Skill UI

This specialized skill is designed for deep forensic analysis of compromised Linux environments, specifically tracing the sequence of credential usage (tokens, keys, service accounts) that leads to lateral movement or privilege escalation. It helps map the decisive path from a recovered artifact to an accepted replay mechanism, identifying the exact trust edge or capability abuse responsible for the host-to-host pivot.

This specialized skill is designed for advanced forensic analysis and penetration testing within Windows environments. It focuses on extracting and proving the replayability of credentials, tickets, and secrets stored in LSASS memory, Kerberos ticket caches, DPAPI, and SSP artifacts. Use it to establish the minimal, actionable chain (host artifact -> extracted material -> accepted privilege) that proves a decisive edge for privilege escalation.

This advanced skill specializes in analyzing complex mail-related abuse scenarios, including OAuth consent flows, forwarding rule exploitation, shared mailbox access, and transport rule manipulation. It is used in forensic investigations to trace message artifacts, identify persistence mechanisms, and prove privilege escalation or data exfiltration following a compromise.

This specialized skill is designed to analyze complex security flaws involving forced authentication (coercion) and identity relay chains. It guides users to trace and document the complete, minimal path from the initial coercion trigger (e.g., a specific service or protocol edge) through intermediate hops, to the final service that accepts the relayed credentials. Use this for deep security research, forensics, and documenting the decisive sequence leading to privilege escalation or code execution.

A comprehensive guide detailing advanced, authorized techniques for Active Directory security testing and red teaming. It covers critical attack vectors such as Kerberos exploitation, BloodHound path analysis, NTLM relay, and domain privilege escalation. Designed for security professionals to systematically map and exploit domain weaknesses.

Coordinates authorized multi-stage security assessments including full penetration testing, external-to-domain compromise, and attack path planning. The skill acts as a central orchestrator, routing reconnaissance, initial access, privilege escalation, lateral movement, and reporting tasks to specialized sub-skills. Intended for authorized engagements only.

A comprehensive methodology for exploiting modern Continuous Integration/Continuous Delivery (CI/CD) pipelines. This skill covers advanced attack vectors across major platforms, including GitHub Actions expression injection, Jenkins RCE, GitLab YAML abuse, and Azure DevOps compromise. Techniques focus on privilege escalation, credential theft, and supply chain poisoning, mapping to MITRE ATT&CK T1195.002.

A comprehensive guide covering advanced Linux privilege escalation techniques. It details a systematic methodology to move from a low-privilege shell to root, exploiting misconfigurations in SUID/SGID binaries, abusing Linux capabilities, targeting sudo flaws (NOPASSWD), and leveraging kernel or system service vulnerabilities. Essential for red team and penetration testing engagements.

A comprehensive guide detailing offensive methodologies for exploiting Layer 2 (ARP spoofing, VLAN hopping) and Layer 3 (DNS poisoning, DHCP attacks) network infrastructure. Covers credential capture, traffic interception, and privilege escalation using tools like Bettercap, Responder, and ntlmrelayx. Essential for authorized internal penetration testing and red teaming.

Detailed methodology for achieving NT AUTHORITY\SYSTEM or local Administrator privileges on Windows targets. Covers token impersonation (JuicyPotato, PrintSpoofer), exploiting service misconfigurations, DLL hijacking, UAC bypass techniques, persistent access, and credential harvesting (LSA, DPAPI). Essential toolkit for red team and penetration testing engagements.

Orchestrates authorized multi-stage security engagements spanning reconnaissance, initial access, privilege escalation, and lateral movement. Plans coherent attack paths and coordinates specialist tools for comprehensive penetration testing and red team operations.

Performs non-intrusive static analysis of AI Skills and Bundles to detect malicious patterns, data leaks, privilege escalation, obfuscated payloads, persistence and mobile threats across Windows, macOS, Linux/Unix, Android and iOS, producing evidence-based audit reports.