families / security
security
ai-security
A comprehensive suite of skills for securing AI systems, covering agent hardening, red teaming, guardrails, and threat detection.
These skills differ by their specific focus within the AI security lifecycle, ranging from proactive hardening and guardrail implementation to active red teaming and specific threat detection techniques.
- Run a structured red team exercise to test an LLM for jailbreak vulnerabilities and data exfiltration risks.
- Configure permission boundaries and sandboxing for an AI coding agent to prevent secret leakage in a team environment.
api-security-hardening
A collection of skills focused on implementing defensive controls, detecting abuse, and managing the security posture of API infrastructure.
This cluster focuses on defensive implementation and management of API security controls, distinct from offensive exploitation or log analysis skills.
- Configure rate limiting and schema validation on our API gateway to prevent abuse and injection attacks.
- Implement API key security controls and set up posture management to monitor for misconfigurations.
authentication-security
A collection of skills covering the implementation, hardening, and exploitation of authentication mechanisms across various platforms and protocols.
The skills differ by focusing on either defensive implementation and best practices (e.g., setup, hardening) or offensive security testing and exploitation (e.g., bypasses, relay attacks).
- Implement a secure password and 2FA setup for a new user authentication system.
- Identify and exploit broken authentication flaws or 401/403 bypass techniques in a web application.
azure-keyvault-management
Manage secrets, keys, and certificates in Azure Key Vault using various programming languages and SDKs.
This skill focuses specifically on the programmatic management of Key Vault assets (secrets, keys, certificates) across different languages, whereas other skills cover broader security monitoring, compliance, or general identity management.
- Retrieve a secret from Azure Key Vault using the Python SDK.
- Generate and store an RSA key in Azure Key Vault using the Rust SDK.
blockchain-security-audit
A suite of specialized tools for conducting security audits, vulnerability scanning, and maturity assessments across various blockchain ecosystems and smart contract platforms.
The skills differ by their specific target blockchain platform (e.g., Solana, Cosmos, TON) or their functional focus (e.g., general audit preparation, cross-chain relayers, or code maturity assessment).
- Run a vulnerability scan on this Solana program and identify any potential reentrancy attacks.
- Assess the code maturity of this Cosmos SDK module and provide a report on its readiness for mainnet deployment.
cloud-security-auditing
A family of skills focused on assessing, auditing, and detecting misconfigurations and security weaknesses across major cloud providers like AWS, Azure, and GCP.
These skills differ from offensive or incident response skills by focusing on defensive assessment, compliance checking, and identification of existing misconfigurations rather than active exploitation or reactive incident handling.
- Audit our AWS S3 buckets for public write permissions and permissive policies.
- Check our Azure Active Directory configuration against CIS benchmarks for security misconfigurations.
code-security-analysis
A set of skills for analyzing, auditing, and securing source code through static analysis, manual review, and structural inspection.
These skills focus specifically on the security and structural integrity of code, distinguishing them from general code documentation or non-security specific refactoring tasks.
- Perform a security audit on this Java codebase to identify potential vulnerabilities.
- Review the C source files for memory safety issues and provide a walkthrough of the findings.
container-security-operations
A comprehensive set of skills for securing containerized workloads through image scanning, runtime hardening, network policy enforcement, and threat detection.
These skills differ by their focus on the container lifecycle, ranging from static image analysis and build-time hardening to dynamic runtime monitoring, network segmentation, and forensic investigation of security breaches.
- Scan my production container images for vulnerabilities using Trivy and Grype, then harden the Dockerfiles to use distroless base images and non-root users.
- Implement Calico network policies to isolate microservices and set up runtime monitoring to detect container escape attempts and configuration drift.
data-exfiltration-detection
A set of skills focused on identifying, analyzing, and preventing unauthorized data leakage and exfiltration activities within an organization.
These skills specifically target the detection and analysis of malicious data movement and exfiltration attempts, distinguishing them from general data protection, encryption, or compliance skills.
- Analyze DNS logs to identify potential data exfiltration channels.
- Hunt for signs of data staging on endpoints prior to exfiltration.
detecting-cloud-identity-abuse
Identifying unauthorized or malicious activities related to cloud identity management, including privilege escalation and service principal misuse.
This skill focuses specifically on identity and access management threats within cloud environments, distinguishing it from network-level or industrial control system detection methods.
- Analyze AWS IAM logs to identify potential privilege escalation attempts.
- Review Azure activity logs to detect signs of service principal abuse.
email-security
A comprehensive suite of skills for analyzing, implementing, and testing email security controls including authentication protocols, compromise detection, and gateway configurations.
These skills differ by focusing on specific aspects of the email security lifecycle, ranging from protocol implementation and gateway configuration to forensic analysis and specific threat detection.
- Analyze the SPF, DKIM, and DMARC records for our domain to ensure proper email authentication.
- Investigate a potential Business Email Compromise (BEC) incident by reviewing mailbox logs and header data.
fuzzing
A collection of skills for designing, implementing, and executing fuzzing campaigns using various tools and frameworks to discover software vulnerabilities.
These skills differ by the specific fuzzing engine (e.g., AFL++, libFuzzer, Syzkaller), the target language or system (e.g., C/C++, Rust, kernel), and the specific phase of the fuzzing workflow (e.g., harness writing, dictionary creation, build loops).
- Write a libFuzzer harness for a C library that parses network packets.
- Configure an AFL++ campaign to fuzz a Rust application using Ruzzy.
agent-skill-security-audit
A collection of tools and protocols for scanning, vetting, and hardening AI agent skills and runtimes against malware, data exfiltration, and malicious code patterns.
These skills focus specifically on the security assessment, vetting, and hardening of AI agent skills and their execution environments, distinct from general CTF challenges or broad network security.
- Scan the 'data-fetcher' skill from ClawHub for crypto-miners and data exfiltration attempts before I install it.
- Audit my current agent runtime configuration and apply hardening measures to prevent prompt injection and unauthorized system modifications.
hunt-web-vulnerabilities
A collection of skills for identifying and exploiting specific web application security flaws such as brute force, deserialization, race conditions, IDOR, and file inclusion.
These skills focus on active exploitation and detection of specific web application logic and input validation flaws, distinct from the broader threat hunting and forensic analysis skills in the cluster.
- Hunt for insecure deserialization vulnerabilities in a Java application using ysoserial gadget chains.
- Identify and exploit race condition vulnerabilities in a payment processing endpoint.
entra-id-security-operations
A set of skills for securing, auditing, and attacking Microsoft Entra ID environments using specialized tools and policies.
These skills focus specifically on the security, auditing, and offensive testing of Microsoft Entra ID (Azure AD), distinguishing them from general identity governance, other IdPs like Okta or Google, or DID-based verification.
- Audit our Azure AD tenant for misconfigurations using AADInternals.
- Demonstrate how to use RoadTools to attack an Entra ID deployment.
incident-response
Manage the full lifecycle of security incidents from detection and triage to containment, eradication, and recovery using established playbooks and forensic analysis.
This skill covers the end-to-end operational process of handling security events, distinguishing it from specific tool implementations or isolated analytical techniques.
- Create a detailed incident response playbook for a ransomware attack including containment and recovery steps.
- Analyze network traffic logs to identify the scope of a data exfiltration incident and build a timeline of events.
malware-analysis
The process of dissecting malicious software to understand its behavior, origin, and impact using static and dynamic analysis tools.
These skills focus on the investigative and analytical techniques used to understand existing malware samples, rather than the creation of new malicious tools or the administrative management of incident response communications.
- Analyze the network traffic of a suspicious binary to identify its Command and Control server.
- Use Ghidra to reverse engineer a Golang-based malware sample to extract its encryption keys.
mobile-security-assessment
A comprehensive suite of techniques for evaluating, testing, and securing mobile applications and devices against various threats.
These skills differ by their specific focus on either offensive penetration testing, defensive implementation, forensic analysis, or specific tool-based execution within the mobile security domain.
- Perform a static analysis of an Android APK using MobSF to identify insecure data storage vulnerabilities.
- Bypass SSL certificate pinning on an iOS app to intercept and analyze its network traffic with Burp Suite.
network-traffic-analysis
The process of inspecting, decoding, and interpreting network data packets and flows to identify threats, anomalies, or specific communication patterns.
These skills focus on the passive or active examination of network data (packets, flows, logs) for analysis and detection, distinct from offensive attack execution, infrastructure auditing, or general incident response procedures.
- Analyze a captured PCAP file using Wireshark to identify the source IP of a suspicious DNS query.
- Use Zeek logs to detect and visualize beaconing patterns from a host communicating with a known C2 server.
ot-security-operations
A collection of skills for securing Operational Technology environments through monitoring, segmentation, assessment, and incident response.
These skills focus specifically on the unique constraints and tools of OT/ICS environments, distinguishing them from general IT security practices by emphasizing safety, availability, and specialized platforms like Dragos, Nozomi, and Claroty.
- Configure network segmentation to isolate the SCADA system from the corporate IT network.
- Perform a safe vulnerability scan on the PLCs using Claroty to identify unpatched firmware.
phishing-detection-and-response
A comprehensive set of skills for identifying, investigating, and mitigating phishing threats through technical analysis, simulation, and automated response workflows.
These skills differ by their focus on either proactive defense (simulations, protection implementation), reactive investigation (header analysis, incident response), or offensive testing (offensive phishing, AITM detection).
- Investigate a reported suspicious email by analyzing its headers and certificate transparency logs to determine if it is a phishing attempt.
- Execute a phishing simulation campaign using Gophish to test employee awareness and generate a report on click rates.
ransware-response-and-recovery
A comprehensive set of skills for detecting, analyzing, responding to, and recovering from ransomware incidents.
These skills focus on the operational lifecycle of an incident, covering immediate response, forensic investigation, and system restoration, rather than long-term strategic planning or theoretical analysis.
- Execute the initial containment and eradication steps for an active ransomware outbreak.
- Restore critical business systems from verified backups after a confirmed ransomware attack.
sast
A family of skills focused on performing, configuring, and integrating static application security testing to identify vulnerabilities in source code.
The skills differ by their specific focus, ranging from general scanning and tool configuration to detecting specific vulnerability classes like SQL injection, XSS, and RCE, or handling reporting and pipeline integration.
- Configure Semgrep to detect SQL injection vulnerabilities in our Python codebase and integrate the scan into our GitHub Actions pipeline.
- Generate a report on recent SAST findings for path traversal and XSS issues and implement custom rules for missing authentication checks.
security-audit-and-patrol
A collection of tools and methodologies for conducting security audits, vulnerability scans, and continuous security patrols across various systems.
These skills differ in their specific focus, ranging from general security engineering and threat modeling to specialized automated scanning, patrol routines, and specific platform integrations.
- Run a comprehensive security audit on the production environment using the senior-security toolkit.
- Execute a scheduled security patrol to check for new vulnerabilities in the network infrastructure.
supply-chain-security
A comprehensive set of skills for assessing, securing, and responding to threats within the software supply chain, covering dependency auditing, provenance verification, and attack simulation.
These skills differ by their specific focus within the supply chain lifecycle, ranging from offensive reconnaissance and attack simulation to defensive auditing, provenance verification, and incident response.
- Audit our project's dependencies to identify packages at heightened risk of exploitation or takeover.
- Verify the build provenance of our container images using SLSA and Sigstore to ensure integrity.
threat-intelligence-analysis
The process of gathering, processing, and analyzing threat data to understand adversary tactics, techniques, and procedures (TTPs) and assess organizational risk.
This skill focuses on the analytical and intelligence-gathering aspects of threat management, distinguishing it from operational hunting or defensive modeling tasks.
- Analyze the TTPs of a specific threat actor using the MITRE ATT&CK framework to identify potential gaps in our current defenses.
- Correlate recent threat intelligence feeds with internal security logs to determine if a known campaign is targeting our infrastructure.
vulnerability-management
A comprehensive workflow for identifying, assessing, prioritizing, and remediating security vulnerabilities across systems and dependencies.
This cluster covers the end-to-end lifecycle of vulnerability handling, from initial scanning and scoring to triage and remediation, distinguishing it from general security operations or specific tool configurations.
- Scan our web application dependencies for known CVEs and generate a prioritized report.
- Triage the high-severity vulnerabilities found in the last scan and provide remediation steps.
web-application-security-testing
A collection of skills for conducting offensive security assessments, vulnerability scanning, and specific attack simulations against web applications.
These skills focus on active offensive testing and vulnerability discovery, distinguishing them from defensive implementation tasks like WAF rule creation or log analysis.
- Perform a comprehensive penetration test on the staging environment using Burp Suite to identify authentication bypasses.
- Scan the production web server with Nikto and ffuf to discover hidden directories and misconfigured endpoints.
windows-forensic-artifact-analysis
Examine Windows system artifacts such as registry keys, event logs, prefetch files, and shellbags to reconstruct user activity and detect malicious behavior.
This skill focuses on the post-incident or investigative analysis of existing Windows artifacts to uncover evidence, whereas other skills in the cluster focus on proactive hardening, configuration, or active exploitation techniques.
- Analyze Windows registry hives to identify persistence mechanisms and recent user activity.
- Use Eric Zimmerman's tools to extract and correlate timeline data from Windows event logs and prefetch files.
zero-trust-architecture-implementation
Designing and deploying zero-trust security frameworks that enforce identity-based access, micro-segmentation, and continuous verification across network, cloud, and application environments.
The skills differ by their specific focus area within the zero-trust paradigm, ranging from general network architecture and micro-segmentation to specific vendor implementations (Zscaler, HashiCorp, NextDNS), maturity models (CISA), and specialized components like browser isolation, DNS, and zero-k
- Configure micro-segmentation and identity-based access controls to implement a zero-trust network architecture for our on-premises data center.
- Implement a zero-trust access model for our SaaS applications using BeyondCorp principles to ensure continuous verification of user and device posture.
general
Skills filed under general.
The skills differ by name and by the task each description states.
- Use gdpr-compliance
- Apply gdpr-compliance to a matching task