Skill UI

A comprehensive, cross-functional diagnostic tool that assesses overall organizational health across eight critical dimensions, including Financial, Product, People, and Engineering. It uses traffic-light scoring and industry benchmarks to provide deep, actionable insights, making it ideal for board reviews, risk assessment, and monitoring company vitality.

Offers testing guidance covering TDD workflows, unit/integration/E2E organization, framework support, mocking strategy, and coverage to help teams deliver reliable, well-structured test suites.

This comprehensive framework guides the design of sustainable motivation systems for products and teams, shifting focus from outdated 'carrot-and-stick' rewards to intrinsic drivers: Autonomy, Mastery, and Purpose (AMP). It provides deep insights into how to build engaging, lasting user loops and organizational incentives that foster genuine engagement and high performance, especially when traditional gamification fails.

This router bundles 15 specialized compliance skills crucial for HealthTech and MedTech organizations. It provides structured guidance across major global regulations, including ISO 13485 QMS, EU MDR, FDA submissions, GDPR, and the EU AI Act. Use this when a compliance request is complex and needs to be accurately directed to a specific technical skill area (e.g., risk management, CAPA, data security).

Leverage Certificate Transparency (CT) logs via crt.sh and Certstream to proactively monitor for suspicious SSL/TLS certificates. This skill helps detect lookalike domains, unauthorized certificate issuance, and potential phishing infrastructure targeting your organization before attacks launch. Includes querying logic and threat intelligence integration.

This powerful tool leverages DNSTwist, a comprehensive domain permutation engine, to detect various forms of domain impersonation. It generates thousands of potential lookalike domains (including typosquatting, attribute flaws, and homographs) and performs deep checks on DNS records, web page similarity (ssdeep/pHash), and registration status. It is vital for security analysts and threat hunters to proactively monitor for brand squatting and sophisticated phishing threats targeting an organization.

This tool applies advanced role mining techniques (including clustering and formal concept analysis) to analyze existing user-permission assignments. It discovers optimal, minimal role sets for Role-Based Access Control (RBAC) systems, helping organizations mitigate 'role explosion' and enforce the principle of least privilege. Ideal for identity governance and access control architecture redesign.

This framework defines a comprehensive, context-driven matrix for managing security incidents within a Security Operations Center (SOC). It details tiered escalation paths, response Service Level Agreements (SLAs), and notification procedures based not only on severity (P1-P4) but also on business risk, asset criticality, and data sensitivity. It guides analysts through triage, investigation, and timely escalation to management (CISO/Legal) to ensure rapid containment and appropriate organizational response during a breach.

This skill provides a comprehensive framework for tracking vulnerability aging and enforcing Service Level Agreements (SLAs). It calculates time-to-remediation against severity-based deadlines (e.g., 14 days for critical), incorporating adaptive modifiers and automated escalation paths. It is essential for establishing compliance policies, measuring remediation efficiency, and managing organizational risk.

This guide outlines the process of passive external reconnaissance using Open Source Intelligence (OSINT) techniques. Users can map an organization's digital footprint by gathering comprehensive data, including DNS records, subdomains, certificate transparency logs, social media profiles, and leaked credentials. It is critical for the planning phase of penetration testing, asset mapping, or preparing for social engineering, all without actively interacting with target systems.

Simulates advanced persistent threat (APT) activity across the entire cyber kill chain, from reconnaissance to data exfiltration. It evaluates an organization's detection, prevention, and response capabilities using MITRE ATT&CK-aligned techniques, moving beyond typical vulnerability scanning. Ideal for objective-based assessments and purple teaming.

This comprehensive skill guides users through designing and executing advanced social engineering penetration tests. It covers simulating real-world attacks, including phishing (email), vishing (voice), smishing (SMS), and physical pretexting. The goal is to measure an organization's human security resilience, identify training gaps, and test security controls across multiple vectors using tools like GoPhish and SET.