Skill UI

Automate Open Source Intelligence (OSINT) collection and target profiling using the SpiderFoot REST API and CLI. This tool leverages over 200 modules to map an organization's attack surface, collecting structured data including domains, IPs, email addresses, leaked credentials, and DNS records. Ideal for conducting comprehensive security assessments, threat intelligence gathering, and incident response procedures.

This guide details how to use GoPhish, an open-source framework, to conduct authorized phishing simulations. You will learn the complete lifecycle, from deploying the tool and configuring SMTP profiles, to creating realistic email templates and cloning secure landing pages. The skill culminates in analyzing campaign results to assess organizational security posture and improve employee resilience against social engineering attacks.

Nikto is a powerful, open-source web server and web application scanner designed for comprehensive vulnerability assessment. It tests over 7,000 potentially dangerous files and checks for critical issues like XSS, SQL injection, outdated versions, and misconfigurations across modern web applications. Ideal for security audit, penetration testing, and validating web server security controls.

Grype is an open-source vulnerability scanner designed by Anchore. It inspects container images, filesystems, and SBOMs for known Common Vulnerabilities and Exposures (CVEs). By leveraging Syft-generated SBOMs, it cross-references package vulnerabilities against major sources like NVD and GitHub Advisories. It is essential for security assessments, supply chain integrity checks, and integrating security into CI/CD pipelines.

Trivy is an open-source scanner for comprehensive security auditing of container images. It detects vulnerabilities in OS packages, language dependencies, misconfigurations, exposed secrets, and license violations. It is essential for integrating security checks into CI/CD pipelines, performing rigorous security assessments, or conducting incident response investigations. Supports generating SBOMs and reporting in formats like SARIF and CycloneDX.

Kubesec is a powerful open-source tool designed to perform comprehensive security risk analysis on Kubernetes resource manifests (YAML/JSON). It automatically detects critical misconfigurations, potential privilege escalation vectors, and deviations from industry security best practices. It provides actionable scoring and hardening recommendations, making it essential for CI/CD pipelines, security auditing, and automated compliance checks.

Comprehensive guide on hardening the open-source Harbor container registry. It details configurations for advanced security features including integrated Trivy vulnerability scanning, Notary/Cosign image signing for content trust, fine-grained RBAC, immutable tag retention, and OIDC authentication. Use this when deploying or auditing a registry to ensure image provenance and compliance.

Guides on using SwanLab for open-source ML experiment tracking, offering local or self-hosted dashboards, rich media logging, and integrations with PyTorch, Transformers, Lightning, or Fastai for comparing runs and monitoring metrics.

bdistill transforms AI interactions into a structured, queryable knowledge base. It extracts, structures, and quality-scores domain knowledge from both closed-source AI models (in-session) and local open-source models (via Ollama). Users can build comprehensive reference datasets, Q&A pairs, or generate structured training data for traditional machine learning, ensuring validated and exportable domain expertise.

This skill manages the secure transition of private internal projects to public open-source releases. It executes a three-stage pipeline: Forking (removing secrets), Sanitizing (verifying clean code), and Packaging (generating required documentation like README, setup.sh, and CLAUDE.md). It ensures code safety and readiness before public deployment.

This skill manages comprehensive software development life cycle operations—including issue triage, PR reviews, version releases, bug fixing, and marketing content generation. It operates using a parallel "agent army" of dynamic agents (10-20 per task), requiring the user to adopt an Engineering Manager (EM) mindset. Key principles involve rigorous citation checking (anti-hallucination) and applying multiple roles (Product Owner, Open Source Contributor, Architect) simultaneously to ensure robust, safe, and user-centric outcomes across all platforms.

This skill provides comprehensive automation for managing GitHub workflows across the entire development lifecycle. It covers detailed issue triage, PR review status checks, CI/CD failure debugging, official release management, and security monitoring using the GitHub CLI. Ideal for maintaining open-source project health and streamlining team development processes.