external/trailofbits-skills-curated/plugins/skill-extractor/skills/skill-extractor/SKILL.md
Extracts reusable skills from work sessions. Use when: (1) a non-obvious problem was solved worth preserving, (2) a pattern was discovered that would help future sessions, (3) a workaround or debugging technique needs documentation. Manual invocation only via /skill-extractor command - no automatic triggers or hooks.
npx skillsauth add seikaikyo/dash-skills skill-extractorInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
Extracts reusable knowledge from work sessions and saves it as a Claude Code skill.
Use these prompts to identify knowledge worth extracting:
If you can't answer at least two of these with something non-trivial, it's probably not worth extracting.
/skill-extractor [--project] [context hint]
~/.claude/skills/[name]/SKILL.md--project: saves to .claude/skills/[name]/SKILL.md/skill-extractor the cyclic data DoS fix)Before creating a new skill, search for existing ones that might cover the same ground:
# Check user skills
ls ~/.claude/skills/
# Check project skills
ls .claude/skills/
# Search by keyword
grep -r "keyword" ~/.claude/skills/ .claude/skills/ 2>/dev/null
If a related skill exists, consider updating it instead of creating a new one. See skill-lifecycle.md for guidance on when to update vs create.
If $ARGUMENTS contains a context hint (e.g., "the cyclic data DoS fix"), use it to focus the extraction on that specific topic.
Analyze the conversation to identify:
Present a brief summary to the user:
I identified this potential skill:
**Problem:** [Brief description]
**Key insight:** [What made it non-obvious]
**Triggers:** [Error messages or symptoms]
Evaluate the candidate skill against these criteria:
| Criterion | Pass? | Evidence | |-----------|-------|----------| | Reusable - Helps future tasks, not just this instance | | [Why] | | Non-trivial - Required discovery, not docs lookup | | [Why] | | Verified - Solution actually worked | | [Evidence] | | Specific triggers - Exact error messages or scenarios | | [What they are] | | Explains WHY - Trade-offs and judgment, not just steps | | [How] | | Value-add - Teaches judgment, not just facts Claude could look up | | [How] |
Present assessment to user and ask: "Proceed with extraction? [yes/no]"
The user decides whether to proceed regardless of how many criteria pass. Respect their judgment - if they say yes, extract; if no, skip.
Ask the user:
--project)If the topic involves a specific library or framework:
Skip research for:
Use the template from skill-template.md.
Quality standards: Follow quality-guide.md to ensure the skill provides lasting value. Key points:
Run through the validation checklist in skill-template.md. If validation fails, fix the issues before saving.
Create the directory and save:
~/.claude/skills/[name]/SKILL.md.claude/skills/[name]/SKILL.mdReport success:
Skill saved to: [path]
The skill will be available in future sessions when the context matches:
"[first line of description]"
When extracting, consider how the new knowledge relates to existing skills:
Combine or separate?
Update vs create:
Cross-referencing:
Skills aren't permanent. See skill-lifecycle.md for guidance on:
If you catch yourself thinking any of these, do NOT extract:
Scenario: User discovered that an AST visitor crashes with RecursionError when analyzing serialized files containing cyclic references (e.g., a list that contains itself).
Identified learning:
Generated skill name: cyclic-ast-visitor-hardening
Key sections:
visited: set parameter, check before recursingtools
Conduct comprehensive GDPR compliance assessments by evaluating data processing activities against EU Regulation 2016/679, including Article 30 records of processing, lawful basis validation, data subject rights implementation, Data Protection Impact Assessments (DPIAs) under Article 35, breach notification procedures, international transfer safeguards (SCCs, adequacy decisions), and technical/organizational measures under Article 32. Use when processing personal data of EU residents, preparing for supervisory authority audits, implementing privacy-by-design for new systems, scoping compliance gaps for M&A due diligence, assessing third-party processors, or responding to data subject access requests at scale. Incorporates 2026 guidance from ICO, EDPB, and post-Data (Use and Access) Act 2025 UK-GDPR considerations. Do not use for implementing specific Article 32 controls — use implementing-gdpr-data-protection-controls; or for DSAR automation — use implementing-gdpr-data-subject-access-request.
tools
Parse Windows forensic artifacts—$MFT/$J (MFTECmd), Prefetch (PECmd), registry hives (RECmd), shellbags, and Amcache—into normalized CSV/JSON with Eric Zimmerman's EZ Tools, then load results into Timeline Explorer for analysis. Use during DFIR/incident-response investigations, after triage collection (e.g. with KAPE), to establish program execution, file/folder access, and persistence evidence from acquired forensic images.
development
Build automated multi-turn adversarial attacks against conversational LLM targets using Microsoft PyRIT's RedTeamingOrchestrator, CrescendoOrchestrator (gradual escalation), and TreeOfAttacksWithPruningOrchestrator (adaptive branching), with scorer feedback loops and persisted conversation memory. Use when single-shot LLM scanning is insufficient and you need multi-turn, scorer-driven AI red-team campaigns against a chatbot or agent.
testing
Stand up MISP, enable and cache curated threat feeds (CIRCL, abuse.ch, Feodo Tracker), apply warninglists to suppress false positives, query indicators with PyMISP, and export attributes as auto-generated Suricata/Sigma/Wazuh detection rules. Use when maturing a MISP instance to actively drive detection, curating threat feeds with quality controls, or automating IOC-to-detection pipelines for the SIEM/IDS.