Skill UI

Helps teams ship reliable AI-powered products by detailing LLM integration patterns, RAG architecture, scalable prompt engineering, UX resilience, and cost-aware design.

This guide details how to implement robust, multi-layered Role-Based Access Control (RBAC) for managing LLM API calls to Groq in an enterprise setting. It covers best practices for API key scoping, application-level authorization (model selection, token limits), rate limiting, and detailed spending control mechanisms, ensuring secure and cost-effective usage across multiple teams.

A comprehensive toolkit designed to professionalize LLM prompt workflows. It moves prompts from ad-hoc drafts to measurable, production-ready assets through A/B testing against structured test cases, immutable version tracking, and governance guidelines. Essential for marketing teams needing verifiable quality and safety for AI-generated content.

A comprehensive security auditing framework designed to systematically detect sensitive information disclosure from Large Language Models (LLMs). It uses multi-phase, escalating dialogue probes to test for leaks such as system prompts, API keys, PII, and internal configurations. Essential for red teaming and rigorous model security assessment.

A comprehensive offensive checklist for assessing the security and robustness of AI and Large Language Model (LLM) applications. It covers advanced adversarial techniques such as prompt injection, jailbreaking, model extraction, data poisoning, and analyzing system vulnerabilities across components. Essential for red-teaming and security assessment.

This skill provides a comprehensive framework for security auditing LLM agents that possess external tools (file system access, command execution, network calls). It employs advanced dialogue probing techniques—such as command injection, path traversal, and SSRF attempts—to identify vulnerabilities where the agent might be induced to execute unexpected or malicious code, or access sensitive resources. Essential for red teaming and securing agent functionalities.

This comprehensive canvas guides teams through developing robust AI-powered features. It ensures product decisions are rigorous by covering problem definition, model selection (LLM, RAG, etc.), data governance, evaluation metrics, user experience design (including fallbacks), and responsible AI compliance. Ideal for assessing AI readiness and preventing common product failures.

This skill details advanced red-teaming techniques for forcing machine account authentication using RPC coercion methods (e.g., MS-EFSR, MS-RPRN) via tools like Coercer and PetitPotam. It demonstrates how to complete a coercion-relay chain against Domain Controllers, facilitating NTLM relay attacks against services like AD CS Web Enrollment (ESC8) or LDAP, ultimately aiming for domain compromise. Use only in authorized engagements.

An automated framework for continuous, repeatable red-teaming of LLM applications within CI/CD pipelines. It integrates Promptfoo and DeepTeam to test against recognized vulnerabilities like OWASP LLM Top 10, OWASP Agentic, and MITRE ATLAS (e.g., Prompt Injection, Jailbreaks). This ensures that security vulnerabilities do not regress after code or model changes, providing a critical merge-blocking security gate for production LLM apps.

An open-source automation framework for conducting multi-turn, adversarial red-teaming against conversational LLMs. PyRIT simulates real-world attacker behavior using advanced orchestrators (Crescendo, TAP) and scorer feedback loops. It is designed for comprehensive security assessments of AI agents and chatbots, going far beyond single-shot prompt testing to evaluate robustness under gradual or adaptive attacks.

NVIDIA garak is an open-source LLM vulnerability scanner designed for comprehensive red-teaming and security assessment. It systematically probes large language models (via OpenAI-compatible APIs, Hugging Face, etc.) using thousands of adversarial prompts. It covers critical vulnerabilities such as prompt injection, jailbreaking, data leakage, and toxicity. Use this tool to establish a repeatable security baseline before or after deployment, validate the effectiveness of safety guardrails, or generate quantitative evidence for AI risk assessments.

This technique exploits vulnerable Active Directory Certificate Services (AD CS) HTTP web-enrollment endpoints (ESC8) that lack Extended Protection for Authentication (EPA). By coercing a Domain Controller (DC) to authenticate and relaying the captured NTLM credentials, an attacker can obtain a DC machine certificate. This certificate is then used via PKINIT to request a TGT, recover the DC's NT hash, and ultimately achieve full domain compromise via DCSync. Essential for advanced AD red-teaming simulations.