Results for “fr”

This skill should be used when the user asks to "follow red team methodology", "perform bug bounty hunting", "automate reconnaissance", "hunt for XSS vulnerabilities", "enumerate subdomains", or needs security researcher techniques and tool configurations from top bug bounty hunters.

Anti-AI-slop design skill for greenfield pages, audits, redesigns, and design extraction from URLs or screenshots. Use when the user asks to build a new app or landing page, wants to redesign something, invokes Hallmark by name, or uses audit/redesign/study.

Audit team performance using the Elon Algorithm (identify A/B/C players) and extract action items from meeting transcripts. Use when asked to "audit team performance", "review my team", "extract meeting actions", "meeting notes to tasks", "team efficiency audit", or "identify underperformers".

Anti-AI-slop design skill for greenfield pages, audits, redesigns, and design extraction from URLs or screenshots. Use when the user asks to build a new app or landing page, wants to redesign something, invokes Hallmark by name, or uses audit/redesign/study.

Recover metadata and content of deleted files from NTFS volumes by analyzing the Master File Table, $LogFile, $UsnJrnl, and MFT slack space using forensic tools like MFTECmd and analyzeMFT.

Apply bottom-up and top-down role mining techniques to discover optimal RBAC roles from existing user-permission assignments, reducing role explosion and enforcing least privilege.

Guide federal systems through the NIST Risk Management Framework (SP 800-37 Rev 2) to achieve an Authorization to Operate (ATO), covering categorization, control selection, assessment, and continuous monitoring.

Automates the collection of suspicious files from endpoints and email gateways, submission to sandbox and multi-engine scanners, and generation of verdicts with IOCs for SIEM integration.

Map advanced persistent threat (APT) group tactics, techniques, and procedures (TTPs) to the MITRE ATT&CK framework using the ATT&CK Navigator and attackcti Python library.

Use when planning an NDSS submission calendar — choosing between the summer and fall cycles, backward-planning from the AoE deadline through early-reject, rebuttal, notification, camera-ready, and the Seoul symposium, and placing NDSS honestly inside the security big-four retargeting year.

Drafts Software and POS System License Agreements for proprietary software use between licensor and licensee. Covers license grants, financial terms, IP, PCI-DSS data security, SLAs, and termination. Use when drafting POS software licenses, SaaS subscriptions, franchise technology licenses, or software distribution agreements.

BitVM, BitVM2, BitVM3: off-chain computation framework using optimistic challenge games on Bitcoin script. Foundation for trust-minimized bridges to L2s and PoS chains. USE WHEN: building trust-minimized bridges, understanding ZK rollup peg-out mechanisms, evaluating bridge security models.

Projects external audit findings from SARIF static analysis results and weAudit annotation files onto Trailmark code graphs as annotations and subgraphs, enabling cross-referencing with pre-analysis data like blast radius and taint.

Conducts security testing of REST, GraphQL, and gRPC APIs to identify vulnerabilities in authentication, authorization, rate limiting, input validation, and business logic using the OWASP API Security Top 10 framework.

Investigate phishing email incidents from initial user report through header analysis, URL/attachment detonation, impacted user identification, and containment actions using SOC tools like Splunk, Microsoft Defender, and sandbox analysis platforms.

Conducts penetration testing of iOS and Android mobile applications following the OWASP MASTG to identify vulnerabilities in data storage, network communication, authentication, cryptography, and platform-specific security controls.

Conduct a defensible cybersecurity risk assessment using the NIST SP 800-30 Rev 1 methodology, from scoping and threat identification to risk determination and communication.

Maps intrusion activity to the Lockheed Martin Cyber Kill Chain framework to identify adversary phase completion, detection gaps, and defensive controls for post-incident analysis and prevention.

Triages security incidents by classifying type, assigning severity based on business impact, enriching with threat intelligence, and routing to appropriate response teams using NIST SP 800-61r3 and SANS PICERL frameworks.

Parses Kubernetes API server audit logs (JSON lines) to detect exec-into-pod, secret access, RBAC modifications, privileged pod creation, and anonymous API access. Builds threat detection rules from audit event patterns.

Analyze Windows Security Event Logs to detect RDP brute force attacks by parsing Event ID 4625 and 4624 entries, identifying source IP frequency, and generating detection reports.

Triages and enriches indicators of compromise (IPs, domains, file hashes, URLs, email artifacts) from phishing emails, security alerts, or threat feeds, assigning confidence scores and dispositions using VirusTotal, AbuseIPDB, MalwareBazaar, and MISP.

Query AWS CloudTrail events with boto3, build statistical baselines of normal API activity, and detect anomalies such as unusual event sources, geographic anomalies, high-frequency API calls, and first-time API usage patterns.

Perform forensic acquisition and analysis of cloud storage services including Google Drive, OneDrive, Dropbox, and Box by collecting both API-based remote data and local sync client artifacts from endpoint devices.

Deploy Runtime Application Self-Protection (RASP) agents to detect and block attacks from within application runtime, covering OpenRASP integration, attack pattern detection, and security policy configuration for Java and Python web applications.

Provides a complete deep-dive into Cross-Site Scripting (XSS) with exact payloads and bypass techniques for every PortSwigger lab variant, from apprentice to expert level.

Plan and execute a comprehensive red team engagement covering reconnaissance through post-exploitation using MITRE ATT&CK-aligned TTPs to evaluate an organization's detection and response capabilities.

Exploit JWT algorithm confusion vulnerabilities by manipulating the alg header to switch from RS256 to HS256, set alg to none, or inject kid/jku/x5u headers to bypass signature verification.

Protect APIs from abuse and resource exhaustion by implementing rate limiting with token bucket, sliding window, and fixed window algorithms using Redis-backed counters, API gateway plugins, or application middleware.

Guides front-end JavaScript reverse engineering through a structured observe-capture-rebuild workflow using js-reverse MCP tools and optional jshookmcp for browser automation, CDP debugging, and runtime hooking.

Runs a deep cross-layer consistency audit across a codebase, tracing features from UI to database to find broken wiring, missing handlers, model mismatches, and security gaps, then auto-fixes critical and warning issues.

Detect and exploit DOM-based XSS vulnerabilities by auditing JavaScript for tainted data flow from controllable sources to dangerous sinks, with payloads and bypass techniques for client-side testing.

Supplements general deposition preparation with IP-specific examination frameworks for patent, trademark, copyright, and trade secret cases. Covers witness strategies for inventors, accused infringers, licensing witnesses, and experts. Use alongside @deposition-preparation and @deposition-expert-witness when planning IP depositions, drafting outlines, or analyzing witness strategy.

Designs and documents structured incident response playbooks aligned with NIST SP 800-61r3 and SANS PICERL frameworks, covering playbook structure, decision trees, escalation criteria, RACI matrices, and SOAR integration.

Execute HTTP Parameter Pollution attacks to bypass input validation, WAF rules, and security controls by injecting duplicate parameters that are processed differently by front-end and back-end systems.

Deploy AWS Config rules for continuous compliance monitoring, including managed and custom rules aligned to CIS and PCI DSS frameworks, automatic remediation with SSM Automation, and multi-account compliance aggregation.