Skill UI

This skill is designed for deep security and behavioral analysis within the Kubernetes control plane. It specializes in tracing complex interactions, including RBAC edge cases, service-account trust paths, admission webhook behavior, resource mutation, and cluster-level state drift. Use it when diagnosing why live workloads differ from manifest declarations, or when investigating cluster-wide permission issues.

A highly specialized skill for advanced security analysis, designed to trace complex Kerberos delegation chains (including constrained, unconstrained, and RBCD). Use this skill to pinpoint the exact delegation edge, analyze ticket minting (S4U), and prove the effective privilege gained by a target service, going beyond simple domain compromise statements.

This specialized skill is designed for deep forensic analysis of compromised Linux environments, specifically tracing the sequence of credential usage (tokens, keys, service accounts) that leads to lateral movement or privilege escalation. It helps map the decisive path from a recovered artifact to an accepted replay mechanism, identifying the exact trust edge or capability abuse responsible for the host-to-host pivot.

This specialized skill is designed for advanced forensic analysis and penetration testing within Windows environments. It focuses on extracting and proving the replayability of credentials, tickets, and secrets stored in LSASS memory, Kerberos ticket caches, DPAPI, and SSP artifacts. Use it to establish the minimal, actionable chain (host artifact -> extracted material -> accepted privilege) that proves a decisive edge for privilege escalation.

This advanced skill specializes in analyzing complex mail-related abuse scenarios, including OAuth consent flows, forwarding rule exploitation, shared mailbox access, and transport rule manipulation. It is used in forensic investigations to trace message artifacts, identify persistence mechanisms, and prove privilege escalation or data exfiltration following a compromise.

A highly specialized, downstream skill for advanced threat analysis. This tool is used to recover hidden configurations, decode C2 (Command and Control) parameters, unpack staged payloads, and extract Indicators of Compromise (IOCs) from complex malware samples. It focuses on identifying the exact decode chains—including compression, encoding, and crypto steps—and linking recovered fields to observed behavioral outcomes within a sandbox environment.

This specialized skill automates advanced forensic network analysis on captured packet data (PCAP). It is designed for reconstructing complex network sessions (TCP/UDP), decoding obscure or custom protocols (e.g., C2, custom binary), and correlating packet sequences with host or malware behavior. Use when evidence is embedded in protocol framing, timing, or session state, requiring reassembly beyond simple packet inspection.

A specialized downstream skill for analyzing security vulnerabilities in complex agentic systems. This tool is designed for red teaming and penetration testing, focusing on detecting prompt injection, retrieval poisoning, memory contamination, planner drift, and tool boundary abuse within multi-step LLM chains. Use when proving how untrusted inputs compromise system integrity.

This skill is designed for deep forensic analysis of asynchronous processing chains, specifically focusing on 'drift'—behavioral or configuration differences between a synchronous request path and subsequent worker-executed tasks. Use it to trace payloads, inspect worker-only state, follow retry mechanisms, handle dead-letter queues, or connect enqueued items to eventual side effects (e.g., file writes, cache updates, emails). It is a specialized downstream tool, requiring prior orchestration context.

This specialized skill is designed to analyze complex security flaws involving forced authentication (coercion) and identity relay chains. It guides users to trace and document the complete, minimal path from the initial coercion trigger (e.g., a specific service or protocol edge) through intermediate hops, to the final service that accepts the relayed credentials. Use this for deep security research, forensics, and documenting the decisive sequence leading to privilege escalation or code execution.

This specialized skill guides deep-dive analysis for binary-heavy challenges, including CTF, malware analysis, and advanced forensics. It covers reverse engineering binaries, unpacking samples, inspecting memory dumps, debugging crashes, and building exploit chains by correlating artifacts like files, memory, and network packets.

This specialized downstream skill is designed for deep analysis of complex attack paths originating from Server-Side Request Forgery (SSRF). It systematically tracks the entire exploitation chain: from the initial SSRF source (e.g., webhook, URL parameter) through internal service reachability, metadata endpoint exploitation, credential extraction, and finally, demonstrating how an attacker achieves accepted access or elevated privileges. Use this when tracing the decisive path through server-side requests and credential pivoting.