Skill UI

Scans FunC-based TON smart contracts for boolean, Jetton, and gas handling vulnerabilities, reporting critical issues with file references and offering remediation guidance for auditors and secure dApp launches.

This skill establishes a rigorous framework for building deep architectural context by performing ultra-granular, line-by-line analysis of code. It applies methodologies like First Principles and 5 Whys to maintain a stable, evolving mental model of the entire system, making it essential for pre-vulnerability security auditing, threat modeling, and complex architecture reviews.

A rigorous framework designed to audit GitHub Actions workflows for exploitable security vulnerabilities. This skill focuses strictly on real-world attack patterns, requiring every identified finding to include a concrete exploitation scenario (Entry Point, Payload, Impact). Ideal for securing CI/CD pipelines against external attackers.

A systematic skill for identifying similar vulnerabilities and bugs across large, complex codebases. It guides the user through generalizing initial bug patterns using techniques like CodeQL and Semgrep, ensuring comprehensive security audits beyond the initially discovered flaw. Ideal for advanced security research and robust code auditing.

Guides security teams through Active Directory vulnerability assessments with PingCastle health checks, BloodHound attack-path mapping, and Purple Knight scoring to spot misconfigurations, privilege escalation paths, and Kerberos lateral-movement weaknesses in enterprise domains.

Performs credentialed vulnerability scans with Nessus, Qualys, and similar tools to log into hosts, inspect installed software, patches, and settings, and validate controls during assessments, incident response, or audits.

Simulates and detects software supply chain attacks by checking typosquatting risks with Levenshtein distance, probing dependency confusion across registries, verifying package hashes, and running pip-audit vulnerability scans for security assessments.

Comprehensive guide for managing Go project dependencies, covering best practices for adding, upgrading, and removing packages. It emphasizes critical security practices like vulnerability scanning (govulncheck), supply chain verification (go mod verify), and maintaining clean module files (go mod tidy). Use this when auditing security, refactoring dependencies, or ensuring build reproducibility.

A comprehensive skill set for senior Go security engineers, providing structured methodologies for identifying and mitigating vulnerabilities. It teaches defense-in-depth principles, utilizes Threat Modeling (STRIDE), and scores risks using DREAD. Modes include detailed Review (PR security checks), full Audit (parallel vulnerability scanning), and Coding (secure implementation). Essential for auditing, reviewing, or developing any Go application that handles sensitive data.

A comprehensive, expert playbook for challenging insecure file upload mechanisms. It provides advanced attack vectors covering validation bypass (magic bytes, extension), storage path abuse (traversal, overwrite), and exploitation of post-upload processing chains (XXE, RCE, CMDi). Essential for deep security auditing of file-handling workflows.