Results for “sleuth-kit”

Conducts disk forensics investigations using forensic imaging, file system analysis, artifact recovery, and timeline reconstruction to support incident response cases.

Scans agent skills for security issues including prompt injection, malicious scripts, excessive permissions, secret exposure, and supply chain risks.

Investigate tokens, wallets, and on-chain entities with natural-language answers backed by on-chain data. Detect insiders, whales, pump-and-dump, wash trading, and wallet networks on Base.

Collects publicly available information about a target organization to identify attack surfaces, social engineering targets, technology stacks, and credential exposures for authorized security testing.

Detect and prevent hardcoded secrets in git repositories using Gitleaks, including pre-commit hooks, CI/CD integration, custom rules, baseline management, and remediation workflows.

Audit the working tree and git history for exposed credentials and mis-scoped keys, then a rotate-vs-relocate plan. Use when "hardcoded secrets", "did I commit a key", "secret scan", "is my .env safe", or "rotate keys". Do not fire for "RLS audit" or generic "security burndown".

Configure and manage GitHub secret scanning, push protection, custom patterns, and alert remediation.

Local-first secret scanning for repos and git history. Use before every push, when scanning for exposed keys, checking for committed credentials, or auditing a repo for accidental secret leaks. Designed for Nick's workflow and safer than forcing suspicious marketplace secret scanners.

Detects leaked secrets in Git repositories by scanning full commit history with Gitleaks rules and the GitHub Secret Scanning API, identifying exposed API keys, tokens, and credentials.

Collects and synthesizes open-source intelligence (OSINT) about threat actors, malicious infrastructure, and attack campaigns using passive reconnaissance tools and public data sources.

Chief Security Officer mode. (gstack)

Scan and audit AI agent skills for security risks before installation, producing a PASS/WARN/FAIL verdict with findings and remediation guidance.

Defense-in-depth security across Rust, TypeScript, and Bash for the Pump SDK — cryptographic key handling, memory zeroization, secure file I/O, input validation, privilege management, dependency auditing, and a 60+ item security checklist.

Authorized security assessment for cloud, container, and Kubernetes environments covering metadata SSRF, IAM misconfigurations, container escape paths, and cluster RBAC review.

Audit installed SKILL.md files and companion scripts for shell injection, secret exfiltration, path traversal, prompt-override payloads, destructive commands, and obfuscation. Integrates with Bankr Safety Scores and produces delta reports against prior scans.

Security audit engine for OpenClaw configurations. Detects vulnerabilities, misconfigurations, secret leaks, and over-privileged agents. Use when the user asks about security, hardening, config review, or audit of their OpenClaw setup.

Build automated threat intelligence enrichment pipelines in Splunk Enterprise Security using lookup tables, modular inputs, and the Threat Intelligence Framework.

Conduct passive OSINT reconnaissance on target organizations using a MITRE ATT&CK framework. Discovers employees, email patterns, subdomains, infrastructure, leaked credentials, and cloud assets with confidence-scored findings.

Simulate and detect software supply chain attacks including typosquatting via Levenshtein distance, dependency confusion testing, package hash verification, and vulnerability scanning with pip-audit.

Scans installed or specified agent skills for advertising, covert commercial intent, task hijacking, suspicious external calls, and sensitive-data access. Reports findings first and quarantines only after explicit user confirmation.

Deep OAuth 2.0 / OpenID Connect security assessment. Covers the full attack surface: redirect_uri validation bypass (path traversal, open redirect chains, subdomain confusion, URL parsing tricks, parameter pollution, response mode switching), missing/broken state parameter CSRF, PKCE downgrade and absent-challenge attacks, implicit grant token leakage (Referer, browser history, XSS fragment theft), authorization code injection, scope escalation, client confusion attacks, mutable-claims account takeover (iss+sub confusion, email-keyed identity merging), pre-account takeover via unverified registration, OpenID Connect dynamic client registration SSRF (logo_uri, jwks_uri, sector_identifier_uri, request_uri), nonce replay, ID token validation failures, Device Code phishing flow, mobile custom URI scheme hijacking, refresh token persistence, token introspection enumeration, consent screen clickjacking, host header injection, and cross-IdP mix-up attacks. Uses KOAuth, jwt_tool, nuclei oauth templates, and manual ht

Provides a structured 5-phase workflow for bug bounty and SRC vulnerability hunting, including 19 attack-type playbooks, 305 structured payloads, 263 WAF bypass variants, and 2,887 real HackerOne case studies.

Use the release-audit skill to run the pre-release validation sweep and print

Guides blue-team threat hunting and detection engineering with hypothesis-driven workflows, Sigma/YARA rule creation, SIEM query design, and validation using Atomic Red Team in authorized environments.

Examine file system slack space, MFT entries, USN journal, and alternate data streams to recover hidden data and reconstruct file activity on NTFS volumes.