Skill UI

This skill automates the execution of red team phishing campaigns using the Python gophish library. It enables users to create sophisticated email templates with tracking pixels, configure SMTP profiles, import target lists from CSV, and launch full-scale simulations. The system tracks key metrics, including open rates, click rates, and submitted credentials, providing essential data for security awareness training and vulnerability assessments.

Guides SOC teams through discussion-based tabletop exercises that simulate security incidents, validate IR playbooks, train analysts, and rehearse cross-functional communication so you can test procedures without touching production systems.

This tool is designed for security professionals to test for Server-Side Request Forgery (SSRF) vulnerabilities. It systematically probes user-controllable URL parameters to identify access to internal network services, cloud metadata endpoints (AWS/GCP/Azure), and restricted local resources. It supports various payload techniques, including protocol handlers (gopher, file), IP encoding, and DNS rebinding, making it essential for thorough security assessments and penetration testing.

Guide to systematically assess REST and GraphQL APIs against the OWASP API Security Top 10 risks using Burp Suite, Postman, ffuf, and curl to discover endpoints, probe auth/authorization flaws, and verify rate limiting before deployment.

A comprehensive skill for identifying and exploiting Cross-Site Scripting (XSS) vulnerabilities in web applications. It systematically tests reflected, stored, and DOM-based contexts by injecting various JavaScript payloads. The process involves mapping all user input points, identifying output contexts (HTML body, attribute, JS string, etc.), and crafting payloads to bypass sanitization and Content Security Policy (CSP) protections, simulating real-world attacks like session hijacking and credential theft.

Guides analysts through using binwalk to scan, extract, mount, and inspect firmware images, covering entropy analysis, nested archive handling, filesystem mounts, and string hunting for credentials or config data during IoT/security research.

Assesses AI/ML systems for prompt injection, jailbreak, model inversion, data poisoning, and agent tool abuse using MITRE ATLAS mapping, signature detection, and scoring metrics before deployment.

Guidance for Go security engineers covering injection, cryptography, filesystem, network, secrets, memory safety, and logging so audits or coding efforts stay defense-in-depth aware.

Catalogs 42 cloud-agnostic design patterns that architects can apply when designing, reviewing, or operating distributed systems to boost reliability, performance, messaging, security, and deployment outcomes.

Guides Debian Linux experts through triaging package, service, and security problems using apt, systemd, dpkg, and AppArmor-aware checks with follow-up verification at every step.

Comprehensive guide for configuring GitHub Dependabot updates, grouping strategies, multi-ecosystem workflows, scheduling, and security-driven labeling to optimize dependency management.

A comprehensive, five-stage methodology for reviewing code quality. This process systematically checks for requirements compliance, logical correctness, code maintainability, test coverage, and critical security/performance vulnerabilities. It provides actionable feedback categorized by severity (Blocker, Major, Minor, Nit), ensuring high standards for all merged code.