Skill UI

This skill provides comprehensive methods and frameworks to detect sophisticated AI attacks, including model extraction, membership inference, and model inversion, which abuse inference APIs. It focuses on monitoring per-principal query volume, input distribution, and confidence exposure. Use it for securing public or partner inference APIs, or for conducting pre-deployment red-teaming to assess the model's extractability and overall security posture against MITRE ATLAS techniques.

Exploits privileged pods, host mounts, runC CVEs, and exposed Docker sockets to break out of a container and reach the underlying host during an authorized container-security assessment. Use when executing an approved breakout test, demonstrating the real impact of a privileged or hostPath workload, or validating that escape mitigations actually hold. Keywords: container breakout, privileged, hostPath, docker.sock, runC CVE-2019-5736, CVE-2024-21626, release_agent, nsenter. Do not use for defensive detection of these techniques - use detecting-container-escape-attempts.

Hayabusa is a specialized threat-hunting and fast-forensics tool designed to analyze Windows EVTX event logs. It applies a comprehensive library of Sigma detection rules to raw log data, generating a single, prioritized, chronological timeline. The output includes severity levels, MITRE ATT&CK mappings, and detailed metrics, enabling analysts to perform rapid, SIEM-free incident triage and export results for collaborative analysis.

This skill provides comprehensive, read-only access to the pkg.go.dev API using the `godig` tool. It allows users to query detailed information about Go packages and modules, including full documentation, API signatures, available versions, dependency graphs, and known security vulnerabilities. It is essential for researching the external Go ecosystem and comparing library metadata.

GraphRunner is a powerful PowerShell toolset built on the Microsoft Graph API, designed for authorized red-teaming engagements against M365/Entra ID tenants. After obtaining a valid Graph token, it enables reconnaissance, establishes persistence (e.g., injecting OAuth apps and inbox rules), performs privilege escalation, and exfiltrates sensitive data from mailboxes, SharePoint, and Teams. Use only in authorized testing environments.

NVIDIA garak is an open-source LLM vulnerability scanner designed for comprehensive red-teaming and security assessment. It systematically probes large language models (via OpenAI-compatible APIs, Hugging Face, etc.) using thousands of adversarial prompts. It covers critical vulnerabilities such as prompt injection, jailbreaking, data leakage, and toxicity. Use this tool to establish a repeatable security baseline before or after deployment, validate the effectiveness of safety guardrails, or generate quantitative evidence for AI risk assessments.

Detailed methods for red-teaming and penetration testing of LLM applications. This skill extracts sensitive system prompts, secrets, and embedded logic using advanced techniques like jailbreaking, encoding tricks, and automated scanners (Garak, Promptfoo), ensuring compliance with OWASP LLM07:2025.

KAPE (Kroll Artifact Parser and Extractor) is a specialized, rapid triage tool for incident response. It collects specific, volatile forensic artifacts (like registry hives, event logs, and browser data) from compromised Windows systems. It is designed for remote, at-scale artifact collection when full disk imaging is impractical, enabling analysts to quickly build a defensible, parseable dataset for initial investigation and containment.

This skill enables users to upload local images, such as screenshots or before-and-after comparisons, directly to GitHub using the GitHub CLI. It bypasses the lack of a public image upload API by mimicking the web UI's internal attachment flow, generating canonical `user-attachments` URLs. These URLs can then be seamlessly embedded into Pull Requests, Issues, or comments from the terminal.

Run open-source molecular design and structural biology tools on Tamarind Bio's managed cloud GPUs via REST API or MCP. Covers AlphaFold/Boltz/Chai structure prediction, RFdiffusion and ProteinMPNN design, antibody and nanobody engineering, DiffDock docking, binding affinity, MSA generation, and molecular dynamics — no local GPU setup needed.

This skill validates the correctness and completeness of any API request. It rigorously checks the HTTP method, URL structure, required headers, body format, authentication details, and query parameters. Use it to debug cURL commands, verify endpoint calls, or ensure API structures adhere to best practices, providing immediate, actionable feedback on required fixes.

This skill provides comprehensive guidance on designing complex system integrations, including event-driven architectures (EDA), webhook flows, API chaining, and robust ETL pipelines. It covers advanced patterns like Saga, Outbox, and resilience mechanisms (Idempotency, Circuit Breaker), making it ideal for connecting multiple microservices and managing asynchronous data flows.