Skill UI

Offensive cloud security methodology for AWS, Azure, and GCP. Covers identity discovery, credential harvesting, enumeration, privilege escalation, persistence, data exfiltration, lateral movement, serverless abuse, Kubernetes paths, and detection evasion during authorized assessments.

A comprehensive expert playbook detailing advanced Large Language Model (LLM) prompt injection techniques. Covers direct methods (instruction override, role play), indirect attacks (RAG poisoning, web data manipulation), and sophisticated tool/function calling abuse for data exfiltration and security bypass. Essential for rigorous AI application security testing.

This skill audits the security and integrity of legal AI components, including skills, prompts, workflows, and tools. It proactively detects prompt injection, malicious code, data exfiltration paths, and supply-chain risks before deployment or trust. Essential for maintaining confidentiality, privilege, and adhering to legal standards in AI environments.

Secure AI agents against prompt injection, tool abuse, and data exfiltration with defense-in-depth controls, input validation, sandboxing, and audit logging.

This skill enables structured AI red team exercises to evaluate model resilience against jailbreaks, data exfiltration, and harmful outputs. It helps identify exploitable failure modes before attackers do, suitable for new LLM features, third-party model evaluation, and compliance audits. Includes adversarial prompt libraries and automated testing scripts for security assessments.

This skill helps secure Large Language Model (LLM) and AI deployments against various threats including prompt injection, data exfiltration, model theft, and supply chain attacks. It covers implementing guardrails, output filtering, PII scrubbing, and API security measures to ensure compliance with standards like SOC2 or ISO 27001.

This skill focuses on identifying security vulnerabilities in Large Language Model (LLM) and AI features. It covers prompt injection, system prompt leakage, cross-tenant access, and data exfiltration techniques. Users must verify findings against false positives using reproducibility checks and out-of-band callbacks before reporting.

Detects data exfiltration via URL path encoding and chained web_fetch navigation, covering fake trusted UI injection, indirect prompt injection, letter-level path exfiltration, and multi-hop navigation hijacking in agent memory/context scenarios.