Skip to content
BreachPilot

Skill Catalog (Generated)

Auto-generated by scripts/generate_skill_catalog.py — do not edit by hand. 146 skills (139 top-level + 7 maybe/ tier) as of 2026-09-07.

Counts

  • Total: 146
  • cybersecurity: 145
  • experimentation: 1

By domain

cybersecurity (145)

  • analyzing-active-directory-acl-abuse — Detect dangerous ACL misconfigurations in Active Directory using ldap3 to identify GenericAll, WriteDACL, and WriteOwner abuse paths (identity-security, v1.0)
  • analyzing-api-gateway-access-logs — Parses API Gateway access logs (AWS API Gateway, Kong, Nginx) to detect BOLA/IDOR attacks, rate limit bypass, credential scanning, and injection attempts. Uses… (security-operations, v1.0)
  • analyzing-cyber-kill-chain — Analyzes intrusion activity against the Lockheed Martin Cyber Kill Chain framework to identify which phases an adversary has completed, where defenses… (threat-intelligence, v1.0.0)
  • analyzing-network-flow-data-with-netflow — Parse NetFlow v9 and IPFIX records to detect volumetric anomalies, port scanning, data exfiltration, and C2 beaconing patterns. Uses the Python netflow library… (network-security, v1.0)
  • analyzing-network-packets-with-scapy — Craft, send, sniff, and dissect network packets using Scapy for protocol analysis, network reconnaissance, and traffic anomaly detection in authorized security… (network-security, v1.0)
  • analyzing-network-traffic-with-wireshark — Captures and analyzes network packet data using Wireshark and tshark to identify malicious traffic patterns, diagnose protocol issues, extract artifacts, and… (network-security, v1.0)
  • analyzing-sbom-for-supply-chain-vulnerabilities — Parses Software Bill of Materials (SBOM) in CycloneDX and SPDX JSON formats to identify supply chain vulnerabilities by correlating components against the NVD… (supply-chain-security, v1.0.0)
  • analyzing-threat-intelligence-feeds — Analyzes structured and unstructured threat intelligence feeds to extract actionable indicators, adversary tactics, and campaign context. Use when ingesting… (threat-intelligence, v1.0.0)
  • analyzing-tls-certificate-transparency-logs — Queries Certificate Transparency logs via crt.sh and pycrtsh to detect phishing domains, unauthorized certificate issuance, and shadow IT. Monitors newly… (security-operations, v1.0)
  • analyzing-typosquatting-domains-with-dnstwist — Detect typosquatting, homograph phishing, and brand impersonation domains using dnstwist to generate domain permutations and identify registered lookalike… (threat-intelligence, v1.0)
  • attacking-domains-end-to-end — End-to-end domain attack methodology -- resolve, enumerate subdomains, run DNS recon, check for subdomain takeover, scan web apps, and exploit across the full… (web-application-security, v1.0)
  • auditing-mcp-servers-for-tool-poisoning — Scan Model Context Protocol servers and tool metadata for poisoning, SSRF, and unauthenticated exposure. (ai-security, v1.0)
  • auditing-tls-certificate-transparency-logs — Monitors Certificate Transparency (CT) logs to detect unauthorized certificate issuance, discover subdomains via CT data, and alert on suspicious certificate… (threat-intelligence, v1.0.0)
  • automating-ioc-enrichment — Automates the enrichment of raw indicators of compromise with multi-source threat intelligence context using SOAR platforms, Python pipelines, or TIP playbooks… (threat-intelligence, v1.0.0)
  • building-attack-pattern-library-from-cti-reports — Extract and catalog attack patterns from cyber threat intelligence reports into a structured STIX-based library mapped to MITRE ATT&CK for detection… (threat-intelligence, v1.0)
  • building-vulnerability-aging-and-sla-tracking — Implement a vulnerability aging dashboard and SLA tracking system to measure remediation performance against severity-based timelines and drive accountability. (vulnerability-management, v1.0)
  • building-vulnerability-dashboard-with-defectdojo — Deploy DefectDojo as a centralized vulnerability management dashboard with scanner integrations, deduplication, metrics tracking, and Jira ticketing workflows. (vulnerability-management, v1.0)
  • building-vulnerability-exception-tracking-system — Build a vulnerability exception and risk acceptance tracking system with approval workflows, compensating controls documentation, and expiration management. (vulnerability-management, v1.0)
  • building-vulnerability-scanning-workflow — Builds a structured vulnerability scanning workflow using tools like Nessus, Qualys, and OpenVAS to discover, prioritize, and track remediation of security… (soc-operations, v1.0)
  • bypassing-authentication-with-forced-browsing — Discovering and accessing unprotected pages, APIs, and administrative interfaces by enumerating URLs and bypassing authentication controls during authorized… (web-application-security, v1.0)
  • cloud-ir-playbook maybe/ — Run a structured cloud incident-response playbook — scope the blast radius across IAM/object-store/compute, preserve forensic state, and revoke live access… (incident-response, v1.0)
  • collecting-open-source-intelligence — Collects and synthesizes open-source intelligence (OSINT) about threat actors, malicious infrastructure, and attack campaigns using publicly available data… (threat-intelligence, v1.0.0)
  • conducting-api-security-testing — Conducts security testing of REST, GraphQL, and gRPC APIs to identify vulnerabilities in authentication, authorization, rate limiting, input validation, and… (penetration-testing, v1.0.0)
  • conducting-external-reconnaissance-with-osint — Conducts external reconnaissance using Open Source Intelligence (OSINT) techniques to map an organization''s external attack surface without directly… (penetration-testing, v1.0.0)
  • conducting-full-scope-red-team-engagement — Plan and execute a comprehensive red team engagement covering reconnaissance through post-exploitation using MITRE ATT&CK-aligned TTPs to evaluate an… (red-teaming, v1.0)
  • conducting-internal-network-penetration-test — Execute an internal network penetration test simulating an insider threat or post-breach attacker to identify lateral movement paths, privilege escalation… (penetration-testing, v1.0)
  • conducting-internal-reconnaissance-with-bloodhound-ce — Conduct internal Active Directory reconnaissance using BloodHound Community Edition to map attack paths, identify privilege escalation chains, and discover… (red-teaming, v1.0)
  • conducting-network-penetration-test — Conducts comprehensive network penetration tests against authorized target environments by performing host discovery, port scanning, service enumeration,… (penetration-testing, v1.0.0)
  • executing-red-team-engagement-planning — Red team engagement planning is the foundational phase that defines scope, objectives, rules of engagement (ROE), threat model selection, and operational… (red-teaming, v1.0)
  • executing-red-team-exercise — Executes comprehensive red team exercises that simulate real-world adversary operations against an organization''s people, processes, and technology. The red… (penetration-testing, v1.0.0)
  • exploiting-active-directory-certificate-services-esc1 — Exploit misconfigured Active Directory Certificate Services (AD CS) ESC1 vulnerability to request certificates as high-privileged users and escalate domain… (red-teaming, v1.0)
  • exploiting-active-directory-with-bloodhound — BloodHound is a graph-based Active Directory reconnaissance tool that uses graph theory to reveal hidden and unintended relationships within AD environments.… (red-teaming, v1.0)
  • exploiting-adcs-with-certipy — Enumerate and exploit Active Directory Certificate Services ESC1 through ESC16 misconfigurations with Certipy, including SAN abuse, NTLM relay to web… (red-teaming, v1.0)
  • exploiting-api-injection-vulnerabilities — Tests APIs for injection vulnerabilities including SQL injection, NoSQL injection, OS command injection, LDAP injection, and Server-Side Request Forgery (SSRF)… (api-security, v1.0.0)
  • exploiting-broken-function-level-authorization — Tests APIs for Broken Function Level Authorization (BFLA) vulnerabilities where regular users can invoke administrative functions or access privileged API… (api-security, v1.0.0)
  • exploiting-broken-link-hijacking — Discover and exploit broken link hijacking vulnerabilities by identifying references to expired domains, decommissioned cloud resources, and dead external… (web-application-security, v1.0)
  • exploiting-excessive-data-exposure-in-api — Tests APIs for excessive data exposure where endpoints return more data than the client application needs, relying on the frontend to filter sensitive fields.… (api-security, v1.0.0)
  • exploiting-http-request-smuggling — Detecting and exploiting HTTP request smuggling vulnerabilities caused by Content-Length and Transfer-Encoding parsing discrepancies between front-end and… (web-application-security, v1.0)
  • exploiting-idor-vulnerabilities — Identifying and exploiting Insecure Direct Object Reference vulnerabilities to access unauthorized resources by manipulating object identifiers in API requests… (web-application-security, v1.0)
  • exploiting-insecure-deserialization — Identifying and exploiting insecure deserialization vulnerabilities in Java, PHP, Python, and .NET applications to achieve remote code execution during… (web-application-security, v1.0)
  • exploiting-ipv6-vulnerabilities — Identifies and exploits IPv6-specific vulnerabilities including SLAAC spoofing, Router Advertisement flooding, and IPv6 tunneling during authorized assessments… (network-security, v1.0)
  • exploiting-jwt-algorithm-confusion-attack — Exploits JWT algorithm confusion vulnerabilities where the server''s token verification library accepts the algorithm specified in the JWT header rather than… (api-security, v1.0.0)
  • exploiting-mass-assignment-in-rest-apis — Discover and exploit mass assignment vulnerabilities in REST APIs to escalate privileges, modify restricted fields, and bypass authorization controls by… (web-application-security, v1.0)
  • exploiting-ms17-010-eternalblue-vulnerability — MS17-010 (EternalBlue) is a critical vulnerability in Microsoft's SMBv1 implementation that allows remote code execution. Originally discovered by the NSA and… (red-teaming, v1.0)
  • exploiting-nopac-cve-2021-42278-42287 — Exploit the noPac vulnerability chain (CVE-2021-42278 sAMAccountName spoofing and CVE-2021-42287 KDC PAC confusion) to escalate from standard domain user to… (red-teaming, v1.0)
  • exploiting-nosql-injection-vulnerabilities — Detect and exploit NoSQL injection vulnerabilities in MongoDB, CouchDB, and other NoSQL databases to demonstrate authentication bypass, data extraction, and… (web-application-security, v1.0)
  • exploiting-oauth-misconfiguration — Identifying and exploiting OAuth 2.0 and OpenID Connect misconfigurations including redirect URI manipulation, token leakage, and authorization code theft… (web-application-security, v1.0)
  • exploiting-prototype-pollution-in-javascript — Detect and exploit JavaScript prototype pollution vulnerabilities on both client-side and server-side applications to achieve XSS, RCE, and authentication… (web-application-security, v1.0)
  • exploiting-race-condition-vulnerabilities — Detect and exploit race condition vulnerabilities in web applications using Turbo Intruder's single-packet attack technique to bypass rate limits, duplicate… (web-application-security, v1.0)
  • exploiting-server-side-request-forgery — Identifying and exploiting SSRF vulnerabilities to access internal services, cloud metadata, and restricted network resources during authorized penetration… (web-application-security, v1.0)
  • exploiting-smb-vulnerabilities-with-metasploit — Identifies and exploits SMB protocol vulnerabilities using Metasploit Framework during authorized penetration tests to demonstrate risks from unpatched Windows… (network-security, v1.0)
  • exploiting-sql-injection-vulnerabilities — Identifies and exploits SQL injection vulnerabilities in web applications during authorized penetration tests using manual techniques and automated tools like… (penetration-testing, v1.0.0)
  • exploiting-sql-injection-with-sqlmap — Detecting and exploiting SQL injection vulnerabilities using sqlmap to extract database contents during authorized penetration tests. (web-application-security, v1.0)
  • exploiting-template-injection-vulnerabilities — Detecting and exploiting Server-Side Template Injection (SSTI) vulnerabilities across Jinja2, Twig, Freemarker, and other template engines to achieve remote… (web-application-security, v1.0)
  • exploiting-type-juggling-vulnerabilities — Exploit PHP type juggling vulnerabilities caused by loose comparison operators to bypass authentication, circumvent hash verification, and manipulate… (web-application-security, v1.0)
  • exploiting-vulnerabilities-with-metasploit-framework — The Metasploit Framework is the world's most widely used penetration testing platform, maintained by Rapid7. It contains over 2,300 exploits, 1,200 auxiliary… (vulnerability-management, v1.0)
  • exploiting-websocket-vulnerabilities — Testing WebSocket implementations for authentication bypass, cross-site hijacking, injection attacks, and insecure message handling during authorized security… (web-application-security, v1.0)
  • exploiting-zerologon-vulnerability-cve-2020-1472 — Exploit the Zerologon vulnerability (CVE-2020-1472) in the Netlogon Remote Protocol to achieve domain controller compromise by resetting the machine account… (red-teaming, v1.0)
  • generating-threat-intelligence-reports — Generates structured cyber threat intelligence reports at strategic, operational, and tactical levels tailored to specific audiences including executives,… (threat-intelligence, v1.0.0)
  • implementing-epss-score-for-vulnerability-prioritization — Integrate FIRST's Exploit Prediction Scoring System (EPSS) API to prioritize vulnerability remediation based on real-world exploitation probability within 30… (vulnerability-management, v1.0)
  • implementing-threat-intelligence-lifecycle-management — Implement a structured threat intelligence lifecycle encompassing planning, collection, processing, analysis, dissemination, and feedback stages to produce… (threat-intelligence, v1.0)
  • lateral-movement-decision-trees maybe/ — Decision-tree methodology for authorized lateral movement — gate each pivot on the target-IP allowlist, pick the movement primitive from the foothold type, and… (lateral-movement, v1.0)
  • llm-grammar-fuzzing maybe/ — Fuzz an LLM or LLM tool layer with grammar-aware payloads — context-free-grammar-derived mutation, output-schema violation, and role-directive injection… (ai-security, v1.0)
  • mapping-attack-paths-with-bloodhound-ce — Collect Active Directory data with SharpHound and Entra ID data with AzureHound, ingest into BloodHound Community Edition, and analyze on-prem, cloud, and… (red-teaming, v1.0)
  • mapping-mitre-attack-techniques — Maps observed adversary behaviors, security alerts, and detection rules to MITRE ATT&CK techniques and sub-techniques to quantify detection coverage and guide… (threat-intelligence, v1.0.0)
  • performing-active-directory-bloodhound-analysis — Use BloodHound and SharpHound to enumerate Active Directory relationships and identify attack paths from compromised users to Domain Admin. (red-teaming, v1.0)
  • performing-active-directory-penetration-test — Conduct a focused Active Directory penetration test to enumerate domain objects, discover attack paths with BloodHound, exploit Kerberos weaknesses, escalate… (penetration-testing, v1.0)
  • performing-active-directory-vulnerability-assessment — Assess Active Directory security posture using PingCastle, BloodHound, and Purple Knight to identify misconfigurations, privilege escalation paths, and attack… (vulnerability-management, v1.0)
  • performing-agentless-vulnerability-scanning — Configure and execute agentless vulnerability scanning using network protocols, cloud snapshot analysis, and API-based discovery to assess systems without… (vulnerability-management, v1.0)
  • performing-ai-driven-osint-correlation — Use AI and LLM-based reasoning to correlate findings across multiple OSINT sources—username enumeration, email lookups, social media profiles, domain records,… (threat-intelligence, v1.0)
  • performing-api-fuzzing-with-restler — Uses Microsoft RESTler to perform stateful REST API fuzzing by automatically generating and executing test sequences that exercise API endpoints, discover… (api-security, v1.0.0)
  • performing-api-inventory-and-discovery — Performs API inventory and discovery to identify all API endpoints in an organization''s environment including documented, undocumented, shadow, zombie, and… (api-security, v1.0.0)
  • performing-api-rate-limiting-bypass — Tests API rate limiting implementations for bypass vulnerabilities by manipulating request headers, IP addresses, HTTP methods, API versions, and encoding… (api-security, v1.0.0)
  • performing-api-security-testing-with-postman — Uses Postman to perform structured API security testing by building collections that test for OWASP API Security Top 10 vulnerabilities including… (api-security, v1.0.0)
  • performing-asset-criticality-scoring-for-vulns — Develop and apply a multi-factor asset criticality scoring model to weight vulnerability prioritization based on business impact, data sensitivity, and… (vulnerability-management, v1.0)
  • performing-authenticated-scan-with-openvas — Configure and execute authenticated vulnerability scans using OpenVAS/Greenbone Vulnerability Management with SSH and SMB credentials for comprehensive… (vulnerability-management, v1.0)
  • performing-authenticated-vulnerability-scan — Authenticated (credentialed) vulnerability scanning uses valid system credentials to log into target hosts and perform deep inspection of installed software,… (vulnerability-management, v1.0)
  • performing-binary-exploitation-analysis — Analyze binary exploitation techniques including buffer overflows and ROP chains using pwntools Python library. Covers checksec analysis, gadget discovery with… (offensive-security, v1.0)
  • performing-blind-ssrf-exploitation — Detect and exploit blind Server-Side Request Forgery vulnerabilities using out-of-band techniques, DNS interactions, and timing analysis to access internal… (web-application-security, v1.0)
  • performing-clickjacking-attack-test — Testing web applications for clickjacking vulnerabilities by assessing frame embedding controls and crafting proof-of-concept overlay attacks during authorized… (web-application-security, v1.0)
  • performing-content-security-policy-bypass — Analyze and bypass Content Security Policy implementations to achieve cross-site scripting by exploiting misconfigurations, JSONP endpoints, unsafe directives,… (web-application-security, v1.0)
  • performing-cryptographic-audit-of-application — A cryptographic audit systematically reviews an application's use of cryptographic primitives, protocols, and key management to identify vulnerabilities such… (cryptography, v1.0)
  • performing-csrf-attack-simulation — Testing web applications for Cross-Site Request Forgery vulnerabilities by crafting forged requests that exploit authenticated user sessions during authorized… (web-application-security, v1.0)
  • performing-cve-prioritization-with-kev-catalog — Leverage the CISA Known Exploited Vulnerabilities catalog alongside EPSS and CVSS to prioritize CVE remediation based on real-world exploitation evidence. (vulnerability-management, v1.0)
  • performing-directory-traversal-testing — Testing web applications for path traversal vulnerabilities that allow reading or writing arbitrary files on the server by manipulating file path parameters. (web-application-security, v1.0)
  • performing-dns-enumeration-and-zone-transfer — Enumerates DNS records, attempts zone transfers, brute-forces subdomains, and maps DNS infrastructure during authorized reconnaissance to identify attack… (network-security, v1.0)
  • performing-external-network-penetration-test — Conduct a comprehensive external network penetration test to identify vulnerabilities in internet-facing infrastructure using PTES methodology, reconnaissance,… (penetration-testing, v1.0)
  • performing-fuzzing-with-aflplusplus — Perform coverage-guided fuzzing of compiled binaries using AFL++ (American Fuzzy Lop Plus Plus) to discover memory corruption, crashes, and security… (application-security, v1.0)
  • performing-graphql-depth-limit-attack — Execute and test GraphQL depth limit attacks using deeply nested recursive queries to identify denial-of-service vulnerabilities in GraphQL APIs. (api-security, v1.0)
  • performing-graphql-introspection-attack — Performs GraphQL introspection attacks to extract the full API schema including types, queries, mutations, subscriptions, and field definitions from GraphQL… (api-security, v1.0.0)
  • performing-graphql-security-assessment — Assessing GraphQL API endpoints for introspection leaks, injection attacks, authorization flaws, and denial-of-service vulnerabilities during authorized… (web-application-security, v1.0)
  • performing-http-parameter-pollution-attack — Execute HTTP Parameter Pollution attacks to bypass input validation, WAF rules, and security controls by injecting duplicate parameters that are processed… (web-application-security, v1.0)
  • performing-ip-reputation-analysis-with-shodan — Analyze IP address reputation using the Shodan API to identify open ports, running services, known vulnerabilities, and hosting context for threat intelligence… (threat-intelligence, v1.0)
  • performing-jwt-none-algorithm-attack — Execute and test the JWT none algorithm attack to bypass signature verification by manipulating the alg header field in JSON Web Tokens. (api-security, v1.0)
  • performing-network-forensics-with-wireshark — Capture and analyze network traffic using Wireshark and tshark to reconstruct network events, extract artifacts, and identify malicious communications. (digital-forensics, v1.0)
  • performing-network-packet-capture-analysis — Perform forensic analysis of network packet captures (PCAP/PCAPNG) using Wireshark, tshark, and tcpdump to reconstruct network communications, extract… (digital-forensics, v1.0)
  • performing-network-traffic-analysis-with-tshark — Automate network traffic analysis using tshark and pyshark for protocol statistics, suspicious flow detection, DNS anomaly identification, and IOC extraction… (network-security, v1.0)
  • performing-network-traffic-analysis-with-zeek — Deploy Zeek network security monitor to capture, parse, and analyze network traffic metadata for threat detection, anomaly identification, and forensic… (network-security, v1.0)
  • performing-open-source-intelligence-gathering — Open Source Intelligence (OSINT) gathering is the first active phase of a red team engagement, where operators collect publicly available information about the… (red-teaming, v1.0)
  • performing-osint-with-spiderfoot — Automate OSINT collection using SpiderFoot REST API and CLI for target profiling, module-based reconnaissance, and structured result analysis across 200+ data… (threat-intelligence, v1.0)
  • performing-privilege-escalation-assessment — Performs privilege escalation assessments on compromised Linux and Windows systems to identify paths from low-privilege access to root or SYSTEM-level control.… (penetration-testing, v1.0.0)
  • performing-privilege-escalation-on-linux — Linux privilege escalation involves elevating from a low-privilege user account to root access on a compromised system. Red teams exploit misconfigurations,… (red-teaming, v1.0)
  • performing-second-order-sql-injection — Detect and exploit second-order SQL injection vulnerabilities where malicious input is stored in a database and later executed in an unsafe SQL query during a… (web-application-security, v1.0)
  • performing-security-headers-audit — Auditing HTTP security headers including CSP, HSTS, X-Frame-Options, and cookie attributes to identify missing or misconfigured browser-level protections. (web-application-security, v1.0)
  • performing-serverless-function-security-review — Performing security reviews of serverless functions across AWS Lambda, Azure Functions, and GCP Cloud Functions to identify overly permissive execution roles,… (cloud-security, v1.0)
  • performing-service-account-audit — Audit service accounts across enterprise infrastructure to identify orphaned, over-privileged, and non-compliant accounts. This skill covers discovery of… (identity-access-management, v1.0)
  • performing-soap-web-service-security-testing — Perform security testing of SOAP web services by analyzing WSDL definitions and testing for XML injection, XXE, WS-Security bypass, and SOAPAction spoofing. (api-security, v1.0)
  • performing-ssl-tls-security-assessment — Assess SSL/TLS server configurations using the sslyze Python library to evaluate cipher suites, certificate chains, protocol versions, HSTS headers, and known… (network-security, v1.0)
  • performing-ssrf-vulnerability-exploitation — Test for Server-Side Request Forgery vulnerabilities by probing cloud metadata endpoints, internal network services, and protocol handlers through… (security-operations, v1.0)
  • performing-subdomain-enumeration-with-subfinder — Enumerate subdomains of target domains using ProjectDiscovery's Subfinder passive reconnaissance tool to map the attack surface during security assessments. (web-application-security, v1.0)
  • performing-thick-client-application-penetration-test — Conduct a thick client application penetration test to identify insecure local storage, hardcoded credentials, DLL hijacking, memory manipulation, and insecure… (penetration-testing, v1.0)
  • performing-threat-modeling-with-owasp-threat-dragon — Use OWASP Threat Dragon to create data flow diagrams, identify threats using STRIDE and LINDDUN methodologies, and generate threat model reports for secure… (devsecops, v1.0)
  • performing-vulnerability-scanning-with-nessus — Performs authenticated and unauthenticated vulnerability scanning using Tenable Nessus to identify known vulnerabilities, misconfigurations, default… (penetration-testing, v1.0.0)
  • performing-web-application-penetration-test — Performs systematic security testing of web applications following the OWASP Web Security Testing Guide (WSTG) methodology to identify vulnerabilities in… (penetration-testing, v1.0.0)
  • performing-web-application-scanning-with-nikto — Nikto is an open-source web server and web application scanner that tests against over 7,000 potentially dangerous files/programs, checks for outdated versions… (vulnerability-management, v1.0)
  • performing-web-application-vulnerability-triage — Triage web application vulnerability findings from DAST/SAST scanners using OWASP risk rating methodology to separate true positives from false positives and… (vulnerability-management, v1.0)
  • performing-web-cache-deception-attack — Execute web cache deception attacks by exploiting path normalization discrepancies between CDN caching layers and origin servers to cache and retrieve… (web-application-security, v1.0)
  • performing-web-cache-poisoning-attack — Exploiting web cache mechanisms to serve malicious content to other users by poisoning cached responses through unkeyed headers and parameters during… (web-application-security, v1.0)
  • prioritizing-vulnerabilities-with-cvss-scoring — The Common Vulnerability Scoring System (CVSS) is the industry standard framework maintained by FIRST (Forum of Incident Response and Security Teams) for… (vulnerability-management, v1.0)
  • prompt-injection-defense maybe/ — Apply layered prompt-injection defenses to an LLM agent — input/output guardrails, tool-call allowlisting, context isolation, and adversarial test cases drawn… (ai-security, v1.0)
  • quantum-crypto-triage maybe/ — Triage post-quantum cryptography migration risk — identify classical-crypto dependencies, assess harvest-now-decrypt-later exposure, and prioritize… (cryptography, v1.0)
  • scanning-infrastructure-with-nessus — Tenable Nessus is the industry-leading vulnerability scanner used to identify security weaknesses across network infrastructure including servers,… (vulnerability-management, v1.0)
  • scanning-network-with-nmap-advanced — Performs advanced network reconnaissance using Nmap''s scripting engine, timing controls, evasion techniques, and output parsing to discover hosts, enumerate… (network-security, v1.0)
  • securing-agentic-ai-tool-invocation — Apply least-privilege tool allowlisting, identity binding, and human-in-the-loop controls for agent tool calls. (ai-security, v1.0)
  • supply-chain-attribution maybe/ — Attribute a supply-chain compromise to a stage — source, build, distribution, or dependency — using a stage-gated evidence matrix and a reproducible-build diff. (supply-chain, v1.0)
  • testing-api-authentication-weaknesses — Tests API authentication mechanisms for weaknesses including broken token validation, missing authentication on endpoints, weak password policies, credential… (api-security, v1.0.0)
  • testing-api-for-broken-object-level-authorization — Tests REST and GraphQL APIs for Broken Object Level Authorization (BOLA/IDOR) vulnerabilities where an authenticated user can access or modify resources… (api-security, v1.0.0)
  • testing-api-for-mass-assignment-vulnerability — Tests APIs for mass assignment (auto-binding) vulnerabilities where clients can modify object properties they should not have access to by including additional… (api-security, v1.0.0)
  • testing-api-security-with-owasp-top-10 — Systematically assessing REST and GraphQL API endpoints against the OWASP API Security Top 10 risks using automated and manual testing techniques. (web-application-security, v1.0)
  • testing-cors-misconfiguration — Identifying and exploiting Cross-Origin Resource Sharing misconfigurations that allow unauthorized cross-domain data access and credential theft during… (web-application-security, v1.0)
  • testing-for-broken-access-control — Systematically testing web applications for broken access control vulnerabilities including privilege escalation, missing function-level checks, and insecure… (web-application-security, v1.0)
  • testing-for-business-logic-vulnerabilities — Identifying flaws in application business logic that allow price manipulation, workflow bypass, and privilege escalation beyond what technical vulnerability… (web-application-security, v1.0)
  • testing-for-email-header-injection — Test web application email functionality for SMTP header injection vulnerabilities that allow attackers to inject additional email headers, modify recipients,… (web-application-security, v1.0)
  • testing-for-host-header-injection — Test web applications for HTTP Host header injection vulnerabilities to identify password reset poisoning, web cache poisoning, SSRF, and virtual host routing… (web-application-security, v1.0)
  • testing-for-json-web-token-vulnerabilities — Test JWT implementations for critical vulnerabilities including algorithm confusion, none algorithm bypass, kid parameter injection, and weak secret… (web-application-security, v1.0)
  • testing-for-open-redirect-vulnerabilities — Identify and test open redirect vulnerabilities in web applications by analyzing URL redirection parameters, bypass techniques, and exploitation chains for… (web-application-security, v1.0)
  • testing-for-sensitive-data-exposure — Identifying sensitive data exposure vulnerabilities including API key leakage, PII in responses, insecure storage, and unprotected data transmission during… (web-application-security, v1.0)
  • testing-for-xml-injection-vulnerabilities — Test web applications for XML injection vulnerabilities including XXE, XPath injection, and XML entity attacks to identify data exposure and server-side… (web-application-security, v1.0)
  • testing-for-xss-vulnerabilities — Tests web applications for Cross-Site Scripting (XSS) vulnerabilities by injecting JavaScript payloads into reflected, stored, and DOM-based contexts to… (penetration-testing, v1.0.0)
  • testing-for-xss-vulnerabilities-with-burpsuite — Identifying and validating cross-site scripting vulnerabilities using Burp Suite's scanner, intruder, and repeater tools during authorized security assessments. (web-application-security, v1.0)
  • testing-for-xxe-injection-vulnerabilities — Discovering and exploiting XML External Entity injection vulnerabilities to read server files, perform SSRF, and exfiltrate data during authorized penetration… (web-application-security, v1.0)
  • testing-jwt-token-security — Assessing JSON Web Token implementations for cryptographic weaknesses, algorithm confusion attacks, and authorization bypass vulnerabilities during security… (web-application-security, v1.0)
  • testing-oauth2-implementation-flaws — Tests OAuth 2.0 and OpenID Connect implementations for security flaws including authorization code interception, redirect URI manipulation, CSRF in OAuth… (api-security, v1.0.0)
  • testing-websocket-api-security — Tests WebSocket API implementations for security vulnerabilities including missing authentication on WebSocket upgrade, Cross-Site WebSocket Hijacking (CSWSH),… (api-security, v1.0.0)
  • triaging-vulnerabilities-with-ssvc-framework — Triage and prioritize vulnerabilities using CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree framework to produce actionable… (vulnerability-management, v1.0)

experimentation (1)

  • experimental-skill-test maybe/ — Placeholder for the maybe/ tier. Higher-risk or niche skills live here and are ignored unless skills.maybe_enabled is true. Replace this with a real… ((none), v(none))

All skills (alphabetical)

NameDomainSubdomainVersionTags
analyzing-active-directory-acl-abusecybersecurityidentity-security1.0- active-directory
analyzing-api-gateway-access-logscybersecuritysecurity-operations1.0- api-security
analyzing-cyber-kill-chaincybersecuritythreat-intelligence1.0.0- kill-chain
analyzing-network-flow-data-with-netflowcybersecuritynetwork-security1.0- analyzing
analyzing-network-packets-with-scapycybersecuritynetwork-security1.0- scapy
analyzing-network-traffic-with-wiresharkcybersecuritynetwork-security1.0- network-security
analyzing-sbom-for-supply-chain-vulnerabilitiescybersecuritysupply-chain-security1.0.0- SBOM
analyzing-threat-intelligence-feedscybersecuritythreat-intelligence1.0.0- STIX
analyzing-tls-certificate-transparency-logscybersecuritysecurity-operations1.0- certificate-transparency
analyzing-typosquatting-domains-with-dnstwistcybersecuritythreat-intelligence1.0- dnstwist
attacking-domains-end-to-endcybersecurityweb-application-security1.0- domain-attack
auditing-mcp-servers-for-tool-poisoningcybersecurityai-security1.0- ai-security
auditing-tls-certificate-transparency-logscybersecuritythreat-intelligence1.0.0- certificate-transparency
automating-ioc-enrichmentcybersecuritythreat-intelligence1.0.0- SOAR
building-attack-pattern-library-from-cti-reportscybersecuritythreat-intelligence1.0- attack-pattern
building-vulnerability-aging-and-sla-trackingcybersecurityvulnerability-management1.0- vulnerability-management
building-vulnerability-dashboard-with-defectdojocybersecurityvulnerability-management1.0- defectdojo
building-vulnerability-exception-tracking-systemcybersecurityvulnerability-management1.0- vulnerability-exception
building-vulnerability-scanning-workflowcybersecuritysoc-operations1.0- soc
bypassing-authentication-with-forced-browsingcybersecurityweb-application-security1.0- penetration-testing
cloud-ir-playbookcybersecurityincident-response1.0- cloud
collecting-open-source-intelligencecybersecuritythreat-intelligence1.0.0- OSINT
conducting-api-security-testingcybersecuritypenetration-testing1.0.0- API-security
conducting-external-reconnaissance-with-osintcybersecuritypenetration-testing1.0.0- OSINT
conducting-full-scope-red-team-engagementcybersecurityred-teaming1.0- red-team
conducting-internal-network-penetration-testcybersecuritypenetration-testing1.0- internal-pentest
conducting-internal-reconnaissance-with-bloodhound-cecybersecurityred-teaming1.0- red-team
conducting-network-penetration-testcybersecuritypenetration-testing1.0.0- network-pentest
executing-red-team-engagement-planningcybersecurityred-teaming1.0- red-team
executing-red-team-exercisecybersecuritypenetration-testing1.0.0- red-team
experimental-skill-testexperimentation(none)(none)- experimental
exploiting-active-directory-certificate-services-esc1cybersecurityred-teaming1.0- red-team
exploiting-active-directory-with-bloodhoundcybersecurityred-teaming1.0- red-team
exploiting-adcs-with-certipycybersecurityred-teaming1.0- red-team
exploiting-api-injection-vulnerabilitiescybersecurityapi-security1.0.0- api-security
exploiting-broken-function-level-authorizationcybersecurityapi-security1.0.0- api-security
exploiting-broken-link-hijackingcybersecurityweb-application-security1.0- broken-link-hijacking
exploiting-excessive-data-exposure-in-apicybersecurityapi-security1.0.0- api-security
exploiting-http-request-smugglingcybersecurityweb-application-security1.0- penetration-testing
exploiting-idor-vulnerabilitiescybersecurityweb-application-security1.0- penetration-testing
exploiting-insecure-deserializationcybersecurityweb-application-security1.0- penetration-testing
exploiting-ipv6-vulnerabilitiescybersecuritynetwork-security1.0- network-security
exploiting-jwt-algorithm-confusion-attackcybersecurityapi-security1.0.0- api-security
exploiting-mass-assignment-in-rest-apiscybersecurityweb-application-security1.0- mass-assignment
exploiting-ms17-010-eternalblue-vulnerabilitycybersecurityred-teaming1.0- red-team
exploiting-nopac-cve-2021-42278-42287cybersecurityred-teaming1.0- red-team
exploiting-nosql-injection-vulnerabilitiescybersecurityweb-application-security1.0- nosql-injection
exploiting-oauth-misconfigurationcybersecurityweb-application-security1.0- penetration-testing
exploiting-prototype-pollution-in-javascriptcybersecurityweb-application-security1.0- prototype-pollution
exploiting-race-condition-vulnerabilitiescybersecurityweb-application-security1.0- race-condition
exploiting-server-side-request-forgerycybersecurityweb-application-security1.0- penetration-testing
exploiting-smb-vulnerabilities-with-metasploitcybersecuritynetwork-security1.0- network-security
exploiting-sql-injection-vulnerabilitiescybersecuritypenetration-testing1.0.0- SQL-injection
exploiting-sql-injection-with-sqlmapcybersecurityweb-application-security1.0- penetration-testing
exploiting-template-injection-vulnerabilitiescybersecurityweb-application-security1.0- penetration-testing
exploiting-type-juggling-vulnerabilitiescybersecurityweb-application-security1.0- type-juggling
exploiting-vulnerabilities-with-metasploit-frameworkcybersecurityvulnerability-management1.0- vulnerability-management
exploiting-websocket-vulnerabilitiescybersecurityweb-application-security1.0- penetration-testing
exploiting-zerologon-vulnerability-cve-2020-1472cybersecurityred-teaming1.0- zerologon
generating-threat-intelligence-reportscybersecuritythreat-intelligence1.0.0- CTI
implementing-epss-score-for-vulnerability-prioritizationcybersecurityvulnerability-management1.0- epss
implementing-threat-intelligence-lifecycle-managementcybersecuritythreat-intelligence1.0- threat-intelligence
lateral-movement-decision-treescybersecuritylateral-movement1.0- lateral-movement
llm-grammar-fuzzingcybersecurityai-security1.0- ai-security
mapping-attack-paths-with-bloodhound-cecybersecurityred-teaming1.0- bloodhound-ce
mapping-mitre-attack-techniquescybersecuritythreat-intelligence1.0.0- MITRE-ATT&CK
performing-active-directory-bloodhound-analysiscybersecurityred-teaming1.0- bloodhound
performing-active-directory-penetration-testcybersecuritypenetration-testing1.0- active-directory
performing-active-directory-vulnerability-assessmentcybersecurityvulnerability-management1.0- active-directory
performing-agentless-vulnerability-scanningcybersecurityvulnerability-management1.0- agentless-scanning
performing-ai-driven-osint-correlationcybersecuritythreat-intelligence1.0- osint
performing-api-fuzzing-with-restlercybersecurityapi-security1.0.0- api-security
performing-api-inventory-and-discoverycybersecurityapi-security1.0.0- api-security
performing-api-rate-limiting-bypasscybersecurityapi-security1.0.0- api-security
performing-api-security-testing-with-postmancybersecurityapi-security1.0.0- api-security
performing-asset-criticality-scoring-for-vulnscybersecurityvulnerability-management1.0- asset-criticality
performing-authenticated-scan-with-openvascybersecurityvulnerability-management1.0- openvas
performing-authenticated-vulnerability-scancybersecurityvulnerability-management1.0- vulnerability-management
performing-binary-exploitation-analysiscybersecurityoffensive-security1.0- binary-exploitation
performing-blind-ssrf-exploitationcybersecurityweb-application-security1.0- blind-ssrf
performing-clickjacking-attack-testcybersecurityweb-application-security1.0- penetration-testing
performing-content-security-policy-bypasscybersecurityweb-application-security1.0- csp-bypass
performing-cryptographic-audit-of-applicationcybersecuritycryptography1.0- cryptography
performing-csrf-attack-simulationcybersecurityweb-application-security1.0- penetration-testing
performing-cve-prioritization-with-kev-catalogcybersecurityvulnerability-management1.0- cisa-kev
performing-directory-traversal-testingcybersecurityweb-application-security1.0- penetration-testing
performing-dns-enumeration-and-zone-transfercybersecuritynetwork-security1.0- network-security
performing-external-network-penetration-testcybersecuritypenetration-testing1.0- external-pentest
performing-fuzzing-with-aflpluspluscybersecurityapplication-security1.0- fuzzing
performing-graphql-depth-limit-attackcybersecurityapi-security1.0- graphql
performing-graphql-introspection-attackcybersecurityapi-security1.0.0- api-security
performing-graphql-security-assessmentcybersecurityweb-application-security1.0- penetration-testing
performing-http-parameter-pollution-attackcybersecurityweb-application-security1.0- http-parameter-pollution
performing-ip-reputation-analysis-with-shodancybersecuritythreat-intelligence1.0- shodan
performing-jwt-none-algorithm-attackcybersecurityapi-security1.0- jwt
performing-network-forensics-with-wiresharkcybersecuritydigital-forensics1.0- forensics
performing-network-packet-capture-analysiscybersecuritydigital-forensics1.0- pcap
performing-network-traffic-analysis-with-tsharkcybersecuritynetwork-security1.0- tshark
performing-network-traffic-analysis-with-zeekcybersecuritynetwork-security1.0- zeek
performing-open-source-intelligence-gatheringcybersecurityred-teaming1.0- red-team
performing-osint-with-spiderfootcybersecuritythreat-intelligence1.0- osint
performing-privilege-escalation-assessmentcybersecuritypenetration-testing1.0.0- privilege-escalation
performing-privilege-escalation-on-linuxcybersecurityred-teaming1.0- red-team
performing-second-order-sql-injectioncybersecurityweb-application-security1.0- second-order-sqli
performing-security-headers-auditcybersecurityweb-application-security1.0- penetration-testing
performing-serverless-function-security-reviewcybersecuritycloud-security1.0- cloud-security
performing-service-account-auditcybersecurityidentity-access-management1.0- iam
performing-soap-web-service-security-testingcybersecurityapi-security1.0- soap
performing-ssl-tls-security-assessmentcybersecuritynetwork-security1.0- network-security
performing-ssrf-vulnerability-exploitationcybersecuritysecurity-operations1.0- ssrf
performing-subdomain-enumeration-with-subfindercybersecurityweb-application-security1.0- subdomain-enumeration
performing-thick-client-application-penetration-testcybersecuritypenetration-testing1.0- thick-client
performing-threat-modeling-with-owasp-threat-dragoncybersecuritydevsecops1.0- threat-modeling
performing-vulnerability-scanning-with-nessuscybersecuritypenetration-testing1.0.0- vulnerability-scanning
performing-web-application-penetration-testcybersecuritypenetration-testing1.0.0- web-application-pentest
performing-web-application-scanning-with-niktocybersecurityvulnerability-management1.0- vulnerability-management
performing-web-application-vulnerability-triagecybersecurityvulnerability-management1.0- web-application
performing-web-cache-deception-attackcybersecurityweb-application-security1.0- web-cache-deception
performing-web-cache-poisoning-attackcybersecurityweb-application-security1.0- penetration-testing
prioritizing-vulnerabilities-with-cvss-scoringcybersecurityvulnerability-management1.0- vulnerability-management
prompt-injection-defensecybersecurityai-security1.0- ai-security
quantum-crypto-triagecybersecuritycryptography1.0- quantum
scanning-infrastructure-with-nessuscybersecurityvulnerability-management1.0- vulnerability-management
scanning-network-with-nmap-advancedcybersecuritynetwork-security1.0- network-security
securing-agentic-ai-tool-invocationcybersecurityai-security1.0- ai-security
supply-chain-attributioncybersecuritysupply-chain1.0- supply-chain
testing-api-authentication-weaknessescybersecurityapi-security1.0.0- api-security
testing-api-for-broken-object-level-authorizationcybersecurityapi-security1.0.0- api-security
testing-api-for-mass-assignment-vulnerabilitycybersecurityapi-security1.0.0- api-security
testing-api-security-with-owasp-top-10cybersecurityweb-application-security1.0- penetration-testing
testing-cors-misconfigurationcybersecurityweb-application-security1.0- penetration-testing
testing-for-broken-access-controlcybersecurityweb-application-security1.0- penetration-testing
testing-for-business-logic-vulnerabilitiescybersecurityweb-application-security1.0- penetration-testing
testing-for-email-header-injectioncybersecurityweb-application-security1.0- email-injection
testing-for-host-header-injectioncybersecurityweb-application-security1.0- host-header-injection
testing-for-json-web-token-vulnerabilitiescybersecurityweb-application-security1.0- jwt
testing-for-open-redirect-vulnerabilitiescybersecurityweb-application-security1.0- open-redirect
testing-for-sensitive-data-exposurecybersecurityweb-application-security1.0- penetration-testing
testing-for-xml-injection-vulnerabilitiescybersecurityweb-application-security1.0- xml-injection
testing-for-xss-vulnerabilitiescybersecuritypenetration-testing1.0.0- XSS
testing-for-xss-vulnerabilities-with-burpsuitecybersecurityweb-application-security1.0- penetration-testing
testing-for-xxe-injection-vulnerabilitiescybersecurityweb-application-security1.0- penetration-testing
testing-jwt-token-securitycybersecurityweb-application-security1.0- penetration-testing
testing-oauth2-implementation-flawscybersecurityapi-security1.0.0- api-security
testing-websocket-api-securitycybersecurityapi-security1.0.0- api-security
triaging-vulnerabilities-with-ssvc-frameworkcybersecurityvulnerability-management1.0- ssvc
source: repo docs (build sync)Edit this page on GitHub →