Skill UI

This tool is designed for security professionals to test for Server-Side Request Forgery (SSRF) vulnerabilities. It systematically probes user-controllable URL parameters to identify access to internal network services, cloud metadata endpoints (AWS/GCP/Azure), and restricted local resources. It supports various payload techniques, including protocol handlers (gopher, file), IP encoding, and DNS rebinding, making it essential for thorough security assessments and penetration testing.

This guide details a comprehensive methodology for penetration testing desktop (thick client) applications. It covers static and dynamic analysis, focusing on identifying vulnerabilities such as hardcoded credentials, insecure local storage, DLL hijacking, memory manipulation, and API communication flaws. Tools like dnSpy, Procmon, and Burp Suite are utilized for in-depth security auditing of enterprise and banking software.

Performs sector-specific threat landscape assessments by analyzing targeting patterns, attack vectors, TTPs, and vulnerability trends so security teams can prioritize risk management, investment, and reporting for verticals such as finance, healthcare, energy, and government.

This tool provides a structured methodology for triaging raw vulnerability findings generated by DAST and SAST scanners. It utilizes the OWASP risk rating methodology to validate true positives, filter out false positives, and calculate a comprehensive risk score (Risk = Likelihood x Impact). This process significantly reduces alert fatigue and ensures development teams prioritize remediation efforts on the most critical and exploitable vulnerabilities.

Guides analysts through CVSS v4 scoring, vector parsing, and contextual factors (EPSS, CISA KEV, asset criticality) to prioritize vulnerabilities, adjust environmental scores, and blend threat telemetry for effective remediation planning.

A powerful skill designed for comprehensive academic research. It searches, aggregates, and analyzes literature from multiple sources, including Zotero, Obsidian vaults, local PDFs, and major academic databases like Semantic Scholar. Use it when performing a literature review, needing to find related work, summarizing key ideas, or conducting systematic academic research.

Orchestrates idea discovery, implementation, scaling experiments, and autonomous review loops into a single pipeline that builds and iterates toward submission-ready research.

Provides a Codex-powered workflow that orchestrates multi-round, high-reasoning GPT research reviews, capturing context, criticisms, follow-ups, experiments, and documentation.

Deploys and runs ML experiments on local, remote, Vast.ai, or Modal GPUs by detecting the target environment, syncing code, ensuring W&B logging when needed, and launching training jobs safely.

Integrates Aqua Security’s Trivy scanner into CI/CD workflows to automatically scan Docker images, IaC files, and configs for OS and dependency CVEs, enforce severity-based quality gates, and block vulnerable images before deployment.

Use Kubesec to analyze Kubernetes YAML/JSON manifests for misconfigurations, privilege escalation risks, and missing controls, delivering scores and remediation hints via CLI, Docker, kubectl plugin, or REST API for DevSecOps and CI/CD pipelines.

A comprehensive guide to securing AWS Lambda execution roles. It details implementing least-privilege IAM policies, utilizing permission boundaries, and restricting resource-based policies. The workflow includes auditing existing permissions using AWS CLI, analyzing actual API usage with CloudTrail and IAM Access Analyzer, and programmatically creating highly scoped policies to minimize the security attack surface.