Security & Auditing Skills

Compact governance skill for offensive phase selection, router selection, detailed pack selection, and OPSEC-aware progression.

Detailed Active Directory attack-path pack for kerberos, ACL, ADCS, and NTLM relay routes.

Detailed API pack for API auth, BOLA, GraphQL, hidden parameter, and schema-driven testing.

Detailed authentication pack for session, token, OAuth/OIDC, SAML, and auth-boundary testing.

Compact operational boundary policy for durable red-team workflows. It does not route domains or decide workflow completion.

Domain routing and boundary guidance for authorized clickjacking testing, including missing X-Frame-Options, CSP frame-ancestors bypasses, and drag-and-drop hijacking. Use when a task belongs to the clickjacking domain and needs scope, evidence, pivot, or exit criteria.

Detailed cloud pack for IAM, metadata, role assumption, and control-plane abuse.

Domain routing and boundary guidance for authorized operating system command injection testing, including direct injection, blind injection, out-of-band callbacks, and argument injection. Use when a task belongs to the command injection domain and needs scope, evidence, pivot, or exit criteria.

Detailed code-audit pack for entrypoint tracing, trust boundaries, exploit proofs, and sink selection.

Detailed container and Kubernetes pack for cluster misconfiguration, pod abuse, and breakout paths.

Domain routing and boundary guidance for authorized CORS misconfiguration testing, including reflected origins, null origins, subdomain trust, and credential exposure. Use when a task belongs to the CORS testing domain and needs scope, evidence, pivot, or exit criteria.

Detailed cryptography pack for RSA, hash, symmetric-cipher, lattice, stego, and classical-cipher attack paths.

Domain routing and boundary guidance for authorized CSRF testing, including token bypasses, SameSite bypasses, and JSON CSRF. Use when a task belongs to the CSRF testing domain and needs scope, evidence, pivot, or exit criteria.

CVE lookup and applicability assessment skill for matching collected product names, versions, and service fingerprints to known vulnerabilities. Use after reconprofile creation when evaluating whether known CVEs apply to a target.

CVE validation domain card. Use after CVE lookup has produced applicable or candidate CVEs and red-team mode needs scoped evidence to decide whether to continue, pivot, or report.

Domain routing and boundary guidance for authorized insecure deserialization testing, including Java, PHP, Python, .NET, and gadget-chain analysis. Use when a task belongs to the deserialization testing domain and needs scope, evidence, pivot, or exit criteria.

Detailed file pack for upload, traversal, arbitrary write, source exposure, and filesystem reachability issues.

Detailed injection pack for SSRF, SQLi, XSS, SSTI, deserialization, XML, command, and expression injection paths.

Detailed logic pack for workflow abuse, race conditions, weak trust transitions, and state-machine flaws.

Detailed mobile pack for Android, iOS, pinning bypass, and dynamic instrumentation-driven analysis.

Detailed network/protocol pack for websocket, HTTP/2, request smuggling, DNS rebinding, and protocol parsing issues.

Domain routing and boundary guidance for authorized open redirect testing, including parameter redirects, meta or JavaScript redirects, and OAuth redirecturi abuse. Use when a task belongs to the open redirect domain and needs scope, evidence, pivot, or exit criteria.

Detailed payload pack for launcher format, staging choices, persistence, and delivery tradeoffs.

Detailed post-exploitation pack for foothold triage, privesc, credentials, lateral movement, and tunneling.