Skill UI

This skill provides a comprehensive guide to hardening managed Kubernetes clusters on major cloud platforms (EKS, AKS, GKE). It details implementing critical security layers, including Pod Security Standards, least-privilege network policies, workload identity (eliminating static cloud credentials), and runtime security monitoring. Essential for securing production environments and meeting compliance requirements.

This skill provides a comprehensive guide to implementing secure, defense-in-depth remote access architectures for Operational Technology (OT) and Industrial Control Systems (ICS). It covers best practices such as using jump servers, implementing Multi-Factor Authentication (MFA), session recording, and adhering to standards like IEC 62443 and NERC CIP-005 for vendor and operator access.

This skill provides comprehensive security hardening guidelines for serverless compute platforms like AWS Lambda, Azure Functions, and Google Cloud Functions. It covers essential security pillars including enforcing least privilege IAM roles, integrating robust secrets management (e.g., AWS Secrets Manager), automating dependency vulnerability scanning within CI/CD pipelines, and implementing strict input validation to mitigate risks such as injection and credential theft. Ideal for DevSecOps practitioners and security architects.

An interactive tool designed to discover, select, and assemble specialized teams of AI agents. It supports structured agent collections across different domains (e.g., Engineering, Marketing). Users select multiple roles for a specific task, and the skill launches them in parallel, synthesizing their independent findings into a unified report, including consensus and conflict analysis.

This skill is designed for assessing the security of Android inter-process communication (IPC) by systematically testing intents, broadcast receivers, content providers, and exported components. It helps identify critical vulnerabilities such as intent injection, unauthorized data leakage, and component hijacking, which are crucial during mobile penetration testing and security audits.

This tool systematically tests API endpoints for mass assignment (over-posting) vulnerabilities. It simulates an attacker injecting undocumented or privileged fields (such as 'role' or 'balance') into standard API requests. By analyzing the server's response, it determines if the API binds all client-supplied parameters to the data model without proper filtering, which could allow unauthorized privilege escalation or data modification. This is critical for achieving OWASP API Top 10 compliance.

This skill provides a comprehensive guide and methodology for identifying and exploiting Cross-Origin Resource Sharing (CORS) misconfigurations in web applications. It covers testing origin validation bypasses, analyzing preflight requests, and simulating data exfiltration during authorized penetration tests, crucial for assessing API security.

A comprehensive methodology for penetration testing web applications to identify broken access control vulnerabilities. This guide covers systematic testing for Role-Based Access Control (RBAC), privilege escalation, insecure direct object references (IDOR), and API authorization flaws in multi-tenant environments. It outlines the use of tools like Burp Suite and ffuf to map endpoints and simulate various user roles.

A comprehensive guide for advanced penetration testing designed to identify flaws in application business rules that automated scanners miss. Focus areas include price manipulation, workflow bypass, privilege escalation, and race conditions. Essential for securing e-commerce platforms, financial systems, and multi-step critical processes.

A comprehensive guide for performing security assessments to identify various forms of sensitive data exposure, such as leaked API keys, PII in API responses, insecure client-side storage, and unprotected data transmission. This workflow covers scanning JavaScript files, analyzing API responses, verifying data encryption, and examining browser storage.

A comprehensive guide and set of payloads for penetration testing web applications that process XML input. It details how to test for major vulnerabilities such as XXE, XPath injection, SSRF, and XML parsing attacks, providing step-by-step workflows and advanced payloads for identifying data exposure and security flaws.

This comprehensive skill guides the testing of web applications for Cross-Site Scripting (XSS) vulnerabilities. It covers reflected, stored, and DOM-based injection points. Testers learn to map input/output contexts, craft context-appropriate payloads, and bypass complex sanitization and CSP protections, ensuring thorough client-side security assessment.