Browse Skills

Mitmproxy API Security Testing intercepts, modifies, and replays HTTP(S) traffic for API security testing. Use it to inspect app traffic, debug mobile or thick clients, and automate checks with Python scripts.

Nuclei DAST scans web apps, APIs, and infrastructure with template-based checks for CVEs, OWASP issues, and misconfigurations. Use it for fast vulnerability scanning, CI/CD security checks, and custom templates.

Osquery Forensics uses SQL queries to inspect processes, network connections, files, users, and persistence on Linux, macOS, and Windows. Use it for incident response, threat hunting, and collecting forensic evidence from endpoints.

OT Security Assessment follows a two-stage process to discover OT/ICS devices and protocols, then assess vulnerabilities using online sources and Metasploit. Use it for authorized industrial network assessments, protocol enumeration, and IEC 62443-aligned checks.

OWASP ZAP DAST runs passive and active security scans against web applications and APIs. Use it to find runtime issues like XSS, SQL injection, auth flaws, and other OWASP Top 10 risks, including in CI/CD pipelines.

Privacy Check scans a release for obvious personal-data collection signals like email forms, payment fields, or telemetry libraries. It is used before shipping to confirm a privacy note exists when collection is detected; it is not a legal review.

QA verifies that code works by testing browser UIs, native apps, CLIs, and APIs, then debugging and fixing failures. Use it for Playwright checks, computer-use testing, or root-cause analysis with re-verification.

Review runs a two-pass code review after code changes: first for structural correctness, then for edge cases and failure modes. Use it when you want a thorough check of a diff, with depth that scales to the size of the change.

Security Audit performs OWASP Top 10 checks and STRIDE threat modeling against a codebase before shipping. Use it to review code, dependencies, secrets, CI, and other likely attack surfaces.

Semgrep SAST scans code for security vulnerabilities, maps findings to OWASP Top 10 and CWE, and supports secure code review. Use it for PR checks, custom rules, and CI/CD security gates.

Sigma Detection Engineering creates, validates, and converts Sigma rules for security monitoring across multiple SIEM platforms. Use it for detection-as-code, threat hunting queries, and MITRE ATT&CK mapping.

Trivy Scanning finds CVEs, secrets, IaC misconfigurations, and license risks in containers, filesystems, and dependencies. Use it to scan projects, generate SBOMs, and integrate vulnerability checks into CI/CD.