Skill UI

Audits IAM policies, ACLs, and similar access control setups via the access-control-auditor plugin to surface misconfigurations, overly permissive roles, and privilege escalation risks across cloud and infrastructure environments.

Audits IAM policies, ACLs, and similar access control setups via the access-control-auditor plugin to surface misconfigurations, overly permissive roles, and privilege escalation risks across cloud and infrastructure environments.

This comprehensive skill provides a security posture assessment for AWS environments. It uses AWS CLI commands to audit critical security areas, including IAM policy review, network security groups, data encryption status (EBS, S3, RDS), and logging mechanisms (CloudTrail, VPC Flow Logs). Use this to proactively identify misconfigurations and ensure adherence to security best practices and compliance standards.

Scans infrastructure-as-code, application, and system configurations via the security-misconfiguration-finder plugin to expose vulnerabilities and compliance gaps, enabling proactive remediation before deployment.

Scans Android APKs for Firebase misconfigurations, testing databases, storage, authentication, and cloud functions to surface vulnerabilities during mobile security audits.

A specialized security auditor for Laravel applications. It analyzes code, APIs, and configurations against OWASP standards to detect vulnerabilities such as XSS, IDOR, SQL injection, and misconfigurations. Ideal for reviewing backend logic to ensure robust data protection and authorization.

Performs OWASP-guided security scans on PostgreSQL and MySQL databases via the database-security-scanner plugin, identifying weak passwords, SQL injection risks, and misconfigurations while generating reports and remediation advice.

Performs authorized SMTP penetration testing to discover open relays, user enumeration vectors, authentication weaknesses, and misconfigurations, then documents findings, relay status, and remediation steps.

This tool collects a comprehensive, redacted diagnostic bundle from a Supabase project. It systematically tests connectivity, authentication (Auth), Realtime capabilities, Storage buckets, and Row-Level Security (RLS) policies. The resulting archive is designed for sharing with support teams to accelerate troubleshooting of complex issues like connection failures or misconfigurations.

Analyzes CORS configurations via the cors-policy-validator plugin to spot misconfigurations, validate headers or files, and report vulnerabilities so developers can secure web apps and APIs from unsafe cross-origin access.

Scans Go codebases for security vulnerabilities, highlighting risky patterns, insecure dependencies, and misconfigurations so auditors can catch issues before deployment.

This skill analyzes Active Directory (AD) Access Control Lists (ACLs) to detect dangerous misconfigurations. It uses the ldap3 Python library to query domain controllers, parse security descriptors (SDDL), and identify instances where non-privileged users or groups are granted dangerous permissions like GenericAll, WriteDACL, or WriteOwner on sensitive objects. Essential for security incident response and privilege escalation path discovery.