Skill UI

This skill provides deep security review for GitHub Actions workflow files. It focuses on the unique Actions threat model—identifying vulnerabilities like script injection via ${{ }} interpolation, privilege escalation from triggers (e.g., pull_request_target), and ensuring least-privilege permissions for CI/CD pipelines. Use it to audit, secure, or harden existing workflows, preventing attacks from untrusted inputs and supply chain risks.

This tool audits Kubernetes Role-Based Access Control (RBAC) configurations to systematically identify overly permissive roles, dangerous wildcards, and insecure ClusterRoleBindings. It helps pinpoint potential privilege escalation paths, service account abuses, and compliance gaps in EKS, GKE, and AKS clusters, ensuring adherence to the principle of least privilege.

This skill uses Python and boto3 to analyze AWS CloudTrail logs. It establishes statistical baselines of normal API activity and detects various anomalies, such as unusual event sources, first-time API usage, geographic IP deviations, and high-frequency calls. This is critical for identifying credential compromise, privilege escalation, and unauthorized resource access in a security incident.

A comprehensive security auditing tool designed to identify over-permissive Role-Based Access Control (RBAC) roles and potential service-account token abuse paths within a Kubernetes cluster. It systematically reviews cluster bindings, effective permissions, and common escalation primitives using advanced tools like `kubectl auth can-i`, `rbac-police`, and `rakkess`, ensuring adherence to the principle of least privilege.

A powerful offensive security toolkit for red-teaming and penetration testing. It systematically enumerates and exploits various misconfigurations within Active Directory Certificate Services (AD CS) using Certipy. This allows attackers to forge privileged certificates, perform PKINIT authentication, and achieve domain compromise and privilege escalation, even without knowing user passwords. Ideal for validating security hardening.

Pacu is an open-source, modular AWS exploitation framework designed for authorized cloud penetration testing and red-teaming. It functions as a cloud-pentest analogue to Metasploit, enabling users to enumerate AWS resources, scan for privilege escalation paths, and automate the exploitation of IAM vulnerabilities, persistence mechanisms, and data exfiltration. Use this skill to assess the blast radius of compromised credentials in a controlled, authorized environment.

This skill enables comprehensive security graph mapping by ingesting both on-premises Active Directory data (via SharpHound) and cloud Entra ID data (via AzureHound) into BloodHound CE. It analyzes complex, hybrid attack paths, allowing security teams to identify critical privilege escalation chains from low-privileged accounts to Tier-0 assets, mapping findings to MITRE ATT&CK.