Skill UI

This skill generates a highly structured, section-by-section paper outline by synthesizing raw research data, detailed review conclusions, and experimental results. It guides the writing process by mapping core claims to supporting evidence (Claims-Evidence Matrix) and adhering to specific academic venue formatting guidelines (e.g., ICLR, NeurIPS). Use this when you need to transform scattered findings into a cohesive narrative structure.

Configure and execute Saviynt Enterprise Identity Cloud access recertification campaigns to validate user entitlements, revoke excessive privileges, and satisfy SOX/SOC2/HIPAA compliance through scheduled, event-driven, or on-demand reviews enriched with risk scoring and analytics.

Conduct structured access reviews and certifications—defining campaign scope, selecting reviewers, prioritizing risks, and tracking remediation—to prove compliance during audits and governance-focused assessments.

Guide for conducting focused Active Directory penetration tests: enumerate domain objects, analyze attack paths with BloodHound, abuse Kerberos, exploit ADCS/DCSync, and demonstrate privilege escalation to Domain Admin.

Guides security teams through Active Directory vulnerability assessments with PingCastle health checks, BloodHound attack-path mapping, and Purple Knight scoring to spot misconfigurations, privilege escalation paths, and Kerberos lateral-movement weaknesses in enterprise domains.

A workflow for detecting and responding to Adversary-in-the-Middle phishing attacks that swipe credentials/MFA tokens via reverse-proxy kits, with guidance for hardening MFA, conditional access, and logging.

Sets up agentless vulnerability scanning across on-premises, cloud, and container environments by leveraging SSH/WMI, cloud snapshot APIs, and API-based discovery to assess systems without endpoint agents.

Simulates authorized ARP spoofing attacks with arpspoof, Ettercap, and Scapy to demonstrate MITM risks, validate detection controls, and train analysts within isolated labs or approved windows.

Guide for using AWS CloudTrail logs, Athena, and boto3 to reconstruct attacker activity, track compromised credentials, and produce forensic timelines for cloud incident response.

Use Falco YAML rules and the Falco gRPC API to monitor syscalls and runtime behavior in containers or Kubernetes, catching shell spawns, file tampering, network anomalies, and privilege escalation while parsing alerts to support incident response and security testing.

Uses the Kubernetes Python client to inspect pod security contexts, privileged mode, capabilities, namespace sharing, and hostPath mounts to highlight container escape vectors during security audits or incident response.

Harden container images by minimizing attack surface, adopting multi-stage and distroless bases, stripping unused packages, enforcing non-root execution and read-only roots, and validating against CIS Docker Benchmark before production rollout.