Skill UI

Provides steps and tooling for intercepting JWTs, crafting tokens with the alg header set to none, and submitting forged privileged claims to verify whether a service improperly skips signature verification during authorized security testing.

Use kube-bench to audit Kubernetes clusters against CIS benchmarks, covering control plane, etcd, nodes, and RBAC with automated reports and CI/CD integration.

Guides security teams through hands-on Kubernetes penetration testing—covering reconnaissance, KPI scanning (kube-hunter, Kubescape, kube-bench), RBAC exploitation, secret extraction, and compliance checks to validate cluster resilience.

Analyzes malware to extract file hashes, C2 domains, IPs, URLs, registry hits and behavioral artifacts, blending static PE parsing, sandbox detonations, YARA-based IOC spotting, and STIX 2.1 formatting for CTI sharing during assessments or incident response.

Automate OSINT collection via the SpiderFoot REST API and CLI to profile domains, IPs, emails, leaked credentials, and DNS records across 200+ sources, parse structured results, and deliver intelligence reports for security assessments and response.

Crafts and injects tailored packets with Scapy, hping3, and Nemesis so security teams can validate firewall rules, IDS/IPS, protocol handling, and stack resilience through spoofed, malformed, and fragmented traffic during authorized assessments.

Conduct authorized physical penetration testing to evaluate facility security controls, including tailgating, badge cloning, lock bypasses, and rogue device deployment as part of red team assessments.

Guides ransomware incident response from detection through containment, forensic analysis, recovery, and post-incident hardening while covering negotiation, validation of backups, and regulatory notification steps.

This skill automates the execution of red team phishing campaigns using the Python gophish library. It enables users to create sophisticated email templates with tracking pixels, configure SMTP profiles, import target lists from CSV, and launch full-scale simulations. The system tracks key metrics, including open rates, click rates, and submitted credentials, providing essential data for security awareness training and vulnerability assessments.

Guides teams through designing, implementing, and evidencing SOC 2 Type II controls aligned with the AICPA Trust Services Criteria, covering scoping, control mapping, evidence collection, remediation, and audit collaboration for a six- to twelve-month examination.

Guides SOC teams through discussion-based tabletop exercises that simulate security incidents, validate IR playbooks, train analysts, and rehearse cross-functional communication so you can test procedures without touching production systems.

Performs forensic analysis on SQLite databases by reading headers, freelist chains, WAL files, and unallocated pages to recover deleted records and extract evidence from browsers, messaging apps, and mobile storage, aiding incident response and security audits.