Skill UI

A comprehensive tool for assessing cybersecurity vulnerabilities across power grid infrastructure, including generation, transmission, substations, and EMS/SCADA systems. It focuses specifically on NERC CIP compliance verification, IEC 61850 protocol security (GOOSE/MMS), and synchrophasor (PMU) network defense against advanced threats. Ideal for compliance audits and critical infrastructure security reviews.

This skill automates red team operations using the Covenant C2 framework, providing comprehensive capabilities for authorized adversary simulation. It covers the full attack lifecycle, including listener setup, deploying agents (grunts), executing tasks on compromised hosts, and tracking lateral movement via the Covenant API. Ideal for professional penetration testing and security auditing.

This guide provides a comprehensive methodology for auditing essential HTTP security headers, including CSP, HSTS, X-Frame-Options, and Referrer-Policy. It helps identify missing or improperly configured browser-level protections, crucial for mitigating vulnerabilities like XSS, clickjacking, and mixed content issues, ensuring compliance with standards like PCI DSS and SOC 2.

This sophisticated tool automates the security review of serverless functions across major cloud providers, including AWS Lambda, Azure Functions, and GCP Cloud Functions. It systematically identifies critical misconfigurations such as overly permissive IAM execution roles (wildcard actions), hardcoded secrets in environment variables, and potential lack of runtime protections. Ideal for pre-production auditing and compliance checks.

A comprehensive skill for auditing service accounts across complex enterprise environments, including Active Directory, major cloud platforms (AWS, Azure, GCP), and databases. It identifies risks such as orphaned accounts, over-privileged access, and non-compliant credentials, ensuring adherence to industry standards like SOX, PCI DSS, and HIPAA. Used during security assessments and compliance reviews.

This skill assesses SSL/TLS server configurations using the sslyze Python library. It evaluates critical security parameters including supported protocol versions (TLS 1.0-1.3), cipher suite strength, certificate chain validation, HSTS enforcement, and known vulnerabilities like Heartbleed and ROBOT. Essential for security audits and compliance testing.

A comprehensive security tool designed to simulate and detect critical software supply chain attacks. It identifies risks such as typosquatting via Levenshtein distance, dependency confusion against private registries, package integrity failures through SHA-256 hash verification, and known vulnerabilities using pip-audit. Essential for security auditing and assessing project dependency risk.

This framework executes sophisticated threat emulation tests using Atomic Red Team, mapping directly to MITRE ATT&CK techniques. It allows security teams to actively simulate adversary behavior, validating the detection coverage of SIEM rules and EDR controls. Use this tool for comprehensive purple team operations, penetration testing, and security auditing.

A comprehensive guide for performing systematic security assessments on web applications. Following the OWASP Web Security Testing Guide (WSTG), this process identifies critical vulnerabilities such as broken authentication, authorization flaws (IDOR), SQL injection, and Cross-Site Scripting (XSS). The workflow covers reconnaissance, mapping, and advanced testing techniques using tools like Burp Suite and sqlmap, ensuring deep coverage beyond automated scanner capabilities. Ideal for pre-production security validation and compliance audits.

Nikto is a powerful, open-source web server and web application scanner designed for comprehensive vulnerability assessment. It tests over 7,000 potentially dangerous files and checks for critical issues like XSS, SQL injection, outdated versions, and misconfigurations across modern web applications. Ideal for security audit, penetration testing, and validating web server security controls.

A comprehensive guide detailing how to conduct passive wireless security assessments using Kismet. This skill covers identifying rogue access points, detecting weak encryption (WEP, TKIP), mapping hidden SSIDs, and analyzing raw 802.11 frame types. It is essential for professional network auditing, incident response, and penetration testing in complex wireless environments.

A comprehensive guide detailing systematic steps to remediate Amazon S3 bucket misconfigurations that expose sensitive data. Procedures include enabling S3 Block Public Access, auditing and restricting overly permissive policies and ACLs, enforcing default server-side encryption (KMS/AES-256), and using AWS Config/Security Hub for automated compliance checks. Essential for achieving robust cloud storage security compliance.