Skill UI

This skill provides a comprehensive guide to the Common Vulnerability Scoring System (CVSS v4.0), the industry standard for assessing vulnerability severity. It teaches users how to calculate CVSS scores using Base, Threat, and Environmental metrics, and crucially, how to integrate real-world context like EPSS scores and CISA KEV listings for advanced, actionable risk prioritization in security operations.

Grype is an open-source vulnerability scanner from Anchore. It inspects container images, filesystems, and SBOMs for known CVEs. It leverages Syft-generated SBOMs to match packages against multiple vulnerability databases (NVD, GitHub Advisories). Use it for security assessments, auditing, and integrating into CI/CD pipelines to enforce vulnerability standards and manage supply chain risks.

Use Trivy to automate comprehensive vulnerability detection (CVEs, misconfigurations) in Docker container images within CI/CD pipelines. This skill guides users on establishing robust quality gates—such as integrating into GitHub Actions or GitLab CI—to ensure that only secure images are pushed to production registries, covering OS packages, dependencies, and Dockerfile best practices.

This tool implements the Stakeholder-Specific Vulnerability Categorization (SSVC) framework, providing a structured decision-tree methodology for advanced vulnerability prioritization. It moves beyond traditional CVSS scoring by incorporating critical factors such as active exploitation status (CISA KEV), technical impact, automatability, and mission prevalence. It generates actionable remediation priorities (Track, Attend, Act) to guide security teams in managing risk and improving security program maturity.

GoldRush API by Covalent lets agents query wallet balances, token prices, transaction history, DEX pairs, and live OHLCV across 100+ chains via REST, CLI, SDK, or WebSocket, avoiding chain-specific plumbing.

This tool parses Software Bill of Materials (SBOM) in CycloneDX and SPDX formats. It correlates components against the NVD CVE database to identify known supply chain vulnerabilities. Key features include building dependency graphs, calculating transitive risk scores, and generating compliance reports for regulatory assessment.

Guides creating, altering, and validating Snowflake semantic views via the Snowflake CLI, covering connection setup, star-schema modeling, metadata comments/synonyms, temporary validation steps, and post-validation querying for reliable semantic layer delivery.

scVelo is a leading Python package for analyzing RNA velocity in single-cell RNA-seq data. It infers cell state transitions and developmental trajectories by modeling the kinetics of mRNA splicing (unspliced/spliced ratios). This allows researchers to determine cell fate decisions, predict differentiation paths, and identify driver genes without requiring time-course experiments. It complements tools like Scanpy for comprehensive analysis.

A deep-dive curriculum into core memory corruption vulnerability classes, covering topics like stack/heap buffer overflows, Use-After-Free (UAF), integer overflows, and format strings. This guide uses real-world CVE case studies (e.g., QNAP, Chrome) to illustrate attack vectors, impact analysis, and modern mitigation techniques. Ideal for cybersecurity professionals, penetration testers, and students learning exploit development.

A professional methodology for writing penetration test and red team reports, covering executive summaries, technical findings, CVSS scoring, evidence handling, remediation tracking, retest notes, and delivery formats for clients and internal teams.

An expert guide covering advanced exploitation techniques for Expression Language (EL) injection across multiple Java frameworks, including Spring (SpEL), Struts2 (OGNL), and JSP/JSF (Java EL). Details detection methods, sandbox bypasses, and real-world CVE chains for Remote Code Execution (RCE).

A comprehensive playbook detailing advanced JNDI injection techniques. Covers the abuse of JNDI lookups via RMI and LDAP, focusing on critical vulnerabilities like Log4Shell (CVE-2021-44228), deserialization gadgets, and post-8u191 bypass methods. Essential for deep-dive security testing and vulnerability research.