Test design, vulnerability assessment, and quality assurance (13.1K skills)
Organize authorized bug bounty investigations from scope review through reconnaissance, asset discovery, vulnerability testing, and reporting. Use vulnerability-specific guides to prioritize checks and prepare reproducible findings with evidence, impact, and remediation advice.
Investigate AI-agent and cloud infrastructure challenges in a CTF sandbox. Trace untrusted content into tool actions, compare deployment configuration with runtime behavior, and follow software artifacts from source through build and release to their actual consumers.
Investigate suspicious domains, scams, impersonation, and malicious activity using public sources. Preserve source details, check leads against independent evidence, and prepare a threat intelligence handoff that records confidence, verification status, and remaining gaps.
Inspect browser storage and caches in a CTF sandbox to explain changes in authentication, page rendering, or requests. Compare clean and modified states, then document the smallest sequence that reproduces the relevant behavior.
Assess authorized APIs through a ten-stage workflow covering endpoint discovery, authentication, access permissions, input handling, and request limits. Collect reproducible evidence and turn findings into regression checks that can run in a development pipeline.
Inspect executable files from the command line with radare2, starting with file details, strings, and imported functions. Trace code through disassembly, compare binaries, automate inspections, or apply explicitly requested patches with verification.
Assess database security within an authorized scope by reviewing network exposure, authentication, access permissions, risky features, audit logs, and backup access. Distinguish configuration weaknesses from issues that can be demonstrated through safe validation.
Test desktop application security across local storage, communication between processes, network traffic, and update channels. Map where trust and permissions change, then investigate weaknesses in credentials, access checks, and update verification.
Coordinate authorized penetration testing with tools for port discovery, vulnerability scanning, web testing, and password hash recovery. Use MCP servers to connect agents to security tools, record reproducible evidence, and support reporting within the approved scope.
Analyze captured network traffic and binary messages to recover custom protocol structures. The skill organizes message types, fields, and connection states, then produces reproducible decoding steps with supporting evidence for authorized investigations.
Analyze authorized macOS applications and Mach-O binaries, the executable format used on macOS. Examine signatures, dependencies, Objective-C and Swift symbols, and runtime behavior to produce findings tied to specific addresses or symbols.
Compare software binaries before and after a security patch to identify the underlying flaw. Guide creation of a proof of concept, a small vulnerability demonstration, and compare its behavior across patched and unpatched versions.
Trace how a web page generates request signatures and encrypted parameters by inspecting network requests and JavaScript execution. Collect runtime evidence, then use it to reproduce the behavior locally in Node.js.
Analyze Android and iOS apps through package inspection, code analysis, runtime observation, and network traffic review. Support authorized security testing of embedded secrets, certificate checks, device protection checks, and cryptographic behavior.
Analyze executable files and libraries with IDA Pro. Inspect pseudocode, strings, function calls, and data flow, then add meaningful names and comments and produce a Markdown report documenting findings and analysis steps.
Analyze custom virtual machines written in JavaScript by extracting instruction tables, examining constants, and capturing runtime state. Use the findings to reconstruct how obfuscated code executes, including custom runtimes used in risk-control engines.
Investigate signs of intrusion through hypothesis-led log searches, then turn findings into detection rules. Supports Sigma, YARA, and SIEM queries, with attention to false positives, data field mapping, and validation against historical logs.
Assess Windows and Active Directory identity security within an authorized scope. Map accounts and permissions, investigate authentication and certificate weaknesses, and document paths that could allow an attacker to gain greater access.
Assess industrial control systems by mapping devices, network zones, and exposed protocols. The workflow prioritizes observing traffic and read-only checks, then organizes evidence about configuration weaknesses, firmware vulnerabilities, and potential effects on physical processes.
Review authorized source code or pull request changes for security flaws. Combine automated static analysis, which checks code without running it, with manual validation to document affected locations, data flows, reproduction examples, and suggested fixes.
Analyze authorized browser extensions for Chrome, Edge, and Firefox. Inspect permissions, background scripts, storage, and network activity to reconstruct key data flows and explain credential handling, signing, encryption, or proxy behavior.
Analyze how EDR, software that monitors endpoint threats, and antivirus products detect activity. Support authorized exercises by examining monitoring mechanisms, assessing evasion approaches, and checking detection results in an isolated test environment.
Assess security in authorized cloud, container, and Kubernetes environments. Review excessive permissions, exposed resources, container isolation, and cluster access controls, then document findings with reproduction details and their impact.
Inspect compiled programs in Binary Ninja using strings, function references, and intermediate representations—views of program logic at different levels. Trace data flow and report findings with addresses, supporting evidence, confidence, and reproduction steps.