Skill UI

This tool parses Software Bill of Materials (SBOM) in CycloneDX and SPDX formats. It correlates components against the NVD CVE database to identify known supply chain vulnerabilities. Key features include building dependency graphs, calculating transitive risk scores, and generating compliance reports for regulatory assessment.

A guide for security researchers focused on finding exploitable, remote-reachable vulnerabilities for bug bounties or responsible disclosure. It emphasizes high-signal flaws such as SSRF, RCE, and SQL injection, while guiding users through the professional triage and PoC creation process for penetration testing.

A comprehensive guide for setting up production-grade CI/CD pipelines for Go projects using GitHub Actions. This skill covers essential quality gates including unit testing, linting (golangci-lint), static analysis security testing (SAST), vulnerability scanning, dependency management, Docker builds, and automated releases using GoReleaser.

This skill enforces best practices for managing Go modules, focusing on stability, security, and maintainability. It guides users through essential workflows like dependency addition, safe upgrading (e.g., patch updates), cleanup (go mod tidy), and critical vulnerability scanning (govulncheck). Use this when initializing, updating, or auditing a Go project's dependency tree to ensure supply chain safety.

This skill guides users through advanced security auditing and best practices for Golang development. It acts as a senior security engineer, focusing on defense in depth by analyzing critical areas like injection patterns, cryptography, secrets management, and authorization flaws. It supports full codebase audits (using STRIDE and DREAD scoring) and precise PR vulnerability reviews, ensuring secure and resilient Go applications.

Guides learners through reconnaissance, scanning, vulnerability analysis, exploitation, and reporting phases of authorized penetration testing, pairing command examples with tool choices and professional deliverables.

Covers comprehensive HTML injection attack scenarios, detection tips, and tooling so security testers can validate and document injection points, phishing overlays, and reflected or stored payloads during vulnerability assessments.

This comprehensive guide details how to configure and manage GitHub Dependabot. It covers everything from setting up initial dependency updates (npm, pip, docker, etc.) to advanced strategies like monorepo glob patterns, cross-directory grouping, and multi-ecosystem updates. Learn how to automate dependency vulnerability detection and version upgrades efficiently.

This skill provides a comprehensive framework for conducting high-quality code reviews. It guides developers through checking code across four critical dimensions: Correctness (functional accuracy and edge cases), Maintainability (readability and documentation), Performance (efficiency and resource usage), and Security (input validation and vulnerability management). It also emphasizes providing actionable, constructive, and empathetic feedback.

This skill guides the comprehensive process of crash triage, enabling the assessment of vulnerability exploitability. It covers advanced techniques using debuggers (WinDbg/GDB), sanitizers (ASAN/MSAN), and interpreting low-level data like stack traces and register dumps. It is essential for vulnerability researchers analyzing crash dumps or fuzzer-generated failures to identify root causes and potential attack vectors.

This is a detailed offensive checklist for identifying and exploiting insecure deserialization vulnerabilities across multiple programming languages (Java, Python, PHP, .NET, Node.js, etc.). It covers techniques like gadget chain generation, magic method abuse, type confusion, and modern attack vectors, providing a deep methodology for penetration testing and vulnerability research.

This comprehensive curriculum provides a detailed roadmap for mastering exploit development and vulnerability research. It covers fundamental techniques like fuzzy testing using AFL++, and progresses through advanced topics such as in-process fuzzing with Google FuzzTest. It is ideal for structuring professional security training programs or onboarding new research engineers.