Skill UI

A comprehensive guide for performing authorized security assessments on GraphQL APIs. This skill covers key areas such as endpoint discovery, schema introspection, testing for authorization flaws (BOLA/BFLA), injection vulnerabilities (SQL/NoSQL), and denial-of-service risks. Essential for penetration testers and bug bounty researchers targeting modern web applications.

Provides a comprehensive guide to auditing the security posture of the etcd cluster, the critical key-value store backing Kubernetes. This assessment covers encryption at rest for secrets, TLS transport security, access control policies, secure backup procedures, and network isolation best practices. Essential for hardening control planes and ensuring regulatory compliance.

A comprehensive guide to analyzing volatile memory (RAM) dumps using the Volatility 3 framework. This skill enables the extraction of crucial digital evidence, including running processes, network connections, loaded modules, credentials, and encryption keys. It is essential for incident response, detecting rootkits, process hollowing, or identifying malware when traditional disk-based forensics are insufficient.

This comprehensive guide details the end-to-end process of conducting wireless security assessments. It covers passive reconnaissance, capturing WPA/WPA2 handshakes, cracking keys using Aircrack-ng and Hashcat, simulating Evil Twin attacks, detecting rogue access points, and testing network segmentation. It is essential for organizations validating their WiFi infrastructure security.

This comprehensive guide teaches advanced iOS reverse engineering techniques using Frida dynamic instrumentation. Users can analyze proprietary app logic, extract encryption keys, trace method calls, and bypass anti-tampering or anti-debugging mechanisms without needing source code. It is essential for authorized mobile security testing and protocol analysis.

A comprehensive security script designed to test REST API authentication mechanisms for common vulnerabilities. It assesses broken token validation, missing authentication on critical endpoints, weak password policies, and session management flaws. The tool specifically evaluates JWT implementation, API key handling, and adherence to OWASP API Security Top 10, helping identify authentication bypasses before production deployment.

This skill details the deployment of various canary tokens (DNS, HTTP, AWS API Keys) across enterprise network infrastructure. It establishes digital tripwires that detect behavioral anomalies, such as unauthorized access, credential leakage, or lateral movement. Tokens are configured with webhook alerts (Slack, SIEM) for real-time, low-false-positive notification, significantly enhancing traditional IDS/IPS capabilities.

This comprehensive skill provides a systematic framework for performing deep security assessments on iOS applications. It covers static analysis of IPA packages, dynamic instrumentation using Frida and Objection, SSL pinning bypass for traffic interception, extraction and auditing of sensitive data from the Keychain, and runtime method hooking. Use this for authorized penetration testing against standards like OWASP MASTG.

This guide details how to implement secure, keyless software signing using the Sigstore ecosystem components (Cosign, Fulcio, Rekor). It establishes cryptographic provenance for container images and binaries by binding identity via OIDC, ensuring verifiable integrity and tamper-proofing throughout the CI/CD supply chain.

This skill activates the P7 Senior Engineer mode, designed for rigorous, solution-driven execution under P8 supervision. It is used when the user explicitly requests 'P7模式' or when invoked as a sub-task executor by P8. The process involves three key stages: designing a detailed implementation plan and impact analysis, executing the core coding, and finally, completing a mandatory three-question self-review, ensuring high quality and comprehensive verification.

A comprehensive guide for diagnosing production performance issues in Qdrant vector databases. Learn how to systematically check the optimizer status, analyze high memory usage (OOM crashes), and troubleshoot slow query latencies using key metrics and dedicated API endpoints. Essential for maintaining optimal operational health.

This guide details securing the CAST AI integration across multiple layers. It covers best practices for API key management (including rotation and secrets storage), implementing least-privilege RBAC using 'kubectl', deploying the Kvisor security agent for runtime scanning, and setting up Kubernetes Network Policies to restrict egress traffic. Use this when hardening production clusters or performing security audits.