Skill UI

Scan systems and dependencies for CVEs and security vulnerabilities using industry-standard tools like Nessus, OpenVAS, and Nuclei. Supports Docker deployment, API integration, and template-based scanning for infrastructure and application security assessments. Requires authorized scope and explicit permission before execution.

A comprehensive asset discovery pipeline for authorized security assessments. It automates subdomain enumeration, live host detection, URL crawling, and vulnerability scanning using tools like subfinder, httpx, nuclei, and katana, delivering prioritized URL lists for penetration testing.

This skill provides a framework for auditing Web3 smart contracts for security vulnerabilities. It includes pre-audit risk assessment strategies, critical bug class identification (like accounting desynchronization and access control), and Solidity code analysis techniques. Designed for authorized security assessments and educational purposes, it helps identify high-value targets and common exploit patterns in blockchain protocols.

Authorized wireless security assessment skill for Wi-Fi capture, WPA handshake analysis, rogue AP detection research, and lab-only deauthentication testing. Includes workflow, toolchain, and safety guidelines for ethical use.

Enables authorized offensive security assessments on Windows Active Directory environments. Covers Kerberos abuse, AD CS escalation, BloodHound path analysis, NTLM relay, and domain privilege escalation techniques. Requires explicit written permission and strict authorization gates before execution. Designed for educational purposes or authorized security assessments only.

Assess WordPress installations for common vulnerabilities and attack surfaces. Use this skill for authorized security assessments, penetration testing, and defensive validation. Includes WPScan, Metasploit, and Burp Suite integration with legal and technical constraints.

A specialized tool for auditing WordPress plugins, themes, and blocks before deployment. It checks for security vulnerabilities like SQL injection, XSS, and improper escaping, ensures API correctness, and enforces internationalization standards. Use it to review generated code or perform security assessments on WordPress environments.

A comprehensive skill for conducting client-side injection vulnerability assessments on web applications. It identifies XSS and HTML injection flaws, demonstrates exploitation techniques for session hijacking and credential theft, and validates input sanitization and output encoding mechanisms. Includes practical examples and strict safety guardrails.

Audits C, C++ and Rust source code for missing zeroization of secrets, keys and passwords, and detects wipes removed by compiler optimizations such as dead-store elimination. Uses LLVM IR and assembly evidence, control-flow verification and optional runtime tests. For authorized security assessments only.

Builds a competency matrix of expected proficiency by job title and grade, with assessment methods and linked skill areas. Use for role frameworks and hiring bars. Produces CSV, SQL DDL, JSON Schema, Notion mapping, or Excel on request.

This skill enables investigation of slow activities, waiting times, and handoff durations within workflows. It identifies bottlenecks and cumulative activity workload by analyzing average durations and event frequencies. Users can retrieve bottleneck analysis, attribute statistics, and edge metrics to resolve performance issues. It emphasizes distinguishing between averages and totals, ensuring accurate workload assessment without deriving population totals from limited samples.