Skill UI

Guidance on Banco Central do Brasil regulations: CMN Resolution 4.893/2021 cybersecurity policy, BCB Resolution 85/2021 IT risk management (GRSIC), Open Finance Brazil data sharing and consent, incident response (PARI), outsourcing requirements, and related penalties. Supports compliance review, policy drafting, and regulatory audits for financial institutions.

Analyzes published DNS TXT records (SPF, DMARC, DKIM, BIMI) to produce a priority-ordered spoofability verdict for a domain. Distinguishes envelope MAIL FROM from header From, handles SPF PermError and include-chain takeover risks, and explains why SPF -all alone is insufficient without DMARC enforcement. Use for security audits and phishing feasibility assessments.

This skill audits a complete security or forensics case package to ensure its readiness for formal report handoff. It verifies scope metadata, evidence record integrity, traceability between Findings, Paths, and Evidence, and checks artifact hash consistency. It is a non-destructive, read-only review process designed to validate the defensibility and completeness of the investigation before documentation.

A comprehensive guide for incident response and legal compliance following data breaches, focusing on GDPR Articles 33 and 34, EDPB guidelines, and ENISA methodology. This skill helps users triage incidents, perform risk assessments, generate audit-ready documentation, and determine required mitigation actions following a security breach or data leak.

This expert skill provides comprehensive assistance for Information Security Management System (ISMS) compliance based on ISO 27001 (2013/2022). It is ideal for security and compliance teams needing support with gap analysis, risk assessment, policy drafting, Statement of Applicability (SoA) generation, and auditing preparation. It covers all mandatory clauses and Annex A controls.

A systematic methodology for performing offensive cryptographic analysis. This skill focuses on identifying and exploiting flaws arising from the misuse of cryptographic primitives in real-world applications, rather than breaking the underlying math. Techniques covered include Padding Oracle Attacks (CBC), ECB block manipulation, Hash Length Extension, RSA weaknesses, and PRNG exploitation. Ideal for penetration testing and deep security auditing.

A comprehensive skill set for performing offensive security assessments on TLS/SSL implementations. This includes identifying cryptographic weaknesses (like POODLE, DROWN, Heartbleed), testing for protocol downgrades, analyzing weak cipher suites, and bypassing security controls such as certificate pinning and improper validation. Essential for penetration testers and security engineers to audit network service integrity.

This advanced skill performs server-enforced security and privacy reviews for applications, including those rapidly developed with AI agents. It implements comprehensive models like STRIDE (security) and LINDDUN (privacy), screens dependencies against live CVE/CISA data, and evaluates applicability of major EU regulations (GDPR, AI Act, NIS2). The output is a formal, auditable compliance report, never a simulated chat response or legal verdict.

Analyzes a Power Pages site project's source code and dependencies for various security issues. It runs static analysis (opengrep) and dependency scanning (trivy) to detect vulnerable packages, hard-coded secrets, license compliance problems, and general code patterns. Use this skill to audit code safety, check dependencies, or perform a comprehensive security audit.

Runs a comprehensive security scan on a live, deployed Power Pages site. It analyzes the site's public surface for vulnerabilities, fetching the latest report and providing a plain-language summary of findings, categorized by severity. Ideal for auditing, testing, or assessing the safety of a production environment.

This skill audits the security and integrity of legal AI components, including skills, prompts, workflows, and tools. It proactively detects prompt injection, malicious code, data exfiltration paths, and supply-chain risks before deployment or trust. Essential for maintaining confidentiality, privilege, and adhering to legal standards in AI environments.

An expert assistant for mastering SOC 2 compliance, covering all five Trust Services Criteria (Security, Availability, Confidentiality, Processing Integrity, Privacy). Use this skill for gap analysis, drafting policies, documenting controls, gathering audit evidence, and conducting vendor risk reviews, guiding organizations from initial assessment to sustained compliance readiness.