Skill UI

This guide outlines a comprehensive workflow for detecting and preventing the exposure of sensitive AWS credentials (access keys, session tokens) within source code repositories, CI/CD pipelines, and configuration files. It utilizes TruffleHog for deep historical scanning and integrates git-secrets for robust pre-commit hooks, significantly reducing the risk of credential theft and unauthorized account access.

This technique exploits the Active Directory attribute `msDS-KeyCredentialLink` by injecting attacker-controlled public keys (Shadow Credentials). Using tools like pyWhisker and Certipy, the attacker forces the target account to register a new key. Subsequently, by leveraging PKINIT (Public Key Cryptography for Initial Authentication in Kerberos), the attacker can obtain a service ticket and recover the target's NT hash, achieving a stealthy, password-less, complete account takeover.

This skill simulates advanced red-teaming techniques targeting Microsoft Entra ID's OAuth 2.0 device-code flow and illicit consent mechanisms. It demonstrates how attackers can steal access and refresh tokens, bypass Multi-Factor Authentication (MFA), and pivot across various Microsoft 365 services. It is designed for authorized security testing to validate token protection and conditional access policies.

This skill details how to forcefully coerce a target machine account (e.g., a Domain Controller) to authenticate to an attacker-controlled relay. It combines tools like Coercer and PetitPotam, leveraging various RPC protocols (MS-EFSR, MS-RPRN) to achieve NTLM relay. This technique ultimately enables domain compromise by forcing authentication into services like AD CS Web Enrollment (ESC8).

A powerful offensive security toolkit for red-teaming and penetration testing. It systematically enumerates and exploits various misconfigurations within Active Directory Certificate Services (AD CS) using Certipy. This allows attackers to forge privileged certificates, perform PKINIT authentication, and achieve domain compromise and privilege escalation, even without knowing user passwords. Ideal for validating security hardening.

This skill validates the correctness and completeness of any API request. It rigorously checks the HTTP method, URL structure, required headers, body format, authentication details, and query parameters. Use it to debug cURL commands, verify endpoint calls, or ensure API structures adhere to best practices, providing immediate, actionable feedback on required fixes.

This skill guides optimizing the entire developer onboarding journey to minimize Time-to-First-API-Call (TTFAC). It covers critical strategies for simplifying authentication, implementing effective sandbox environments, structuring interactive documentation, and identifying and eliminating common friction points to ensure developers can achieve their first successful API response quickly and easily.

This skill generates complete, production-grade client SDKs and API wrapper libraries for any REST API, regardless of the language (Python, TypeScript, etc.). It handles boilerplate code like authentication, retry logic (exponential backoff), data modeling, and structured resource management, saving significant development time. Use it whenever you need to consume a REST API via code.

This skill converts standard API specifications, including OpenAPI 3.x and Swagger 2.0 (in YAML or JSON format), into fully functional, import-ready Postman Collection v2.1 JSON files. It automatically maps paths, parameters, request bodies, authentication schemes, and generates corresponding environment variables, allowing users to immediately test defined APIs.

A comprehensive guide for developers working with Supabase. Covers best practices for database interaction, robust authorization using Row Level Security (RLS), secure authentication (Auth), and integrating various Supabase products (Storage, Realtime, Edge Functions). Essential for preventing common security vulnerabilities like BOLA/IDOR and ensuring data integrity across your application stack.

This guide outlines how to build new API connectors or providers that strictly adhere to the existing integration architecture and patterns of a target repository. It is designed for adding integrations while maintaining architectural consistency (e.g., layout, configuration schema, authentication model, and testing style), preventing the creation of novel, unsupported patterns.

This skill performs an adversarial audit of web application authentication flows. It systematically probes for critical security vulnerabilities such as missing CSRF protection, insecure session cookies (lacking Secure/HttpOnly flags), risky cross-origin redirects, and OAuth misconfigurations. It generates a structured report detailing findings and severity levels, making it ideal for pre-deployment security audits and regression testing.