Blue team & detection

The top-rated launch-quality Blue team & detection skill for AI agents is building-automated-malware-submission-pipeline (grade A), followed by hunting-for-supply-chain-compromise and detecting-modbus-command-injection-attacks. Skillspace rates 547 Blue team & detection skills; 167 are launch-quality.

Defensive operations: SIEM, detection rules, malware analysis, forensics, threat intelligence.

Launch-quality skills first, then by grade, then by our Skill Score, which adds judge reviews, test results, GitHub stars and adoption.

  1. building-automated-malware-submission-pipeline A
  2. hunting-for-supply-chain-compromise A
  3. detecting-modbus-command-injection-attacks A
  4. detecting-stuxnet-style-attacks A
  5. analyzing-memory-forensics-with-lime-and-volatility A
  6. acquiring-disk-image-with-dd-and-dcfldd B
  7. analyzing-campaign-attribution-evidence B
  8. analyzing-cobaltstrike-malleable-c2-profiles B
  9. analyzing-android-malware-with-apktool B
  10. greynoise B
  11. urlscan B
  12. virustotal B
  13. urlscan B
  14. sangfor-edr-use B
  15. malware-analysis B
  16. privacy-scanner B
  17. performing-ics-asset-discovery-with-claroty B
  18. implementing-honeytokens-for-breach-detection B
  19. hunting-for-dcom-lateral-movement B
  20. implementing-threat-intelligence-lifecycle-management B
  21. performing-malware-hash-enrichment-with-virustotal B
  22. building-adversary-infrastructure-tracking-system B
  23. ghidra-mcp B
  24. detecting-dnp3-protocol-anomalies B
  25. detecting-api-enumeration-attacks B

Frequently asked questions

What is the best Blue team & detection skill for AI agents?

The top-rated launch-quality Blue team & detection skill for AI agents is building-automated-malware-submission-pipeline (grade A), followed by hunting-for-supply-chain-compromise and detecting-modbus-command-injection-attacks. Skillspace rates 547 Blue team & detection skills; 167 are launch-quality.

How does Skillspace rate Blue team & detection skills?

Skillspace grades every Blue team & detection skill from A to F with a published scoring engine that reads the skill's SKILL.md: architecture and maturity make the score, and a security scan can cap it. In crowded categories, a judge model also compares the strongest contenders side by side, and some skills are tested head-to-head on real tasks against other skills in the same category (including a deliberately weak one) and a no-skill baseline. Launch-quality skills are graded A to C with a clean safety verdict, and not excluded by a quality filter: the filters catch skills our model's safety screen flags for prompt injection, guardrail bypass, harmful content or credential exposure; test fixtures and attack benchmarks; skills written only for the repository they live in; templates and stubs; and near-duplicate variants and copies of other skills. Ratings were last updated on 24 September 2026; the full method is on the methodology page.

Are Blue team & detection skills safe to install?

Of the 547 Blue team & detection skills Skillspace rates, 399 passed its safety scan with no flag from its model, and 148 are flagged: 5 for review, 136 as risky, 5 as unsafe and 2 as attack benchmarks. Each skill's page shows its safety verdict. A pass is not a guarantee: the scan reads only the skill's SKILL.md, not the scripts or other files it ships, and looks for patterns such as piping a remote script into a shell, reading credentials or hiding actions from the user. Skills are third-party code that Skillspace indexes but does not host or endorse, so read a skill's source on GitHub before you install it.

Skillspace indexes and rates skills; it does not host or endorse them. Run third-party skills at your own risk.