Results for “assessment”

Assess security of SCADA HMI systems by evaluating authentication, communication, web interfaces, and hardening against IEC 62443 and NIST SP 800-82 guidelines.

Bypasses SSL/TLS certificate pinning in Android and iOS apps to intercept HTTPS traffic during authorized security assessments using Frida, Objection, and custom scripts.

Exploit misconfigured Active Directory Certificate Services ESC1 vulnerability to request certificates as high-privileged users and escalate domain privileges during authorized red team assessments.

Provides production-grade techniques for evaluating LLM outputs using LLMs as judges, covering direct scoring, pairwise comparison, bias mitigation, rubric generation, and confidence calibration.

Automates reverse engineering of PE and ELF binaries by driving IDA with the WPeGPT plugin, producing structured reports on program purpose, network IoCs, suspicious functions, and vulnerability assessment.

Assesses a project against all five SOC 2 Trust Service Criteria, producing a control-by-control PASS/PARTIAL/FAIL matrix with evidence references, remediation roadmap, and evidence collection checklist for audit readiness.

Implement the NIST Privacy Framework IDENTIFY function including ID.BE business environment, ID.DA data actions, ID.IM improvement, and ID.RA risk assessment subcategories. Provides control mapping, gap analysis templates, and implementation workflows for privacy risk identification.

Exploit privileged pods, host mounts, runC CVEs, and exposed Docker sockets to break out of a container and reach the underlying host during authorized container-security assessments.

Enables comprehensive security monitoring across Azure subscriptions, including cloud security posture management, workload protection, regulatory compliance assessment, and adaptive security controls.

Integrates endpoint health signals from CrowdStrike ZTA, Microsoft Intune, and Jamf into conditional access policies to enforce device compliance before granting resource access.

Use when designing a course, assessment, or student-feedback workflow and deciding where AI assistance is acceptable, when grading or feedback must stay within academic-integrity and FERPA/KVKK boundaries, or when AI-use rules for students need stating.

Design a single-point rubric with one criterion and open columns for evidence. Use for student self-assessment, peer feedback, teacher formative feedback, or pre-task planning. Works with any learning target, with or without a band system.

Autonomous multi-round research review loop. Repeatedly reviews via Codex MCP, implements fixes, and re-reviews until positive assessment or max rounds reached. Use when user says "auto review loop", "review until it passes", or wants autonomous iterative improvement.

Expert guidance for FedRAMP certification and compliance. Use this skill whenever a user asks about FedRAMP authorization, ATO (Authority to Operate), cloud security for federal government, NIST SP 800-53 controls, CSP compliance, or any of the core FedRAMP document types: SSP, SAP, SAR, POA&M, CIS/CRM workbooks. Also trigger for questions about FedRAMP impact levels (Low, Moderate, High, LI-SaaS), FedRAMP 20x, OSCAL, 3PAO assessments, continuous monitoring (ConMon), gap assessments, system boundary definition, FedRAMP readiness, or architecture reviews for federal cloud. When in doubt, use this skill — it covers the full FedRAMP lifecycle from readiness through continuous monitoring.

Performs STRIDE-A threat model analysis of repositories and systems, producing architecture overviews, DFD diagrams, prioritized findings, and executive assessments. Supports both single analysis and incremental updates with change tracking.

Quantifies the business and regulatory impact of a potential data breach by inventorying sensitive data, tracing data flows, scoring exposure vectors, and estimating regulatory fines using law-sourced figures.

Identifies and exploits IPv6-specific vulnerabilities including SLAAC spoofing, Router Advertisement flooding, and IPv6 tunneling during authorized assessments to test dual-stack security controls and IPv6-aware network defenses.

Assess whether your product work is AI-first or AI-shaped, evaluate maturity across five key competencies, and get recommendations on which capability to build next.

Conduct authorized security assessments of LLM applications and AI agents, covering prompt injection, tool abuse, RAG exposure, memory poisoning, and model supply-chain risks.

Performs a full-stack security posture assessment with 0-100 risk scoring, scanning dependencies, code patterns, configuration, and data handling, then produces a prioritized report and routes to specialized skills.

Systematically evaluate scholarly work using the ScholarEval framework, providing structured assessment across research quality dimensions including problem formulation, methodology, analysis, and writing with quantitative scoring and actionable feedback.

Automates GoPhish phishing simulation campaigns using the Python gophish library to create email templates, configure SMTP profiles, import targets, launch campaigns, and analyze results for security awareness assessment.

Guide federal systems through the NIST Risk Management Framework (SP 800-37 Rev 2) to achieve an Authorization to Operate (ATO), covering categorization, control selection, assessment, and continuous monitoring.

Expert ISO 27001 compliance assistant for security and compliance teams. Use this skill whenever a user asks about ISO 27001 or ISO/IEC 27001, including any of the following: gap analysis, auditing, compliance assessments, control checklists, policy writing, document generation, Statement of Applicability (SoA), risk assessment, risk registers, risk treatment plans, Annex A controls, ISMS implementation, clause requirements, certification readiness, transitioning from 2013 to 2022, control implementation guidance, incident response policies, access control policies, supplier security, or any information security management system (ISMS) topic. Trigger even if the user doesn't say "skill" — any ISO 27001 or ISMS question should use this skill.

Generates operations-focused guidance for Google Cloud workloads based on the Operational Excellence pillar of the Well-Architected Framework, including assessment questions and validation checklists.

Audit Google Cloud Platform environments for security misconfigurations using Forseti, Security Command Center, and gcloud CLI to evaluate IAM policies, firewall rules, storage permissions, and CIS compliance.

Deploy Nozomi Networks Guardian sensors for passive OT network traffic analysis to achieve asset visibility, threat detection, and vulnerability assessment across industrial control systems.

Scan codebases for technical debt, score severity, track trends, and generate prioritized remediation plans. Use when users mention tech debt, code quality, refactoring priority, debt scoring, cleanup sprints, or code health assessment. Also use for legacy code modernization planning and maintenance cost estimation.

Handles GDPR Article 21 right to object to processing, including compelling legitimate grounds assessment, ceasing processing obligations, documentation requirements, and the relationship with erasure under Article 17(1)(c). Activate for right to object, Art. 21, objection to processing, legitimate interest queries.

Scan codebases for technical debt, score severity, track trends, and generate prioritized remediation plans. Use when users mention tech debt, code quality, refactoring priority, debt scoring, cleanup sprints, or code health assessment. Also use for legacy code modernization planning and maintenance cost estimation.

Plan and execute authorized red team engagements with structured attack path analysis, MITRE ATT&CK kill-chain planning, technique scoring, choke point identification, OPSEC risk assessment, and crown jewel targeting.

Evaluates US market bubble risk through quantitative data analysis using the Minsky/Kindleberger framework, scoring indicators like Put/Call ratio, VIX, margin debt, breadth, and IPO data.

Evaluates text-to-image generation models by decomposing assessment into five specialized skills (object presence, count, spatial relations, scale, and text rendering) and open-ended prompts, producing interpretable binary scores with visual and textual explanations.

Macroeconomic monitor. Supports UK, US, Euro area, and Australia. Pulls GDP, inflation, employment, wages, rates, trade, housing, and fiscal data. Each country follows its central bank's reporting structure. Produces a single clean briefing with a traffic-light assessment and user-selectable sub-components.

Expert CMMC 2.0 (Cybersecurity Maturity Model Certification) advisor for US defense contractors and subcontractors in the Defense Industrial Base (DIB). Use this skill whenever a user asks about CMMC 2.0, CMMC Level 1, Level 2, or Level 3, DoD cybersecurity compliance, NIST SP 800-171, CUI (Controlled Unclassified Information) protection, System Security Plan (SSP), Plan of Action & Milestones (POA&M), C3PAO assessments, DIBCAC audits, self-assessment, SPRS score, or any requirement under DFARS 252.204-7012 or 7021. Also trigger for: "CMMC gap analysis", "CMMC readiness", "FCI protection", "CUI scoping", "CMMC practices", "DoD contract cybersecurity", "defense supply chain security", or "prime contractor flow-down requirements".

Enumerate and audit Active Directory forest trust relationships using impacket for SID filtering analysis, trust key extraction, cross-forest SID history abuse detection, and inter-realm Kerberos ticket assessment.