Skill UI

Security guardrails embedded in the mortgage plugin that block prompt injection and social-engineering tricks, stop system prompt extraction, guard PII and pricing logic, enforce workflow phases, and ensure conversational inputs stay within refinance scope.

A comprehensive cybersecurity tool designed to analyze malicious VBA and XLM macros embedded within Microsoft Office documents (Word, Excel, PowerPoint). It facilitates deep forensic investigation by extracting, deobfuscating, and tracing the full attack chain, including identifying auto-execution triggers, payload download URLs, and file writing techniques. Useful for malware analysts investigating phishing campaigns and maldocs.

This tool provides comprehensive security assessments for the entire IoT ecosystem, including physical hardware, embedded firmware, network communications, and cloud APIs. Testers can perform deep dives using hardware debugging (UART/JTAG), firmware extraction and reverse engineering, analyzing protocols (MQTT, CoAP, BLE), and simulating cloud-to-device attacks to identify vulnerabilities across all layers of the smart device stack.

A comprehensive guide detailing advanced offensive fuzzing methodologies. It covers the full lifecycle from target identification (parsers, network protocols, kernels) to tool selection (AFL++, libFuzzer, Honggfuzz, syzkaller), building harnesses, curating seed corpora, executing fuzz campaigns, and finally, performing crash triage and vulnerability analysis. Essential for security researchers and embedded systems developers.

A hands-on methodology for testing IoT and embedded devices, covering hardware reconnaissance, firmware extraction and analysis, bootloader access, runtime exploitation, wireless protocol attacks, companion app review, and cloud API abuse.

Detects hardcoded secrets like API keys, tokens, and passwords embedded in source code, configuration files, or Infrastructure as Code (IaC). Used when an agent can access its codebase to identify security vulnerabilities at rest. Focuses on secrets stored in files rather than runtime leaks.