Skill UI

A powerful tool for comprehensive, offline dependency auditing across 8+ programming ecosystems (e.g., Node, Python, Go, Rust). It identifies critical CVE vulnerabilities, license conflicts, and calculates safe upgrade paths, making it essential for pre-release security checks, legal compliance reviews, and major version migrations.

Automatically runs the vulnerability-scanner plugin to inspect code, dependencies, and configurations, detecting CVEs and insecure settings before releases and delivering detailed reports with remediation guidance.

Provides a Senior SecOps engineer toolkit for running SAST/DAST, dependency CVE scans, policy checks, and compliance automation (SOC2/PCI-DSS/HIPAA/GDPR) during audits, CVE response, or CI/CD hardening.

Structured pre-PR verification loop for Spring Boot projects that runs fast-build checks, static analysis, tests with coverage, security scans, formatting gates, and diff reviews to catch issues before deployment.

AnnData supplies a Python-native container for annotated matrices, letting researchers store measurements alongside rich metadata, read/write h5ad/zarr/loom/10X files, and integrate with the scverse tools when building single-cell or related data workflows.

Executes a deep security audit via Centinela (QA), covering OWASP Top 10 checks, dependency CVEs, secrets scans, and delivers structured findings and handoff reports.

This skill details the exploitation of the critical Zerologon vulnerability (CVE-2020-1472) found in the Microsoft Netlogon Remote Protocol. It allows an unauthenticated attacker to compromise a domain controller by resetting its machine account password. The guide covers the complete attack chain, including initial exploitation, credential dumping via DCSync, and subsequent privilege escalation in Active Directory environments. Used exclusively for authorized red teaming and security testing.

This skill implements a sophisticated risk-based prioritization engine by combining three critical data sources: the CISA Known Exploited Vulnerabilities (KEV) catalog, the Exploit Prediction Scoring System (EPSS), and traditional CVSS scores. It allows security teams to move beyond simple severity ratings, focusing remediation efforts on vulnerabilities confirmed to be actively exploited in the wild or predicted to be highly exploitable. The workflow integrates fetching, enriching, and scoring vulnerabilities to generate an actionable remediation plan with defined SLAs.

This skill utilizes the Shodan API to perform comprehensive IP reputation analysis. It enriches IP addresses by identifying open ports, running services, known vulnerabilities (CVEs), and hosting context. It is crucial for threat intelligence enrichment, incident triage, and security assessments, helping security professionals assess the risk level and potential compromise of exposed infrastructure.

Grype is an open-source vulnerability scanner from Anchore. It inspects container images, filesystems, and SBOMs for known CVEs. It leverages Syft-generated SBOMs to match packages against multiple vulnerability databases (NVD, GitHub Advisories). Use it for security assessments, auditing, and integrating into CI/CD pipelines to enforce vulnerability standards and manage supply chain risks.

Use Trivy to automate comprehensive vulnerability detection (CVEs, misconfigurations) in Docker container images within CI/CD pipelines. This skill guides users on establishing robust quality gates—such as integrating into GitHub Actions or GitLab CI—to ensure that only secure images are pushed to production registries, covering OS packages, dependencies, and Dockerfile best practices.

This tool parses Software Bill of Materials (SBOM) in CycloneDX and SPDX formats. It correlates components against the NVD CVE database to identify known supply chain vulnerabilities. Key features include building dependency graphs, calculating transitive risk scores, and generating compliance reports for regulatory assessment.