Results for “misc”

Deep API security assessment beyond surface scanning. Covers the full OWASP API Security Top 10 (2023): Broken Object Level Authorization (BOLA / IDOR), Broken Authentication, Broken Object Property Level Authorization (mass assignment + excessive data exposure), Unrestricted Resource Consumption, Broken Function Level Authorization (BFLA / vertical privilege escalation), Unrestricted Access to Sensitive Business Flows, Server-Side Request Forgery via API parameters, Security Misconfiguration, Improper Inventory Management (shadow/zombie/deprecated endpoints, v1/v2 drift), and Unsafe Consumption of third-party APIs. Works across REST, GraphQL, gRPC, SOAP, and MCP servers. Discovers APIs from OpenAPI/Swagger specs, GraphQL introspection, gRPC reflection, .well-known endpoints, JS bundles, and traffic capture. Uses kiterunner, ffuf, schemathesis, restler-fuzzer, openapi-fuzzer, graphql-cop, clairvoyance, batchql, inql, jwt_tool, postman, mitmproxy, and manual http(action="request", ...) payloads. Every technique includes actual payloads, commands, and verification logic. Chains from /pentester or /codebase when API endpoints are discovered, chains into /web-exploit when classic injection points are found in API parameters, chains into /post-exploit when RCE is achieved, and chains into /ai-redteam when an LLM/AI endpoint is discovered (chat APIs, completion endpoints, RAG search, agentic tool-use, MCP servers).

The English summary is being prepared. Showing the original description.

Active Directory ACL abuse playbook. Use when exploiting misconfigured AD permissions including GenericAll, WriteDACL, DCSync rights, shadow credentials, LAPS reading, GPO abuse, and BloodHound-guided attack paths.

The English summary is being prepared. Showing the original description.

AD Certificate Services attack playbook. Use when targeting misconfigured AD CS for privilege escalation via ESC1-ESC13 template abuse, NTLM relay to enrollment, CA officer abuse, and certificate-based persistence.

The English summary is being prepared. Showing the original description.

Scan code for security vulnerabilities, misconfigurations, and exposed secrets. Use when a user asks to audit security, find vulnerabilities, check for OWASP issues, scan for secrets, review dependencies for CVEs, detect SQL injection, find XSS vulnerabilities, or harden an application. Covers OWASP Top 10, dependency auditing, secrets detection, and generates fix recommendations with severity ratings.

The English summary is being prepared. Showing the original description.

Scan projects for credential leaks, secrets in code, insecure patterns, LLM API key exposure, PII leakage to external AI services, and .env/.gitignore misconfigurations. Especially useful for data and API integrations, regardless of implementation language.

The English summary is being prepared. Showing the original description.

Interprets GitHub Actions run status and logs, diagnoses CI failure patterns, and suggests targeted fixes. Handles dependency install failures, test timeouts, build OOM, flaky tests, and workflow misconfigurations. Activate on: 'CI failing', 'build broken', 'workflow error', 'GitHub Actions debug', 'flaky CI', 'pipeline timeout', 'CI red'. NOT for: writing new workflows from scratch (use github-actions-pipeline-builder), CI caching strategy (use ci-cache-optimizer), deployment orchestration (use devops-automator).

The English summary is being prepared. Showing the original description.

Imports gene expression count matrices from featureCounts, HTSeq, STAR ReadsPerGene, Salmon/kallisto via tximport or tximeta, RSEM, 10X Genomics MTX/H5, AnnData H5AD, and RDS. Handles silent-miscounting traps (featureCounts -p v2.0.2 API break, STAR strandedness column choice, salmon NumReads-sum without tximport, RSEM non-integer expected_count, GENCODE _PAR_Y suffix, zero-length-transcript TPM divide-by-zero), and encodes the tximport countsFromAbundance decision tree with the "lengthScaledTPM is not TPM" warning. Use when assembling a gene-by-sample count matrix from aligner or quantifier output, importing salmon/kallisto for DESeq2 vs limma-voom, choosing strandedness column for STAR, debugging zero-count panics, or building tx2gene mapping.

The English summary is being prepared. Showing the original description.

Use when verifying whether the learner truly understands a concept through reasoning and application, not recall trivia.

The English summary is being prepared. Showing the original description.

Use when the learner benefits from guided questioning to build reasoning and uncover misconceptions before receiving direct answers.

The English summary is being prepared. Showing the original description.

This skill outlines methodologies for performing authorized penetration testing against AWS, Azure, and GCP cloud environments. It covers understanding the shared responsibility model for testing scope, leveraging cloud-specific attack tools like Pacu and ScoutSuite, exploiting IAM misconfigurations, testing for SSRF to cloud metadata services, and reporting findings aligned to MITRE ATT&CK Cloud matrix.

The English summary is being prepared. Showing the original description.

Conduct internal Active Directory reconnaissance using BloodHound Community Edition to map attack paths, identify privilege escalation chains, and discover misconfigurations in domain environments.

The English summary is being prepared. Showing the original description.

Auditing Terraform infrastructure-as-code for security misconfigurations using Checkov, tfsec, Terrascan, and OPA/Rego policies to detect overly permissive IAM policies, public resource exposure, missing encryption, and insecure defaults before cloud deployment.

The English summary is being prepared. Showing the original description.

Systematically audit AWS S3 bucket permissions to identify publicly accessible buckets, overly permissive ACLs, misconfigured bucket policies, and missing encryption settings using AWS CLI, S3audit, and Prowler to enforce least-privilege data access controls.

The English summary is being prepared. Showing the original description.

Audit, detect, and remediate Shadow Credentials misconfigurations on msDS-KeyCredentialLink in Active Directory. Focuses on access-controls, monitoring Event ID 5136, and credential-management hygiene.

The English summary is being prepared. Showing the original description.

Detect dangerous ACL misconfigurations in Active Directory using ldap3 to identify GenericAll, WriteDACL, and WriteOwner abuse paths

The English summary is being prepared. Showing the original description.

- Verify whether an image or video is authentic, original and correctly captioned — provenance checks, error level analysis, noise and JPEG compression analysis, clone and copy-move detection, lighting and shadow consistency, C2PA… Use when fact-checking a photo or video, checking for a deepfake or AI-generated image, spotting manipulation, or testing whether footage is recycled or miscaptioned

The English summary is being prepared. Showing the original description.

Terraform / OpenTofu / Nix / k8s manifest misconfiguration detection — open security groups, missing encryption, public S3/GCS, IAM wildcards, plaintext secrets, missing tags. Use when reviewing an IaC PR, gating `terraform apply` / `tofu apply`, auditing existing state for drift, or building a compliance report for cloud configuration.

The English summary is being prepared. Showing the original description.

Métodos sistémicos y enfocados en soluciones: pregunta del milagro, escala, exploración de excepciones, preguntas circulares, preguntas hipotéticas, preguntas de empeoramiento, preguntas de afrontamiento. Fusionado de solution-focused-therapy y systemic-questioning.

The English summary is being prepared. Showing the original description.

Системные и ориентированные на решение методы: чудесный вопрос, шкалирование, поиск исключений, циркулярные вопросы, гипотетические вопросы, вопросы на ухудшение, вопросы на преодоление. Объединено из solution-focused-therapy и systemic-questioning.

The English summary is being prepared. Showing the original description.

システム療法および解決志向アプローチの手法：ミラクル・クエスチョン、スケーリング、例外の探索、サーキュラー・クエスチョン、仮定の質問、悪化の質問、コーピング・クエスチョン。solution-focused-therapy および systemic-questioning から統合。

The English summary is being prepared. Showing the original description.

系统化与焦点解决方法：奇迹提问、刻度提问、例外探索、循环提问、假设性提问、恶化提问、应对提问。合并自 solution-focused-therapy 与 systemic-questioning。

The English summary is being prepared. Showing the original description.

Systemic and solution-focused methods: miracle question, scaling, exception exploration, circular questions, hypothetical questions, worsening questions, coping questions. Merged from solution-focused-therapy and systemic-questioning.

The English summary is being prepared. Showing the original description.

Ordner und Dateiablagen semantisch aufräumen: lokale Regeln und vorhandene Taxonomie erkennen, Dateien inhaltlich zuordnen, zusammengehörige Sets erhalten, klare Vorgänger-/Nachfolgerreihen und Logs archivieren, gemischte gültige und überholte Inhalte per Cut-and-Clue trennen und Löschkandidaten reversibel in einen Prüf-Papierkorb legen. Nutze diesen Skill bei „Ordner aufräumen“, „Dateien sinnvoll einsortieren“, „alte Versionen archivieren“, „Logdateien bereinigen“, „veraltete und gültige Inhalte trennen“ oder wenn beim Aufräumen Geheimnisdateien beziehungsweise Geheimnisse in einer Cloud-Ablage auffallen. Er funktioniert anbieter- und nutzerneutral allein; erkannte kompatible Module oder Dateidienste werden nur als optionale Beschleuniger genutzt. Für bereits vollständig definierte wiederkehrende Sammelregeln stattdessen eine regelbasierte Datei-Automation, für den Umbau einer ganzen Projektarchitektur einen Pipeline-/Projekt-Optimizer verwenden.

The English summary is being prepared. Showing the original description.

Genogramm-Arbeit: Familien-Beziehungsmuster erkennen und reflektieren. Mehrgenerationen-Perspektive, Genogramm-Symbole, Muster-Erkennung und Ressourcen in der Familiengeschichte.

The English summary is being prepared. Showing the original description.