Skill UI

A specialized security testing skill designed to identify excessive data exposure in REST or GraphQL APIs, adhering to OWASP API3:2023 guidelines. It works by intercepting raw API responses and systematically comparing the returned data against what the frontend UI actually displays. This helps auditors detect leaked PII, internal identifiers, debug fields, or other sensitive business data that should have been filtered out by the endpoint response. Use cases include auditing microservice boundaries, assessing mobile API responses designed for multiple clients, and verifying proper respons...

This tool builds a tamper-evident, append-only log chain using SHA-256 hash chaining. By incorporating the previous entry's hash into the current entry, any modification to an old log entry will invalidate all subsequent hashes, enabling pinpoint tamper detection. It supports various log formats (syslog, JSON, plain text) and is essential for compliance, digital forensics, and verifying log authenticity in security operations.

This skill covers performing comprehensive vulnerability assessments across diverse environments, including on-premises infrastructure, cloud VMs, and container registries. It leverages standard network protocols like SSH (Linux) and WMI (Windows), coupled with advanced cloud provider APIs for analyzing disk snapshots without requiring local endpoint agents. Ideal for security auditing and compliance checks.

This guide details how to configure and execute deep, authenticated vulnerability scans using OpenVAS/Greenbone Vulnerability Management (GVM). By utilizing valid credentials (SSH, SMB, or ESXi), users can log into target systems to detect local vulnerabilities, missing security patches, and misconfigurations, which are typically missed by unauthenticated scans. Essential for professional security auditing and penetration testing.

This tool audits Kubernetes pod configurations to detect potential container escape misconfigurations. It checks for dangerous settings like privileged flags, excessive capabilities, host path mounts, shared namespaces, and cgroup abuses. Use it for comprehensive security assessments, compliance checking, or generating pre-enforcement security posture reports.

This skill guides users through advanced container security practices using Trivy. It covers vulnerability scanning for container images, filesystems, IaC (Terraform, K8s), and Git repositories. Key features include generating industry-standard SBOMs (CycloneDX/SPDX), integrating scanning into CI/CD pipelines, and deploying the Kubernetes Operator for comprehensive supply chain security and compliance auditing.

This skill provides a comprehensive guide to systematic dark web monitoring, involving scanning underground forums, paste sites, and marketplaces for organizational threats. It covers setting up Tor-based crawling, automating credential leak detection (e.g., HIBP integration), and analyzing threat intelligence (CTI) using Python. Essential for proactive incident response and security auditing.

This skill details advanced techniques for performing stealthy lateral movement across Windows domains using Windows Management Instrumentation (WMI). It covers the abuse of native tools like Impacket's wmiexec.py and CrackMapExec, enabling remote command execution, Pass-the-Hash attacks, and fileless techniques, crucial for authorized red team engagements and security auditing.

This automated toolkit streamlines memory forensics using the Volatility3 framework. It is designed to analyze raw memory dumps from Windows, Linux, and macOS, revealing complex threats such as process injection, hidden rootkits, malicious code artifacts, and illicit network connections that traditional disk-based methods cannot detect. Essential for real-time incident response and deep security auditing.

A comprehensive security tool designed to simulate and detect critical software supply chain attacks. It identifies risks such as typosquatting via Levenshtein distance, dependency confusion against private registries, package integrity failures through SHA-256 hash verification, and known vulnerabilities using pip-audit. Essential for security auditing and assessing project dependency risk.

A comprehensive guide detailing systematic steps to remediate Amazon S3 bucket misconfigurations that expose sensitive data. Procedures include enabling S3 Block Public Access, auditing and restricting overly permissive policies and ACLs, enforcing default server-side encryption (KMS/AES-256), and using AWS Config/Security Hub for automated compliance checks. Essential for achieving robust cloud storage security compliance.

A comprehensive security tool designed to detect prompt injection attacks targeting Large Language Models (LLMs). It employs a multi-layered approach combining regex signature matching, structural anomaly scoring, and advanced DeBERTa transformer classification. It is essential for securing input validation layers in chatbots, AI agents, and RAG pipelines, and for retrospectively auditing LLM interaction logs against OWASP standards.