Review DeFi smart contracts for ten classes of security flaws, including inconsistent accounting, missing permissions, and price manipulation. The skill helps prioritize audit targets and build Foundry tests that reproduce a finding and demonstrate its impact.
中文简介正在准备中。当前显示英语简介。
Discover subdomains, live hosts, and URLs to build a prioritized map for web security testing. Includes JavaScript analysis, API specification discovery, and monitoring for new subdomains, JavaScript changes, and GitHub commits.
中文简介正在准备中。当前显示英语简介。
Assess internet-exposed VMware management services by identifying versions, matching known vulnerabilities, and checking authentication settings and information exposure. Use the findings to document affected services, supporting evidence, and the potential impact on virtual infrastructure.
中文简介正在准备中。当前显示英语简介。
Review vulnerability findings before drafting a bug bounty report. Seven validation questions and submission checklists help assess scope, reproducibility, demonstrated impact, duplicate reports, and whether the claimed severity matches the available evidence.
中文简介正在准备中。当前显示英语简介。
Inspect public repositories, build artifacts, and container images for software supply chain risks. The skill identifies exposed internal package names, unsafe workflow configurations, and leaked secrets, while requiring build evidence before treating unclaimed package names as exploitable.
中文简介正在准备中。当前显示英语简介。
Find test inputs and filter bypass examples for web security checks, organized by vulnerability type. Includes URL classification patterns, discovery wordlists, and examples of combining findings to demonstrate concrete security impact.
中文简介正在准备中。当前显示英语简介。
Turn validated vulnerabilities into clear bug bounty reports for HackerOne, Bugcrowd, Intigriti, or Immunefi. Platform templates help organize demonstrated impact, reproducible steps, supporting evidence, severity reasoning, and concrete fixes in language reviewers can follow.
中文简介正在准备中。当前显示英语简介。
Turn enterprise red-team findings into client-facing reports with clear observations, business impact, remediation, and reproducible evidence. The skill provides report structure, severity and status guidance, and a Markdown-to-DOCX workflow with embedded screenshots and delivery checks.
中文简介正在准备中。当前显示英语简介。
Guide authorized red-team exercises that simulate attackers seeking access and demonstrating impact. The skill organizes test priorities, evidence preservation, related application checks, and minimal data collection, with checklists for planning, ongoing work, and final validation.
中文简介正在准备中。当前显示英语简介。
Review security discovery results to distinguish a target organization’s assets from unrelated assets sharing its name. Check ownership evidence, identify misleading web responses, quarantine uncertain entries, and recalculate severity counts before proceeding with security testing.
中文简介正在准备中。当前显示英语简介。
Structure open-source intelligence research, meaning investigation using publicly available information, for authorized external assessments. Map organizational assets, record evidence and confidence levels, prioritize exposures, and prepare reports that explain technical findings and business risks.
中文简介正在准备中。当前显示英语简介。
Assess enterprise sign-in environments that use Okta, from identifying tenants to reviewing authentication factors and connected applications. The skill provides security testing workflows, configuration checks, and guidance on validating findings within an authorized assessment.
中文简介正在准备中。当前显示英语简介。
Support authorized external security reconnaissance, the discovery of exposed systems and information. The skill provides search queries, probe references, secret detection patterns, and scoring guidance to help identify assets and organize findings with evidence and confidence levels.
中文简介正在准备中。当前显示英语简介。
Track changes during authorized red-team testing by comparing response times, headers, and account lockouts. Preserve evidence before and after changes, investigate possible defensive actions or concurrent attacks, and turn observations into timestamped findings.
中文简介正在准备中。当前显示英语简介。
Review EVM and Solana meme coins for hidden minting, blocked sales, adjustable fees, and liquidity withdrawal risks. The skill guides source checks and on-chain verification to identify privileged controls that could enable a rug pull.
中文简介正在准备中。当前显示英语简介。
Assess Microsoft 365 and Entra ID authentication using tenant discovery, login error analysis, and browser-based verification. It provides attempt tracking and evidence templates to distinguish credential results from access-policy restrictions.
中文简介正在准备中。当前显示英语简介。
Assess iOS apps from IPA acquisition through file inspection and runtime testing. The skill helps uncover embedded credentials, insecure network settings, and app link handling issues using tools such as Frida, objection, and binary analysis utilities.
中文简介正在准备中。当前显示英语简介。
Investigate XXE, an XML parsing flaw, in APIs and document uploads. The skill guides entry point discovery, external callback checks, and evidence collection to establish whether files or internal services are actually exposed.
中文简介正在准备中。当前显示英语简介。
Investigate cross-site scripting, where untrusted input executes as JavaScript in a web page. Check reflected, stored, and browser-side cases, distinguish escaped output from executable content, and validate reproducible behavior and user impact before reporting.
中文简介正在准备中。当前显示英语简介。
Assess WebSocket security in chat, notifications, and other live features. The skill covers connection checks, message permissions, tampering, and access to private channels, with validation steps to distinguish actual data exposure or state changes from misleading responses.
中文简介正在准备中。当前显示英语简介。
Inspect TLS certificates, DNS records, and email authentication settings, then separate configuration advice from demonstrable vulnerabilities. The skill guides evidence collection and impact assessment for subdomain takeover, client certificate bypass, internal hostname exposure, and email spoofing.
中文简介正在准备中。当前显示英语简介。
Investigate subdomain takeover risks caused by DNS records pointing to abandoned services. The skill covers discovery, provider error checks, resource claimability, and evidence collection, then examines potential effects on login flows, shared cookies, and trusted content.
中文简介正在准备中。当前显示英语简介。
Investigate server-side template injection, where user input is interpreted as template code. The skill covers engine identification, testing email and PDF rendering, and checking whether an injection can lead to command execution on the server.
中文简介正在准备中。当前显示英语简介。
Investigate SSRF, where supplied URLs cause unintended server requests, in previews, imports, proxies, and PDF generation. Confirm outbound connections, identify the responsible input, and establish whether internal services or sensitive responses are accessible.
中文简介正在准备中。当前显示英语简介。