Vulnerability Scanning Agent Skills

Provides a structured CLI workflow for Android APK reverse engineering, covering decompilation with jadx and apktool, smali modification, repackaging, signing, and Frida dynamic hooking, with optional native .so analysis via IDA or radare2.

Authorized security assessment of REST, GraphQL, WebSocket, and SOAP APIs covering discovery, authentication, authorization, rate-limiting, and CI/CD integration.

Orchestrates multi-stage attack-path planning and execution across reconnaissance, initial access, privilege escalation, lateral movement, and impact assessment for authorized penetration testing.

Conduct authorized security assessments of LLM applications and AI agents, covering prompt injection, tool abuse, RAG exposure, memory poisoning, and model supply-chain risks.

Guides authorized macOS and Mach-O reverse engineering covering codesign analysis, Objective-C/Swift symbol recovery, endpoint security surfaces, and Apple platform malware analysis.

Provides a comprehensive penetration testing toolchain with 20+ security tools (Nmap, Nuclei, SQLMap, FFUF, Hashcat, etc.) exposed via MCP servers for authorized vulnerability scanning, exploitation, and reporting.

Guides authorized Wi-Fi security assessments including handshake capture, PMKID collection, rogue AP detection, and offline password policy evaluation using aircrack-ng, hashcat, and Wireshark.

Analyzes email security including phishing dissection, SPF/DKIM/DMARC authentication checks, BEC fraud patterns, and OAuth token abuse research for authorized reviews.

Performs free, open-source reverse engineering with Ghidra using headless or GUI modes, including decompilation, cross-references, and optional MCP workflows when IDA is unavailable.

Provides a structured methodology for authorized Android and iOS reverse engineering, covering static analysis, dynamic instrumentation with Frida and Objection, SSL pinning bypass, root/jailbreak detection evasion, and cryptographic key extraction.

End-to-end firmware and IoT penetration testing pipeline following OWASP FSTM methodology. Extracts, emulates, and exploits router, camera, and smart-home firmware using binwalk, EMBA, Firmadyne, and AFL++.

Authorized reverse engineering of custom binary protocols, Protobuf/gRPC, WebSocket frames, and PCAP-driven protocol recovery with structured workflow and tooling.

Guides authorized digital forensics and incident response workflows including memory dump analysis, disk timeline creation, PCAP investigation, and artifact triage with evidence preservation.

Guides authorized hardware and embedded interface security research including UART/JTAG discovery, debug pad triage, secure boot assessment, and offline firmware extraction support.

Provides structured reverse engineering techniques for analyzing compiled, obfuscated, packed, or virtualized targets including binaries, APKs, WASM, firmware, and custom VMs using static and dynamic analysis workflows.

Assess software supply chain security by generating SBOMs, scanning dependencies, auditing CI/CD pipelines, analyzing container images, and verifying vulnerability reachability.

Provides a structured 5-phase workflow for bug bounty and SRC vulnerability hunting, including 19 attack-type playbooks, 305 structured payloads, 263 WAF bypass variants, and 2,887 real HackerOne case studies.

Analyzes iOS IPA bundles and hooks runtime behavior using Frida to inspect Objective-C or Swift methods, Keychain access, SSL pinning, and URL schemes for CTF challenges. Correlates static evidence with live hook output to reproduce accepted request paths.

Specialized CTF workflow for reverse engineering, malware analysis, DFIR, firmware, pwnable, and native exploit challenges under sandbox assumptions.

Recovers transform chains, hidden media payloads, mobile signing paths, and local trust boundaries in CTF challenges involving crypto, encoding, steganography, APK, IPA, and mobile trust-boundary analysis.

Recovers malware configuration, decodes C2 and beacon parameters, unpacks staged payloads, and extracts bot or campaign IDs from samples in a CTF sandbox environment.

Maps and reproduces OAuth/OIDC authentication chains by tracing redirects, token exchange, and identity acceptance in controlled environments.

Runs KICS to scan infrastructure-as-code files for security vulnerabilities and compliance issues.

Detects leaked secrets in Git repositories by scanning full commit history with Gitleaks rules and the GitHub Secret Scanning API, identifying exposed API keys, tokens, and credentials.

Generates custom Semgrep rules from natural language descriptions of vulnerability patterns, verifying syntax with semgrep --validate and testing against sample fixtures with semgrep --test.

Runs Semgrep static analysis with custom YAML rules, supporting taint tracking, metavariable comparisons, and pattern-not-inside exclusions for precise vulnerability detection.

Runs Semgrep static analysis via the semgrep CLI with custom YAML rule packs, supports community rules, parses JSON output, and integrates with the Semgrep App API for findings management.

Automates REST API security testing using the OWASP ZAP Python SDK, running active scans, SQL injection probes, and XSS tests against OpenAPI specs with structured vulnerability reports.

Audits a codebase for scalability bottlenecks, flagging N+1 queries, missing indexes, unbounded result sets, blocking operations, and memory pressure, then outputs a prioritized fix list.

Audits codebases against PCI DSS v4.0, scanning for PAN patterns, CVV storage, and all 12 requirements including network security, encryption, access control, and logging. Estimates SAQ type for payment-handling systems.

Performs a static-analysis penetration test to find exploitable vulnerabilities, providing proof-of-concept payloads and fixes. Covers injection, XSS, authentication bypass, authorization flaws, path traversal, command injection, CSRF, SSRF, hardcoded secrets, and insecure deserialization, with a full attack surface.

Sets up and runs OSS-Fuzz fuzzing harnesses locally, builds project images, and generates coverage reports.

Runs Semgrep static analysis to find bugs and security vulnerabilities, with guidance on installation, rule selection, custom rule writing, and CI/CD integration.

Analyzes DeFi protocol risk before deposit, decomposes headline APY into sustainable yield, emissions, and drag factors, and flags common rug-risk patterns in tokenomics, liquidity, and governance. Advisory only—no wallet access, no private key handling, no transaction signing, no on-chain execution.

Runs a six-phase security audit covering attack-surface mapping, STRIDE/PASTA threat modeling, technical checklists, red/blue team exercises, and a final verdict, plus incident-response and monitoring guidance.

Automated security auditing covering SAST, DAST, dependency scanning, secret detection, container hardening, and compliance checks before deployments or when integrating new dependencies.