Test design, vulnerability assessment, and quality assurance (13K skills)
Review the current codebase for ignored errors, embedded credentials, unused exports, and obvious type-safety gaps. Receive a report ordered by severity, with file and line references, while all source files remain unchanged.
Assess smart-home and commercial mesh networks, where devices relay communications. Covers Zigbee, Thread, and Matter, with methods for observing radio traffic, reviewing device setup and key handling, and testing exposure of lighting, locks, and sensors.
Plan authorized internal network assessments covering traffic interception, spoofed network services, network separation, and access controls. The skill combines testing workflows with traffic analysis guidance and indicators defenders can use to detect suspicious activity.
Guides security testing of Android and iOS apps through file inspection and observation while the app runs. Covers network traffic, stored secrets, external app interfaces, authentication, and backend APIs, with tool examples and a testing checklist.
Plan authorized security tests involving phone calls, text messages, physical access, and USB devices. Helps develop scenarios from public information, document interactions, and assess how staff verification procedures and physical controls respond.
Investigate how a limited Linux account could gain root, the system administrator's privileges. The skill guides checks of permissions, scheduled tasks, services, and known vulnerabilities, while outlining evidence defenders can monitor during authorized security assessments.
Audit TLS/SSL, the technology that encrypts network connections, across servers and mobile apps. The skill covers outdated protocols, weak encryption, certificate validation failures, known vulnerabilities, and replay risks, helping organize evidence and prioritize fixes.
Supports authorized security exercises that test data transfer outside a network. Organizes channel choices, compression, encryption, splitting, and receipt verification, alongside the monitoring signals defenders can use to identify different transfer methods.
Plan security testing for IoT and embedded devices, from circuit board inspection and firmware analysis to wireless links, companion apps, and cloud APIs. Includes tools, investigation checklists, and guidance for documenting findings.
Assess how Wi-Fi clients respond to impersonated access points using Evil Twin, KARMA, and Mana methods. Covers portal-based credential exposure, traffic interception conditions, client behavior, and limits imposed by modern protections.
Assess GraphQL APIs during penetration tests, from finding endpoints and mapping data structures to checking access controls, query limits, subscriptions, and uploads. Includes example queries, guidance for testing tools, and defensive controls for interpreting findings.
Assess Bluetooth Classic devices such as older car kits, industrial sensors, and audio accessories. The skill guides device discovery, service inspection, authentication checks, and known vulnerability assessment, helping document exposed functions and device-specific findings.
Assess LoRaWAN and sub-GHz wireless devices by capturing signals, examining packet formats, and checking key reuse and replay weaknesses, where recorded messages are resent. It covers IoT networks, fixed-code remotes, and proprietary radio protocols.
Assess web applications and APIs for SQL injection, where input changes database queries. The skill covers finding vulnerable inputs, testing different database systems, automating checks, and documenting findings with remediation suggestions.
Assess Docker, containerd, and Podman environments for weaknesses that could expose the host system. The skill organizes checks for excessive permissions, exposed runtime sockets, and known vulnerabilities, alongside indicators defenders can monitor.
Assess enterprise Wi-Fi that uses 802.1X, a system for authenticating individual users or devices. Covers identifying authentication methods, testing rogue access points, reviewing certificate trust and storage, and assessing domain access through recovered credentials.
Assess dependency confusion, where a build retrieves a public package instead of an intended private one. Discover internal package names, review registry settings, plan callback-based proofs of execution, and document fixes across major package ecosystems.
Investigate how credentials can be exposed in CI/CD, the systems that build and deploy software. Covers environment variables, logs, credential stores, cloud trust settings, and runner tokens, with methods to assess access scope and defensive controls.
Test application business rules by mapping workflows and checking unexpected actions, inputs, identities, and repetition. The skill helps investigate checkout, refunds, subscriptions, permissions, and concurrency flaws, then document reproduction steps and financial impact.
Plan and run fuzz testing, which feeds varied inputs to software to uncover bugs. The skill guides tool selection, test harness creation, input collection, coverage measurement, and crash triage for parsers, protocols, kernels, and other targets.
Assess Active Directory security by mapping accounts, permissions, and paths to administrative access. The skill covers credential misuse, certificate service misconfigurations, movement between systems, and hybrid identity environments involving Entra ID.
Assess API business workflows for flaws that automated scanners can miss. The skill examines skipped steps, simultaneous transactions, authentication tokens, GraphQL, and webhooks, helping testers document weaknesses and their financial or operational impact during authorized assessments.
Assess server-side template injection, where user input is interpreted as template code. Identify template engines, evaluate information exposure and code execution risks, and organize evidence alongside detection and prevention measures.
Assess JWT authentication in web and mobile apps using a structured security checklist. Examine token signatures, key handling, validation, and storage to investigate authentication bypass risks and identify relevant fixes.