Skill UI

This tool automates the OAuth 2.0 scope minimization review process. It identifies over-permissioned third-party application integrations, excessive API scopes, and risky OAuth consent patterns across identity providers. It is crucial for security audits, compliance (GDPR, SOC 2), and enforcing the least-privilege principle for cross-boundary data access.

Automated system designed to monitor paste sites (e.g., Pastebin, GitHub Gists) for leaked credentials, API keys, and sensitive data dumps. It uses advanced scraping, keyword matching, and regex patterns to provide early detection of data breaches and security incidents.

This skill enforces a rigorous data validation protocol by establishing hard boundaries at every point data enters the system (API requests, user input, environment variables, webhooks, etc.). It mandates a four-phase process: detection, trust classification, mandatory filtering (schema validation, sanitization, type checking), and final verification. This prevents untrusted data from reaching core business logic, mitigating risks like SQL injection and XSS.

This skill demonstrates how to exploit the Windows Data Protection API (DPAPI) to extract sensitive, encrypted secrets, including saved user credentials, browser logins, RDP passwords, and vault data. It covers online, offline, and domain-wide decryption techniques, essential for post-exploitation red team engagements and penetration testing.

This skill provides methods and frameworks to detect sophisticated AI attacks, including model stealing, membership inference, and model inversion. It focuses on monitoring query patterns, analyzing confidence exposure, and implementing defensive controls on inference APIs to protect intellectual property and data privacy.

This PowerShell toolset performs advanced post-exploitation, reconnaissance, persistence, and data exfiltration against Microsoft 365/Entra ID tenants using the Microsoft Graph API. It operationalizes stolen Graph tokens to enumerate users, dump policies, escalate privileges, and search sensitive data across mailboxes, SharePoint, and Teams. Essential for authorized red teaming engagements.

This skill utilizes NVIDIA's open-source garak framework to conduct comprehensive red-teaming assessments on Large Language Models (LLMs). It tests for critical vulnerabilities such as prompt injection, jailbreaks, data leakage, and toxic content generation by sending thousands of adversarial probes. Ideal for pre-deployment security validation, API guardrail testing, and generating defensible evidence for AI risk assessments.

This guide provides a structured approach to red-teaming Large Language Models (LLMs) to detect sensitive data leakage from system prompts. It simulates advanced attacks—including prompt injection, instruction override, and encoding tricks—to identify embedded secrets, API keys, and proprietary business logic. Essential for validating adherence to OWASP LLM07 and securing AI applications against data exfiltration.

This skill provides comprehensive guidance on designing complex system integrations, including event-driven architectures (EDA), webhook flows, API chaining, and robust ETL pipelines. It covers advanced patterns like Saga, Outbox, and resilience mechanisms (Idempotency, Circuit Breaker), making it ideal for connecting multiple microservices and managing asynchronous data flows.

This skill generates complete, production-grade client SDKs and API wrapper libraries for any REST API, regardless of the language (Python, TypeScript, etc.). It handles boilerplate code like authentication, retry logic (exponential backoff), data modeling, and structured resource management, saving significant development time. Use it whenever you need to consume a REST API via code.

This discipline establishes a portable, framework-agnostic layer for ensuring type safety at the network edge of any React or React Native application. It mandates a single, typed API client to wrap all network fetching, guaranteeing that raw wire JSON is immediately parsed into trusted, domain-specific types or standardized error objects before entering the application state. This pattern drastically reduces runtime errors and enhances code robustness.

A comprehensive utility for building reusable, command-line scripts and utilities to interact with the Hugging Face API. It enables complex data workflows by allowing users to chain, pipe, and process data fetched from models, datasets, and various endpoints. Ideal for automation, enrichment, and advanced data pipelines.