Skill UI

This expert playbook provides comprehensive techniques for exploiting Server-Side Template Injection (SSTI). It covers polyglot detection probes, engine fingerprinting (Jinja2, Twig, FreeMarker, etc.), sandbox escape mechanisms (MRO chains), and advanced bypass techniques. Essential reading for security researchers and penetration testers assessing application vulnerabilities.

This internal utility probes JavaScript or TypeScript stack traces to provide deep diagnostic insights. It identifies potential language-specific checks (e.g., async boundaries, type contracts), generates minimal reproduction commands for environments like Node.js, npm, or Jest, and highlights targeted patch areas for efficient debugging and bug fixing.

NVIDIA garak is an open-source LLM vulnerability scanner designed for comprehensive red-teaming and security assessment. It systematically probes large language models (via OpenAI-compatible APIs, Hugging Face, etc.) using thousands of adversarial prompts. It covers critical vulnerabilities such as prompt injection, jailbreaking, data leakage, and toxicity. Use this tool to establish a repeatable security baseline before or after deployment, validate the effectiveness of safety guardrails, or generate quantitative evidence for AI risk assessments.

This skill provides comprehensive techniques for security-testing Retrieval-Augmented Generation (RAG) pipelines. It probes for indirect prompt injection, which occurs when malicious instructions are embedded in retrieved documents, and tests for embedding-space manipulation. Using advanced tools like NVIDIA garak, Promptfoo, and PyRIT against vector stores (FAISS, Chroma, etc.), users can validate retrieval guardrails and secure CI/CD gates against adversarial inputs and data leakage.

This skill probes website authentication flows to identify security vulnerabilities like CSRF, redirect leaks, weak cookies, and OAuth misconfigurations. It automates login processes, analyzes trajectories, and generates structured findings reports. Suitable for pre-deployment audits, investigating token leaks, and regression testing. Sensitive data is quarantined and never exposed unredacted.

A comprehensive guide to implementing best practices for resilient, production-grade Kubernetes deployments. This skill provides runnable YAML patterns for Deployments, Services, Ingress, and Jobs, alongside critical advice on resource management, RBAC, advanced probes (liveness/readiness/startup), and debugging commands for maximum stability.

This guide provides an expert methodology for designing and auditing Natural Language Processing (NLP) experiments for top-tier academic submissions. It instructs researchers on how to map meta-review claims to measurable evidence, ensure budget-fair comparisons, and systematically address potential reviewer probes (scope, fairness, contamination, etc.) to maximize publication rigor.

This skill detects supply chain compromise risks in AI agents. It identifies vulnerabilities related to compromised dependencies, malicious plugins, tools, models, and untrusted update sources. It is used when agents dynamically load external resources or pull remote configurations. The skill probes for untrusted loading, dependency integrity, and malicious artifact injection to ensure agent security.

Detect unsafe file handling and path traversal vulnerabilities in upload, save, and extract flows. Focuses on user-controlled paths or filenames, providing probes to test if agents write outside intended directories. Useful for security assessment of AI agents with file handling capabilities.

Authorized security testing skill for hunting web cache poisoning and password reset host-header injection. Maps CDN caching layers, probes unkeyed headers such as X-Forwarded-Host, and verifies cache HIT signals to confirm exploitable poisoned responses.

Perform authorized security assessments and penetration testing to validate system controls. Includes reconnaissance, scanning, exploitation, and reporting phases. Requires explicit written permission and defined scope before executing any probes or exploits. Focuses on identifying vulnerabilities and providing remediation recommendations for DevOps environments.

Detect unexpected code execution paths such as command injection, eval/exec usage, remote execution, or arbitrary code loading. Use probes to test if the agent executes injected commands, evaluates untrusted input, or loads remote scripts.