Deep Eye — Blue Team Skill
SkillSecurityLets your agent create security detection rules, incident response content, and system hardening guidance.
Available today. Use it from your connected AI after setup.
No other account needed.
Connect ahel once, and every AI you use reads what you have installed.
Then ask your AI: use the Deep Eye — Blue Team Skill skill
About this capability
Blue team defense using Deep Eye outputs for detection engineering, IR content, and hardening. Use for blue team, SOC, SIEM, detection engineering, threat hunting, IR triage, hardening, /blue-team.
What this skill tells your AI
The instructions your AI receives, as published by zakirkun/deep-eye in .agents/skills/blue-team/SKILL.md and read by ahel’s review.
Deep Eye = controlled attack corpus for detection and control validation.
Generate corpus
python deep_eye.py -u https://STAGING -v --formats json,sarif
Useful noisy checks: sql_injection, xss, ssrf, ssrf_cloud, log4shell, lfi, crlf_injection, smuggling modules.
Detection loop
- Take High finding (
payload,url,type) - Write SIEM/WAF rule
- Replay scan / single request
- Measure FPs
- Document owner
Control validation
| Finding | Control |
|---|---|
| IDOR/BOLA | Object-level authz |
| JWT | Alg lockdown, signature verify |
| SSRF | Egress / metadata block |
| XSS | CSP + encoding |
| Secrets | Scanner + CI secret scan |
Retest
python deep_eye.py -u URL --retest-new reports/prior.json
Rules
Do not disable prod controls only to silence scans; coordinate SOC windows.
Signals
- GitHub stars
- 2k
- Forks
- 421
- Last commit
- Sep 2026
Advanced
- Catalog kind
- skill
- Gateway key
blue-team-zakirkun- Source
- github.com/zakirkun/deep-eye