Skill UI

This skill enables security professionals to conduct authorized assessments on Linux systems, identifying misconfigurations and vulnerabilities that allow privilege escalation from standard users to root. It covers techniques like SUID exploitation, sudo misconfigurations, and cron job hijacking, strictly requiring written authorization and defensive guardrails.

Secure LLM-powered applications against prompt injection, data leakage, and abuse using input validation, output controls, and tenant isolation. Implements OWASP LLM Top 10 mitigations with Python and Node.js examples.

Conduct authorized security assessments for LLM applications and AI agents. Covers prompt injection, tool abuse, RAG exposure, memory poisoning, and system prompt extraction following OWASP LLM/ASI Top 10 guidelines. Includes red-teaming, vulnerability mapping, and compliance engineering for AI systems to ensure safety and robustness.

Logic Lens is an AI-powered code review skill that uses formal logic frameworks to detect bugs, anti-patterns, and security risks beyond linters. It covers 9 risk categories including null handling, type safety, concurrency, and security injection, providing severity-ranked findings with fix suggestions.

Luna is an automated code reviewer focused on correctness, security, and reliability. She evaluates code against blueprints and checklists, identifying critical vulnerabilities like injection flaws, authentication bypasses, and race conditions. Luna acts as a quality gate, ensuring no unresolved high-risk issues proceed to QA or deployment. She excludes style preferences, focusing only on measurable risks to maintainability and safety.

This skill enables developers to override Markstream node renderers and add trusted custom tags across Vue, React, Svelte, and Angular. It allows scoped or renderer-local mappings without replacing the parser. Useful for customizing built-in elements or rendering specific tags like thinking. It emphasizes security by treating custom tags as trusted input and maintaining safe HTML policies.

Comprehensive hardening guide for Model Context Protocol (MCP) servers, covering transport encryption, mTLS, authentication, authorization, input validation, and audit logging to secure AI agent integrations.

This skill enables security auditing of meme coins and tokens on EVM and Solana blockchains. It identifies critical vulnerabilities like hidden mint functions, honeypot transfer restrictions, fee manipulation, and liquidity pool drains. Users must obtain explicit authorization before scanning targets to ensure ethical use.

Methodology for detecting client SOC patches, attacker activity, and security-state changes that occur during a red-team engagement. Triggers on recheck failures, timing shifts, new WAF cookies, and lockout anomalies. Provides investigation discipline, WAF-evasion confirmation, and positive finding templates for IR responsiveness.

Authorized Android/iOS reverse engineering and security testing: APK/IPA analysis, runtime instrumentation (Frida/Objection), SSL-pinning and jailbreak/root-detection bypass, per OWASP MASTG.

Secure AI model supply chains with artifact signing, provenance attestation, SBOM generation, dependency controls, and trusted model promotion. Use for verifying model integrity, meeting SLSA/SOC2 compliance, and protecting against tampering and compromised dependencies.

Administer and optimize MySQL/MariaDB databases in production environments. Covers installation, configuration tuning, security hardening, backup strategies using mysqldump or XtraBackup, and source-replica replication setup. Essential for managing relational database deployments and ensuring high availability.