Skill UI

Maps a litigation team's disclosure strategy from a case summary, pleading, chronology, or early case theory. Identifies relevant document categories, likely custodians, potentially adverse materials, evidential gaps, and search themes. Supports early case assessment and proactive risk planning in civil or commercial disputes.

This skill helps classify AI systems under the EU AI Act (Regulation (EU) 2024/1689) to determine compliance obligations. It guides users through the decision tree from prohibited practices to high-risk categories, GPAI models, and role-specific responsibilities. Useful for assessing risk levels, mapping provider/deployer duties, and building compliance roadmaps. Includes DACH-specific regulatory considerations.

Comprehensive skill for FedRAMP certification and compliance under CR26. Covers authorization paths, Certification Classes A-D, SSP/SAP/SAR/POA&M documentation, NIST SP 800-53 control mapping, FedRAMP 20x, OSCAL mandate, 3PAO assessments, continuous monitoring, and gap assessments. Ideal for cloud service providers and security teams navigating federal cloud authorization.

A structured, step-by-step method for drafting and finalising complex multi-pillar regulated fintech agreements, focused on payment services deals. It covers regulatory mapping, contract architecture, core clause drafting, execution-blocker triage, and pre-signature checks. Designed for lawyers, it ensures compliance conditions are handled correctly and provides repeatable processes from intake to signature.

This skill maps an organization's entire identity fabric, identifying its tenant boundaries (federation mapping) and various Identity Providers (IdPs like Entra, Okta, ADFS, Google). It performs pre-authentication user enumeration and synthesizes login candidates using harvested names and confirmed email patterns. It is strictly for reconnaissance and mapping, never for credential submission or authentication bypass.

This skill provides an engine-neutral, high-level architecture for abstracting raw physical inputs (keys, buttons, touch) into named gameplay actions. It supports advanced features like multi-device binding, conflict detection, analog deadzones, input buffering, and coyote time, ensuring flexible and accessible control schemes for modern games.

A comprehensive guide for structuring and building playable game levels. This skill focuses on the engine-neutral process of blockout (whitebox/greybox), defining player metrics, pacing the experience (tension/rest curve), and mapping the critical path. It ensures that gameplay flow and mechanics are validated long before any final art or details are applied.

An expert advisor specializing in NIST SP 800-53 Revision 5. Guide federal agencies and system owners through the complex risk management lifecycle (RMF). Expertise covers all 20 control families, system categorization (FIPS 199/200), gap assessments, control narrative writing, and mapping to major standards including FedRAMP, FISMA, and ISO 27001.

An expert advisor on the NIST Cybersecurity Framework (CSF) 2.0 and 1.1. This skill assists security, risk, and compliance teams with comprehensive risk management consulting. Use it for gap assessments, profile creation (Current vs. Target), implementation roadmaps, tier advancement guidance, and mapping to other standards like ISO 27001 and CIS Controls.

A comprehensive methodology for exploiting modern Continuous Integration/Continuous Delivery (CI/CD) pipelines. This skill covers advanced attack vectors across major platforms, including GitHub Actions expression injection, Jenkins RCE, GitLab YAML abuse, and Azure DevOps compromise. Techniques focus on privilege escalation, credential theft, and supply chain poisoning, mapping to MITRE ATT&CK T1195.002.

A comprehensive methodology for offensive security, detailing how to systematically extract secrets from Continuous Integration/Continuous Deployment (CI/CD) pipelines. Techniques covered include dumping environment variables, exploiting misconfigurations in HashiCorp Vault, AWS Secrets Manager, and cloud platform tokens (GitHub, GitLab, etc.). It also guides attackers on OIDC federation abuse, build log analysis, and advanced exfiltration methods, mapping to MITRE ATT&CK T1552.

A comprehensive guide covering advanced offensive methodologies for data exfiltration. Techniques include abusing DNS (dnscat2, iodine), tunneling over HTTPS/CDN, utilizing ICMP, and exploiting cloud storage services. This knowledge is critical for authorized red team engagements and post-exploitation simulations, mapping directly to MITRE ATT&CK tactics like T1048 and T1041.