Security & Auditing Skills

Maps every entry point, component, and trust boundary of a target before testing begins — preventing missed coverage and prioritizing the highest-value attack paths. Use at the start of an engagement, once scope is set, when you have a target and need to decide where to begin or what to test.

Converts a confirmed bug bounty finding — raw notes, a request/response, or a PoC — into a complete, triage-ready report with clear description, numbered reproduction steps, self-contained PoC, risk, and remediation, written for triagers who are not necessarily security experts. Use when you have a finding to submit to HackerOne, Bugcrowd, Intigriti, or YesWeHack.

Searches known exploit databases and sources — searchsploit, Vulners, Metasploit, and beyond — for a given service, version, or CVE. Use when you have a service+version, a CVE ID, or nmap output and want to know whether public exploits or PoCs exist. Not for fixing a vulnerability (use remediation-planner).

Complete clickjacking (UI redressing) methodology — framing protection detection, single-click and multi-step PoC construction, JS frame-busting bypass, drag-and-drop and OAuth consent variants, and report structure. Use when checking whether a page can be framed for UI-redressing, building a clickjacking PoC, or testing X-Frame-Options / CSP frame-ancestors.

Aggregates audit findings mapped to framework controls, classifies each as compliant / partially compliant / non-compliant / not tested, identifies blind spots, prioritizes gaps by severity, and produces a self-contained gap report — ISO 27001, NIST CSF, PCI-DSS, OWASP (Top 10 / ASVS). Use when you have audit or pentest findings to map to a framework and want a gap or coverage report. Not for a single control (use control-lookup) or a single finding (use finding-writer).

Looks up any control ID across ISO 27001, NIST CSF, PCI-DSS v4, and OWASP (Top 10 / ASVS) — returns the full control card, cross-framework mappings with confidence level, related controls, and testing hints. Use when you have a control ID, a cross-framework mapping question, or a plain-language search for the control covering a topic (e.g. MFA, patch management).

Computes an exact CVSS v3.1 base score and vector from a vulnerability description. Infers metrics from context, picks the most accurate score when info is sufficient, and asks one short question only when the ambiguity would change the severity level. Use when you need a CVSS v3.1 score or vector for a vulnerability. No noise, no tables, no formula dumps.

A final accuracy check for security work — it re-tests a conclusion against the evidence and labels each part as confirmed, inferred, or assumed, so an unverified result never goes out as if it were proven. Use it right before delivering a finding, assigning a severity or confidence rating, claiming something is exploitable or confirmed, presenting a multi-step attack path, or summarizing what was tested. Match the effort to the stakes: a quick check for one small finding, a full pass for a report or attack chain. Also runs on request: "deadangle" or "/deadangle".

Weighs each attack path's effort against its likely impact to find the most important weakness with the least wasted effort, pursuing high-value surfaces first. Shapes the order in which you test, not what you test. Use it whenever you are doing offensive testing and need to decide where to focus: it compares effort against impact, goes after high-value surfaces first, and checks in with you when a finding lands or a surface goes dry.

Documents the current state of an active pentest engagement so the next session can continue without losing context — findings, coverage, next steps, and open threads. Use when an engagement needs to pause and resume later: a handoff, saving progress, end of a testing day, or a context window getting long. Not for the final client report (use pentest-report).

Converts raw pentest notes, logs, or observations into a structured audit finding ready for a security report. Use when you have evidence of a specific vulnerability — notes, tool output, an HTTP request/response — and need it written up. Not for scoring only (use cvss-scorer), fixing (use remediation-planner), or exploitation (use the relevant hunter skill).

Full HexStrike engagement workflow — sequences the right tools for your target type, kills false positives, and forges confirmed findings into a professional report. Use when the HexStrike MCP is active and you want a structured engagement, or you have raw HexStrike output to turn into findings.

Complete HTTP Parameter Pollution methodology — server behavior fingerprinting, server-side and client-side HPP, WAF bypass via parameter splitting, OAuth/payment/access-control abuse, header and JSON body pollution, and report structure. Use when testing whether duplicated or malformed parameters change server behavior, or to bypass a WAF or abuse logic via parameter pollution.

Systematic IDOR/BOLA detection methodology — recon, multi-account testing, bypass techniques, and report structure. Use when testing object references (IDs, UUIDs, usernames) for broken object-level authorization — accessing another user's data or actions.

Full JavaScript analysis methodology for pentesting and bug bounty — JS file discovery, secret extraction, endpoint mapping, DOM XSS, prototype pollution, postMessage abuse, client-side logic flaws, source map extraction, and hardcoded credential hunting. Use when analyzing a target's JavaScript: hunting endpoints or secrets in bundles, or testing client-side vulns.

Full JWT attack methodology — alg:none, RS256-to-HS256 confusion, weak secret brute-force, kid injection, jku/jwk injection, and claim tampering. Use when testing a JWT for forgery or authentication bypass, or when you see a token shaped like xxxxx.yyyyy.zzzzz.

Tests for vulnerabilities, but less aggressively — read-only where possible, confirming a flaw without exercising its full impact or causing damage, following a strict set of safety rules. Not the default. Use it whenever the user wants the testing to stay cautious and non-destructive, or when the target is sensitive enough that an aggressive action could do real harm — in any context, Do not use it when the user wants a full, aggressive test, or on isolated labs, sandboxes, and CTFs where destruction is expected.

Runs offensive security work in a low-noise mode — passive recon first, minimal footprint, and only deliberate, targeted active actions that blend with legitimate traffic, so the engagement stays below detection thresholds. Not the default. Use it whenever the user wants to stay undetected, or when the target is monitored enough that tripping a WAF, SOC, or anomaly detector could get the engagement flagged and blocked mid-operation — in any context. Do not use it when speed and coverage matter more than stealth, or on isolated labs, sandboxes, and CTFs where detection is not a concern.

Converts a vulnerability description or HTTP request/response pair into a ready-to-run Nuclei YAML template — handles auth strategies, matcher selection, OOB detection, and multi-step flows. Use when you want to automate detection of a finding across other targets or build a personal template library.

Complete open redirect detection and exploitation methodology — parameter discovery, 30+ bypass techniques, OAuth token theft, SSRF chaining, CSP abuse, phishing escalation, and report structure. Use when testing a redirect parameter (?next=, ?url=, ?redirect=), a controllable Location header, OAuth redirecturi abuse, or chaining open redirect into SSRF, CSP bypass, or account takeover.

Red team mindset that shifts the agent to offensive security thinking across any target or engagement type. Use whenever the objective is offensive — finding what can be broken, bypassed, or abused, or assessing a target from an attacker's perspective — regardless of how the request is phrased.

Converts a security finding or vulnerability into a prioritized, step-by-step remediation plan with effort estimates per step. Use when you have a specific finding and need a fix plan — "how do we fix this?". Not for exploiting, scanning, or theoretical questions with no concrete finding.

Interviews the user about a pentest or audit engagement before any testing begins — capturing target, scope, rules of engagement, auth, and deliverables into a structured brief. Use when starting an engagement that isn't yet scoped, or when a target is described without scope, authorization, or deliverables.

Complete SSRF detection and exploitation methodology — injection point discovery, cloud metadata theft (AWS/GCP/Azure), internal network enumeration, protocol handler abuse, filter bypass techniques, blind SSRF via OOB, and report structure. Use when testing a parameter that fetches a URL or server-side resource, probing cloud metadata or internal services, or chaining blind SSRF via out-of-band.