securityskills/skills

1

stride-threat-modeling Run a STRIDE-based threat modeling workshop — diagram the system, enumerate threats per element, rank them, and drive…

securityskills/skills

68

2

jwt-security-review Audit JSON Web Token implementations for algorithm confusion, weak secrets, missing validation, and token lifecycle f…

securityskills/skills

37

3

secure-code-review Perform a security-focused code review — map trust boundaries, audit input paths and auth flows, and use vulnerabilit…

securityskills/skills

32

4

agentic-sdlc-controls Review a development pipeline where AI coding agents write, commit and deploy — permission boundaries, approval gates…

securityskills/skills

22

5

network-segmentation-review Review network segmentation designs and verify enforcement — VLANs, firewalls, cloud security groups, and zero-trust …

securityskills/skills

14

6

owasp-top10-analysis Systematically review a web application against the OWASP Top 10 vulnerability classes with concrete test cases per c…

securityskills/skills

14

7

attack-surface-recon Map an organization's external attack surface — domains, subdomains, exposed services, leaked credentials, and brand …

securityskills/skills

13

8

active-directory-attack-paths Enumerate and exploit common Active Directory misconfigurations such as Kerberoasting, AS-REP roasting, delegation ab…

securityskills/skills

11

9

ai-change-evidence Turn changes authored by AI coding agents into evidence an auditor accepts — provenance, authorization, and mapping t…

securityskills/skills

7

10

pci-dss-scoping Scope a PCI DSS environment correctly — cardholder data flows, segmentation validation, and requirements mapping for …

securityskills/skills

7

11

soc2-readiness Prepare an organization for a SOC 2 Type I or II audit — trust services criteria mapping, evidence collection, contro…

securityskills/skills

7

12

bug-bounty-recon-pipeline Build an automated, continuously-running reconnaissance pipeline for bug bounty programs — subdomain enumeration, ser…

securityskills/skills

5

13

bug-bounty-report-writing Write bug bounty reports that get triaged quickly and rated accurately — clear impact statements, minimal reproductio…

securityskills/skills

5

14

pentest-engagement-methodology Execute an authorized penetration test end-to-end, from scoping and rules of engagement through reconnaissance, explo…

securityskills/skills

5

15

ssrf-hunting Find and exploit Server-Side Request Forgery across URL-fetching features, including cloud metadata bypasses and blin…

securityskills/skills

5

16

aws-security-review Audit AWS environments for IAM privilege escalation, exposed resources, logging gaps, and misconfigurations across ac…

securityskills/skills

4

17

container-image-hardening Harden Dockerfiles and container images — multi-stage builds, non-root users, minimal base images, and vulnerability …

securityskills/skills

4

18

gdpr-data-mapping Build a GDPR-compliant data inventory — record of processing activities, lawful basis mapping, data subject rights re…

securityskills/skills

4

19

incident-response-forensics Perform digital forensics during incident response — evidence preservation, volatile data collection, artifact analys…

securityskills/skills

4

20

kubernetes-security-audit Audit Kubernetes clusters for RBAC excesses, pod security gaps, network policy holes, and supply-chain risks. Use whe…

securityskills/skills

4

21

malware-triage Safely triage unknown malware samples — static indicators, sandbox execution, behavior extraction, and reporting. Use…

securityskills/skills

4