99 skills found · Page 1 of 4
nexu-io / brandkitPremium brand-kit image generation skill for creating high-end brand-guidelines boards, logo systems, identity decks, and visual-world presentations. Trained for minimalist, cinematic, editorial, dark-tech, luxury, cultural, security, gaming, developer-tool, and consumer-app brand systems.
sickn33 / active-directory-attacksAssess Active Directory attack paths using scoped configuration review and controlled synthetic lab validation; identify prerequisites, evidence and mitigations.
sickn33 / api-fuzzing-bug-bountyProvide comprehensive techniques for testing REST, SOAP, and GraphQL APIs during bug bounty hunting and penetration testing engagements. Covers vulnerability discovery, authentication bypass, IDOR exploitation, and API-specific attack vectors.
sickn33 / ai-agent-securitySecure AI agents against prompt injection, tool abuse, and data exfiltration
sickn33 / ai-engineering-toolkitOverview of six AI engineering workflows: prompt evaluation (8-dimension scoring), context budget planning, RAG pipeline design, agent security audit (65-point checklist), eval harness building, and product sense coaching.
sickn33 / ai-red-teamingRun structured AI red team exercises for jailbreak resistance, data exfiltration
sickn33 / ai-sre-incident-responseBuild AI-focused SRE incident response practices for LLM outages, degraded
sickn33 / agent-observabilityInstrument AI agents with tracing, token metrics, latency, and cost visibility.
sickn33 / ai-pipeline-orchestrationOrchestrate AI/ML pipelines for data ingestion, model training, batch
sickn33 / ai-security-hardeningHarden AI/LLM deployments against prompt injection, data exfiltration,
sickn33 / alerting-oncallSet up alerting rules, configure on-call rotations, and manage incident
sickn33 / api-security-testingAPI security testing workflow for REST and GraphQL APIs covering authentication, authorization, rate limiting, input validation, and security best practices.
sickn33 / api-securityAuthorized security assessment of REST, GraphQL, WebSocket, and SOAP APIs: discovery, authentication and authorization flaws (BOLA/IDOR, JWT/OAuth), rate-limit testing, and a structured multi-phase methodology.
sickn33 / anti-reversing-techniquesAnalyze anti-debugging, obfuscation, and anti-tamper techniques during authorized binary analysis and reverse engineering.
wshobson / anti-reversing-techniquesUnderstand anti-reversing, obfuscation, and protection techniques encountered during software analysis. Use this skill when analyzing malware evasion techniques, when implementing anti-debugging protections for CTF challenges, when reverse engineering packed binaries, or when building security resea…
github / entra-agent-userCreate Agent Users in Microsoft Entra ID from Agent Identities, enabling AI agents to act as digital workers with user identity capabilities in Microsoft 365 and Azure environments.
mukul975 / building-cloud-siem-with-sentinelDeploy Microsoft Sentinel as a cloud-native SIEM/SOAR by configuring multi-cloud data connectors (AWS, Azure, GCP), writing KQL detection and hunting queries, and building automated Logic Apps response playbooks
mukul975 / building-threat-feed-aggregation-with-mispDeploy MISP via Docker and configure feeds from sources like abuse.ch, AlienVault OTX, and CIRCL to aggregate, correlate, and distribute threat intelligence, including automated feed synchronization and STIX/TAXII-based integration with Splunk, Elasticsearch, and SOAR platforms
mukul975 / abusing-dpapi-for-credential-accessExtract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys) online or offline using SharpDPAPI, SharpChrome, Mimikatz, or Impacket's dpapi.py, including domain-wide decryption via the DPAPI backup key.
mukul975 / abusing-shadow-credentials-for-privescTake over Active Directory accounts by writing attacker-controlled public keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, or Certipy, then authenticate via PKINIT to recover the target's NT hash without a password reset
mukul975 / analyzing-ios-app-security-with-objectionRuntime iOS app security testing with Objection (Frida): inspect keychain and filesystem data, explore app internals at runtime, and validate/bypass client-side protections during authorized mobile assessments.
mukul975 / auditing-entra-id-with-aadinternalsDrive the AADInternals PowerShell toolkit to perform Microsoft Entra ID tenant reconnaissance, access-token acquisition across Microsoft APIs, and federation/AD FS backdoor testing (Golden SAML, T1606.002) for defensive validation.
mukul975 / building-threat-intelligence-platformDesign and deploy a Threat Intelligence Platform (TIP) by integrating open-source CTI tools (MISP, OpenCTI, TheHive, Cortex) into a unified system with feed ingestion pipelines, enrichment workflows, STIX/TAXII interoperability, and analyst dashboards
mukul975 / building-vulnerability-dashboard-with-defectdojoDeploy DefectDojo as a centralized vulnerability management dashboard that ingests findings from 200+ security scanners, deduplicates results, tracks remediation metrics, and integrates with CI/CD, Jira ticketing, and Slack notifications via its REST API
mukul975 / coercing-authentication-with-coercer-petitpotamTrigger machine account authentication with PetitPotam (MS-EFSR) and Coercer (MS-RPRN, MS-DFSNM, MS-FSRVP, MS-EVEN) via Coercer's scan/coerce/fuzz modes, feeding the coerced NTLM auth into a relay against AD CS Web Enrollment (ESC8), LDAP (RBCD), or SMB.
mukul975 / conducting-cloud-incident-responseRespond to security incidents in AWS, Azure, and GCP via identity-based containment, cloud-native log analysis (CloudTrail, Azure Activity Logs, GCP Audit Logs), resource isolation, and forensic evidence acquisition adapted for ephemeral cloud infrastructure
mukul975 / Create Fake Materials: Fake WebsiteDesign and execute a social engineering penetration test combining OSINT-driven target profiling with phishing, vishing, smishing, and physical pretexting campaigns using tools like GoPhish, the Social Engineer Toolkit (SET), and Evilginx to measure human security resilience
mukul975 / PhishingMonitor Certificate Transparency logs using crt.sh and Certstream to
mukul975 / assessing-vector-and-embedding-weaknessesTest RAG vector stores (Pinecone, Qdrant, Weaviate, Chroma, pgvector,
mukul975 / conducting-cloud-penetration-testing'This skill outlines methodologies for performing authorized penetration
