mlab

Build a threat actor profile brief from mlab.sh actor intelligence - origin, motivations, targeting, aliases, exploited CVEs, tools and techniques. Use when the user names a threat actor or APT group (APT28, Lazarus, Scattered Spider...), asks who is behind a campaign, or wants to know whether an actor targets their sector or exploits a given CVE.

Keep a persistent investigation journal - mlab.sh bookmarks hold the case's indicator set (IPs, domains, hashes), a local case file holds the narrative. Use when the user opens/resumes an investigation, says "bookmark this", "add to the case", asks what is in the current case, or wants a case summary.

Triage blockchain addresses through mlab.sh - labels, sanctions status, risk scoring and address type across Bitcoin, Ethereum and 12 other EVM chains, Tron, Solana, TON and Dogecoin. Use when the user provides a crypto/wallet address, investigates a ransomware payment or scam wallet, or needs a sanctions/AML check on an address.

Review what a change or pull request introduces into the dependency tree - new packages, version bumps, typosquats, install scripts, vulnerabilities - using postmortem diff plus mlab.sh enrichment. Use when reviewing a PR that touches a lockfile, comparing two branches' dependencies, or gating dependency changes in CI.

Vet a single package BEFORE adding it as a dependency - reputation, typosquat check, maintainer history, install scripts, blast radius - using postmortem and mlab.sh. Use when the user asks "can I trust this package", considers adding a dependency (npm i / cargo add / pip install X), or compares candidate libraries.

Review the external attack surface of a domain via mlab.sh - DNS records, subdomains, SSL certificates, mail spoofability (SPF/DKIM/DMARC), security.txt and exposed hosts. Use when the user asks to scan/audit/review a domain, check what a company exposes, verify their own perimeter, or assess a third party's external posture.

Turn a finished investigation into a client-ready CTI report - TLP marking, executive summary, findings with confidence levels, defanged IOC annex. Pure writing playbook on top of results already gathered. Use when the user asks for a report, deliverable, write-up or summary of an investigation done in this or a previous session.

Bulk-enrich a list of IOCs through mlab.sh with quota management - takes a CSV, text file or pasted list of mixed indicators, enriches each with the right tool, and produces a machine-usable CSV plus a human summary. Use when the user provides a file or list of multiple indicators to check, enrich, or turn into a blocklist.

Triage any indicator of compromise (IOC) through mlab.sh - IPs, CIDR ranges, domains, URLs, file hashes, email addresses, MAC addresses, phone numbers or blockchain addresses. Detects the indicator type, runs the right lookups, pivots to malware families, threat actors and CVEs, and produces an analyst-ready verdict. Use when the user pastes one or more indicators, or asks to check, triage, enrich, or investigate an IOC.

Inventory the licenses of a project's dependency graph and enforce a policy over them using postmortem - denied licenses, unknown licenses, dual-licensing. Use when the user asks about license compliance, what licenses their dependencies carry, whether GPL/AGPL is present, or wants a license gate for CI.

Analyze a suspicious email, SMS or message for phishing/smishing using mlab.sh - sender address reputation, domain spoofability (SPF/DKIM/DMARC), embedded URL analysis, callback phone numbers and smishing scoring. Use when the user pastes a suspicious message, reports a phishing attempt, or asks whether an email/SMS/link is legit.

Inventory what a codebase talks to - extract embedded URLs, IPs, domains, wallets, base64 blobs and shell scripts from a repo, then enrich each endpoint through mlab.sh. Use when the user asks what a repo connects to, wants an egress inventory, or vets a vendor/third-party codebase for suspicious embedded infrastructure.

Audit a dependency lockfile or SBOM for known vulnerabilities via mlab.sh, prioritize findings by KEV status and EPSS, and attribute actively exploited CVEs to threat actors. Use when the user provides a Cargo.lock, package-lock.json, requirements.txt, go.sum, composer.lock, Gemfile.lock or CycloneDX SBOM, or asks to check dependencies for vulnerabilities.

Generate a CycloneDX SBOM locally with postmortem and push it through mlab.sh vulnerability scanning - for projects or container images where no single lockfile can be pasted. Use when the user asks for an SBOM, needs vuln scanning of a container image or a multi-ecosystem repo, or when sbom-audit lacks a usable lockfile.

Statically analyze a suspicious shell script through mlab.sh - install.sh, cron payloads, CI steps, curl-pipe-sh one-liners. Flags dangerous constructs (download-piped-to-shell, base64 decoding, reverse shells, persistence, anti-forensics, destructive deletes), extracts every IOC and enriches them. Use when the user pastes shell code and asks if it is safe/malicious, or provides a .sh file to vet before running it.

Analyze a batch of reported SMS/text messages through mlab.sh - score each for smishing, cluster them into campaigns, and extract the shared infrastructure (URLs, callback numbers, sender patterns). Use when the user has multiple reported SMS from users/employees, or investigates an SMS phishing wave. For a single message, phishing-triage does the job.

Full supply-chain audit of a project - postmortem detects malicious code, install hooks and risky dependencies locally, then mlab.sh enriches what it finds (hashes, endpoints, actors, CVEs). Use when the user asks to audit a project's dependencies or supply chain, check a repo for malicious packages, or vet a codebase before adoption or deployment.

Generate a threat landscape digest from mlab.sh - recent critical/KEV CVEs filtered to a declared technology stack, with actor attribution. Use when the user asks what is new in vulnerabilities, wants a daily/weekly threat brief, asks about recent CVEs for a product, or sets up a recurring watch on their stack.