559 skills · sorted by relevance
Plan and coordinate an authorized security assessment across reconnaissance, access testing, privilege escalation, and reporting. Route work to specialist skills, review each stage, and adjust the assessment path within the agreed scope.
Design production alerts, route notifications by severity, and organize on-call schedules. Use configuration examples to define backup contacts, escalation steps when alerts go unanswered, and runbooks that guide responders through incident investigation.
Support authorized security assessments of Microsoft Active Directory with guidance on environment discovery, credential risks, authentication weaknesses, and privilege escalation. The material organizes tools and workflows for penetration testing and controlled training environments.
Assess Windows and Active Directory identity security within an authorized scope. Map accounts and permissions, investigate authentication and certificate weaknesses, and document paths that could allow an attacker to gain greater access.
Plan and coordinate authorized penetration tests across multiple stages, from reconnaissance to access, privilege escalation, movement between systems, and impact assessment. Assign specialist skills, revise blocked paths, and maintain evidence and progress records for the final report.
Investigate service account misuse by examining unexpected interactive logons, privilege changes, and movement between systems. Correlate endpoint and security logs, distinguish suspicious activity from legitimate operations, and document evidence, risk, and recommended responses.
Investigate misuse of application identities in Microsoft Entra ID using audit and sign-in logs. Provides detection queries and investigation steps for suspicious credential additions, privileged role assignments, consent grants, and service principal enumeration.
Map Active Directory permissions, group memberships, and user sessions with BloodHound CE. Reveal paths from ordinary accounts to administrator privileges, prioritize findings, and document evidence for authorized assessments or checks after security hardening.
Create reusable procedures for responding to security incidents, from detection and containment to recovery. Define decision points, responsibilities, escalation rules, and workflows for security automation platforms so teams can follow a consistent response process.
Assess an internal network from the position of an intruder or malicious insider. Covers discovering systems, testing paths to other machines and higher privileges, demonstrating sensitive data access, and documenting findings with remediation recommendations.
Investigate Linux intrusions using auditd records. Configure audit rules, search events with ausearch, summarize activity with aureport, reconstruct a timeline of suspicious actions, and forward logs to a central security monitoring system.
Turn an unresolved customer issue into a structured brief for the right team. Gather context, document reproduction steps, assess customer and business impact, and clarify the action and deadline needed from engineering, product, security, or leadership.
Review cloud permissions, public storage access, network rules, and infrastructure definitions for security gaps. The skill helps identify risky configurations, rank findings by severity, and suggest narrower permissions, with fuller coverage for AWS than Azure or GCP.
Update one part of an existing privacy practice profile through a guided conversation. Change risk preferences, contract review positions, contacts, privacy assessment formats, or personal data request procedures, with an explanation of how the change affects later outputs.
Adjust an existing litigation practice profile through a guided conversation. Update roles, risk thresholds, document styles, contacts, or workflow settings one change at a time, with an explanation of downstream effects and checks for inconsistent settings.
Update an existing intellectual property practice profile one setting at a time. Review current values, understand how changes affect later work, and adjust risk preferences, contacts, portfolio coverage, enforcement policies, or open-source license review rules.
Update an existing employment-law practice profile through guided questions. Adjust employee locations, risk preferences, contacts, hiring or termination review rules, and other settings while reviewing downstream effects, without repeating setup or editing configuration files by hand.
Adjust an existing corporate legal practice profile through guided questions. Change risk preferences, contacts, review thresholds, active modules, or workspace paths, with an explanation of how each change affects related workflows.
Adjust an existing commercial contracts profile through a guided conversation. Update risk preferences, approvers, contract positions, or review formats one change at a time, with an explanation of how each update affects later work.
Monitor other agent teams for abandoned work, process drift, off-task activity, and excessive token use. It guides evidence checks after alerts and chooses a proportionate response, from notifying the team’s coordinator to escalating to a human.
Assess AWS, Azure, and GCP environments by identifying identities, permissions, and paths to broader access or data exposure. Covers cloud storage, secrets, cross-account trust, and CI/CD, the automated systems used to build and deploy software.
Runs repeated reviews and fixes on a Claude Code skill until no critical or major findings remain. Tracks findings across rounds, checks change boundaries, and stops for a design decision when fixes stop making progress.
Prepare customer-facing teams before announcing a product or feature retirement. Create support FAQs, honest replacement comparisons, objection responses, and escalation guidance, with the scope adjusted from a short support note to a broader training pack.
Find relevant references for CTF miscellaneous challenges, including restricted execution environments, layered encodings, hidden data in media, and game or virtual machine analysis. It also covers CTFd platform operations and Linux privilege escalation.