693 skills · sorted by relevance
Helps review application code, authentication, access controls, and dependencies for security flaws. Uses OWASP guidance and CVE reports, records of known vulnerabilities, to assess impact and recommend practical fixes.
Guides research into companies, markets, and technologies using public sources. Helps organize people and organizations, map their relationships, compare changes over time, assess source reliability, and structure reports with supporting links and sentiment trends.
Plan and carry out research by refining questions, improving searches, evaluating sources, and checking claims across independent references. Turn findings into cited reports that explain the evidence, conflicting views, confidence levels, and remaining gaps.
Investigate errors, crashes, and unexpected behavior by reproducing failures, tracing execution, and comparing logs. Tests one explanation at a time, then provides a verified fix, supporting evidence, and tests or safeguards to prevent recurrence.
Investigate production incidents and bugs using logs, metrics, and code evidence. The skill guides hypothesis testing, root cause analysis, fix validation, and reusable investigation notes, with access to configured observability tools such as Axiom.
Build a single-page quarterly finance report combining four key metrics, revenue and cash burn charts, and a profit and loss summary. Add five highlights, an outlook, and an expandable methodology section to explain the figures.
Assess smart-home and commercial mesh networks, where devices relay communications. Covers Zigbee, Thread, and Matter, with methods for observing radio traffic, reviewing device setup and key handling, and testing exposure of lighting, locks, and sensors.
Assess how applications use encryption, signed tokens, and random values. Identify implementation weaknesses, select relevant testing tools, and document causes and fixes for issues involving encryption modes, RSA parameters, predictable randomness, and key derivation.
Guides security testing of Android and iOS apps through file inspection and observation while the app runs. Covers network traffic, stored secrets, external app interfaces, authentication, and backend APIs, with tool examples and a testing checklist.
Assess API business workflows for flaws that automated scanners can miss. The skill examines skipped steps, simultaneous transactions, authentication tokens, GraphQL, and webhooks, helping testers document weaknesses and their financial or operational impact during authorized assessments.
Plan authorized security tests involving phone calls, text messages, physical access, and USB devices. Helps develop scenarios from public information, document interactions, and assess how staff verification procedures and physical controls respond.
Supports authorized security exercises that test data transfer outside a network. Organizes channel choices, compression, encryption, splitting, and receipt verification, alongside the monitoring signals defenders can use to identify different transfer methods.
Assess how Wi-Fi clients respond to impersonated access points using Evil Twin, KARMA, and Mana methods. Covers portal-based credential exposure, traffic interception conditions, client behavior, and limits imposed by modern protections.
Investigate TOCTOU flaws: race conditions where a checked property changes before an action uses it. The skill covers filesystem, kernel, web, and container testing, helping identify vulnerable sequences, reproduce timing issues, and document observed impact.
Assess GraphQL APIs during penetration tests, from finding endpoints and mapping data structures to checking access controls, query limits, subscriptions, and uploads. Includes example queries, guidance for testing tools, and defensive controls for interpreting findings.
Assess enterprise Wi-Fi that uses 802.1X, a system for authenticating individual users or devices. Covers identifying authentication methods, testing rogue access points, reviewing certificate trust and storage, and assessing domain access through recovered credentials.
Plan and carry out wireless security assessments, from surveying nearby networks to checking authentication weaknesses and recording findings. Covers personal and enterprise Wi-Fi, rogue access points, and testing considerations for Wi-Fi 6, 6E, and 7.
Assess Z-Wave smart home security by examining captured traffic, distinguishing S0 and S2 security schemes, and reviewing authentication, key exchange, and hub weaknesses. Organize findings by device, firmware, and security mode.
Assess weaknesses in the software supply chain, from dependency packages to build pipelines and distributed artifacts. Covers authorized proof-of-concept testing, package confusion, container image risks, signing abuse, and defensive checks for tampering.
Investigate how a limited Linux account could gain root, the system administrator's privileges. The skill guides checks of permissions, scheduled tasks, services, and known vulnerabilities, while outlining evidence defenders can monitor during authorized security assessments.
Assess LoRaWAN and sub-GHz wireless devices by capturing signals, examining packet formats, and checking key reuse and replay weaknesses, where recorded messages are resent. It covers IoT networks, fixed-code remotes, and proprietary radio protocols.
Assess AWS, Azure, and GCP environments by identifying identities, permissions, and paths to broader access or data exposure. Covers cloud storage, secrets, cross-account trust, and CI/CD, the automated systems used to build and deploy software.
Assess Bluetooth Low Energy devices by inspecting exposed data and commands, pairing methods, captured traffic, and companion apps. The skill provides a testing workflow for identifying authentication gaps and weaknesses in device communication.
Audit TLS/SSL, the technology that encrypts network connections, across servers and mobile apps. The skill covers outdated protocols, weak encryption, certificate validation failures, known vulnerabilities, and replay risks, helping organize evidence and prioritize fixes.