Skill UI

This skill specializes in transforming theoretical threat models, risk assessments, and business context into concrete, actionable security requirements. It is essential for writing detailed security user stories, defining robust acceptance criteria, building comprehensive security test cases, and ensuring compliance requirement mapping. Use it when bridging the gap between identifying a vulnerability and specifying how the system must be secured.

This skill enables comprehensive SQL injection vulnerability assessments on web applications to identify database security flaws and validate input sanitization. It supports detection of in-band, blind, and out-of-band attack vectors. Users can demonstrate exploitation techniques and extract data for authorized security testing purposes only. Requires explicit written permission before execution.

This skill enables comprehensive security assessments of SSH services. It covers enumeration, credential attacks, vulnerability exploitation, and configuration auditing using tools like Nmap, Hydra, and Metasploit. Suitable for authorized penetration testing and security research to identify weaknesses in SSH implementations.

This skill covers comprehensive software supply chain security assessments, including SBOM generation, SCA scanning, CI/CD pipeline reviews, and container image audits. It focuses on verifying build integrity, dependency provenance, and vulnerability reachability to ensure secure software delivery and mitigate supply chain risks.

This skill enables authorized security testing of desktop thick clients. It focuses on local storage, update channels, IPC, traffic interception, and client-side trust-boundary review. Techniques include reverse engineering, network analysis, and vulnerability assessment for C/S architectures like Electron or .NET.

Provides a structured reference for the 100 most critical web application vulnerabilities. Enables systematic vulnerability identification, impact assessment, and remediation guidance. Suitable for authorized security assessments and educational purposes.

A security assessment skill that enforces a 7-question validation gate before submitting any vulnerability finding, ensuring only confirmed, in-scope, high-impact issues are reported. It provides a structured decision framework to kill false positives, verify authorization, and avoid known invalid bug classes.

Scan systems and dependencies for CVEs and security vulnerabilities using industry-standard tools like Nessus, OpenVAS, and Nuclei. Supports Docker deployment, API integration, and template-based scanning for infrastructure and application security assessments. Requires authorized scope and explicit permission before execution.

A comprehensive skill for conducting client-side injection vulnerability assessments on web applications. It identifies XSS and HTML injection flaws, demonstrates exploitation techniques for session hijacking and credential theft, and validates input sanitization and output encoding mechanisms. Includes practical examples and strict safety guardrails.