (gated) |
1.0.0 |
security, projectachilles, validation, gated-write, detection-engineer |
review-validation-fleet |
Review ProjectAchilles test agents and accepted risk |
1.0.0 |
security, projectachilles, agents, coverage, risk |
| Skill |
Description |
Version |
Tags |
investigate-audit-activity |
Search the M365 unified audit log for user activity |
1.0.0 |
security, purview, audit, investigation, hunter |
review-data-risk |
Review Purview data-risk posture (DLP, labels, IRM) |
1.0.0 |
security, purview, dlp, data-risk, ciso |
triage-dlp-alerts |
Triage Microsoft Purview DLP alerts by severity |
1.0.0 |
security, purview, dlp, soc, triage |
| Skill |
Description |
Version |
Tags |
generate-report |
Persona posture report (MD+HTML+PDF, EN/ES) from findings |
1.0.0 |
security, report, posture, ciso, deliverable |
| Skill |
Description |
Version |
Tags |
review-exposure-posture |
Review Tenable vulnerability exposure and fix-first list |
1.0.0 |
security, tenable, vulnerability, posture, ciso |
triage-host-vulnerabilities |
Enumerate and triage one host's Tenable vulnerabilities |
1.0.0 |
security, tenable, vulnerability, host, soc |
review-scan-coverage |
Review Tenable scan coverage and freshness gaps |
1.0.0 |
security, tenable, scans, coverage, engineer |