Skill UI

Automates web application penetration testing by leveraging the penetration-tester plugin to scan OWASP Top 10 threats, suggest exploitation techniques, and produce actionable vulnerability reports for pentest or vulnerability assessment requests.

Automates vulnerability scans for applications and APIs via the security-test-scanner plugin, covering OWASP Top 10, SQL injection, XSS, CSRF, authentication, and authorization weaknesses while generating detailed remediation reports.

Centralizes proven red team methodologies into an automated reconnaissance and vulnerability discovery workflow that sequences asset discovery, live host validation, fingerprinting, content hunting, and exploit surface analysis for bug bounty and defensive assessments.

This skill provides a comprehensive, expert guide to the entire reverse engineering lifecycle. It covers advanced techniques for binary analysis, including static analysis (disassembly, metadata extraction, control flow mapping) and dynamic analysis (API hooking, memory tracing). Mastery includes utilizing industry-leading tools such as IDA Pro, Ghidra, radare2, and specialized frameworks like pwntools and angr. The methodology is structured for secure research, CTF challenges, and vulnerability assessment, emphasizing best practices and ethical use.

Automatically runs the vulnerability-scanner plugin to inspect code, dependencies, and configurations, detecting CVEs and insecure settings before releases and delivering detailed reports with remediation guidance.

Automatically scans code for reflected, stored, and DOM-based XSS risks across HTML, JavaScript, CSS, and URLs, providing reports and safe proof-of-concept payloads for use in reviews, audits, or pre-deployment checks.

Guide to mastering essential security scanning tools for network discovery, vulnerability assessment, web application testing, wireless checks, and compliance reporting, covering selection, configuration, and practical workflows.

Secret Scanner Assistant auto-activates within Security Fundamentals to guide you on secret detection, authentication, validation, secure coding, and vulnerability checks with best practices.

A comprehensive, multi-phase workflow designed for conducting deep security audits across modern web applications and APIs. This bundle guides users through the entire security lifecycle, including reconnaissance, vulnerability scanning (SAST/DAST), specific testing for OWASP Top 10 and injection flaws, specialized API fuzzing, full-scope penetration testing, security hardening, and final risk reporting. Ideal for compliance checks and proactive security enhancement.

Automates the creation and validation of security headers by guiding users through authentication, input validation, secure coding, and vulnerability detection practices within the Security Fundamentals domain.

This skill specializes in transforming theoretical threat models, risk assessments, and business context into concrete, actionable security requirements. It is essential for writing detailed security user stories, defining robust acceptance criteria, building comprehensive security test cases, and ensuring compliance requirement mapping. Use it when bridging the gap between identifying a vulnerability and specifying how the system must be secured.

A specialized skill for conducting comprehensive security audits. It identifies vulnerabilities in code, infrastructure, and dependencies, generating structured reports with severity ratings (CVSS) and detailed remediation guidance. Ideal for SAST scans, penetration testing, DevSecOps pipelines, and compliance checks.