Security

aeondave Bundle

Design and evolve high-quality software systems from concept through implementation: clarify outcomes and constraints, choose the simplest fitting architecture, define boundaries and contracts, address data, security, reliability, observability, testing, and delivery, then simplify and verify the result. Use when creating, refactoring, reviewing, or simplifying cross-language software, modules, APIs, services, or system architecture.

aeondave Bundle

Auth/lab ref: ekzhang/bore: minimal Rust-based reverse TCP tunnel exposing a local port through a public relay (default bore.pub) or a self-hosted server, with optional HMAC `--secret` auth.

aeondave Bundle

Auth/lab ref: XSStrike XSS validation; context analysis, DOM checks, crawler, blind callback workflow, WAF-aware evidence.

aeondave Bundle

Auth/lab ref: Browser Exploitation Framework - hook browsers via XSS/injected JS and perform client-side testing.

aeondave Bundle

Auth assessment: web impact-validation; SQLi, SSTI, XXE, command injection, SSRF, XSS, uploads, deserialization, smuggling, WAF/parser checks.

aeondave Bundle

Auth assessment: post-compromise host methodology; shell state, local privesc triage, secret-exposure review, pivot planning, evidence.

aeondave Bundle

Auth/lab: exploitability validation methodology; CVE/PoC triage, local repro, reliability checks, framework/tool routing, evidence handoff.

aeondave Skill

Auth/lab ref: Suggest Linux privilege escalation exploits based on kernel version and OS.

aeondave Skill

Auth/lab: binary/memory-corruption exploitation methodology — turn a confirmed corruption primitive (stack/heap overflow, UAF, double-free, type confusion, OOB, format string) into reproducible controlled impact. Use when deciding exploitability, qualifying a crash or primitive, selecting a mitigation-aware strategy (NX, ASLR/PIE, canary, RELRO, CET/CFG, safe-linking), planning a staged leak/control/impact chain, or choosing between control-flow (ROP/JOP/SROP/ret2dlresolve) and data-only paths. Routes to concrete pwn recipes and exploit-development skills. Not for CVE/PoC initial access (vuln-exploit-technique), static/dynamic analysis (reversing-technique), or writing primitives at code depth (offensive-coding/*-dev).

ngocsangyem Bundle

Pack an EXTERNAL repository into a single AI-friendly file (markdown/xml/json). Use for third-party library analysis, security audits, or handoff to external LLMs. Do NOT use to pack the current project for inbound context — the host runtime already reads files lazily. Triggers: 'pack this repo', 'snapshot of X', 'export codebase', 'repomix'.

ngocsangyem Bundle

Use when answering factual or explanatory questions about the current project — codebase, architecture, conventions, workflows, constraints — with minimal cited evidence. Triggers on "how does X work here", "what does X mean", "why is X structured this way", "is this claim true in the repo", "explain X with sources". NOT for brainstorming or comparing approaches (mk:brainstorming), trade-off decisions (mk:party), debugging/root cause (mk:investigate), code review (mk:review), plans (mk:plan-creator), security audits (mk:cso), visual explanations/diagrams (mk:preview --explain), test-coverage gaps (mk:nyquist), library docs (mk:docs-finder), or workflow navigation (mk:help).

ngocsangyem Skill

Reviews a GitHub PR with a single shallow correctness/security/breaking/AI-slop checklist and emits a verdict; optionally posts it via gh pr review. Use to review an external or teammate PR. NOT for deep pre-landing audit of your own diff (see mk:review); NOT for responding to received review comments (see mk:respond-pr).

ngocsangyem Skill

Fetch external sources (web / arXiv / GitHub) and turn them into scanner-gated wiki CANDIDATES — never canonical pages. Every fetched byte is DATA; url-guarded, size-capped, redirect-re-validated, injection-scanned, and secret-scrubbed before a candidate is even created. Requires network. NOT for capturing local knowledge (see mk:wiki); NOT for one-shot page-to-markdown (see mk:web-to-markdown).

ngocsangyem Bundle

Design and implement backend service changes: API contracts, service boundaries, auth integration, reliability and delivery checks. Use for backend/API handlers, services, webhooks, jobs, or backend architecture changes. Routes schema/migrations to mk:database; security review to the existing security workflow.

ngocsangyem Bundle

Advanced vulnerability analysis principles. OWASP Top 10 baseline + current threat landscape awareness, Supply Chain Security, attack surface mapping, risk prioritization. Use when performing security audits, threat modeling, or OWASP reviews. NOT for STRIDE/CSO-mode infrastructure audits (see mk:cso).

poly-gents Bundle

Runs Snyk dependency and code security scans, prioritizes findings by severity and exploitability, and proposes minimal-breakage remediations. Use when auditing vulnerabilities or validating fixes.

odjaramillo Skill

Use this skill when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive features. Provides comprehensive security checklist and patterns.

odjaramillo Bundle

Advanced vulnerability analysis principles. OWASP 2025, Supply Chain Security, attack surface mapping, risk prioritization.

odjaramillo Skill

Implement secure API design patterns including authentication, authorization, input validation, rate limiting, and protection against common API vulnerabilities

purpleailab Skill

Smart contract audit lane — Solidity/EVM pattern scanner, Slither ingestion, Foundry PoC generation, DeFi attack playbooks.

purpleailab Bundle

Active Directory exploitation — BloodHound analysis, Kerberoasting, AS-REP Roasting, AD CS abuse, DCSync, Golden Ticket, Constrained Delegation.

purpleailab Skill

Modern API category — gRPC, SOAP/WSDL, WebSocket, Server-Sent Events. Routing skill: identify the API protocol from the response Content-Type or wire format, then load the matching sub-skill.

purpleailab Skill

Web application exploitation — the primary category skill for all web-based attacks. This is a routing skill: read this first to identify the attack type, then load the appropriate specialized sub-skill for detailed procedures. Covers 11 technique areas across injection, file access, authentication, and API exploitation.

purpleailab Skill

Exploit Active Directory Certificate Services ESC1 — vulnerable template allows arbitrary SAN, enabling user impersonation up to domain admin.

purpleailab Skill

Use when the engagement scope includes supply-chain attack simulation — typosquatted package publication, dependency confusion, GitHub Actions secret mining, internal mirror poisoning, OAuth-app impersonation, or vendor portal credential abuse.

purpleailab Skill

Cipher detection + automated decryption via Ciphey, Cyberchef recipes, hashcat hash-ID, format conversion, common encoding chains.

purpleailab Skill

ICS / OT attack category — Modbus, BACnet, S7Comm, DNP3. Routing skill: fingerprint the industrial protocol by port + Wireshark dissector, then load the matching sub-skill. SAFETY-CRITICAL: always confirm written scope before any write/control class action.

purpleailab Skill

Known CVE exploitation — fingerprint CMS/framework/plugin version, look up CVE candidates via cve_lookup, retrieve PoCs via cve_poc_lookup, adapt the public exploit to the target, and confirm RCE. Use whenever the challenge tag is `cve`, recon fingerprinted a versioned service, or the challenge name hints at known vulnerable software (WordPress, Joomla, Apache Struts, Spring4Shell, Log4j, etc.).

purpleailab Skill

HTTP Parameter Pollution — parser discrepancies between proxy/server/app, WAF bypass, auth/ACL bypass, injection delivery.

purpleailab Skill

JSON Web Token attacks — algorithm confusion (alg=none, HS256↔RS256), kid header injection, JWKS spoofing, weak HMAC secret cracking, signature stripping.

purpleailab Skill

Path traversal and Local File Inclusion (LFI) — arbitrary file reading via directory traversal, PHP filter/input/data wrappers for RCE, log poisoning, static resource disclosure, and information leakage. Use for any challenge involving file path manipulation, ../ traversal, local file read, PHP wrappers, or sensitive file disclosure.

purpleailab Skill

Cross-Site Scripting (XSS) — reflected, stored, DOM-based XSS exploitation. Covers filter bypass, CSP evasion, bot-triggered cookie exfiltration, admin page scraping, and headless browser flag extraction. Use for any challenge involving client-side JavaScript injection, Cross payloads, cookie theft, or browser-based exploitation.

purpleailab Skill

Framework-agnostic C2 orchestration — listener types, implant modes, redirector architecture, malleable profiles, jitter strategy, OPSEC guidance.

purpleailab Skill

Broken Function Level Authorization (BFLA) — exploit action-level access control failures where lower-privileged principals invoke admin/staff functions across REST, GraphQL, gRPC, WebSocket, and background job paths.

purpleailab Skill

CORS misconfiguration exploitation — reflected origin, null origin, trusted-subdomain abuse, regex-validation bypass, and credentialed cross-origin data theft.

purpleailab Skill

Cross-Site Request Forgery — missing/invalid tokens, method override, JSON CSRF, SameSite gaps, double-submit flaws, login/logout CSRF, and CSRF-via-XSS chains to account takeover.