Skill UI

A highly specialized skill for advanced security analysis, designed to trace complex Kerberos delegation chains (including constrained, unconstrained, and RBCD). Use this skill to pinpoint the exact delegation edge, analyze ticket minting (S4U), and prove the effective privilege gained by a target service, going beyond simple domain compromise statements.

A specialized deep-dive skill for analyzing container-to-host escape vulnerabilities. This tool is used after a sandbox orchestrator establishes initial assumptions, focusing on mapping isolation boundaries (namespaces, cgroups, seccomp, capabilities). It helps prove boundary crossings, identify minimal exploit primitives, and determine if an exploit can break out of the container context to the host kernel.

This specialized skill is designed for deep forensic analysis of compromised Linux environments, specifically tracing the sequence of credential usage (tokens, keys, service accounts) that leads to lateral movement or privilege escalation. It helps map the decisive path from a recovered artifact to an accepted replay mechanism, identifying the exact trust edge or capability abuse responsible for the host-to-host pivot.

This specialized skill is designed for advanced forensic analysis and penetration testing within Windows environments. It focuses on extracting and proving the replayability of credentials, tickets, and secrets stored in LSASS memory, Kerberos ticket caches, DPAPI, and SSP artifacts. Use it to establish the minimal, actionable chain (host artifact -> extracted material -> accepted privilege) that proves a decisive edge for privilege escalation.

This advanced skill specializes in analyzing complex mail-related abuse scenarios, including OAuth consent flows, forwarding rule exploitation, shared mailbox access, and transport rule manipulation. It is used in forensic investigations to trace message artifacts, identify persistence mechanisms, and prove privilege escalation or data exfiltration following a compromise.

This specialized skill automates advanced forensic network analysis on captured packet data (PCAP). It is designed for reconstructing complex network sessions (TCP/UDP), decoding obscure or custom protocols (e.g., C2, custom binary), and correlating packet sequences with host or malware behavior. Use when evidence is embedded in protocol framing, timing, or session state, requiring reassembly beyond simple packet inspection.

This advanced skill is designed for security research and CTF environments to trace subtle divergences in request handling across multiple network hops (proxies, gateways, backend servers). It focuses on identifying vulnerabilities stemming from differential interpretation of headers, path normalization, transfer framing (CL/TE), and host derivation, crucial for detecting request smuggling and parsing inconsistencies.

This specialized skill is used to trace complex network requests through multi-layered infrastructure, such as reverse proxies, container boundaries, and various header manipulations. It is essential for determining which specific node, proxy rule, or derived header ultimately serves a live request within a sandboxed environment. Use it when analyzing VHost routing, path rewrites, or X-Forwarded headers to pinpoint the decisive backend.

This advanced skill specializes in tracing the complete provenance of software artifacts across the entire development lifecycle. It is designed for deep security analysis of CI/CD pipelines, identifying dependency drift, build tampering, package origin, and determining the final artifact consumed at runtime. Use it when investigating integrity vulnerabilities in complex release flows.

A specialized, downstream skill designed for forensic analysis within a confined sandbox environment, particularly for CTF challenges. It guides the user to inspect the full stack behavior, including API interactions, server routing, browser state (cookies, local storage), and asynchronous worker processes. Use this skill to trace complex, end-to-end request flows, debug authentication/session leaks, or diagnose discrepancies between frontend UI and backend enforcement.

A specialized skill for analyzing complex, host-to-host lateral movement chains within a Windows environment. It focuses on tracing protocols like WinRM, SMB, and RDP, replaying captured Kerberos tickets, understanding privilege edges, and identifying the exact accepting service or host that facilitates credential movement. Used in advanced penetration testing and digital forensics scenarios.

This skill provides a structured, multi-step guide for automating interactions with desktop applications. It emphasizes obtaining a reliable context via observation, preferring UI Automation (using element IDs for buttons, menus, or editable fields) over raw coordinates. It covers best practices for keyboard input and ensuring state consistency across major operating systems (Windows/macOS), making it suitable for complex, reliable process automation.