Skill UI

A comprehensive checklist and methodology for penetration testing file upload endpoints. Covers critical vulnerabilities such as MIME type bypass, extension bypass, magic byte manipulation, path traversal, and stored XSS. Essential for web application security assessment and bug bounty hunting, guiding testers through basic testing to advanced exploitation techniques like Null Byte injection and double extensions.

This playbook is designed for advanced vulnerability assessment, covering flaws invisible to automated scanners. It guides testing for race conditions, complex workflow bypasses, state machine manipulation, financial parameter tampering (e.g., price/quantity manipulation), and coupon/credit abuse in multi-step applications. Essential for deep manual security testing.

An expert playbook for identifying and simulating dependency confusion attacks in software supply chains. It comprehensively covers how internal package names can be squatted on public registries, leading to malicious code execution via package manager lifecycle hooks (e.g., npm, pip, Maven). Use this guide for authorized red-team exercises and deep vulnerability assessment of build processes.

This skill runs the Bumblebee scanner on macOS/Linux to perform read-only inventory and exposure checks. It detects compromised packages, developer tools, and host configurations against known security advisories. It is primarily used for supply-chain incident response and vulnerability assessment, providing developers with a clear picture of local system exposure.

This skill provides a comprehensive solution for monitoring brand impersonation attacks across multiple digital vectors. It systematically scans domains, social media platforms, mobile app stores, and the dark web to detect phishing campaigns, typosquatting, and unauthorized brand usage. It is essential for security teams conducting proactive threat intelligence gathering and vulnerability assessments to safeguard brand integrity.

A specialized downstream skill for CTF-sandbox workflows. Used to analyze complex security challenges driven by AI agent interactions, prompt injection, or infrastructure vulnerabilities. Focuses on tracing control chains involving untrusted input, tool side effects, deployment drift, container runtime issues, and CI/CD supply chain provenance. Ideal for rigorous vulnerability assessment in modern, distributed systems.

This skill provides an active penetration testing toolchain covering information gathering, port scanning, vulnerability scanning, web attacks (SQL injection, XSS), directory brute-forcing, and password cracking. It exposes 20+ security tools to AI agents via MCP servers for authorized security assessments.