Skill UI

This skill assists users in defining, adapting, and designing bounded, structured feedback loops for AI agents. Whether you need to find a suitable existing workflow, fine-tune a published loop, or design a new process from scratch, this tool guides you through a safe, iterative methodology. It emphasizes setting clear stopping rules, guardrails, and verifiable, measurable steps to ensure the automation remains controllable and focused.

ROADtools is a comprehensive offensive toolkit for Microsoft Entra ID (Azure AD). It consists of ROADrecon for offline directory enumeration (users, groups, roles, policies) and roadtx for advanced token acquisition and exchange. It is designed for authorized red-teaming and penetration testing to discover attack paths and pivot tokens across various Microsoft resources.

A comprehensive security auditing tool designed to identify over-permissive Role-Based Access Control (RBAC) roles and potential service-account token abuse paths within a Kubernetes cluster. It systematically reviews cluster bindings, effective permissions, and common escalation primitives using advanced tools like `kubectl auth can-i`, `rbac-police`, and `rakkess`, ensuring adherence to the principle of least privilege.

This skill provides comprehensive security auditing for Model Context Protocol (MCP) servers and their associated tool metadata. It is designed to detect sophisticated supply chain attacks, including tool poisoning (indirect prompt injection), Server-Side Request Forgery (SSRF), tool shadowing, and unauthenticated exposure. It is essential for securing AI agent stacks before integrating new tools or during CI/CD processes.

This comprehensive tool manages all aspects of a brand's identity, including voice, visual standards, messaging frameworks, and asset management. It helps teams maintain brand integrity by synchronizing guidelines (e.g., markdown) into actionable digital tokens (JSON/CSS) and validating assets, ensuring all content and designs adhere to established rules and standards.

A comprehensive security tool designed to detect and defend against subtle prompt injection attacks hidden within untrusted multi-modal content, such as web pages, PDFs, and images. It scans for obfuscated payloads (e.g., hidden CSS, metadata, zero-width characters) by combining content normalization, heuristic analysis, and dedicated ML detectors, ensuring that LLM agents only consume sanitized, trustworthy input.

Stratus Red Team is an open-source tool designed for detection engineering and purple teaming. It programmatically detonates granular, documented offensive techniques across major cloud platforms (AWS, Azure, GCP, and Kubernetes). It validates existing security detections (like CloudTrail/GuardDuty) by simulating real attacker activity in a controlled, reversible environment. The tool ensures deterministic lifecycles, guaranteeing that all created resources are cleaned up after testing.

CloudFox is an open-source, attacker-centric tool designed for authorized cloud penetration testing. It maps attack paths and identifies exploitable misconfigurations across AWS and Azure environments. By simulating an attacker's perspective, it goes beyond simple configuration audits to reveal critical assets, exposed secrets, and lateral movement opportunities (like STS AssumeRole trust relationships), providing comprehensive situational awareness for security assessment.

NetExec is a powerful, protocol-oriented tool for penetration testing, designed for assessing and exploiting Windows and Active Directory environments. It facilitates lateral movement by authenticating over protocols like SMB, WinRM, LDAP, and MSSQL. Key functions include password spraying, comprehensive network enumeration, command execution, and dumping critical credentials (SAM, LSA, NTDS) during post-exploitation phases.

PyRIT (Python Risk Identification Tool) is an open-source automation framework designed for advanced, multi-turn adversarial red-teaming of conversational LLMs. It simulates real-world attack scenarios by orchestrating an attacker model and a scorer model in a feedback loop. Features include Crescendo (gradual escalation) and Tree-of-Attacks with Pruning (TAP) techniques to detect complex vulnerabilities like prompt injection and jailbreaks in stateful dialogues.

This comprehensive tool suite provides high-fidelity parsers for key Windows artifacts, including MFT, Registry hives, Prefetch files, and ShellBags. Designed for digital forensics and incident response, it converts raw system evidence into structured CSV/JSON formats. The output is optimized for feeding into Timeline Explorer, enabling analysts to build comprehensive, correlated timelines and establish a clear chain of events.

A specialized tool for generating sophisticated, strategic HTML presentations. It integrates data visualization using Chart.js, adheres to design tokens for consistency, ensures responsive layouts, and incorporates proven copywriting formulas and slide strategies, making your pitch decks highly impactful for marketing and business needs.