Skill UI

A comprehensive security assessment skill for identifying vulnerabilities in federated identity systems, including SAML, OIDC, and OAuth 2.0 flows. It covers common misconfigurations, such as signature tampering, PKCE failures, redirect URI issues, and token confusion, ensuring robust SSO implementation.

A comprehensive framework for conducting authorized security assessments on Large Language Models (LLMs) and AI agents. It covers critical vulnerabilities including advanced prompt injection (OWASP Top 10), tool abuse, RAG data poisoning, memory manipulation, and system prompt extraction. Ideal for red teaming, security auditing, and ensuring the robustness of AI systems in production environments.

A comprehensive framework for assessing software supply chain security. It covers generating Software Bill of Materials (SBOM), performing Software Composition Analysis (SCA) on open-source dependencies, auditing CI/CD pipelines, and analyzing container images. This skill helps identify vulnerabilities, ensure build integrity, and verify component provenance across the entire development lifecycle.

This skill processes public Shopify App Store reviews (especially low-star ones) to generate a structured, actionable brief. It categorizes feedback into incident risk, repeated friction, pricing confusion, and feature requests, providing a prioritized P0-P3 assessment for product and support teams. It ensures every piece of feedback maintains its public source link and labeling for human review.

A rigorous method for authorized adversarial security review. It models the attacker, maps the entire attack surface (APIs, auth flows, data handling), and generates reports containing only findings with a concrete, reproducible exploit path and verified mitigation steps. Essential for pre-launch hardening and critical system reviews.

Coordinates authorized multi-stage security assessments including full penetration testing, external-to-domain compromise, and attack path planning. The skill acts as a central orchestrator, routing reconnaissance, initial access, privilege escalation, lateral movement, and reporting tasks to specialized sub-skills. Intended for authorized engagements only.

Analyzes published DNS TXT records (SPF, DMARC, DKIM, BIMI) to produce a priority-ordered spoofability verdict for a domain. Distinguishes envelope MAIL FROM from header From, handles SPF PermError and include-chain takeover risks, and explains why SPF -all alone is insufficient without DMARC enforcement. Use for security audits and phishing feasibility assessments.

This assistant specializes in complex cross-border and comparative legal analysis. It helps research legal questions across multiple global jurisdictions and provides a structured framework for evaluating legal risks. It utilizes the Legal Data Hunter MCP to access 13M+ legal documents covering case law, legislation, and doctrine from over 50 countries. The output is flexible, requiring mandatory inline citations for all legal claims, and emphasizes aggressive data quality reporting to flag gaps.

This skill provides an active penetration testing toolchain covering information gathering, port scanning, vulnerability scanning, web attacks (SQL injection, XSS), directory brute-forcing, and password cracking. It exposes 20+ security tools to AI agents via MCP servers for authorized security assessments.

Orchestrates authorized multi-stage penetration testing workflows spanning reconnaissance, initial access, privilege escalation, and lateral movement. Coordinates specialist skills to plan coherent attack paths, manage risk, and generate comprehensive security assessment reports for red team engagements and authorized security assessments.

Identifies, classifies, and prioritizes maintainability problems to help teams build a refactoring roadmap, drawing on twelve classic engineering books.

A comprehensive methodology for conducting authorized bug bounty assessments. Covers the full pipeline from reconnaissance to validation and reporting, emphasizing impact-based hunting and avoiding theoretical vulnerabilities. Includes cluster hunting techniques for maximizing findings.