Skill UI

This skill guides developers through installing the Vercel Command Line Interface (CLI) and configuring secure authentication. It covers multiple setup scenarios, including interactive OAuth login, setting environment tokens for CI/CD pipelines, and linking a local project directory to a specific Vercel project. Essential for initial project setup and ensuring smooth deployments.

Provides a comprehensive, production-ready reference architecture for building complex applications on Vercel using Next.js and TypeScript. It covers modern best practices, including layered directory structure, secure typed environment variable management (Zod), lazy database singleton implementation, API route patterns, and essential Edge Middleware for authentication and routing. Use this guide when starting a new Vercel project or standardizing existing application infrastructure.

Run targeted file path traversal assessments to find directory traversal and LFI vulnerabilities across web parameters, verify exploitation payloads, and document sensitive files exposed via automated fuzzing and manual checks.

Creates isolated git worktrees with prioritized directory discovery, ignore verification, dependency bootstrapping, and clean baseline tests so feature branches launch safely alongside ongoing work.

Guides authors through adapting test-driven development to agent skills documentation, covering when to create skills, required background, directory structure, and how to run pressure scenarios to ensure compliance before publishing.

This script automates the generation of a complete set of favicons (including favicon.ico, various PNG sizes, and SVG) from a single source image. It intelligently detects the project framework (e.g., Next.js, Rails, Gatsby) to place assets in the correct static directory, generates the necessary webmanifest, and updates the project's HTML/layout files with the proper link tags.

This skill analyzes Active Directory (AD) Access Control Lists (ACLs) to detect dangerous misconfigurations. It uses the ldap3 Python library to query domain controllers, parse security descriptors (SDDL), and identify instances where non-privileged users or groups are granted dangerous permissions like GenericAll, WriteDACL, or WriteOwner on sensitive objects. Essential for security incident response and privilege escalation path discovery.

This script provides a comprehensive security assessment of Microsoft Entra ID (Azure AD) identity configurations. It audits for risky authentication policies, overly permissive role assignments, stale accounts, conditional access gaps, and guest user risks using PowerShell and Graph API. Ideal for compliance audits, security posture review, and post-merger security assessments.

This guide details advanced techniques for authorized security assessments, focusing on forced browsing. It helps testers discover hidden administrative pages, unprotected APIs, and configuration files by systematically enumerating URLs and challenging application access control mechanisms. Techniques involve using tools like ffuf and Gobuster for comprehensive path and directory discovery.

This skill details the advanced technique of DCSync, which exploits the Microsoft Directory Replication Service Remote Protocol (MS-DRSR) to impersonate a Domain Controller. It is primarily used in authorized red-teaming and penetration testing to dump sensitive credentials, extract the KRBTGT hash, and ultimately forge Golden Tickets, establishing deep domain persistence. Ideal for security auditors and offensive security professionals.

This skill analyzes Azure AD/Microsoft Entra ID environments to detect illicit OAuth application consent grants. It leverages the Microsoft Graph API and directory audit logs to enumerate permissions, identify overly broad scopes, and flag high-risk applications based on publisher verification status. It is essential for SOC analysts and threat hunters investigating cloud identity security incidents.

This skill details the exploitation of the critical Zerologon vulnerability (CVE-2020-1472) found in the Microsoft Netlogon Remote Protocol. It allows an unauthenticated attacker to compromise a domain controller by resetting its machine account password. The guide covers the complete attack chain, including initial exploitation, credential dumping via DCSync, and subsequent privilege escalation in Active Directory environments. Used exclusively for authorized red teaming and security testing.