Skill UI

Provides comprehensive patterns and techniques for securing AI agent systems. Learn how to enforce governance policies, including tool allow/block lists, content filtering, rate limiting, and human approval workflows. Essential for building robust, compliant, and trustworthy agents in multi-agent or production environments that interact with external APIs and sensitive data.

Guides Python authors from commit to release with end-to-end steps for structuring src layouts, choosing setuptools/hatchling/flit/poetry backends, enforcing SOLID+type-hinting patterns, orchestrating lint/test/CI, managing PEP 440 semantics, and publishing trusted releases to PyPI.

Provides a comprehensive audit of content quality, focusing on E-E-A-T (Experience, Expertise, Authoritativeness, Trustworthiness) signals, readability, and structural integrity. Use this tool when reviewing content for SEO optimization, assessing academic citation readiness, or ensuring adherence to modern search engine and AI best practices.

A comprehensive CLI for managing the entire lifecycle of Windows applications. It handles initialization, building, packaging into MSIX, signing, debugging, and advanced UI automation via Microsoft UI Automation. Supports multiple modern frameworks including .NET, C++, Electron, Rust, and Flutter, streamlining the deployment process to the Microsoft Store.

Gtars offers local genomic interval models, set algebra, overlap/count operations, consensus and coverage, tokenization, fragment processing, and refget/BEDbase planning across Python, Rust, and CLI.

A comprehensive guide covering advanced exploitation techniques for insecure deserialization vulnerabilities across multiple languages (Java, PHP, Python, .NET, Node.js). It details how to enumerate data sinks (cookies, message queues), fingerprint various serialization formats (e.g., Pickle, Marshal, JSON.NET), and construct complex gadget chains using tools like ysoserial. This is essential for penetration testers reviewing applications that process untrusted serialized input.

This comprehensive, zero-trust security auditor scans third-party AI agent skills before installation. It performs a rigorous 6-phase review process, analyzing surface patterns, script integrity, permissions, and supply chain risks. It is designed to detect malicious payloads, credential theft, instruction overrides, and prompt injection attacks, ensuring secure AI development and deployment.

Methodology for red team testing of on-prem Active Directory, hybrid AD/Entra ID, and ADCS. Covers reconnaissance, credential abuse, privilege escalation, lateral movement, persistence, trust abuse, and Defender for Identity evasion.

This comprehensive playbook guides the testing of Cross-Origin Resource Sharing (CORS) misconfigurations. It focuses on detecting critical vulnerabilities such as reflected origins, wildcard trust misuse, credentialed cross-origin reads, and bypasses in origin allowlists. Use this when analyzing browser-based access and trust boundaries for authenticated APIs.

This comprehensive guide details advanced techniques for circumventing Content Security Policies (CSP). It covers exploiting weaknesses in critical directives (e.g., base-uri, object-src), abusing nonces, leveraging trusted CDN endpoints, and executing code despite strict controls like script-src 'self' or 'strict-dynamic'. Essential knowledge for deep security auditing and penetration testing.

An expert playbook detailing DNS rebinding techniques to bypass the Same-Origin Policy (SOP). This method is used in penetration testing to exploit client-side applications that rely on DNS resolution for origin checks, allowing attackers to trick the browser into sending requests to internal, non-publicly accessible services (like cloud metadata endpoints) while maintaining a seemingly trusted origin.

This skill provides a comprehensive playbook for testing the security of SAML-based Single Sign-On (SSO) solutions. It focuses on validating assertion trust by checking signature coverage, audience and recipient restrictions, handling of Assertion Consumer Service (ACS), and identifying potential XML parsing weaknesses or IdP/SP confusion flaws. Use this when evaluating enterprise authentication systems for critical security vulnerabilities.