Skill UI

This skill guides the integration of gitleaks and trufflehog into CI/CD pipelines. It automates the detection of hardcoded secrets, such as API keys, passwords, and tokens, preventing their accidental deployment. By integrating scans as a mandatory pre-deployment gate, organizations enforce strong security policies and maintain compliance.

This skill provides a comprehensive framework for performing authorized penetration testing on Google Cloud Platform (GCP). It uses specialized tools like GCPBucketBrute to enumerate publicly accessible storage buckets and audits IAM policies to identify overly permissive role bindings. The process includes checking service account keys and mapping potential privilege escalation paths, generating actionable, risk-scored reports for robust cloud security posture management.

This script systematically investigates all persistence mechanisms on Windows and Linux systems. It analyzes critical areas like the Windows Registry (SYSTEM, SOFTWARE, HKCU), scheduled tasks, and common run keys to identify how malware maintains access and survives system reboots. It is essential for advanced incident response, threat hunting, and digital forensics investigations.

A comprehensive guide to analyzing volatile memory (RAM) dumps using the Volatility 3 framework. This skill enables the extraction of crucial digital evidence, including running processes, network connections, loaded modules, credentials, and encryption keys. It is essential for incident response, detecting rootkits, process hollowing, or identifying malware when traditional disk-based forensics are insufficient.

This skill automates the monitoring of public paste sites (e.g., Pastebin, GitHub Gists) to detect leaked credentials, API keys, and sensitive data dumps. It employs advanced regex patterns and keyword matching to provide early warning of security breaches, crucial for incident response, vulnerability assessment, and threat intelligence gathering.

This comprehensive guide details the end-to-end process of conducting wireless security assessments. It covers passive reconnaissance, capturing WPA/WPA2 handshakes, cracking keys using Aircrack-ng and Hashcat, simulating Evil Twin attacks, detecting rogue access points, and testing network segmentation. It is essential for organizations validating their WiFi infrastructure security.

A comprehensive guide for reversing and analyzing .NET malware samples. Learn the full workflow, including identifying .NET assemblies, using de4dot to deobfuscate code protected by tools like ConfuserEx or SmartAssembly, and loading the cleaned code into dnSpy. This skill is essential for extracting hardcoded C2 configurations, encryption keys, and credentials, and debugging runtime behaviors of complex malware.

This comprehensive guide teaches advanced iOS reverse engineering techniques using Frida dynamic instrumentation. Users can analyze proprietary app logic, extract encryption keys, trace method calls, and bypass anti-tampering or anti-debugging mechanisms without needing source code. It is essential for authorized mobile security testing and protocol analysis.

A comprehensive guide for performing security assessments to identify various forms of sensitive data exposure, such as leaked API keys, PII in API responses, insecure client-side storage, and unprotected data transmission. This workflow covers scanning JavaScript files, analyzing API responses, verifying data encryption, and examining browser storage.

This skill details the deployment of various canary tokens (DNS, HTTP, AWS API Keys) across enterprise network infrastructure. It establishes digital tripwires that detect behavioral anomalies, such as unauthorized access, credential leakage, or lateral movement. Tokens are configured with webhook alerts (Slack, SIEM) for real-time, low-false-positive notification, significantly enhancing traditional IDS/IPS capabilities.

A comprehensive guide for building a FIDO2/WebAuthn relying party server using python-fido2. This skill covers the entire lifecycle of passwordless authentication, including secure credential registration (enrollment of hardware keys like YubiKey and resident passkeys) and robust authentication ceremonies. It is essential for migrating traditional password-based systems to phishing-resistant Multi-Factor Authentication (MFA).

Skill for implementing Firebase Crashlytics in Flutter apps. Covers fatal/non-fatal error capture, async and isolate exceptions, crash customization with keys/logs/user IDs, symbol upload, opt-in data collection, and debug build disables.