Skill UI

Exploits privileged pods, host mounts, runC CVEs, and exposed Docker sockets to break out of a container and reach the underlying host during an authorized container-security assessment. Use when executing an approved breakout test, demonstrating the real impact of a privileged or hostPath workload, or validating that escape mitigations actually hold. Keywords: container breakout, privileged, hostPath, docker.sock, runC CVE-2019-5736, CVE-2024-21626, release_agent, nsenter. Do not use for defensive detection of these techniques - use detecting-container-escape-attempts.

This skill is designed to mitigate false-positive safety triggers from strict AI classifiers (e.g., cyber, bio/chem, reasoning). It operates by making minimal, surgical edits to sensitive phrases, abstracting away specific domains or actions while preserving the original benign intent and structure. It ensures the prompt remains policy-compliant without losing its core purpose, making it ideal for academic or defensive inquiries.

This skill applies Steve McConnell's construction rules to software development tasks. It covers routine design, variable usage, class design, control flow, defensive programming, coding standards, and testing. Use it for disciplined software construction to ensure high-quality code implementation.

This skill provides authorized security techniques for analyzing protected binaries and malware. It is designed for educational purposes, penetration testing, and CTF competitions. Users must confirm written authorization before bypassing protections or extracting data. It focuses on understanding anti-debugging and obfuscation for defensive security research.

This skill empowers you to implement secure backend coding practices, focusing on input validation, authentication, and API security. It covers vulnerability prevention, defensive programming, and secure architecture implementation. Ideal for building security-first applications that resist common attack vectors like SQL injection, XSS, and CSRF. Includes expertise in database protection, secret management, and HTTP security headers.

This guide provides comprehensive techniques for writing highly robust, production-grade Bash scripts. It covers advanced error handling, input validation, and safety best practices essential for building reliable CI/CD pipelines, system administration utilities, and mission-critical automation scripts that must handle edge cases gracefully.

Master essential practices for writing robust, secure, and portable Bash scripts suitable for production environments, CI/CD pipelines, and critical system automation. This guide covers strict error handling, safe argument parsing, input validation, process orchestration, and cross-platform compatibility, ensuring scripts are resilient to unexpected inputs and failures.

A comprehensive, multi-phase workflow designed for creating production-ready Bash scripts. This guide covers the entire development lifecycle, including defensive pattern implementation, structured error handling (traps, retry logic), logging strategies, rigorous unit testing using Bats, and professional documentation. Ideal for system administration, CI/CD automation, and core DevOps scripting.

This skill audits deployed web apps for exposed secrets like hardcoded API keys and tokens in JavaScript or HTML. It checks for publicly reachable config files and security header misconfigurations. It is a defensive, read-only workflow for authorized security reviews to identify potential data leaks without exploiting systems.

Conduct comprehensive security assessments on cloud infrastructure across Azure, AWS, and GCP. Includes identity management testing, S3 enumeration, and service account compromise analysis. Requires explicit authorization and defensive guidance protocols.

This skill enables identification and testing of HTML injection vulnerabilities in web applications to assess security risks. It involves using tools like Burp Suite and understanding HTTP structures. Strictly for authorized security assessments, defensive validation, or educational purposes in controlled environments.

This skill covers identifying and exploiting HTTP request smuggling vulnerabilities (CL.TE, TE.CL, H2.CL, H2.TE). It includes fingerprinting front-end servers, crafting payloads for cache poisoning, and harvesting credentials via backend desyncs. Requires authorization and defensive guidance protocols.