Skill UI

Build enterprise agents for Microsoft 365, Teams, and Copilot Studio using the Microsoft Agents SDK for Python. Supports aiohttp hosting, AgentApplication routing, streaming responses, and MSAL-based authentication.

Red-team playbook for Microsoft 365 and Entra ID: tenant discovery, AADSTS error-code triage, Smart Lockout math for safe credential spraying, and user-enumeration vectors. Authorized engagements only.

Authorized macOS and Mach-O reverse engineering: inspect code signatures, entitlements and Hardened Runtime, recover Objective-C/Swift structures, and triage Apple-platform malware with otool, Hopper, Ghidra, Frida and lldb.

Analyze suspected malware through static, dynamic, and behavioral techniques: IOC extraction, YARA/Sigma rule authoring, sandbox orchestration, and anti-analysis detection.

Audit multi-role marketplace authorization across roles, resource ownership, tenant boundaries, and order-state transitions. Use this skill when access rules require evidence instead of UI assumptions, covering policy matrices, identity tracing, and field-level security checks.

Comprehensive hardening guide for Model Context Protocol (MCP) servers, covering transport encryption, mTLS, authentication, authorization, input validation, and audit logging to secure AI agent integrations.

This skill enables security auditing of meme coins and tokens on EVM and Solana blockchains. It identifies critical vulnerabilities like hidden mint functions, honeypot transfer restrictions, fee manipulation, and liquidity pool drains. Users must obtain explicit authorization before scanning targets to ensure ethical use.

Leverage the Metasploit Framework for authorized penetration testing, from module search and exploit configuration to payload generation, auxiliary scanning, and post-exploitation. Use only with explicit written permission.

Microsoft Entra Authentication Events SDK for .NET. Azure Functions triggers that handle custom authentication extensions, including token claim enrichment, attribute collection customization and validation, and custom OTP delivery.

Authorized Android/iOS reverse engineering and security testing: APK/IPA analysis, runtime instrumentation (Frida/Objection), SSL-pinning and jailbreak/root-detection bypass, per OWASP MASTG.

This skill specializes in secure mobile application development, focusing on input validation, WebView security, and mobile-specific security patterns. It covers secure data storage, authentication implementation, and platform-specific vulnerabilities for iOS and Android. Ideal for building security-first mobile apps that protect sensitive data and resist common attack vectors like injection attacks and man-in-the-middle threats.

Automates Monday.com boards, items, columns, groups, and updates through Rube MCP tooling; retrieves current schemas with RUBE_SEARCH_TOOLS and manages Monday.com OAuth links before running creation or update workflows.