Skill UI

Scan systems and dependencies for CVEs and security vulnerabilities using industry-standard tools like Nessus, OpenVAS, and Nuclei. Supports Docker deployment, API integration, and template-based scanning for infrastructure and application security assessments. Requires authorized scope and explicit permission before execution.

This skill helps plan and review read-only data warehouse analysis with explicit scope, privacy, and validation checks. It turns business questions into reproducible analysis plans without assuming specific schemas. It identifies needed data, reviews proposed queries for risks like grain or privacy, and ensures results are communicated accurately. Suitable for authorized data warehouse usage, query review, and analysis documentation while avoiding administrative tasks.

Delegate bounded coding tasks to the Warp Agent CLI (oz) when explicitly requested, with the orchestrator reviewing and landing changes. Handles installation, authentication, brief writing, dispatch, and result review.

This comprehensive workflow guides users through a multi-phase process for assessing web application security. It is designed to systematically test for common vulnerabilities listed in the OWASP Top 10, including SQL injection, XSS, broken authentication, and access control issues. Ideal for professional penetration testing, security auditing, and bug bounty hunting.

A comprehensive asset discovery pipeline for authorized security assessments. It automates subdomain enumeration, live host detection, URL crawling, and vulnerability scanning using tools like subfinder, httpx, nuclei, and katana, delivering prioritized URL lists for penetration testing.

This skill provides a framework for auditing Web3 smart contracts for security vulnerabilities. It includes pre-audit risk assessment strategies, critical bug class identification (like accounting desynchronization and access control), and Solidity code analysis techniques. Designed for authorized security assessments and educational purposes, it helps identify high-value targets and common exploit patterns in blockchain protocols.

Authorized wireless security assessment skill for Wi-Fi capture, WPA handshake analysis, rogue AP detection research, and lab-only deauthentication testing. Includes workflow, toolchain, and safety guidelines for ethical use.

Enables authorized offensive security assessments on Windows Active Directory environments. Covers Kerberos abuse, AD CS escalation, BloodHound path analysis, NTLM relay, and domain privilege escalation techniques. Requires explicit written permission and strict authorization gates before execution. Designed for educational purposes or authorized security assessments only.

Systematic methodologies for discovering and exploiting Windows privilege escalation vulnerabilities in authorized penetration testing, covering service path abuse, AlwaysInstallElevated, token impersonation, unquoted paths and credential harvesting.

Assess WordPress installations for common vulnerabilities and attack surfaces. Use this skill for authorized security assessments, penetration testing, and defensive validation. Includes WPScan, Metasploit, and Burp Suite integration with legal and technical constraints.

This skill enables users to create, maintain, and validate YYLO Ledger workflow records using the yy CLI. It emphasizes strict separation between storage, execution, and evidence boundaries to ensure safety and provenance. Users can search, retrieve, and update workflow definitions while preventing unauthorized execution or data mutation.

Implement zero-trust network architecture with identity-based access, micro-segmentation, and continuous verification. Covers BeyondCorp-style access, Cloudflare Access configuration, and OAuth2 Proxy deployment for securing modern applications.