Skill UI

This comprehensive audit guide assists researchers in preparing papers for CoNEXT submission. It covers critical workflow stages, including choosing the correct submission cycle (December or June), adhering to ACM acmart formatting and strict page budgets, managing the two-step registration process, ensuring double-anonymous review compliance, and implementing essential security checks to prevent identity leaks in artifacts and metadata.

This guide provides rigorous standards for designing, validating, and reporting security research, particularly for high-stakes academic conferences like IEEE S&P. It covers critical areas including adaptive adversary modeling, measurement validity (sampling, ethics), statistical reporting, establishing strong baselines/ablations, and adhering to ethical constraints (IRB, authorization) to ensure evidence is robust and reproducible.

This comprehensive guide serves as the mandatory final audit checklist for papers submitted to top-tier security conferences (like S&P). It covers crucial, non-negotiable steps—including meticulous formatting, ORCID verification, deep anonymization techniques, and ethics considerations—to prevent preventable desk-rejects during the submission workflow.

Performs a comprehensive security audit of Model Context Protocol (MCP) implementations, including servers, clients, and tools. This skill reviews code against critical security baselines (MCP-01 to MCP-05), OWASP MCP Top 10, and common Remote Code Execution (RCE) vectors (e.g., command injection, deserialization, SSRF). The output provides a detailed report with file and line references, ensuring compliance and identifying vulnerabilities before release. Use this when auditing network-exposed services or client security posture.

A comprehensive audit checklist for designing and evaluating security experiments, adhering to the highest academic standards (e.g., USENIX Security). It guides users through verifying adaptive attacker models, calculating precision at realistic base rates, ensuring statistical honesty for stochastic results, and maintaining ethical compliance when working with live systems.

This tool provides a comprehensive, multi-faceted audit of a codebase's health. It scores the project across critical areas like security vulnerabilities, exposed secrets, dependency risks, and structural integrity. Ideal for senior engineers performing pre-commit or pre-release quality assessments to identify weak spots and generate a prioritized remediation plan.

This guide provides a comprehensive methodology for the reverse engineering of browser extensions (Chrome/Firefox). It covers analyzing the manifest, tracing background workers, content scripts, and recovering sensitive logic like credentials or network traffic. Essential for security research, malware investigation, and supply chain security auditing.

A comprehensive white-box security auditing workflow designed for proprietary source code. It integrates static analysis security testing (SAST) tools like Semgrep and CodeQL to detect common vulnerabilities (e.g., injection, IDOR, crypto misuse), followed by mandatory manual threat modeling and verification steps. Applicable for PR reviews and pre-deployment security checks.

A specialized skill for analyzing and reproducing complex, timing-dependent bugs in concurrent systems. Use this to investigate race windows, ordering bugs, lock gaps, stale reads, or state inconsistencies where the final outcome depends critically on request timing or asynchronous execution order. Essential for deep security auditing and debugging of distributed transactions.

A comprehensive framework for conducting authorized security assessments on Large Language Models (LLMs) and AI agents. It covers critical vulnerabilities including advanced prompt injection (OWASP Top 10), tool abuse, RAG data poisoning, memory manipulation, and system prompt extraction. Ideal for red teaming, security auditing, and ensuring the robustness of AI systems in production environments.

This command inspects the native code execution sandbox environment. It reports on platform compatibility (e.g., bubblewrap, Seatbelt), active security configurations (auto-allow status, filesystem policies, network allowlists), and details recent security violations. Use it to audit the execution environment before running autonomous workflows.

This tool performs a rapid, heuristic security assessment focused on identifying common vulnerabilities listed in the OWASP Top 10. It scans source code for hardcoded secrets, SQL injection risks, XSS vectors, insecure dependencies, and authentication flaws. It is ideal for pre-commit checks or code reviews before merging sensitive changes.