Skill UI

This sophisticated tool automates the security review of serverless functions across major cloud providers, including AWS Lambda, Azure Functions, and GCP Cloud Functions. It systematically identifies critical misconfigurations such as overly permissive IAM execution roles (wildcard actions), hardcoded secrets in environment variables, and potential lack of runtime protections. Ideal for pre-production auditing and compliance checks.

Nikto is a powerful, open-source web server and web application scanner designed for comprehensive vulnerability assessment. It tests over 7,000 potentially dangerous files and checks for critical issues like XSS, SQL injection, outdated versions, and misconfigurations across modern web applications. Ideal for security audit, penetration testing, and validating web server security controls.

This skill provides comprehensive methods for securing Helm chart deployments on Kubernetes. It covers validating chart provenance through signature verification, scanning templates for misconfigurations (using tools like kubesec and checkov), enforcing strict pod/container security contexts, managing secrets via external stores, and implementing precise RBAC controls within CI/CD pipelines. Ideal for compliance and robust security architecture.

A comprehensive playbook for advanced mobile security assessments of iOS applications. Covers both jailbroken and non-jailbroken environments, focusing on critical attack vectors such as keychain extraction, URL scheme hijacking, Universal Links exploitation via AASA misconfigurations, runtime memory manipulation (Frida/Objection), and binary protection analysis.

A comprehensive tool to audit Kubernetes cluster security compliance against the CIS Kubernetes Benchmark. It inspects control-plane components, worker nodes, and cluster policies to identify security misconfigurations (PASS/FAIL/WARN). Essential for establishing security baselines, conducting periodic compliance audits (e.g., SOC 2, PCI DSS), and validating hardening efforts in CI/CD pipelines.

This skill simulates high-impact container breakout techniques, demonstrating how to achieve root compromise on the underlying host operating system. It covers exploiting misconfigurations (e.g., privileged pods, hostPath mounts, exposed Docker sockets) and leveraging known vulnerabilities in runC/containerd, making it essential for authorized penetration testing and assessing the blast radius of a compromised microservice.

A comprehensive, authorized methodology for security assessments covering cloud platforms, container runtimes, and Kubernetes clusters. It guides users through checking critical areas such as IAM privilege escalation, metadata SSRF, container escape paths, and granular RBAC misconfigurations, ensuring testing is systematic and non-destructive.