Skill UI

A comprehensive collection of six expert-level, structured workflows designed to elevate AI assistance from ad-hoc querying to repeatable, production-grade engineering practices. Users can evaluate prompts, design RAG architectures, plan context budgets, run security audits, build eval harnesses, and coach product strategy.

Systematically evaluates cyber-campaign evidence to attribute a cyber operation to a specific threat actor. This skill utilizes advanced analytical frameworks like the Diamond Model and Analysis of Competing Hypotheses (ACH) to weigh multiple indicators, including infrastructure overlaps, TTP consistency, malware similarity, and operational patterns, providing confidence-weighted attribution assessments for incident response.

Simulates advanced persistent threat (APT) activity across the entire cyber kill chain, from reconnaissance to data exfiltration. It evaluates an organization's detection, prevention, and response capabilities using MITRE ATT&CK-aligned techniques, moving beyond typical vulnerability scanning. Ideal for objective-based assessments and purple teaming.

This guide outlines the comprehensive process for planning and executing authorized vishing (voice phishing) pretext calls. Used in red teaming exercises, it assesses employee susceptibility to social engineering attacks and evaluates the effectiveness of existing security awareness controls. Key steps include OSINT research, developing believable pretexts (e.g., IT helpdesk impersonation), structured call execution, and collecting detailed metrics.

A comprehensive guide for conducting authorized wireless network penetration tests. This skill assesses the overall security posture of WiFi infrastructure, covering weak encryption protocols, captive portal bypasses, Evil Twin attacks, WPA2/WPA3 handshake capture, and rogue access point detection. It evaluates wireless authentication methods, network segmentation, and the effectiveness of WIDS/WIPS systems.

AWS Verified Access is a Zero Trust Network Access (ZTNA) service that provides secure, VPN-less access to internal applications. It uses granular Cedar policies to evaluate user identity (integrating with Okta, IAM Identity Center) and device security posture (CrowdStrike, Jamf) in real-time. Use this guide when replacing traditional VPNs, enforcing strict conditional access controls, or deploying multi-account Verified Access infrastructure across AWS.

A comprehensive, multi-step workflow for analyzing and deobfuscating highly complex and malicious JavaScript code. It guides users through extracting scripts from phishing pages and web skimmers, identifying obfuscation techniques (Base64, Unicode escapes, eval chains), neutralizing anti-analysis features, and progressively decoding string layers to reveal the original malicious payload for thorough threat intelligence and malware analysis.

This skill guides the comprehensive evaluation and selection of Threat Intelligence Platforms (TIPs). It assesses vendor capabilities, including STIX/TAXII support, workflow automation, SIEM/SOAR integration, and total cost of ownership. It is essential for procurement decisions, migrating between TIP solutions, or assessing whether the current CTI program meets required maturity levels.

This skill implements a simplified version of the Signal Protocol, focusing on robust end-to-end encryption (E2EE) for messaging applications. It covers critical cryptographic components including X3DH key agreement, the Double Ratchet algorithm for continuous key management, and AES-256-GCM for message encryption. The implementation ensures forward secrecy, meaning that compromising a current key does not reveal past messages. Use this when designing, building, or evaluating the security architecture of a messaging service to guarantee that only communicating parties can read the messages.

This methodology provides SOC teams with an adversary-centric framework to evaluate security detection capabilities against the MITRE ATT&CK framework. By systematically mapping existing SIEM rules and data sources, users can identify critical detection gaps, prioritize rule development efforts, and measure the overall maturity of their security operations center (SOC) defenses over time.

A comprehensive security assessment guide and script to test API rate limit vulnerabilities. It evaluates if an API's security controls can be bypassed using advanced techniques such as IP spoofing (manipulating X-Forwarded-For headers), HTTP method variations, and endpoint path traversal. Designed for penetration testing, it helps assess resilience against brute-force or resource exhaustion attacks, aligning with OWASP API Top 10 findings.

A comprehensive toolkit for analyzing ELF binaries to locate memory-corruption vulnerabilities, such as buffer overflows and ROP chains. This skill is vital for authorized penetration testing and CTF challenges, allowing users to evaluate compiler mitigations (ASLR, NX, Canary, PIE) and develop robust proof-of-concept exploits.