Skill UI

A comprehensive security assessment skill for identifying vulnerabilities in federated identity systems, including SAML, OIDC, and OAuth 2.0 flows. It covers common misconfigurations, such as signature tampering, PKCE failures, redirect URI issues, and token confusion, ensuring robust SSO implementation.

A comprehensive framework for conducting authorized security assessments on Large Language Models (LLMs) and AI agents. It covers critical vulnerabilities including advanced prompt injection (OWASP Top 10), tool abuse, RAG data poisoning, memory manipulation, and system prompt extraction. Ideal for red teaming, security auditing, and ensuring the robustness of AI systems in production environments.

A sophisticated, multi-agent system designed to perform deep, comprehensive code reviews on pull requests. It covers core elements like code quality, functionality, security vulnerabilities, and testing coverage. Advanced features include detecting scope drift, enforcing SOLID principles, identifying DRY violations, and providing anti-hallucination safeguards for maintain high software integrity.

This tool performs a rapid, heuristic security assessment focused on identifying common vulnerabilities listed in the OWASP Top 10. It scans source code for hardcoded secrets, SQL injection risks, XSS vectors, insecure dependencies, and authentication flaws. It is ideal for pre-commit checks or code reviews before merging sensitive changes.

This tool simulates a senior application security engineer, performing a comprehensive, multi-phase audit. It checks for exposed secrets, prompt injection vectors, dependency vulnerabilities (supporting multiple languages), and critical configuration misconfigurations. It provides a scored, prioritized remediation report, ensuring a robust security posture before deployment.

A comprehensive framework for assessing software supply chain security. It covers generating Software Bill of Materials (SBOM), performing Software Composition Analysis (SCA) on open-source dependencies, auditing CI/CD pipelines, and analyzing container images. This skill helps identify vulnerabilities, ensure build integrity, and verify component provenance across the entire development lifecycle.

This comprehensive guide outlines a structured methodology for conducting authorized security testing on desktop thick clients (Win/macOS/Linux). It covers critical attack vectors, including local storage analysis, Inter-Process Communication (IPC) vulnerabilities, network traffic interception, client-side trust boundaries, and advanced reverse engineering techniques using tools like IDA and Ghidra.