Skill UI

This skill detects malicious, misspelled, or brand-jacked package names (typosquatting) across major ecosystems (npm, PyPI, crates.io). It uses advanced techniques like edit-distance and keyboard-proximity analysis, powered by tools like typomania and OSSGadget, to flag potential supply chain attacks *before* a dependency is installed. It is essential for implementing robust CI/CD security gates and proactive dependency screening.

This skill guides the end-to-end process of supply chain security by generating standards-compliant Software Bills of Materials (SBOMs) in CycloneDX and SPDX formats. It details using Syft to create inventories, correlating them with vulnerability intelligence via Grype, enforcing CI/CD gates based on severity, and establishing verifiable provenance using Cosign signing. Essential for modern DevSecOps practices.

A powerful CLI and API client for exploring the entire Go ecosystem. It queries pkg.go.dev to provide comprehensive documentation, API references, usage examples, available versions, dependency relationships, and known security vulnerabilities for any Go package or module. Ideal for developers conducting library research, checking compatibility, or auditing dependencies.

A comprehensive guide for threat hunting and detection engineering focused on identifying SSO and OAuth token abuse. It detects 'pass-the-cookie' and session replay attacks where attackers use stolen tokens (like cookies or refresh tokens) to move laterally across federated SaaS platforms (Entra ID, Okta) without needing credentials. Essential for post-incident scope analysis and validating T1550.001 coverage.

NetExec is a powerful, protocol-oriented tool for penetration testing, designed for assessing and exploiting Windows and Active Directory environments. It facilitates lateral movement by authenticating over protocols like SMB, WinRM, LDAP, and MSSQL. Key functions include password spraying, comprehensive network enumeration, command execution, and dumping critical credentials (SAM, LSA, NTDS) during post-exploitation phases.

This skill guides the full lifecycle of threat intelligence processing, transforming raw indicators of compromise (IOCs) from MISP feeds into actionable security detections. It covers feed curation, false positive reduction using warninglists, and automating the generation of high-fidelity rules for Suricata, Sigma, and Wazuh. Use this to mature your MISP instance from a repository into a proactive detection engine.

This PowerShell toolset performs advanced post-exploitation, reconnaissance, persistence, and data exfiltration against Microsoft 365/Entra ID tenants using the Microsoft Graph API. It operationalizes stolen Graph tokens to enumerate users, dump policies, escalate privileges, and search sensitive data across mailboxes, SharePoint, and Teams. Essential for authorized red teaming engagements.

A comprehensive red-teaming skill for assessing the security posture of Retrieval-Augmented Generation (RAG) pipelines. It systematically probes two critical injection surfaces: poisoned retrieved context (indirect prompt injection) and embedding manipulation. Use this skill to validate retrieval guardrails, ensure data leak prevention, and demonstrate vulnerabilities in LLM-powered knowledge assistants.

This comprehensive skill provides a holistic approach to building modern, accessible, and visually stunning user interfaces. It combines the highly accessible components of shadcn/ui (built on Radix UI), the utility-first power of Tailwind CSS, and sophisticated visual design principles (Canvas). Use this when developing complex React applications, implementing full design systems, ensuring responsive layouts across devices, and requiring professional-grade visual compositions, from dashboards to marketing posters. It guarantees consistency, accessibility, and rapid prototyping.

This skill guides the verification of software build provenance and signatures using industry standards like SLSA and Sigstore. It leverages tools like cosign and slsa-verifier to enforce keyless OIDC identity and confirm that artifacts were built by trusted sources without tampering. It is essential for hardening CI/CD pipelines and securing the entire software supply chain against advanced attacks.

Workthreads analyzes a team's coding history across multiple repositories to generate a structured weekly status report. It clusters raw logs into 'work threads' and automatically tags their lifecycle status (new, open loops, closed, reverted). This is essential for leads needing a high-level, actionable summary of project progress, outstanding tasks, and completed features without reading thousands of lines of raw activity.

This skill enables users to upload local images, such as screenshots or before-and-after comparisons, directly to GitHub using the GitHub CLI. It bypasses the lack of a public image upload API by mimicking the web UI's internal attachment flow, generating canonical `user-attachments` URLs. These URLs can then be seamlessly embedded into Pull Requests, Issues, or comments from the terminal.