ggp1
45 verified skills
internal/skills/catalog/sysctl
# sysctl — Kernel Parameter Tuning ## Category System Hardening ## License GPLv2 (procps-ng) ## Source https://gitlab.com/procps-ng/procps (included in all Linux distributions) ## Purpose Read and modify kernel parameters at runtime. ## Use Cases - Verify security-related kernel settings - Enforce hardened kernel parameters (IP forwarding, SYN cookies, ASLR) - Detect weakened kernel security settings - Audit network stack configuration ## Examples ```bash # Read all kernel parameters sysct
development
internal/skills/catalog/coreutils
# coreutils — General System Utilities ## Category General System Utilities ## License GPLv2/GPLv3+ (GNU coreutils, util-linux, procps-ng) ## Source - https://github.com/coreutils/coreutils - https://github.com/util-linux/util-linux - https://gitlab.com/procps-ng/procps Included in every Linux distribution. ## Purpose Standard GNU/Linux utilities used as building blocks in agent operations — file inspection, text processing, system information gathering. ## Tools ### File & Text Processin
tools
internal/skills/catalog/useradd
# useradd / usermod / userdel — User Account Management ## Category User & Group Management ## License BSD-3-Clause (shadow-utils) ## Source https://github.com/shadow-maint/shadow (included in all Linux distributions) ## Purpose Create, modify, and delete user accounts. ## Use Cases - Create service accounts for Mitiga components - Modify user group memberships - Disable or remove compromised accounts - Audit account configurations ## Examples ```bash # Create a system service account (no
development
internal/skills/catalog/stat
# stat — File Status ## Category File Integrity & Verification ## License GPLv3+ (GNU coreutils) ## Source https://github.com/coreutils/coreutils (included in all Linux distributions) ## Purpose Display detailed file or filesystem status — permissions, ownership, timestamps, inode. ## Use Cases - Inspect file metadata during investigations - Verify file permissions match security baselines - Check modification and access times - Examine inode details for forensic analysis ## Examples ```ba
development
internal/skills/catalog/journalctl
# journalctl — Systemd Journal Reader ## Category Log Analysis ## License LGPLv2.1+ (systemd) ## Source https://github.com/systemd/systemd (included in systemd-based distributions) ## Purpose Query and display logs from the systemd journal. ## Use Cases - Search for authentication failures - Investigate service crashes and restarts - Query kernel messages for security events - Filter logs by time range, unit, and priority - Export logs in JSON format for machine consumption ## Examples ```
development
internal/skills/catalog/iptables
# iptables / nftables — Firewall Management ## Category System Hardening ## License GPLv2 ## Source https://git.netfilter.org/ (included in Linux kernel/userspace) ## Purpose Configure kernel packet filtering rules — block/allow traffic by port, IP, protocol, interface. ## Use Cases - Block malicious IPs during incident response - Restrict outbound traffic to authorized destinations - Verify current firewall rule sets - Containment actions for CRITICAL threats - Audit network filtering poli
development
internal/skills/catalog/openssl
# openssl — Cryptographic Toolkit ## Category TLS & Certificate Operations ## License Apache 2.0 ## Source https://github.com/openssl/openssl ## Purpose TLS/SSL testing, certificate inspection, cryptographic operations, connection diagnostics. ## Use Cases - Verify TLS configurations on peer agent connections - Inspect peer certificates for validity and expiry - Test cipher suites offered by a service - Generate CSRs for certificate rotation - Check certificate chain integrity - Verify cert
tools
internal/skills/catalog/ip
# ip — Network Interface and Routing ## Category Network Reconnaissance ## License GPLv2 (iproute2) ## Source https://github.com/iproute2/iproute2 (included in Linux) ## Purpose Query network interfaces, addresses, routes, and neighbors. ## Use Cases - Verify network configuration and interface status - Detect rogue interfaces or unexpected addresses - Inspect routing tables for suspicious entries - Confirm local subnet scope for peer communication - Review ARP/neighbor table for anomalies
development
internal/skills/catalog/id
# id — User Identity ## Category User & Group Management ## License GPLv3+ (GNU coreutils) ## Source https://github.com/coreutils/coreutils (included in all Linux distributions) ## Purpose Display user and group IDs for a given user. ## Use Cases - Verify user privileges and group memberships - Audit service account configurations - Check if a user has unexpected group access - Confirm the agent's own running identity ## Examples ```bash # Current user identity id # Specific user identity
development
internal/skills/catalog/chmod
# chmod — File Permission Management ## Category System Hardening ## License GPLv3+ (GNU coreutils) ## Source https://github.com/coreutils/coreutils (included in all Linux distributions) ## Purpose Modify file and directory permissions. For ownership changes, see [chown](../chown/SKILL.md). ## Use Cases - Restrict permissions on sensitive configuration files - Fix overly permissive file permissions - Set correct ownership on system files - Harden file access controls ## Examples ```bash #
development
internal/skills/catalog/apparmor
# AppArmor — Mandatory Access Control ## Category System Hardening ## License GPLv2 ## Source https://gitlab.com/apparmor/apparmor (included in Ubuntu/Debian/SUSE) ## Purpose Inspect and manage AppArmor profiles — mandatory access control enforcement. ## Use Cases - Verify AppArmor is active and enforcing - Check profile enforcement status for all confined processes - Audit which applications are running unconfined - Verify specific profiles are in enforce mode ## Tools - `aa-status` — Sho
tools
internal/skills/catalog/ausearch
# ausearch / aureport — Linux Audit Tools ## Category Log Analysis ## License GPLv2 (audit) ## Source https://github.com/linux-audit/audit-userspace (Linux Audit Framework) ## Purpose Search and report on Linux Audit Framework events — file access, syscalls, authentication, authorization. ## Use Cases - Investigate file access patterns on sensitive files - Detect privilege escalation attempts - Trace syscall activity for specific processes - Generate authentication and authorization summari
tools
internal/skills/catalog/aide
# aide — Advanced Intrusion Detection Environment ## Category File Integrity & Verification ## License GPLv2 ## Source https://github.com/aide/aide ## Purpose File and directory integrity checker. Creates a baseline database of file attributes and detects unauthorized modifications. ## Use Cases - Monitor critical system files for unauthorized changes - Detect unauthorized binary replacements - Track configuration drift over time - Establish and verify file integrity baselines ## Examples
development
internal/skills/catalog/auditctl
# auditctl — Linux Audit Rule Management ## Category Log Analysis ## License GPLv2 (audit) ## Source https://github.com/linux-audit/audit-userspace (Linux Audit Framework) ## Purpose Configure the Linux Audit Framework rules at runtime. Companion to `ausearch`/`aureport` — `auditctl` defines *what* to audit, while `ausearch` queries the results. ## Use Cases - Add audit rules to monitor access to sensitive files (shadow, passwd, SSH keys) - Watch for privilege escalation syscalls (execve, s
development
internal/skills/catalog/chage
# chage — Password Age Management ## Category User & Group Management ## License BSD-3-Clause (shadow-utils) ## Source https://github.com/shadow-maint/shadow (included in all Linux distributions) ## Purpose View and set password aging parameters — expiration, min/max age, warning days. ## Use Cases - Audit password policies per user - Detect accounts with non-expiring passwords - Verify password rotation compliance - Check password expiration dates ## Examples ```bash # View password aging
development
internal/skills/catalog/chkrootkit
# chkrootkit — Rootkit Checker ## Category Malware & Rootkit Detection ## License BSD-like ## Source http://www.chkrootkit.org/ ## Purpose Check the local system for signs of rootkits — hidden processes, modified system binaries, suspicious kernel modules. ## Use Cases - Periodic rootkit detection sweeps - Incident response verification - Detect hidden processes and modified binaries - Identify suspicious kernel modules ## Examples ```bash # Quick check, report warnings only chkrootkit -q
development
internal/skills/catalog/chown
# chown — File Ownership Management ## Category System Hardening ## License GPLv3+ (GNU coreutils) ## Source https://github.com/coreutils/coreutils (included in all Linux distributions) ## Purpose Change file and directory ownership (user and group). Companion to `chmod` — together they provide complete file access control. ## Use Cases - Restore correct ownership on system files tampered by an attacker - Set ownership on newly created configuration files - Ensure sensitive files (shadow, S
development
internal/skills/catalog/clamav
# clamav — Antivirus Engine ## Category Malware & Rootkit Detection ## License GPLv2 ## Source https://github.com/Cisco-Talos/clamav (Cisco Talos) ## Purpose Open-source antivirus engine for detecting trojans, viruses, malware, and other malicious payloads. ## Use Cases - Scan files and directories for known malware signatures - Verify downloaded artifacts for malicious content - Periodic malware sweeps of critical directories - Incident response file analysis ## Examples ```bash # Recursi
development
internal/skills/catalog/docker
```skill # docker — Sandboxed Tool Testing and Isolation ## Category Sandboxing & Isolation ## License Apache 2.0 (Docker Engine / Moby) ## Source https://github.com/moby/moby (Moby / Docker Engine) ## Purpose Run transient, privilege-restricted containers that mirror the host OS environment. Used exclusively for pre-deployment sandbox verification of CLI tools before they are installed on the real host. Never used to run production workloads or agent operations themselves. ## Use Cases - V
tools
internal/skills/catalog/find
# find — File System Search ## Category File Integrity & Verification ## License GPLv3+ (GNU findutils) ## Source https://github.com/coreutils/coreutils (included in all Linux distributions) ## Purpose Search for files matching specific criteria — permissions, ownership, timestamps, types. ## Use Cases - Find SUID/SGID binaries (potential privilege escalation vectors) - Detect world-writable files and directories - Find recently modified files during investigations - Locate orphaned files w
development
internal/skills/catalog/getent
# getent — Name Service Lookup ## Category User & Group Management ## License LGPLv2.1+ (glibc) ## Source Included in all Linux distributions (part of glibc). ## Purpose Query NSS databases — passwd, group, shadow, hosts, services. ## Use Cases - Enumerate all system users and groups (including LDAP/NIS) - Verify account existence - Audit group memberships - Resolve hostnames and service names ## Examples ```bash # List all system users getent passwd # List all system groups getent group
development
internal/skills/catalog/gitleaks
# gitleaks — Secret Detection ## Category Code Auditing ## License MIT ## Source https://github.com/gitleaks/gitleaks ## Purpose Detect hardcoded secrets (API keys, passwords, tokens, private keys) in Git repositories and files. ## Use Cases - Scan source code for committed secrets - Audit Git history for leaked credentials - Pre-commit secret detection enforcement - Scan arbitrary directories for secret patterns ## Examples ```bash # Detect secrets in a repository gitleaks detect --source
development
internal/skills/catalog/gosec
# gosec — Go Security Checker ## Category Code Auditing ## License Apache 2.0 ## Source https://github.com/securego/gosec ## Purpose Inspects Go source code for security problems by scanning the AST and SSA form. Go-specific rules for crypto, SQL injection, file permissions, command execution, etc. ## Use Cases - Audit Go code for insecure `exec.Command` usage - Detect weak cryptographic primitives - Find unvalidated redirects and hardcoded credentials - Identify file permission issues - Ch
development
internal/skills/catalog/govulncheck
# govulncheck — Go Vulnerability Checker ## Category Vulnerability Scanning ## License BSD-3-Clause ## Source https://github.com/golang/vuln (official Go project) ## Purpose Check Go source code and binaries against the Go vulnerability database. Only reports vulnerabilities in functions actually called by the code — minimizing false positives. ## Use Cases - Audit Go module dependencies for known vulnerabilities - Verify built binaries against the vulnerability database - CI/CD gating for
development
internal/skills/catalog/gpg
# gpg — GNU Privacy Guard ## Category File Integrity & Verification ## License GPLv3 ## Source https://github.com/gpg/gnupg ## Purpose Verify digital signatures on packages, binaries, and documents. ## Use Cases - Verify package signatures before installation - Validate signed release artifacts - Check release integrity against publisher keys - Verify detached signatures ## Examples ```bash # Verify a detached signature gpg --verify release.sig release.tar.gz # Import a public key gpg --i
development
internal/skills/catalog/groupadd
# groupadd / groupmod / groupdel — Group Account Management ## Category User & Group Management ## License BSD-3-Clause (shadow-utils) ## Source https://github.com/shadow-maint/shadow (included in all Linux distributions) ## Purpose Create, modify, and delete groups. Companion to `useradd` — together they provide full user and group lifecycle management. ## Use Cases - Create dedicated groups for Mitiga agent operations (e.g., `mitiga_agents`) - Remove unauthorized or orphaned groups - Modi
development
internal/skills/catalog/grype
# grype — Dependency Vulnerability Scanner ## Category Vulnerability Scanning ## License Apache 2.0 ## Source https://github.com/anchore/grype ## Purpose Match software dependencies and packages against known vulnerability databases. ## Use Cases - Scan Go modules for known CVEs - Audit OS packages for vulnerabilities - Scan container layers for CVEs - SBOM-based vulnerability matching - Focused alternative to `trivy` for dependency-level scanning ## Examples ```bash # Scan a project direc
development
internal/skills/catalog/last
# last / lastb / lastlog — Login History ## Category Log Analysis ## License GPLv2 (util-linux / shadow-utils) ## Source Included in all Linux distributions. ## Purpose Display login history (`last`), failed login attempts (`lastb`), and per-user last login times (`lastlog`). ## Use Cases - Detect unauthorized logins - Identify brute-force patterns via failed attempts - Find accounts that have never logged in - Review login sources and timestamps - Detect logins from unusual IP addresses or
development
internal/skills/catalog/lsof
# lsof — List Open Files ## Category Process Management ## License Custom permissive ## Source https://github.com/lsof-org/lsof ## Purpose List open files, sockets, pipes, and network connections per process. ## Use Cases - Identify which process owns a network connection - Find processes with open handles on sensitive files - Detect hidden network activity - Audit open sockets on specific ports - Investigate file descriptor leaks ## Examples ```bash # List all network connections with pro
development
internal/skills/catalog/lynis
# lynis — Security Auditing Tool ## Category System Hardening ## License GPLv3 ## Source https://github.com/CISOfy/lynis ## Purpose Comprehensive security auditing and hardening assessment. Checks hundreds of security controls and produces a hardening index with specific recommendations. ## Use Cases - Full system security audit - Compliance checking (CIS, HIPAA, PCI-DSS baselines) - Hardening gap analysis - Periodic posture assessment - Generate remediation recommendations ## Examples ```
tools
internal/skills/catalog/nmap
# nmap — Network Mapper ## Category Network Reconnaissance ## License GPLv2 ## Source https://github.com/nmap/nmap ## Purpose Port scanning, service/version detection, OS fingerprinting, network discovery. ## Use Cases - Detect open ports on local and remote hosts - Identify unexpected listeners on the network - Map network services and their versions - Verify firewall rules by testing reachability - OS fingerprinting for asset inventory ## Examples ```bash # Full TCP port scan with servic
development
internal/skills/catalog/passwd
# passwd — Password Management ## Category User & Group Management ## License BSD-3-Clause (shadow-utils) ## Source https://github.com/shadow-maint/shadow (included in all Linux distributions) ## Purpose Change user passwords, lock/unlock accounts, set password status. ## Use Cases - Audit password status for accounts - Lock compromised accounts during incident response - Verify password policy enforcement ## Examples ```bash # Check password status for a user passwd -S username # Lock a
development
internal/skills/catalog/pgrep
# pgrep / pkill — Process Grep and Signal ## Category Process Management ## License GPLv2 (procps-ng) ## Source https://gitlab.com/procps-ng/procps (included in all Linux distributions) ## Purpose Search for processes by name, user, or other attributes. Signal matching processes. ## Use Cases - Detect running instances of known-malicious binaries - Locate processes by owner or name pattern - Targeted process termination during incident response - Count instances of a service ## Examples ``
development
internal/skills/catalog/ps
# ps — Process Status ## Category Process Management ## License GPLv2 (procps-ng) ## Source https://gitlab.com/procps-ng/procps (included in all Linux distributions) ## Purpose Snapshot of current processes with details on PID, user, CPU, memory, command line. ## Use Cases - List all running processes for audit - Detect processes running as root unexpectedly - Find processes with suspicious parent relationships - Identify high-resource-consuming processes - Detect processes with unusual com
development
internal/skills/catalog/rkhunter
# rkhunter — Rootkit Hunter ## Category Malware & Rootkit Detection ## License GPLv2 ## Source https://github.com/installation/rkhunter ## Purpose Scan for rootkits, backdoors, and local exploits by comparing file hashes, checking for hidden files, and inspecting system configuration. ## Use Cases - Complementary rootkit detection alongside `chkrootkit` - Scan for backdoors and local exploits - File hash comparison against known-good baselines - Hidden file and directory detection ## Examp
development
internal/skills/catalog/selinux
# SELinux — Security-Enhanced Linux ## Category System Hardening ## License GPLv2 ## Source https://github.com/SELinuxProject/selinux (included in RHEL/Fedora/CentOS) ## Purpose Inspect SELinux mode and policy status. ## Tools - `sestatus` — Show SELinux status and policy details - `getenforce` — Show current enforcement mode ## Use Cases - Verify SELinux is in enforcing mode - Check for permissive domains that may indicate weakened security - Audit SELinux policy configuration - Detect if
tools
internal/skills/catalog/semgrep
# semgrep — Static Analysis Engine ## Category Code Auditing ## License LGPL 2.1 ## Source https://github.com/semgrep/semgrep ## Purpose Pattern-based static analysis across many languages. Supports custom rules for detecting insecure patterns, logic bugs, and anti-patterns. ## Use Cases - Detect hardcoded credentials in source code - Find insecure cryptographic usage - Identify command injection patterns - Detect missing input validation - Enforce coding standards with custom rules - OWASP
development
internal/skills/catalog/sha256sum
# sha256sum / sha512sum — Checksum Verification ## Category File Integrity & Verification ## License GPLv3+ (GNU coreutils) ## Source https://github.com/coreutils/coreutils (included in all Linux distributions) ## Purpose Generate and verify SHA-256/SHA-512 cryptographic checksums. ## Use Cases - Verify binary integrity against known-good checksums - Detect tampered files - Record baselines for known-good binaries - Validate downloaded artifacts ## Examples ```bash # Generate SHA-256 check
development
internal/skills/catalog/ss
# ss — Socket Statistics ## Category Network Reconnaissance ## License GPLv2 (iproute2) ## Source https://github.com/iproute2/iproute2 (included in Linux) ## Purpose Display local socket information — listening ports, established connections, socket states. ## Use Cases - Audit which processes are listening on which ports - Detect unauthorized listeners - Verify expected services are running on correct ports - Check established connections for suspicious destinations ## Examples ```bash #
development
internal/skills/catalog/systemctl
# systemctl — Service Management ## Category System Hardening ## License LGPLv2.1+ (systemd) ## Source https://github.com/systemd/systemd (included in systemd-based distributions) ## Purpose Control systemd services — start, stop, enable, disable, inspect status. ## Use Cases - Audit running services for unnecessary attack surface - Disable unnecessary services - Check service dependencies and states - Restart misconfigured services after hardening - Verify critical services are enabled and
development
internal/skills/catalog/tcpdump
# tcpdump — Packet Capture ## Category Network Traffic Analysis ## License BSD-3-Clause ## Source https://github.com/the-tcpdump-group/tcpdump ## Purpose Capture and inspect network packets at the interface level. ## Use Cases - Investigate suspicious network connections - Verify mTLS is active on peer communications - Detect plaintext transmissions that should be encrypted - Forensic packet capture during security incidents - Monitor traffic patterns on specific ports ## Examples ```bash
development
internal/skills/catalog/top
# top — Process Monitoring ## Category Process Management ## License GPLv2 (procps-ng) ## Source https://gitlab.com/procps-ng/procps (included in all Linux distributions) ## Purpose Real-time process activity monitoring — CPU, memory, I/O usage. ## Use Cases - Detect resource-abusing processes (cryptominers, DoS tools) - Monitor system load during security scans - Identify processes with abnormal CPU or memory consumption - Snapshot system resource state for reports ## Examples ```bash # B
tools
internal/skills/catalog/trivy
# trivy — Comprehensive Vulnerability Scanner ## Category Vulnerability Scanning ## License Apache 2.0 ## Source https://github.com/aquasecurity/trivy (CNCF project) ## Purpose Scan filesystems, container images, Git repositories, and IaC configurations for known vulnerabilities (CVEs), misconfigurations, and exposed secrets. ## Use Cases - Audit project dependencies for known CVEs - Scan configuration files for misconfigurations - Detect embedded secrets in repositories - Scan container im
development
internal/skills/catalog/ufw
# ufw — Uncomplicated Firewall ## Category System Hardening ## License GPLv3 ## Source https://code.launchpad.net/ufw (included in Ubuntu/Debian) ## Purpose Simplified interface for managing iptables/nftables rules. ## Use Cases - Quick firewall status checks - Rule modifications on systems using ufw - Block malicious sources during incident response ## Examples ```bash # Show firewall status and rules ufw status verbose # Block a malicious IP ufw deny from <malicious_ip> # Allow a speci
development
internal/skills/catalog/who
# who / w — Logged-in Users ## Category User & Group Management ## License GPLv3+ (GNU coreutils) / GPLv2 (procps-ng) ## Source Included in all Linux distributions. ## Purpose Show who is currently logged in and what they are doing. ## Use Cases - Detect unauthorized active sessions - Monitor interactive logins in real-time - Identify login sources (IP, terminal) - Review idle times for active sessions ## Examples ```bash # All login information who -a # Currently logged-in users with act
development