Skill UI

This skill provides comprehensive security auditing for Model Context Protocol (MCP) servers and their associated tool metadata. It is designed to detect sophisticated supply chain attacks, including tool poisoning (indirect prompt injection), Server-Side Request Forgery (SSRF), tool shadowing, and unauthenticated exposure. It is essential for securing AI agent stacks before integrating new tools or during CI/CD processes.

Plaso (log2timeline) is an open-source engine used to generate forensic super-timelines. This skill guides the process of normalizing hundreds of diverse artifact types—including MACB times, registry keys, EVTX logs, and browser history—into a single, cohesive chronological view. The workflow covers extraction, filtering, and importing the timeline into Timesketch for collaborative analysis, which is crucial for incident response, correlating complex activity chains, and detecting anti-forensic techniques like timestomping.

Automate security regression testing for Large Language Model (LLM) applications by integrating Promptfoo and DeepTeam into CI/CD pipelines. This skill enforces a critical security gate, automatically testing endpoints against OWASP LLM Top 10, OWASP Agentic threats, and common jailbreaks/prompt injections. It ensures that security patches do not regress over time due to prompt or model changes, providing continuous risk monitoring.

This skill guides the deployment and strategic use of honeytokens and canarytokens (decoy credentials, files, URLs, etc.). These high-fidelity decoys are designed to detect unauthorized access, insider threats, or adversary reconnaissance by triggering alerts upon any interaction, providing early warning deep within the kill chain.

A comprehensive tool and methodology for identifying and preventing dependency confusion attacks across major package ecosystems (npm, PyPI, Maven). It detects instances where internal, private package names are leaked and subsequently published publicly by attackers. The skill provides both detection (enumerating claimable internal names) and prevention strategies (enforcing registry pinning and scope restrictions) to secure the software supply chain.

Provides a comprehensive workflow and tooling (GuardDog) to triage npm packages and dependency trees for signs of malicious activity. It focuses on static analysis of install scripts, detecting credential exfiltration, reverse shells, and worming behavior, thereby safeguarding against software supply-chain attacks.

This skill detects malicious, misspelled, or brand-jacked package names (typosquatting) across major ecosystems (npm, PyPI, crates.io). It uses advanced techniques like edit-distance and keyboard-proximity analysis, powered by tools like typomania and OSSGadget, to flag potential supply chain attacks *before* a dependency is installed. It is essential for implementing robust CI/CD security gates and proactive dependency screening.

Pacu is an open-source, modular AWS exploitation framework designed for authorized cloud penetration testing and red-teaming. It functions as a cloud-pentest analogue to Metasploit, enabling users to enumerate AWS resources, scan for privilege escalation paths, and automate the exploitation of IAM vulnerabilities, persistence mechanisms, and data exfiltration. Use this skill to assess the blast radius of compromised credentials in a controlled, authorized environment.

This skill guides the end-to-end process of supply chain security by generating standards-compliant Software Bills of Materials (SBOMs) in CycloneDX and SPDX formats. It details using Syft to create inventories, correlating them with vulnerability intelligence via Grype, enforcing CI/CD gates based on severity, and establishing verifiable provenance using Cosign signing. Essential for modern DevSecOps practices.

A comprehensive guide for threat hunting and detection engineering focused on identifying SSO and OAuth token abuse. It detects 'pass-the-cookie' and session replay attacks where attackers use stolen tokens (like cookies or refresh tokens) to move laterally across federated SaaS platforms (Entra ID, Okta) without needing credentials. Essential for post-incident scope analysis and validating T1550.001 coverage.

NetExec is a powerful, protocol-oriented tool for penetration testing, designed for assessing and exploiting Windows and Active Directory environments. It facilitates lateral movement by authenticating over protocols like SMB, WinRM, LDAP, and MSSQL. Key functions include password spraying, comprehensive network enumeration, command execution, and dumping critical credentials (SAM, LSA, NTDS) during post-exploitation phases.

This skill guides the full lifecycle of threat intelligence processing, transforming raw indicators of compromise (IOCs) from MISP feeds into actionable security detections. It covers feed curation, false positive reduction using warninglists, and automating the generation of high-fidelity rules for Suricata, Sigma, and Wazuh. Use this to mature your MISP instance from a repository into a proactive detection engine.