Skill UI

Zeek is a powerful, open-source network analysis framework that functions as a passive security monitor. It generates highly detailed, structured logs (e.g., HTTP, DNS, TLS) from raw network traffic, allowing for deep metadata extraction. This skill guides users through deploying Zeek, writing custom detection scripts, and integrating the resulting rich security logs with SIEM platforms for advanced threat detection and forensic investigations.

This guide provides a comprehensive methodology for auditing essential HTTP security headers, including CSP, HSTS, X-Frame-Options, and Referrer-Policy. It helps identify missing or improperly configured browser-level protections, crucial for mitigating vulnerabilities like XSS, clickjacking, and mixed content issues, ensuring compliance with standards like PCI DSS and SOC 2.

Simulates man-in-the-middle (MITM) attacks by stripping SSL/TLS encryption, forcing HTTPS connections to downgrade to insecure HTTP. This skill is designed for authorized penetration testing to validate HSTS enforcement, assess certificate validation mechanisms, and train security teams on detecting cleartext data leakage during a downgrade attack.

This skill covers the technical process of setting up SSL/TLS inspection (decryption) on next-generation firewalls and proxies. It details how to act as a trusted Man-in-the-Middle to intercept, decrypt, and inspect encrypted HTTPS traffic for malicious payloads, data exfiltration, and policy violations. The workflow includes generating internal Certificate Authority (CA) certificates and deploying them across various operating systems (Windows, macOS, Linux) to ensure visibility into the web's encrypted blind spot.

This guide details advanced techniques for bypassing Web Application Firewalls (WAFs). It covers methods such as payload obfuscation, advanced URL encoding, HTTP method manipulation (PUT, PATCH, etc.), parameter pollution, and utilizing specialized tools like SQLMap tamper scripts to smuggle exploit payloads (e.g., SQLi, XSS) past perimeter security controls. Essential for penetration testing and red team engagements.

A comprehensive guide for security professionals detailing how to exploit web cache mechanisms (CDNs, reverse proxies) to inject malicious content. It covers identifying caching layers, discovering unkeyed headers (like X-Forwarded-Host), and executing poisoning attacks for authorized penetration testing.

This guide assists developers in designing and architecting Model Context Protocol (MCP) servers that integrate deeply with LLMs like Claude. It is not a coding skill, but a comprehensive consultation process that guides users through use case interrogation, determines the optimal deployment model (e.g., Remote HTTP, MCPB), and selects the appropriate tool-design pattern for seamless, robust integration.

This comprehensive guide implements External Attack Surface Management (EASM). It integrates leading industry tools like Shodan, Censys, subfinder, httpx, and nuclei for deep reconnaissance. Users can systematically discover assets, enumerate subdomains, fingerprint services, scan for vulnerabilities, and calculate weighted exposure scores based on professional OWASP methodology. Ideal for continuous security monitoring and deep penetration testing.

This skill details the deployment of various canary tokens (DNS, HTTP, AWS API Keys) across enterprise network infrastructure. It establishes digital tripwires that detect behavioral anomalies, such as unauthorized access, credential leakage, or lateral movement. Tokens are configured with webhook alerts (Slack, SIEM) for real-time, low-false-positive notification, significantly enhancing traditional IDS/IPS capabilities.

This skill monitors for regressions on deployed URLs following deployments, merges, or dependency upgrades. It performs comprehensive checks including HTTP status, console errors, network failures, performance metrics (LCP/CLS/INP), and crucial API endpoint health, ensuring service stability in production or staging environments. Supports quick checks, continuous monitoring, and differential comparison against baselines.

Manage BrowserWing’s intelligent browser automation platform: install Chrome, configure LLM providers, generate AI-explored scripts, and operate the script lifecycle through HTTP APIs for autonomous exploration, execution, and troubleshooting.

Controls BrowserWing-based browsers via HTTP endpoints to navigate pages, interact with elements (click/type/select), capture accessibility snapshots, run JavaScript, take screenshots, and execute batch sequences for data extraction workflows.