Skill UI

Use Anchore Grype to scan container images, archives, and SBOMs for known CVEs, enforce severity thresholds, and integrate results into CI/CD pipelines for consistent container security posture.

Guide to configure and run Nessus scans across servers, workstations, and network devices, covering policy creation, credentialed and unauthenticated checks, REST automation, and result analysis for continual vulnerability management.

Checks Android IPC through intents to find vulnerabilities such as intent injection, unauthorized component access, broadcast sniffing, pending intent hijacking, and content provider leaks by enumerating exported components and exercising them via Drozer, Frida, and ADB.

Automates API testing for mass assignment vulnerabilities by identifying writable endpoints, injecting privileged parameters (e.g., role, isAdmin, balance), and verifying whether the server binds them without filtering, helping defenders confirm Broken Object Property Level Authorization risks before deployment.

Test JWT implementations for algorithm confusion, none bypass, kid/jku injections, and weak secrets to validate authentication and privilege controls during security assessments.

A comprehensive skill for identifying and exploiting Cross-Site Scripting (XSS) vulnerabilities in web applications. It systematically tests reflected, stored, and DOM-based contexts by injecting various JavaScript payloads. The process involves mapping all user input points, identifying output contexts (HTML body, attribute, JS string, etc.), and crafting payloads to bypass sanitization and Content Security Policy (CSP) protections, simulating real-world attacks like session hijacking and credential theft.

Use CISA's SSVC decision tree to prioritize vulnerabilities, combining exploitation data, impact, automatability, and mission context to drive actionable remediation schedules.

Guides Golang dependency management from go.mod/go.sum upkeep to upgrades, vendoring, vulnerability scans, and automated updates with Dependabot/Renovate, plus conflict and workspace handling so agents keep builds secure and reproducible.

Guides learners through reconnaissance, scanning, vulnerability analysis, exploitation, and reporting phases of authorized penetration testing, pairing command examples with tool choices and professional deliverables.

Covers comprehensive HTML injection attack scenarios, detection tips, and tooling so security testers can validate and document injection points, phishing overlays, and reflected or stored payloads during vulnerability assessments.