Skill UI

This skill provides a comprehensive framework for performing authorized penetration testing on Google Cloud Platform (GCP). It uses specialized tools like GCPBucketBrute to enumerate publicly accessible storage buckets and audits IAM policies to identify overly permissive role bindings. The process includes checking service account keys and mapping potential privilege escalation paths, generating actionable, risk-scored reports for robust cloud security posture management.

This skill enables systematic assessment of cloud infrastructure configurations across AWS, Azure, and GCP to identify security misconfigurations such as IAM privilege escalation paths, public storage exposure, and network over-permissioning. It maps findings to MITRE ATT&CK frameworks and provides remediation guidance for preventive security management rather than active incident response.

This guide details Algolia's security best practices, focusing on scoped API keys. It covers essential concepts like separating API keys for frontend vs. backend use, applying the principle of least privilege, and generating secured, time-limited, per-user keys. It also provides a complete procedure for key rotation to maintain a robust production security posture.

This skill guides the detection and recovery of exposed version-control system (VCS) metadata, including paths for Git, SVN, and Mercurial, as well as common backup and configuration files. It is essential for authorized penetration testing when assessing an application's security posture against information leaks. Techniques include probing specific directories (e.g., /.git/HEAD) and analyzing status codes (e.g., 403 vs 404) to confirm exposure.

This skill enables users to identify and exploit authentication and session management vulnerabilities in web applications. It covers testing methodologies for password policies, session handling, multi-factor authentication, and credential management. Commonly associated with OWASP Top 10 risks, it helps assess security posture against account takeover and unauthorized access.

This skill provides command-driven methods to audit and harden security configurations across common SaaS platforms like GitHub, Slack, Google Workspace, and AWS. It covers inventory auditing, OAuth management, identity verification, branch protection, and session policies to prepare for compliance audits and reduce security risks.