Skill UI

Guides authorized practitioners through Nmap, Masscan, Nessus, OpenVAS, Burp Suite, and OWASP ZAP for network discovery, vulnerability assessment, web application testing, wireless security, and compliance reporting across diverse environments.

A powerful skill for conducting structured, systematic code reviews for PRs and MRs. It goes beyond basic style checks, performing deep analysis such as blast radius tracing, comprehensive security scanning (SQLi, XSS, secrets), detecting breaking changes in APIs/DB schemas, and calculating test coverage delta. Ideal for reviewing large, complex, or security-sensitive code changes before merging.

Coordinates discovery, matching, and workflow orchestration across agent ecosystems, automatically scanning SKILL.md, ranking relevant skills, and executing multi-step plans for complex requests.

This skill provides a comprehensive method for detecting kernel-level rootkits on Linux systems. It leverages memory forensics using Volatility3 on physical memory dumps, combined with cross-view analysis (comparing /proc vs /sys) and live system scanning (rkhunter). Techniques include identifying hooked syscall tables, discovering hidden kernel modules, and detecting tampered system structures.

This tool parses NetFlow v9 and IPFIX records to conduct deep network security analysis. It is crucial for investigating security incidents by building traffic baselines and applying statistical methods. Key detection capabilities include identifying port scanning, data exfiltration attempts, command and control (C2) beaconing patterns, and general volumetric anomalies in network traffic.

This comprehensive guide details how to design and implement an end-to-end DevSecOps pipeline leveraging GitLab CI/CD. It integrates crucial automated security checks—such as SAST, DAST, container scanning, dependency scanning, and secret detection—directly into the development workflow. By adopting this approach, teams can effectively 'shift left' security, identifying and mitigating vulnerabilities early in the development lifecycle to ensure compliance and robust application security.

This workflow guides SOC teams in establishing a comprehensive, structured process for vulnerability management. It utilizes major scanning tools (Nessus, Qualys, OpenVAS) to discover, prioritize, and track remediation of security weaknesses across the infrastructure. It integrates threat intelligence (CISA KEV) and asset criticality into risk scoring, ensuring resources are focused on the most critical threats.

A comprehensive skill designed for advanced security analysis, detecting malicious behaviors across mobile applications (Android/iOS). It performs multi-layered analysis, including static indicator checks (permissions, manifest), dynamic instrumentation via Frida, network traffic monitoring (C2 communication, exfiltration), and automated scanning (MobSF). Use this when investigating suspicious apps, detecting trojans, or performing malware triage.

This skill provides comprehensive guidance on detecting network reconnaissance and port scanning activities using industry-standard IDS/IPS systems like Suricata and Snort. It covers various scanning techniques (e.g., SYN, FIN, NULL, Xmas scans, UDP sweeps) and advanced detection methods, including signature matching, threshold-based alerting, and traffic anomaly analysis to identify tools like Nmap and Masscan.

This comprehensive guide configures Fail2ban to implement a robust, layered defense mechanism for network security. It sets up custom filters and actions to automatically detect and mitigate threats such as port scanning, SSH brute force attempts, and network reconnaissance. By dynamically banning malicious IP addresses and providing security alerts, this skill significantly enhances the host-based intrusion prevention capabilities of your system.

Executes comprehensive red team exercises that mimic real-world adversary operations across people, processes, and technology. This capability simulates the full attack lifecycle, from initial reconnaissance to objective completion, specifically testing an organization's detection, response, and containment mechanisms. It focuses on adversary emulation and complex attack chains, differentiating it from standard vulnerability scanning or penetration testing.

A comprehensive guide detailing the methodology for identifying and exploiting Server-Side Request Forgery (SSRF). This technique is critical in authorized penetration testing, allowing attackers to pivot from public-facing applications to internal resources. Use cases include stealing cloud provider metadata (AWS, GCP), scanning private IP ranges, and accessing internal APIs and admin panels.