Skill UI

This skill details the advanced red-teaming technique of exploiting Active Directory Certificate Services (AD CS) via the ESC8 path. By abusing the HTTP web-enrollment endpoint and relaying coerced NTLM credentials, an attacker can compel a domain controller to request a machine certificate. This certificate is then used to compromise the domain via PKINIT and DCSync.

This guide provides a structured approach to red-teaming Large Language Models (LLMs) to detect sensitive data leakage from system prompts. It simulates advanced attacks—including prompt injection, instruction override, and encoding tricks—to identify embedded secrets, API keys, and proprietary business logic. Essential for validating adherence to OWASP LLM07 and securing AI applications against data exfiltration.

This skill guides the verification of software build provenance and signatures using industry standards like SLSA and Sigstore. It leverages tools like cosign and slsa-verifier to enforce keyless OIDC identity and confirm that artifacts were built by trusted sources without tampering. It is essential for hardening CI/CD pipelines and securing the entire software supply chain against advanced attacks.

A comprehensive guide detailing security patterns and audit checklists for Automated Market Maker (AMM) smart contracts in DeFi. Covers critical vulnerabilities such as flash loans, slippage, reentrancy attacks, price manipulation, and integer overflow/underflow. Essential for reviewing major DeFi protocols like Uniswap.

This tool performs comprehensive safety scanning on untrusted inputs, such as user submissions, API payloads, or webhook data. It detects sophisticated threats like prompt injection, jailbreak attempts, and adversarial attacks using advanced AI defense mechanisms, ensuring data integrity and security before model processing or execution.

This comprehensive skill provides best practices for secure coding across multiple domains. It guides developers on managing secrets, validating user input, preventing SQL injection, implementing robust authentication and authorization (including RLS), and mitigating XSS attacks. Use this when handling sensitive data, APIs, or user-generated content to ensure the highest level of security.

This example demonstrates unsafe or malicious review data inputs, specifically designed for calibration and security testing. It simulates prompt injection attacks and must only be used in controlled environments to validate secure data processing and system robustness.