Loading...
Loading...
Found 3,946 Skills
WPA/WPA2/WPA3-Enterprise (802.1X / EAP) attack methodology — EAP method identification (PEAP-MSCHAPv2, EAP-TTLS, EAP-TLS, EAP-GTC, EAP-PWD, EAP-FAST), evil-twin RADIUS attacks with eaphammer for credential capture, MSCHAPv2 challenge-response cracking, EAP-TLS client certificate theft paths (DPAPI, NDES, AD CS auto-enrollment), supplicant validation bypass (missing server cert validation, missing CN pinning, BYOD misconfigurations), and post-capture pivots into AD via cracked domain credentials. Use for corporate Wi-Fi engagements where the network is 802.1X authenticated.
Business logic vulnerability testing for web/mobile/API engagements. Covers workflow bypass, state machine violations, multi-step process abuse, price/quantity/discount manipulation, currency confusion, coupon stacking, refund/chargeback abuse, race conditions on logic boundaries, parameter tampering for hidden flows, role/tenant boundary violations, time-of-check vs use, anti-automation defeat, fraud-detection evasion, and subscription/quota abuse. Use when scoping an application after surface-level OWASP Top 10 has been covered, or when the asset is a transactional/marketplace/fintech/e-commerce/SaaS app where logic flaws produce direct financial impact.
Bluetooth Classic (BR/EDR) attack methodology — device discovery, service enumeration via SDP, LMP/L2CAP layer attacks, legacy PIN cracking (BlueBorne / KNOB), Bluetooth file-transfer abuse (BlueSnarfing legacy), unauthenticated profile abuse (HSP, HFP, OPP), and modern relevance against older industrial / automotive / accessory targets. Use when in-scope devices use Bluetooth Classic (Bluetooth ≤ 4.0 BR/EDR) — common in legacy car kits, industrial sensors, older medical devices, and audio accessories.
Deauthentication and disassociation attacks against 802.11 networks — targeted single-client deauth for handshake capture, broadcast deauth for DoS (with authorization), action-frame attacks bypassing 802.11w (PMF), beacon flooding, mdk4 / aireplay-ng tooling, and rate-limit / PMF-aware operation. Use to coerce client reconnection (handshake capture, evil-twin roaming), as targeted DoS, or to test PMF posture.
Macht mit einer Person ohne Vorwissen ihr Projekt sicher, mit dem Bild vom Haus mit Schlüsselbund, Tresor, Fenstern und Schlössern: Geheimnisse nie ins Logbuch (Git), sondern in .env auf dem Server (und, falls das Fliessband eines braucht, im Tresor des Hafens); versehentlich veröffentlichte Schlüssel sofort neu erzeugen; ein Schlüssel pro Zweck; nur nötige Türen offen; Updates. Nutze den Skill bei «Sicherheit», «Passwort im Code», «API-Schlüssel», «.env», «Secret», «ich habe einen Schlüssel auf GitHub hochgeladen», «ist meine Seite sicher», «gehackt», «Updates», «Firewall», und bevor ein neues Geheimnis ins Projekt kommt.
Provisions, inspects, updates, and deletes Google Cloud Assured Workloads V1 compliant folders, CMEK settings, Sovereign Controls by Partners, and service usage restrictions. Use when creating, listing, describing, updating, or deleting an Assured Workloads workload for any compliance regime or data boundary (FedRAMP, DoD IL2/IL4/IL5, ITAR, CJIS, Healthcare, Sovereign Controls by Partners, or Regional Data Boundaries). Don't use for brownfield assessments or custom frameworks (use assuredworkloads-environment-assessor or assuredworkloads-frameworks-*), or non-compliant folders.
Manages Web3 wallets including HD derivation, ERC-4337 account abstraction, multi-sig (Safe), and social recovery. Use when creating wallets, signing transactions, managing keys, or configuring smart accounts.
Configure or diagnose the staged-only multi-model harness, including selectable implementation workers, review advisors, high-assurance packet policy, provider probes, and optional Claude model-matrix output style. Use when the user says "set up the agent harness", "configure multi-model reviewers", "choose worker models", "check harness setup", "skonfiguruj harness", or "sprawdź modele".
Enforce access via Policies and Gates; use authorize() and authorizeResource() to standardize controller protections
Local Code Review - analyzes code changes and provides structured feedback before commit
Diff Review - analyzes code changes and provides structured feedback before commit
Configure CSRF and origin-aware request forgery protection; PreventRequestForgery middleware (Laravel 13+) with token fallback and exclusions