Skill UI

This skill generates a comprehensive, structured threat model for any given service or feature using the STRIDE framework. It guides users through identifying critical assets, defining trust boundaries, enumerating specific threats (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege), assessing risk, and proposing concrete mitigation controls. Ideal for security design reviews and documentation.

Microsoft Entra PIM enforces Just-in-Time (JIT) access by replacing standing (permanent) privileges with time-bound, eligible assignments. This workflow mandates explicit role activation, justification, Multi-Factor Authentication (MFA), and optional approval workflows, significantly reducing the attack surface and ensuring adherence to Zero Trust principles for critical Azure and Entra roles.

This skill deploys Remote Browser Isolation (RBI) as a core component of a Zero Trust security architecture. It implements sophisticated isolation policies utilizing URL categorization, risk-based routing, and Content Disarming and Reconstruction (CDR) for file sanitization. It provides robust data loss prevention controls, effectively mitigating zero-day exploits, phishing, and data exfiltration across isolated web sessions, and integrating with SWG and ZTNA platforms.

Implements HashiCorp Vault's dynamic secrets engine to automatically generate, lease, and rotate short-lived credentials for databases (e.g., Postgres, MySQL), AWS IAM keys, and PKI certificates. This eliminates the risk associated with storing static secrets, ensuring compliance with zero-trust principles and automating the entire secret lifecycle.

This skill details the implementation of continuous identity verification for Zero Trust architectures. It covers deploying phishing-resistant Multi-Factor Authentication (FIDO2/WebAuthn), establishing risk-based conditional access policies, and integrating identity governance controls aligned with NIST and CISA frameworks. Learn how to move beyond traditional passwords to dynamic, adaptive security models.

A comprehensive guide for conducting authorized vishing (voice phishing) pretext calls. This technique, utilized in red-teaming, simulates an attacker impersonating a trusted authority (e.g., IT support, vendor) to test an organization's human security controls. It measures employee adherence to verification protocols and highlights vulnerabilities in staff security awareness.

Provides a comprehensive guide to implementing Zero Trust Network Architecture on Google Cloud Platform (GCP) using Identity-Aware Proxy (IAP). It enforces rigorous, per-request identity verification and context-aware authorization for services like Compute Engine, App Engine, and Cloud Run. This ensures that only authenticated users who meet specific criteria (e.g., device posture, corporate location, time window) can access protected resources, eliminating reliance on public IPs or VPNs.

This skill enforces a rigorous data validation protocol by establishing hard boundaries at every point data enters the system (API requests, user input, environment variables, webhooks, etc.). It mandates a four-phase process: detection, trust classification, mandatory filtering (schema validation, sanitization, type checking), and final verification. This prevents untrusted data from reaching core business logic, mitigating risks like SQL injection and XSS.

A comprehensive security tool designed to detect and defend against subtle prompt injection attacks hidden within untrusted multi-modal content, such as web pages, PDFs, and images. It scans for obfuscated payloads (e.g., hidden CSS, metadata, zero-width characters) by combining content normalization, heuristic analysis, and dedicated ML detectors, ensuring that LLM agents only consume sanitized, trustworthy input.

This skill provides a comprehensive, cross-platform workflow for auditing UEFI firmware security. It detects advanced threats like bootkits (e.g., BlackLotus, Bootkitty) and Secure Boot bypasses by verifying the integrity of the platform's trust chain. Key checks include confirming Secure Boot status, assessing the currency and application of DBX revocations, and examining the protection of critical EFI variables using specialized tools. Essential for hardware security assessments and forensic investigation.

CloudFox is an open-source, attacker-centric tool designed for authorized cloud penetration testing. It maps attack paths and identifies exploitable misconfigurations across AWS and Azure environments. By simulating an attacker's perspective, it goes beyond simple configuration audits to reveal critical assets, exposed secrets, and lateral movement opportunities (like STS AssumeRole trust relationships), providing comprehensive situational awareness for security assessment.

This skill is designed for proactive firmware forensics and advanced threat hunting. It analyzes the EFI System Partition (ESP) to detect sophisticated, pre-OS persistence mechanisms, such as UEFI bootkits (e.g., BlackLotus, ESPecter). Detection methods include verifying file hashes against a trusted golden baseline, checking Secure Boot signatures, scanning with YARA, and flagging structural anomalies within the ESP.