Skill UI

This skill detects unauthorized modifications (container drift) to running containers by monitoring for deviations from the original image state. It monitors binary execution drift, file system changes, and configuration deviations using tools like Falco and Kubernetes security contexts. Essential for SOC analysts and security teams investigating runtime compromises and enforcing immutable infrastructure.

This tool provides a comprehensive security audit framework for Azure Storage accounts. It systematically detects critical misconfigurations, such as publicly accessible blob containers, weak encryption settings, overly permissive network access rules, and missing logging. Use it when performing compliance checks, responding to security incidents, or establishing storage security baselines in Azure environments.

This skill provides comprehensive methods for detecting and preventing privilege escalation within Kubernetes pods and containers. It details using runtime tools like Falco for monitoring syscalls and capabilities, and implementing admission controls via OPA Gatekeeper or Pod Security Admission to enforce security best practices, thereby hardening the cluster against unauthorized access and dangerous configurations.

This tool scans GitHub Actions workflows and CI/CD configurations to identify critical supply chain attack vectors. It specifically checks for unpinned actions, risks from script injection using expressions, dependency confusion, and secrets exposure, helping organizations harden their build systems against sophisticated threats.

This skill automates the entire iterative process of Design Space Exploration (DSE), primarily for computer architecture and EDA problems. It executes complex programs, analyzes resulting objective metrics, and intelligently tunes input parameters (e.g., cache size, pipeline width, optimization passes). It continues iterating until a predefined objective is met or a timeout is reached, making it ideal for optimizing complex system and hardware configurations.

Executes authorized, advanced attack simulations against Active Directory environments to identify critical misconfigurations, weak credentials, and exploitable trust relationships. Utilizing industry tools like BloodHound, Mimikatz, and Impacket, this process simulates complex attacks such as Kerberoasting, Golden Ticket forging, and domain compromise path analysis, helping organizations validate their security posture against real-world threats.

This guide details the exploitation of the Active Directory Certificate Services (AD CS) ESC1 vulnerability. By leveraging misconfigurations, an attacker can request certificates impersonating high-privileged users (e.g., Domain Admins). The workflow covers AD enumeration, forging certificates with arbitrary Subject Alternative Names (SANs), authenticating via PKINIT, and ultimately escalating domain privileges using tools like mimikatz. Essential for authorized red team and penetration testing.

This technique details how to exploit misconfigurations within Kerberos Constrained Delegation (KCD) in Active Directory. By leveraging S4U2self and S4U2proxy extensions, attackers can impersonate highly privileged users (e.g., Domain Admins) to request service tickets, enabling lateral movement and full domain compromise during authorized red teaming or penetration testing.

A comprehensive guide for penetration testers detailing methods to identify and exploit misconfigurations in OAuth 2.0 and OpenID Connect (OIDC) flows. Techniques cover redirect URI manipulation, authorization code theft, token leakage via headers, and scope escalation during security assessments.

This script is designed for malware analysis, specifically targeting .NET-based Remote Access Trojans (RATs) like Agent Tesla. It automatically extracts embedded and obfuscated configuration data, including SMTP credentials, FTP endpoints, Telegram tokens, and C2 webhooks. It utilizes advanced techniques such as regex pattern matching, Base64 decoding, and simulating XOR/SHA256 decryption to reveal critical threat intelligence for security research.

This utility integrates status updates and notifications with Feishu/Lark. It is designed as an internal, zero-impact tool that other complex skills (e.g., experiment runners, review loops) call to report key events like test completion, scoring results, or reaching a checkpoint. It supports both 'push' (fire-and-forget status updates) and 'interactive' (bidirectional approval/rejection) modes, ensuring seamless workflow visibility and robust operation even if configuration is missing.

A comprehensive guide detailing best practices for hardening Docker containers, aligning with CIS Docker Benchmark v1.8.0. It covers host configuration, minimizing attack surface, implementing least privilege, and enhancing runtime security using techniques like read-only filesystems, Seccomp, and AppArmor. Use this when deploying secure, production-grade containerized applications.