Skill UI

Detect unsafe file handling and path traversal vulnerabilities in upload, save, and extract flows. Focuses on user-controlled paths or filenames, providing probes to test if agents write outside intended directories. Useful for security assessment of AI agents with file handling capabilities.

Security skill for detecting missing or weak rate limiting on authentication endpoints. Identifies brute force vulnerabilities in OTP, password reset, and login systems. Requires explicit authorization for authorized security assessments only. Includes shadow-throttle detection and enumeration techniques.

This skill provides systematic methodologies for identifying and exploiting Insecure Direct Object Reference (IDOR) vulnerabilities in web applications. It covers detection techniques using parameter manipulation, exploitation via Burp Suite, and remediation strategies. Requires authorized security assessments and multiple test accounts to verify cross-user access. Outputs include vulnerability reports, proof of concept, and remediation recommendations.

This skill provides a comprehensive command reference for penetration testing tools. It covers network scanning with Nmap, exploitation via Metasploit, password cracking, and web application testing. Users can quickly lookup commands for security assessments, vulnerability identification, and payload generation. It includes examples for host discovery, port scanning, service detection, and common exploit usage.

Red team tactics principles based on MITRE ATT&CK framework. Covers attack phases, detection evasion, lateral movement, and reporting for authorized security assessments.

This skill enables comprehensive SQL injection vulnerability assessments on web applications to identify database security flaws and validate input sanitization. It supports detection of in-band, blind, and out-of-band attack vectors. Users can demonstrate exploitation techniques and extract data for authorized security testing purposes only. Requires explicit written permission before execution.

A comprehensive asset discovery pipeline for authorized security assessments. It automates subdomain enumeration, live host detection, URL crawling, and vulnerability scanning using tools like subfinder, httpx, nuclei, and katana, delivering prioritized URL lists for penetration testing.

Authorized wireless security assessment skill for Wi-Fi capture, WPA handshake analysis, rogue AP detection research, and lab-only deauthentication testing. Includes workflow, toolchain, and safety guidelines for ethical use.