Skill UI

This specialized downstream skill is designed for deep analysis of complex attack paths originating from Server-Side Request Forgery (SSRF). It systematically tracks the entire exploitation chain: from the initial SSRF source (e.g., webhook, URL parameter) through internal service reachability, metadata endpoint exploitation, credential extraction, and finally, demonstrating how an attacker achieves accepted access or elevated privileges. Use this when tracing the decisive path through server-side requests and credential pivoting.

A comprehensive guide for conducting authorized database security assessments across various platforms (PostgreSQL, MySQL, MSSQL, Mongo, Redis). Covers critical areas including exposure analysis, authentication, authorization checks, misconfiguration review, and attack chain validation, ensuring non-destructive testing practices are followed.

Coordinates authorized multi-stage security assessments including full penetration testing, external-to-domain compromise, and attack path planning. The skill acts as a central orchestrator, routing reconnaissance, initial access, privilege escalation, lateral movement, and reporting tasks to specialized sub-skills. Intended for authorized engagements only.

Covers advanced API exploitation methodologies, focusing on business logic abuse, API call chaining, and sophisticated attack patterns that bypass traditional security controls. Topics include GraphQL abuse (batching, introspection), JWT manipulation (algorithm confusion), race conditions, and identifying API key leakage. This guide is designed for authorized penetration testers targeting deep-seated, logic-layer vulnerabilities.

A comprehensive methodology covering advanced offensive techniques targeting the software supply chain. This includes exploiting dependency confusion across npm, PyPI, and NuGet, executing build system hooks, tampering with CI/CD pipelines, and compromising container images. It provides detailed PoC patterns and detection guidance for red team operations.

This skill provides an active penetration testing toolchain covering information gathering, port scanning, vulnerability scanning, web attacks (SQL injection, XSS), directory brute-forcing, and password cracking. It exposes 20+ security tools to AI agents via MCP servers for authorized security assessments.

Orchestrates authorized multi-stage penetration testing workflows spanning reconnaissance, initial access, privilege escalation, and lateral movement. Coordinates specialist skills to plan coherent attack paths, manage risk, and generate comprehensive security assessment reports for red team engagements and authorized security assessments.

A comprehensive skill for offensive security testing of cloud IAM across AWS, Azure, and GCP. It guides users through credential identification, read-only validation, and privilege escalation techniques, emphasizing authorized use only.

This skill enables the identification and exploitation of client-side DOM vulnerabilities, including DOM Clobbering, PostMessage bypasses, Service Worker abuse, and CSS exfiltration. It is designed for authorized security assessments to discover high-value attack chains that bypass server-side filters. Users must obtain explicit written permission before testing any target.

Red-team playbook for Microsoft 365 and Entra ID: tenant discovery, AADSTS error-code triage, Smart Lockout math for safe credential spraying, and user-enumeration vectors. Authorized engagements only.

This skill provides a red-team attack chain for Okta-as-IdP environments, covering tenant discovery, user enumeration, and authentication flow analysis. It includes commands for probing Okta APIs and analyzing responses to identify security weaknesses. Strictly for authorized security assessments.

This comprehensive, zero-trust security auditor scans third-party AI agent skills before installation. It performs a rigorous 6-phase review process, analyzing surface patterns, script integrity, permissions, and supply chain risks. It is designed to detect malicious payloads, credential theft, instruction overrides, and prompt injection attacks, ensuring secure AI development and deployment.