Results for “admin”

Assess an authorized Active Directory environment by simulating attacks against credentials, permissions, and trust relationships. Use BloodHound and related testing tools to identify paths to administrator access, evaluate detection capabilities, and document findings with remediation recommendations.

• Assessing Active Directory security with written authorization
• Finding paths from ordinary users to administrator access
• Reviewing Kerberos and delegation settings

Analyze Zeek network logs to find lateral movement, when an intruder spreads between internal computers. Examine administrative file sharing, authentication across multiple hosts, and remote service operations to identify suspicious connections and reconstruct incident timelines.

• Tracing spread to other computers after an initial compromise
• Investigating unauthorized transfers to administrative shares
• Finding one account authenticating to many internal hosts

Deploy decoy accounts, service entries, and policy objects in Active Directory to detect suspicious activity. Configure monitoring rules for Windows security events and validate alerts for credential misuse, reconnaissance, and movement between systems.

• Detecting Kerberoasting with decoy service entries
• Monitoring attempts to use decoy credentials
• Placing credential traps in decoy Group Policy objects

Assess authorized web applications for pages and APIs that allow access without authentication. Discover hidden URLs and exposed configuration or backup files, compare signed-in and signed-out responses, and document affected resources, impact, and recommended fixes.

• Finding administrative pages accessible without signing in
• Checking authentication requirements on APIs
• Locating exposed configuration and backup files

Audit Kubernetes access rules to find excessive permissions and service account token abuse paths. Trace which users or workloads could gain cluster administrator access, then produce prioritized findings and recommendations for reducing permissions.

• Reviewing Kubernetes privilege escalation paths
• Checking permissions after an RBAC change
• Tracing workloads with overprivileged service accounts

Audit Microsoft Entra ID identity settings to uncover weak authentication policies, excessive administrator privileges, inactive accounts, and guest access risks. Review conditional access rules and sign-in logs, then organize findings into a prioritized security report.

• Auditing authentication and administrator access in an Azure tenant
• Assessing identity settings before integrating an acquired tenant
• Finding inactive accounts and privileged guest users

Automate Google Workspace tasks with the gws command-line tool, including email, file management, spreadsheets, and scheduling. Get guidance on installation, authentication, reusable workflow templates, and security audits of sharing and account settings.

• Automating Gmail sending and inbox organization
• Managing Drive files and sharing permissions
• Reading and updating Sheets data

Diagnose Google Cloud Filestore mount failures by checking client access rules, network firewalls, and audit logs. Distinguish permission errors from connection timeouts, then provide a structured report and remediation commands that require confirmation before execution.

• Investigating a Filestore mount that hangs or fails
• Diagnosing access-denied errors from a GKE workload
• Checking client permissions and VPC firewall rules

Create and administer AlloyDB for PostgreSQL databases, including clusters, instances, backups, secure connections, and access permissions. It also covers command-line operations, infrastructure configuration, and MCP tools that let agents automate database tasks.

• Create an AlloyDB cluster and primary instance
• Manage backups and plan recovery
• Configure secure connections and access permissions

Guide changes to Kortix billing code, admin controls, and pricing screens. Explain how plans, trials, enterprise contracts, and access exceptions should work, where pricing is defined, and which audited routes must handle account changes.

• Update billing logic and its specification together
• Review how trials and enterprise contracts are handled
• Find the code that defines prices and allowances

Helps manage and troubleshoot Linux, macOS, and Windows systems. Guides checks of CPU, memory, disks, networks, and logs, then supports service configuration and security hardening with explanations suited to the operating system.

• Investigating slow systems and resource usage
• Finding causes of low disk space
• Checking failed services and their logs

Create and improve shell scripts for routine tasks, deployment, and system administration. Covers input checks, error handling, logging, cleanup, and choosing between Bash features and POSIX rules for scripts that work across different systems.

• Automating routine system administration tasks
• Adding error handling and logs to existing scripts
• Making scripts work across macOS and Linux

Operate KubeSphere DevOps pipelines within a permitted project using KubeSphere APIs and OAuth authentication. Create pipelines, run selected branches, monitor execution, and retrieve logs or build artifacts without requiring cluster administrator access or direct Jenkins access.

• Creating pipelines within an authorized project
• Building a selected repository branch
• Checking run status, logs, and build artifacts

Connect supported work apps through browser consent without sharing passwords with the agent. The skill checks available connection methods, provides a single-use authorization link when appropriate, and guides personal Slack account linking.

• Connect an administrator-enabled work app
• Authorize an app through a browser consent link
• Link a personal Slack account

Support ClawHub staff moderation through its local admin tool, including skill reports, removals and restores, user restrictions, publisher and package management, and staff email, with approval checks and verification after changes.

• Triage skill reports and restore hidden listings
• Ban users or lift account restrictions
• Manage organization publishers and package ownership

Add a dashboard or admin panel across the server and interface. This skill follows existing project patterns to build API routes, service logic, components, registration, and styles, then connects request handlers so the new endpoint is reachable.

• Adding a new dashboard panel
• Building an admin feature across the server and interface
• Connecting a new API handler to server routing

Maps externally callable smart contract functions that change stored data, then groups them by access restrictions. Produces a structured audit report showing public functions, privileged operations, and access checks that need further review.

• Mapping entry points before a smart contract audit
• Listing administrator and role-restricted operations
• Reviewing caller restrictions on callbacks

Assess Docker, containerd, and Podman environments for weaknesses that could expose the host system. The skill organizes checks for excessive permissions, exposed runtime sockets, and known vulnerabilities, alongside indicators defenders can monitor.

• Assessing container isolation
• Reviewing permissions and exposed runtime sockets
• Checking known runtime vulnerabilities

Review Windows privilege escalation paths from a standard user session to Administrator or SYSTEM. Examine service permissions, token privileges, library loading, scheduled tasks, and stored credentials, with detection indicators for defensive validation.

• Investigating privilege escalation in authorized Windows assessments
• Reviewing service and scheduled task permissions
• Checking detection coverage with attack and defense teams

Use as a helper when the admin is assigning work but has not specified an existing Worker, so you need to search Nacos for a suitable Worker and ask whether to import it; also use when the admin explicitly says to import a Worker from the market or gives a direct nacos package URI.

The English summary is being prepared. Showing the original description.

Use when determining sender identity in any room, managing trusted contacts, configuring the admin's primary notification channel, handling first-contact from a new channel, or escalating to admin across channels.

The English summary is being prepared. Showing the original description.

Use for standalone Matrix admin requests (register users, create rooms, manage membership, upload files). Also use when you need to send a file to the admin via Matrix media upload. Do NOT use for Worker/project creation — those handle Matrix operations internally.

The English summary is being prepared. Showing the original description.

Hunt API security misconfiguration — mass assignment, prototype pollution, HTTP verb tampering. Mass assignment: send {is_admin:true, role:admin, verified:true} on profile/account/reset endpoints — server blindly applies. JWT signature/crypto forging (alg:none, key confusion, kid/jku) is owned by hunt-jwt-crypto; this skill covers only non-crypto JWT handling. Prototype pollution: __proto__ injection in JSON merge / Object.assign / lodash _.merge → polluted prototype reaches sink (RCE in Node, XSS in browser). HTTP verb: GET-bypass-CSRF, X-HTTP-Method-Override, TRACE enabled. Detection: API responses with extra fields, JWTs in headers (decode at jwt.io). CORS misconfiguration (reflect-any-origin, null origin, subdomain-regex bypass, postMessage) is owned by hunt-cors. Use when hunting API misconfigs, mass-assignment, prototype pollution (JWT crypto → hunt-jwt-crypto).

The English summary is being prepared. Showing the original description.

Hunt JWT cryptographic failures — alg:none signature-stripping and RS256→HS256 key-confusion that let an attacker forge a token for any identity (e.g. an admin) without knowing a secret. Use when the app authenticates with a JSON Web Token (an `eyJ...` Bearer token in the Authorization header, a cookie, or a login response). This skill OWNS JWT signature/crypto forgery (alg:none, key confusion, kid/jku header injection); hunt-ato covers JWT as one ATO path, hunt-auth-bypass covers SSO/SAML token trust, hunt-api-misconfig covers non-crypto JWT handling. Critical when a forged token grants access to another user's data or an admin-only endpoint.

The English summary is being prepared. Showing the original description.