Skill UI

Utilizes Google Distroless images and multi-stage Docker builds to drastically reduce container attack surface. By eliminating unnecessary OS components like shells, package managers, and core utilities, this technique is essential for hardening container security, meeting compliance requirements, or mitigating risks associated with bloated base images.

This comprehensive guide details how to implement Single Sign-On (SSO) for Google Workspace using the SAML 2.0 protocol. It guides administrators through connecting a third-party Identity Provider (IdP) like Okta or Azure AD to centralize authentication, enforce MFA, and manage access policies across the organization.

A comprehensive guide for implementing SAML 2.0 Single Sign-On (SSO) using Okta as the Identity Provider (IdP). This skill covers end-to-end configuration, including SP-initiated and IdP-initiated flows, secure attribute mapping, advanced certificate management (SHA-256, AES-256), and security hardening practices required for enterprise-grade identity access management (IAM) deployments. Learn to establish robust and compliant authentication architecture.

Implement Okta as a centralized Identity Provider (IdP) for robust multi-cloud security across AWS, Azure, and GCP. This skill covers configuring Single Sign-On (SSO), deploying phishing-resistant Multi-Factor Authentication (MFA), automating user lifecycle management via SCIM, and enforcing adaptive access policies based on device posture and user risk, helping organizations achieve Zero Trust compliance.

Conducts comprehensive, sector-specific threat landscape assessments by profiling key threat actors, mapping attack vectors, and detailing associated MITRE ATT&CK TTPs (covering financial, healthcare, energy, etc.). Utilizing sophisticated data analysis via Python stacks and integrating real-time threat intelligence feeds (ISAC, CVEs), this tool generates highly actionable intelligence for risk management, security investment prioritization, and high-level board-level reporting on industry exposure.

A comprehensive skill guide for assessing JSON Web Token (JWT) security flaws. This technique covers advanced attack vectors such as algorithm confusion (e.g., RS256 to HS256), 'none' algorithm bypass, key ID (kid) injection, and JKU/X5U parameter manipulation. It also includes methods for brute-forcing weak symmetric secrets and is essential for penetration testing OAuth2/OIDC and SSO systems.

A comprehensive guide for assessing the security of JSON Web Token (JWT) implementations. This toolkit details attacks against cryptographic weaknesses, including algorithm confusion (e.g., RS256 to HS256), 'none' attacks, brute-forcing HMAC secrets, and claim manipulation. Ideal for penetration testing and security audits of modern APIs and SSO systems.

A comprehensive security tool designed to assess the resilience of OAuth 2.0 and OpenID Connect (OIDC) implementations. It probes for critical misconfigurations and security flaws, including authorization code interception, redirect URI manipulation (open redirects), CSRF vulnerabilities, scope escalation, token leakage, and PKCE bypass. Essential for penetration testing of Single Sign-On (SSO) systems and API security.

This skill provides comprehensive analysis and structured data extraction for academic research papers hosted on Hugging Face and arXiv. It can read paper content in markdown format, retrieve key metadata (authors, abstracts, GitHub repos), and identify linked assets such as associated models, datasets, and Spaces. Use this when the user provides a Hugging Face or arXiv URL, or explicitly requests a summary or explanation of an AI research topic.

This skill functions as a Brand Psychologist and Semiotics Researcher. It diagnoses the subconscious signals (visual, verbal, behavioral) a market currently associates with a brand, identifying the 'perception gap' between the current schema and the desired brand position. It then prescribes minimal, high-leverage changes across all touchpoints to achieve perceptual alignment and build trust.

This skill provides comprehensive security and monitoring for Large Language Model (LLM) powered trading agents. It helps to audit trade decisions, ensure compliance with risk parameters, and mitigate potential risks associated with automated financial operations.

A robust CLI tool for connecting to Lark/Feishu real-time events. It allows streaming, subscribing, and consuming various events (e.g., IM messages, reactions, meeting updates) as NDJSON output. Ideal for developing Lark bots, building real-time message processors, or implementing long-running streaming webhook handlers, especially in AI agent subprocesses.