Security

sheshiyer Skill

Audit and rewrite prose to strip 21 categories of AI writing patterns using a 43-entry replacement table, then re-audit the rewrite. USE WHEN asked to remove AI-isms, make text sound less like AI, or polish a draft for AI tells before publishing.

sheshiyer Skill

FastAPI patterns for async APIs: dependency injection, Pydantic request/response models, OpenAPI docs, tests, security, and production readiness. USE WHEN building or reviewing a FastAPI app, structuring routers and dependencies, or adding auth, tests, or deployment settings.

sheshiyer Skill

Laravel security best practices for authn/authz, validation, CSRF, mass assignment, file uploads, secrets, rate limiting, and secure deployment. USE WHEN adding authentication or authorization, handling user input or file uploads, managing secrets, or hardening a Laravel deployment.

sheshiyer Skill

Local-evidence production readiness audit that keeps repo data off external services. USE WHEN asked is this production-ready, what would break in prod, or what did we miss, for pre-launch reviews, post-merge risk passes, or when CI is green but production risk is unknown.

sheshiyer Skill

Quarkus security: authentication, authorization, JWT/OIDC, RBAC, input validation, CSRF, secrets, and dependency CVEs. USE WHEN adding auth, securing endpoints, validating input, managing secrets, or scanning Quarkus dependencies.

sheshiyer Skill

Security checklist for Solidity AMM contracts, liquidity pools, and swap flows: reentrancy, CEI ordering, donation/inflation attacks, oracle manipulation, slippage, admin controls, and integer math. USE WHEN auditing or writing an AMM, liquidity pool, or swap contract.

sheshiyer Skill

Verification loop for Django projects: migrations, linting, tests with coverage, security scans, and deployment readiness checks. USE WHEN validating a Django change before a PR or release, or running the full pre-ship gate of migrations, lint, tests, and security.

sheshiyer Skill

Spring Security best practices for authn, authz, input validation, CORS/CSRF, security headers, secrets, rate limiting, and dependency CVEs. USE WHEN adding auth (JWT, OAuth2, sessions) or role-based access, validating input, configuring headers, managing secrets, or hardening a Spring Boot service.

sheshiyer Skill

Codified expertise for quality control, non-conformance investigation, root cause analysis, corrective action, and supplier quality management in regulated manufacturing. Informed by quality engineers with 15+ years experience across FDA, IATF 16949, and AS9100 environments. Includes NCR lifecycle management, CAPA systems, SPC interpretation, and audit methodology. Use when investigating non-conformances, performing root cause analysis, managing CAPAs, interpreting SPC data, or handling supplier quality issues.

sheshiyer Skill

Hunt for exploitable, bounty-worthy security issues by biasing toward remotely reachable, user-controlled attack paths over noisy local-only findings. USE WHEN scanning a repo for real vulnerabilities, preparing a Huntr or HackerOne submission, or triaging whether a finding actually qualifies for a bounty.

sheshiyer Skill

Verification loop for Spring Boot projects running build, static analysis, tests with coverage, security scans, and diff review. USE WHEN opening a PR for a Spring Boot service, after major refactoring or dependency upgrades, before deploying to staging or production, or validating that test coverage meets thresholds.

sheshiyer Skill

PHI/PII compliance patterns covering data classification, access control, audit trails, encryption, and common leak vectors (HIPAA, DISHA, GDPR). USE WHEN building features touching patient records, designing healthcare schemas or APIs, or reviewing code for data exposure.

sheshiyer Skill

Pre-deployment checks for router and switch configs: dangerous commands, duplicate addresses, subnet overlaps, stale references, management-plane risk, and IOS-style security hygiene. USE WHEN reviewing Cisco IOS/IOS-XE snippets or script-generated config before a change window or automation run.

sheshiyer Bundle

Diagnose SwiftUI performance problems code-first — invalidation storms, unstable ForEach identity, layout thrash, main-thread image decode — then guide Instruments profiling when code review is inconclusive. USE WHEN a user reports janky scrolling, dropped frames, high CPU, hangs, or excessive view updates in SwiftUI.

undermybelt Bundle

Detect compromised O365 and Google Workspace email accounts by analyzing inbox rule creation, suspicious sign-in locations, mail forwarding rules, and unusual API access patterns via Microsoft Graph and audit logs.

undermybelt Bundle

Analyzes firmware images for embedded malware, backdoors, and unauthorized modifications targeting routers, IoT devices, UEFI/BIOS, and embedded systems. Covers firmware extraction, filesystem analysis, binary reverse engineering, and bootkit detection. Activates for requests involving firmware security analysis, IoT malware investigation, UEFI rootkit detection, or embedded device compromise assessment.

undermybelt Bundle

Detect insider threat behavioral indicators including unusual data access, off-hours activity, mass file downloads, privilege abuse, and resignation-correlated data theft.

undermybelt Bundle

Test JWT implementations for critical vulnerabilities including algorithm confusion, none algorithm bypass, kid parameter injection, and weak secret exploitation to achieve authentication bypass and privilege escalation.

undermybelt Bundle

Collect, parse, and correlate system, application, and security logs to reconstruct events and establish timelines during forensic investigations.

undermybelt Bundle

Crafts and injects custom network packets using Scapy, hping3, and Nemesis during authorized security assessments to test firewall rules, IDS detection, protocol handling, and network stack resilience against malformed and spoofed traffic.

undermybelt Bundle

This skill covers analyzing Programmable Logic Controller (PLC) firmware for security vulnerabilities including hardcoded credentials, insecure update mechanisms, backdoor functions, memory corruption flaws, and undocumented debug interfaces. It addresses firmware extraction from common PLC platforms (Siemens S7, Allen-Bradley, Schneider Modicon), static analysis of firmware images, dynamic analysis in emulated environments, and comparison against known-good baselines to detect tampering.

undermybelt Bundle

Reverse engineers iOS applications using Frida dynamic instrumentation to understand internal logic, extract encryption keys, bypass security controls, and discover hidden functionality without source code access. Use when performing authorized iOS penetration testing, analyzing proprietary protocols, understanding obfuscated logic, or extracting runtime secrets from iOS binaries. Activates for requests involving iOS reverse engineering, Frida iOS hooking, Objective-C/Swift method tracing, or iOS binary analysis.

undermybelt Bundle

Spearphishing targets specific individuals using personalized, researched content that bypasses generic spam filters. Email security gateways (SEGs) like Microsoft Defender for Office 365, Proofpoint,

undermybelt Bundle

Hunt for MITRE ATT&CK T1098 account manipulation including shadow admin creation, SID history injection, group membership changes, and credential modifications using Windows Security Event Logs.

undermybelt Bundle

Generates structured cyber threat intelligence reports at strategic, operational, and tactical levels tailored to specific audiences including executives, security operations teams, and technical analysts. Use when producing finished intelligence products from raw collection data, creating sector threat briefings, or delivering post-incident intelligence assessments. Activates for requests involving CTI report writing, threat briefings, intelligence products, finished intelligence, or executive security reporting.

undermybelt Bundle

Implement comprehensive API security testing using the 42Crunch platform to perform static audit and dynamic conformance scanning of OpenAPI specifications.

undermybelt Bundle

Analyze advanced persistent threat (APT) group techniques using MITRE ATT&CK Navigator to create layered heatmaps of adversary TTPs for detection gap analysis and threat-informed defense.

undermybelt Bundle

Harbor is an open-source container registry that provides security features including vulnerability scanning (integrated Trivy), image signing (Notary/Cosign), RBAC, content trust policies, replicatio

undermybelt Bundle

Detect LSASS credential dumping, SAM database extraction, and NTDS.dit theft using Sysmon Event ID 10, Windows Security logs, and SIEM correlation rules

undermybelt Bundle

Build effective detection rules using Splunk Search Processing Language (SPL) correlation searches to identify security threats in SOC environments.

undermybelt Bundle

Performs GraphQL introspection attacks to extract the full API schema including types, queries, mutations, subscriptions, and field definitions from GraphQL endpoints. The tester uses introspection queries to map the attack surface, identifies sensitive fields and mutations, tests for query depth and complexity limits, and exploits GraphQL-specific vulnerabilities including batching attacks, alias-based brute force, and nested query DoS. Activates for requests involving GraphQL security testing, introspection attack, GraphQL enumeration, or GraphQL API penetration testing.

undermybelt Bundle

Implements FIDO2/WebAuthn hardware security key authentication including registration ceremonies, authentication flows, YubiKey enrollment, and passkey migration strategies. Builds a complete relying party server using the python-fido2 library that supports cross-platform authenticators, resident key (discoverable credential) workflows, and user verification policies. Activates for requests involving FIDO2 implementation, WebAuthn registration, hardware security key enrollment, YubiKey integration, or passkey migration from password-based authentication.

undermybelt Bundle

Hash cracking is an essential skill for penetration testers and security auditors to evaluate password strength. Hashcat is the world's fastest password recovery tool, supporting over 300 hash types w

undermybelt Bundle

Uses the Linux Audit framework (auditd) with ausearch and aureport utilities to detect intrusion attempts, unauthorized access, privilege escalation, and suspicious system activity. Covers audit rule configuration, log querying, timeline reconstruction, and integration with SIEM platforms. Activates for requests involving auditd analysis, Linux audit log investigation, ausearch queries, aureport summaries, or host-based intrusion detection on Linux.

undermybelt Bundle

Discover and exploit mass assignment vulnerabilities in REST APIs to escalate privileges, modify restricted fields, and bypass authorization controls by injecting unexpected parameters in API requests.

undermybelt Bundle

Performs tabletop exercises for SOC teams simulating security incidents through discussion-based scenarios to test incident response procedures, communication workflows, and decision-making under pressure without impacting production systems. Use when organizations need to validate IR playbooks, train analysts, or meet compliance requirements for incident response testing.