Skill UI

This skill guides the secure management and operation of Virtual Private Servers (VPS) and deployed server-side agents. Use it when SSH access, system restarts, log inspection, or complex workflow automation (like n8n or custom agents) is required on authorized remote hosts. It emphasizes following strict operational protocols and obtaining explicit user permission for sensitive actions.

Scan systems and dependencies for CVEs and security vulnerabilities using industry-standard tools like Nessus, OpenVAS, and Nuclei. Supports Docker deployment, API integration, and template-based scanning for infrastructure and application security assessments. Requires authorized scope and explicit permission before execution.

This skill helps plan and review read-only data warehouse analysis with explicit scope, privacy, and validation checks. It turns business questions into reproducible analysis plans without assuming specific schemas. It identifies needed data, reviews proposed queries for risks like grain or privacy, and ensures results are communicated accurately. Suitable for authorized data warehouse usage, query review, and analysis documentation while avoiding administrative tasks.

Delegate bounded coding tasks to the Warp Agent CLI (oz) while the orchestrator writes the brief, reviews the diff, and lands the commit. Requires the authenticated oz CLI, Node 18+, and git.

This comprehensive workflow guides users through a multi-phase process for assessing web application security. It is designed to systematically test for common vulnerabilities listed in the OWASP Top 10, including SQL injection, XSS, broken authentication, and access control issues. Ideal for professional penetration testing, security auditing, and bug bounty hunting.

A comprehensive asset discovery pipeline for authorized security assessments. It automates subdomain enumeration, live host detection, URL crawling, and vulnerability scanning using tools like subfinder, httpx, nuclei, and katana, delivering prioritized URL lists for penetration testing.

This skill provides a framework for auditing Web3 smart contracts for security vulnerabilities. It includes pre-audit risk assessment strategies, critical bug class identification (like accounting desynchronization and access control), and Solidity code analysis techniques. Designed for authorized security assessments and educational purposes, it helps identify high-value targets and common exploit patterns in blockchain protocols.

Authorized wireless security assessment skill for Wi-Fi capture, WPA handshake analysis, rogue AP detection research, and lab-only deauthentication testing. Includes workflow, toolchain, and safety guidelines for ethical use.

Enables authorized offensive security assessments on Windows Active Directory environments. Covers Kerberos abuse, AD CS escalation, BloodHound path analysis, NTLM relay, and domain privilege escalation techniques. Requires explicit written permission and strict authorization gates before execution. Designed for educational purposes or authorized security assessments only.

Systematic methodologies for discovering and exploiting Windows privilege escalation vulnerabilities in authorized penetration testing, covering service path abuse, AlwaysInstallElevated, token impersonation, unquoted paths and credential harvesting.

Assess WordPress installations for common vulnerabilities and attack surfaces. Use this skill for authorized security assessments, penetration testing, and defensive validation. Includes WPScan, Metasploit, and Burp Suite integration with legal and technical constraints.

This skill enables users to create, maintain, and validate YYLO Ledger workflow records using the yy CLI. It emphasizes strict separation between storage, execution, and evidence boundaries to ensure safety and provenance. Users can search, retrieve, and update workflow definitions while preventing unauthorized execution or data mutation.