Skill UI

A comprehensive, adaptive framework for developing and implementing features, adhering to a strict, multi-phase workflow: Specify, Design, Tasks, and Execute. This skill ensures feature quality through granular task breakdown, atomic Git commits, requirement traceability, and mandatory, independent verification. It automatically adjusts its depth based on feature complexity (Small to Complex), providing a robust mechanism for managing technical debt and capturing project lessons.

This skill enforces a rigorous data validation protocol by establishing hard boundaries at every point data enters the system (API requests, user input, environment variables, webhooks, etc.). It mandates a four-phase process: detection, trust classification, mandatory filtering (schema validation, sanitization, type checking), and final verification. This prevents untrusted data from reaching core business logic, mitigating risks like SQL injection and XSS.

This technique exploits the Active Directory attribute `msDS-KeyCredentialLink` by injecting attacker-controlled public keys (Shadow Credentials). Using tools like pyWhisker and Certipy, the attacker forces the target account to register a new key. Subsequently, by leveraging PKINIT (Public Key Cryptography for Initial Authentication in Kerberos), the attacker can obtain a service ticket and recover the target's NT hash, achieving a stealthy, password-less, complete account takeover.

This tool provides a comprehensive security assessment framework for Retrieval-Augmented Generation (RAG) systems and vector databases. It tests critical vulnerabilities such as embedding inversion, cross-tenant data leakage, knowledge-base poisoning, and retrieval manipulation, aligning with OWASP LLM08:2025 standards. It is essential for validating the security posture of multi-tenant and vector-search applications.

ROADtools is a comprehensive offensive toolkit for Microsoft Entra ID (Azure AD). It consists of ROADrecon for offline directory enumeration (users, groups, roles, policies) and roadtx for advanced token acquisition and exchange. It is designed for authorized red-teaming and penetration testing to discover attack paths and pivot tokens across various Microsoft resources.

Plaso (log2timeline) is an open-source engine used to generate forensic super-timelines. This skill guides the process of normalizing hundreds of diverse artifact types—including MACB times, registry keys, EVTX logs, and browser history—into a single, cohesive chronological view. The workflow covers extraction, filtering, and importing the timeline into Timesketch for collaborative analysis, which is crucial for incident response, correlating complex activity chains, and detecting anti-forensic techniques like timestomping.

Automate security regression testing for Large Language Model (LLM) applications by integrating Promptfoo and DeepTeam into CI/CD pipelines. This skill enforces a critical security gate, automatically testing endpoints against OWASP LLM Top 10, OWASP Agentic threats, and common jailbreaks/prompt injections. It ensures that security patches do not regress over time due to prompt or model changes, providing continuous risk monitoring.

This skill guides the deployment and strategic use of honeytokens and canarytokens (decoy credentials, files, URLs, etc.). These high-fidelity decoys are designed to detect unauthorized access, insider threats, or adversary reconnaissance by triggering alerts upon any interaction, providing early warning deep within the kill chain.

A comprehensive tool and methodology for identifying and preventing dependency confusion attacks across major package ecosystems (npm, PyPI, Maven). It detects instances where internal, private package names are leaked and subsequently published publicly by attackers. The skill provides both detection (enumerating claimable internal names) and prevention strategies (enforcing registry pinning and scope restrictions) to secure the software supply chain.

Provides a comprehensive workflow and tooling (GuardDog) to triage npm packages and dependency trees for signs of malicious activity. It focuses on static analysis of install scripts, detecting credential exfiltration, reverse shells, and worming behavior, thereby safeguarding against software supply-chain attacks.

This skill detects malicious, misspelled, or brand-jacked package names (typosquatting) across major ecosystems (npm, PyPI, crates.io). It uses advanced techniques like edit-distance and keyboard-proximity analysis, powered by tools like typomania and OSSGadget, to flag potential supply chain attacks *before* a dependency is installed. It is essential for implementing robust CI/CD security gates and proactive dependency screening.

Pacu is an open-source, modular AWS exploitation framework designed for authorized cloud penetration testing and red-teaming. It functions as a cloud-pentest analogue to Metasploit, enabling users to enumerate AWS resources, scan for privilege escalation paths, and automate the exploitation of IAM vulnerabilities, persistence mechanisms, and data exfiltration. Use this skill to assess the blast radius of compromised credentials in a controlled, authorized environment.