Skill UI

A comprehensive playbook for advanced security testing, focusing on race conditions and TOCTOU (Time-of-check to time-of-use) vulnerabilities in web applications. It guides users to exploit non-atomic, state-changing operations (e.g., coupons, balance deductions, single-use rewards) by sending highly synchronized, parallel requests (including HTTP/2 single-packet attacks). Essential for identifying weaknesses in authorization and transactional integrity.

A comprehensive guide for cryptanalysts detailing advanced attack vectors against RSA cryptography. This playbook covers factorization methods, small exponent exploits (e.g., Hastad Broadcast), lattice-based attacks (Wiener's, Boneh-Durfee), and methods exploiting protocol weaknesses like padding oracles. Essential for CTF challenges and authorized security assessments.

A comprehensive playbook detailing expert techniques to escape multiple types of restricted environments, including Python pyjail, Docker containers, seccomp filters, and browser rendering processes. It covers advanced exploitation vectors like namespace escapes, kernel exploits, and built-in function bypasses for achieving code execution.

A risk-paranoid, mandatory review process designed to interrogate any plan that touches sensitive customer data, regulatory compliance, or production access. It forces consideration of critical security pillars including STRIDE threat modeling, blast radius quantification, detection mechanisms (MTTD), incident response runbooks, regulatory notification windows, and third-party vendor security posture. Essential before deploying features handling PII, PHI, or before compliance audits (SOC 2, HIPAA, GDPR).

A comprehensive simulation tool designed to pressure-test medical device manufacturers' Quality System Regulation (QSR) compliance against FDA standards (21 CFR 820). It covers six critical areas: complaint handling, process validation, device history records (DHRs), CAPAs, labeling, and handling of Form 483 observations. Essential for pre-inspection readiness, internal audits, and regulatory submission planning.

A comprehensive guide for securing container images and runtime environments. Covers best practices from Dockerfile authoring (minimal base images, multi-stage builds, non-root users) through advanced runtime enforcement (seccomp, AppArmor) and Kubernetes security controls. Essential for production hardening and maintaining supply chain integrity.

This skill provides comprehensive management for Opencode's permission system. It allows users to review currently always-allowed commands, suggest safe read-only commands, and configure granular access controls using allow/deny/ask patterns. It is essential for optimizing security, performing system audits, and managing the operational scope of the agent.

This guide provides comprehensive details on the OpenPitrix application management system within KubeSphere. It covers the entire application lifecycle, including managing app repositories (Repo), uploading and versioning templates (Application/ApplicationVersion), conducting review processes, and finally deploying/upgrading applications (ApplicationRelease). Use this skill when troubleshooting App Store interactions, understanding KubeSphere's backend APIs, or managing deployed workloads.

This skill generates a comprehensive capacity plan document for any service. It assists technical teams in proactively managing infrastructure by modeling traffic growth, forecasting resource utilization (CPU, memory, connections), projecting costs, and defining clear scaling strategies. Use this when assessing current resource headroom, planning for seasonal peaks, or defining a long-term infrastructure action roadmap.

This guide helps define a complete observability stack for any service. It systematically covers the Four Golden Signals (latency, traffic, errors, saturation), guiding users to define core metrics, set Service Level Objectives (SLOs), configure actionable alerting rules, and structure comprehensive monitoring dashboards. Essential for establishing robust SRE practices and documenting system health standards.

A comprehensive guide for defense contractors handling Controlled Unclassified Information (CUI). It covers preparing for CMMC Level 2 certification, implementing 110 NIST SP 800-171 controls, calculating the SPRS score using DoD methodology, and managing the POA&M and SSP. Essential for DFARS compliance and external assessments.

This skill guides the comprehensive hardening of LDAP directory services. It addresses common vulnerabilities such as LDAP injection, anonymous binding, and credential harvesting. Users can enforce strong security controls, including LDAPS, channel binding, and granular access control lists (ACLs). It is essential when establishing robust identity access management (IAM) architecture or meeting stringent compliance requirements like NIST standards.