Results for “go”

Run Microsoft Entra ID tenant reconnaissance, token acquisition and manipulation, and federation backdoor testing with the AADInternals PowerShell toolkit to validate identity-attack resilience.

Executes authorized phishing simulation campaigns to assess an organization's susceptibility to email-based social engineering attacks, including scenario design, infrastructure setup, and metric tracking.

Verify TPM measured boot integrity and remote attestation using tpm2-tools, including PCR reading, event log replay, quote generation and verification, and golden baseline comparison.

Drafts DD Form 254 Contract Security Classification Specifications for classified government contracts. Use when preparing security classification specs for prime contractors, subcontractors, SAP/SCI access, or facility clearance documentation per NISPOM (32 CFR Part 117) and DCSA regulations.

Configure Azure API Management as an AI Gateway to govern AI models, MCP tools, and agents with policies for caching, rate limiting, content safety, and cost control.

Conduct authorized red team initial access using EvilGinx3 adversary-in-the-middle phishing to capture session tokens and bypass multi-factor authentication.

Configure and execute access recertification campaigns in Saviynt Enterprise Identity Cloud to validate user entitlements, revoke excessive access, and maintain compliance with SOX, SOC2, and HIPAA.

Queries real-time vulnerability intelligence from NIST NVD, CISA KEV, EPSS, and MITRE ATT&CK via a remote MCP server, offering seven tools for CVE lookup, search, and trending analysis.

Exploit Active Directory replication privileges (DS-Replication-Get-Changes) to perform a DCSync attack, allowing an attacker to impersonate a Domain Controller and extract password hashes (like the krbtgt hash for Golden Tickets) without code execution on a DC.

Evaluates Base ERC-20 tokens by contract address, returning a 0-100 score across five criteria, launch protocol classification, security flags, and a narrative interpretation.

Enumerate and exploit Active Directory Certificate Services ESC1 through ESC16 misconfigurations with Certipy, including SAN abuse, NTLM relay to web enrollment (ESC8), and golden certificate forgery.

Implement PCI DSS 4.0.1 compliance controls across all 12 requirements, including scoping, network security, data protection, access controls, monitoring, and governance.

Runs entitlement review and access certification campaigns using SailPoint IdentityIQ, including manager certifications, targeted entitlement reviews, role-based access validation, SOD violation remediation, and automated revocation workflows.

Audit App Store and Google Play listings for discoverability and conversion — keywords, localized metadata, screenshots, ratings prompts — then emit a prioritized ASO plan. Use when "optimize our store listing", "improve app downloads", or "ASO". Submission mechanics → plan-mobile-readiness. Plan only.

Personal finance review skill for individuals who want to understand their spending, budgets, and financial patterns. Use whenever the user wants to analyze expenses, categorize spending, review a budget, build a budget from scratch, analyze debt, audit subscriptions, understand their savings rate, or track progress toward a financial goal. Triggers: "help me review my spending", "here are my expenses", "can you look at my budget", "help me build a budget", "I want to understand where my money goes", "categorize these transactions", "help me pay off my debt", "audit my subscriptions", "am I saving enough", "am I on track for my goal", "analyze my finances", or any time the user shares financial data (even raw or messy) and wants insight. Does NOT provide investment, tax, or financial planning advice — helps users understand their own data. Trigger proactively when the user pastes transactions, expenses, or any money-related data, even without an explicit request for analysis.

Enumerate DNS records, attempt zone transfers, brute-force subdomains, and map DNS infrastructure during authorized reconnaissance to identify attack surface, misconfigurations, and information disclosure in target domains.

Enforce identity verification, device compliance, and data protection for cloud-hosted services using CASB, SSPM, conditional access policies, OAuth app governance, and session controls.

Uses mutation testing to systematically identify gaps in test vector coverage for cryptographic algorithms, then generates new test vectors that close those gaps. Measures effectiveness by comparing mutation kill rates before and after.

Maps an organization's external attack surface using public sources like DNS records, certificate transparency logs, search engines, social media, and data breach databases, without directly interacting with target systems.

Per-page UX audit using NN/g heuristics, Intuit microcopy, and Google HEART. Use when evaluating usability, auditing microcopy, checking UX heuristics, or assessing cognitive load. Cross-page flows/IA → audit-ux-journeys. Layout/breakpoints → audit-responsive. Empty/error states → audit-ui-states.

Audit Google Cloud Platform environments for security misconfigurations using Forseti, Security Command Center, and gcloud CLI to evaluate IAM policies, firewall rules, storage permissions, and CIS compliance.

Enumerate and audit GCP storage buckets and IAM policies using GCPBucketBrute and gcloud CLI to identify privilege escalation paths and overly permissive access.

Detect and exploit blind Server-Side Request Forgery vulnerabilities using out-of-band techniques, DNS interactions, and timing analysis to access internal services and cloud metadata endpoints.

Audits Google Cloud Platform IAM permissions to identify overly permissive bindings, primitive role usage, service account key proliferation, and cross-project access risks using gcloud CLI, Policy Analyzer, and IAM Recommender.

When the user wants to audit or optimize an App Store or Google Play listing. Also use when the user mentions 'ASO audit,' 'app store optimization,' 'optimize my app listing,' 'improve app visibility,' 'app store ranking,' 'audit my listing,' 'why aren't people downloading my app,' 'improve my...

Conduct internal audits against ISO/IEC 42001:2023 by identifying AIMS gaps, building an AI risk register with Annex A control mappings, and generating a 12-month Clause 9.2 audit plan.

Applies the DORA framework to manage ICT risk and operational resilience for EU financial entities, covering governance, incident reporting, resilience testing, third-party risk, and threat intelligence sharing.

Drafts a Bring Your Own Device (BYOD) policy for U.S. employers governing personal device access to company systems. Covers MDM enrollment, encryption, remote wipe authority, privacy expectations, data classification, and regulatory overlays (HIPAA, GLBA, SOX, GDPR). Use when creating or updating BYOD policies, mobile device security policies, or personal device programs.

Deploy Google BeyondCorp Enterprise zero trust access controls using Identity-Aware Proxy (IAP), context-aware access policies, device trust validation, and Access Context Manager to enforce identity and posture-based access to GCP resources and internal applications.

Audits email domain deliverability setup (SPF, DKIM, DMARC, MX records, blacklists, TLS) and generates health score (0-100) with prioritized fix list. Checks bulk sender compliance against Google/Yahoo/Microsoft 2024-2026 requirements. Provides DNS records to add/update. Use when user asks to audit, check, or analyze email deliverability, domain health, or inbox placement.

Use when answering questions about IFRS standards, IAS standards, IASB, financial reporting, revenue recognition, lease accounting, impairment, financial instruments, expected credit loss, ECL, consolidation, business combinations, fair value measurement, first-time adoption, deferred tax, provisions, insurance contracts, journal entries, disclosure requirements, IFRS compliance checks, audit support, GAAP differences, goodwill, or transitioning from local GAAP to IFRS.

Produces a decision-grade dossier on a specific company, person, nonprofit, or government org by testing the user's hypothesis rather than confirming it. Outputs an editable Word document with verdict, identity facts, 12-month activity timeline, network and reputation signals, and red flags.

Implement Google's BeyondCorp zero trust access model to eliminate implicit trust from the network perimeter, enforce identity-aware access controls using IAP, Access Context Manager, and Chrome Enterprise Premium for VPN-less secure application access.

Prepare safe production launches — pre-launch checklist, monitoring, staged rollout, and rollback. Load when deploying to production, releasing a major change, opening beta access, or the user asks for a launch checklist, go-live plan, rollout strategy, or rollback plan. Not for local-only prototypes. Pairs with ci-cd-and-automation and app-security-hardening.

World-class backend engineering - distributed systems, database architecture, API design, and the battle scars from scaling systems that handle millions of requestsUse when "backend, api, database, postgres, mysql, mongodb, redis, graphql, rest, authentication, authorization, caching, queue, background job, webhook, migration, transaction, n+1, rate limit, server, node.js, python, go, backend, api, database, architecture, performance, reliability, security" mentioned.

Use to audit whether similar customers with similar failures received similar redress, and to find variation that could not be defended. Trigger for "are our refunds consistent", "do we compensate similar cases the same way", "audit our goodwill decisions", redress fairness review, customers who escalate getting more, or a complaint that someone else was treated better.