Skill UI

This toolkit provides comprehensive offensive and administrative capabilities for Microsoft Entra ID, Azure AD, and AD FS. It allows authorized penetration testers to perform unauthenticated reconnaissance, acquire various access tokens, and critically, test for federation backdoors (Golden SAML). It is essential for validating identity-attack resilience and producing detailed hardening recommendations during red-team engagements.

kube-bench is an open-source tool that validates the compliance and security posture of Kubernetes clusters. It rigorously checks control-plane components, worker nodes, and cluster policies against the comprehensive CIS Kubernetes Benchmark. It reports findings (PASS/FAIL/WARN) and includes specific remediation guidance, making it essential for compliance auditing and hardening efforts.

Falco is a powerful CNCF project for real-time runtime security monitoring. This guide teaches authors how to write and deploy custom detection rules using Falco's robust YAML rule engine and modern eBPF driver. It is designed to detect critical threats such as container escapes, namespace manipulation, privileged mounts, and anomalous syscalls in Kubernetes and Docker environments, significantly hardening the overall container security posture.

This skill provides a comprehensive, cross-platform workflow for auditing UEFI firmware security. It detects advanced threats like bootkits (e.g., BlackLotus, Bootkitty) and Secure Boot bypasses by verifying the integrity of the platform's trust chain. Key checks include confirming Secure Boot status, assessing the currency and application of DBX revocations, and examining the protection of critical EFI variables using specialized tools. Essential for hardware security assessments and forensic investigation.

This skill guides the secure migration from classical cryptography (RSA, ECC) to quantum-resistant algorithms (PQC). It covers building a Cryptographic Bill of Materials (CBOM), identifying data at risk (HNDL), and deploying hybrid key exchange protocols like X25519MLKEM768 to ensure long-term data security against quantum threats.

Trivy is an open-source, comprehensive scanner used to find vulnerabilities (CVEs), misconfigurations, secrets, and license issues across multiple targets. It is essential for implementing 'shift-left' security gates in CI/CD pipelines, scanning container images, Infrastructure-as-Code (IaC) like Terraform/Kubernetes, and generating/re-scanning SBOMs for supply chain transparency.

Run comprehensive, read-only exposure checks against your local machine or project directories in response to security advisories and CVEs. This tool systematically checks various ecosystems (Node.js, Python, Homebrew, etc.) to generate a structured, non-invasive audit report, helping users understand their actual risk exposure without making any system changes.

This skill provides comprehensive operational controls for long-lived, cloud-hosted agent workloads. It manages the entire lifecycle—from deployment and scaling to observability and security. Features include detailed monitoring (logs, metrics, traces), safety controls (kill switches, least privilege), and robust change management processes (rollout, rollback, auditing). Ideal for mission-critical microservices and background agents.

This skill guides the planning and review process for complex home or small-lab network changes. It covers creating staged migration plans for VLAN segmentation, implementing local DNS resolvers (like Pi-hole), setting up secure VPN access, and ensuring network safety through detailed inventory checks and rollback procedures. It emphasizes security best practices and trust zoning.

A comprehensive guide on segmenting a home network using VLANs to dramatically enhance security. Learn how to isolate different device types—such as IoT gadgets, guests, and servers—from main PCs, preventing cross-segment malware spread and unauthorized communication. Covers setup steps for UniFi, pfSense, and OPNsense.