Results for “illicit-consent-grant”

Execute OAuth 2.0 device-code and illicit-consent phishing attacks against Microsoft Entra ID to steal access and refresh tokens, bypass MFA, and pivot across Microsoft 365 services during authorized red-team engagements.

NIH grant research skill for clinical researchers. Grill-me intake (research idea + career stage + preliminary data + environment + submission posture + known institute targets) locks down the funding strategy before any search runs. Runs a 5-facet Consensus positioning analysis (with draft Significance/Innovation language), maps the research to the right NIH institutes and study sections via RePORTER, finds NOSIs and funded overlap, and produces an editable Word document (.docx) with budget/scope-aware mechanism recommendations, submission timelines, and a mandatory program officer recommendation. Use when the user asks about research funding or makes any grant-related request (e.g., 'grants for [topic]', 'find grants for my research idea', 'what grants match my research', 'help me find NIH funding', 'grant opportunities for my research'). NIH-only scope — non-NIH funders (PCORI, DOD CDMRP, VA, foundations) are out of scope and flagged at intake.

Detect and defend against prompt injection hidden in documents, web pages, and images consumed by an agent.

Drafts cognovit promissory notes with confession of judgment provisions, gated by mandatory jurisdictional enforceability research, usury compliance, and statutory disclosure requirements. Advises on alternatives where cognovit clauses are prohibited. Use when drafting cognovit notes, confession of judgment instruments, or loan documents requiring waiver-of-defense provisions.

Guide for implementing GDPR-valid consent under Article 7 conditions and Article 4(11) definition. Covers five core requirements: freely given, specific, informed, unambiguous, and clear affirmative action. Includes pre-ticked boxes prohibition per Planet49 CJEU C-673/17, consent form audit checklist, and practical implementation patterns.

Use to confirm clinical ethics and research-integrity requirements for an NEJM submission — IRB/ethics-committee approval and informed consent per the Declaration of Helsinki, ICMJE conflict-of-interest disclosures and authorship criteria, the role-of-the-funding-source statement, and the ICMJE data-sharing statement.

Guides assessment and application of GDPR Article 49 derogation conditions for international data transfers in the absence of adequacy decisions or appropriate safeguards. Covers explicit consent, contract necessity, public interest, vital interests, public register, and compelling legitimate interests with restrictive interpretation per EDPB Guidelines 2/2018. Keywords: Art. 49, derogations, transfer exceptions, explicit consent, compelling legitimate interests.

NIH grant research skill for clinical researchers. Grill-me intake (research idea + career stage + preliminary data + environment + submission posture + known institute targets) locks down the funding strategy before any search runs. Runs a 5-face...

Bootstraps AGENTS.md and CLAUDE.md for AEM 6.5 LTS projects, tailored to project structure and detected add-ons.

CORS misconfiguration allows attacker-controlled origins to read sensitive cross-origin responses when servers echo the `Origin` header in `Access-Control-Allow-Origin` or set it to `*` with `Access-Control-Allow-Credentials: true`. Detect via `Origin: https://attacker.com` reflection in `Access-Control-Allow-Origin` response header, wildcard `*` on credentialed endpoints, and null origin acceptance. Tools: OWASP ZAP, Burp Suite, manual `fetch()` with `credentials: include`.

Checks evidence about an unfamiliar autonomous agent before delegation, verifies signed Agent Guild passports, and returns a bounded hire, caution, or avoid recommendation without taking consequential action.

Detect abuse of legitimate Windows binaries (LOLBins) like certutil, regsvr32, mshta, and rundll32 using process telemetry, Sigma rules, and parent-child process analysis.

Research Guardian - Ethics Advisory & Bias Detection across all research stages Enhanced VS 3-Phase process: Surface-level screening, deep contextual analysis, constructive recommendations Use when: reviewing research ethics, checking for bias, assessing trustworthiness, QRP screening Triggers: ethics review, IRB, bias detection, QRP, trustworthiness, research integrity, p-hacking, HARKing

Atinge o patrimonio escondido do devedor — Incidente de Desconsideracao da Personalidade Juridica (CPC 133-137: instauracao a pedido da parte/MP, suspensao do processo, citacao do socio/PJ e contraditorio em 15 dias, decisao interlocutoria) com pressupostos do CC 50 (desvio de finalidade e confusao patrimonial, Lei 13.874/2019), e fraude a EXECUCAO (CPC 790 VII e 792 — ineficacia perante o exequente), distinguindo da fraude CONTRA credores / acao pauliana (CC 158-165). Use quando o operador disser desconsideracao da personalidade juridica, IDPJ, atingir bens do socio, fraude a execucao, fraude contra credores, devedor blindou patrimonio, confusao patrimonial.

Drafts a Motion for Judgment Notwithstanding the Verdict (JNOV) under FRCP 50(b) or state equivalents, with alternative new-trial request. Builds element-by-element evidentiary insufficiency arguments using transcript citations and preserves the appellate record. Use when drafting JNOV motions, post-trial motions, renewed judgment as a matter of law, or challenging jury verdicts for insufficient evidence.

Cost-reimbursement IGCE scaffold for CPFF, CPAF, and CPIF with fee caps and estimated-cost structure (BLS + CALC+ + per diem MCPs). USE WHEN the user asks to "build a CPFF IGCE", "cost reimbursement estimate", "CPAF fee cap", "CPIF incentive structure", "CR IGCE", or "estimated cost plus fee". DO NOT USE FOR FFP (`igce-builder-ffp`) or T&M (`igce-builder-lh-tm`).

Audit agent skills, plugins, prompts, manifests, scripts, dependencies, and bundled assets for provenance, prompt-injection, permission, execution, exfiltration, persistence, and update risk. Use when evaluating a third-party skill before installing, enabling, updating, publishing, or distributing it; reviewing an untrusted SKILL.md, agent configuration, MCP integration, archive, or repository; comparing a package with a known-good version; or investigating unexpected tool, network, credential, or filesystem behavior.

Search Grants.gov for federal funding opportunities by keyword, agency, category, and eligibility, and retrieve detailed grant information.

Detect and exploit Broken Object Level Authorization (BOLA) and Insecure Direct Object Reference (IDOR) vulnerabilities in APIs and web applications.

Conduct authorized red team initial access using EvilGinx3 adversary-in-the-middle phishing to capture session tokens and bypass multi-factor authentication.

Consensus planning entrypoint that auto-gates vague ralph/autopilot/team requests before execution

Drafts formal responses to governmental Notices of Violation, covering acknowledgment, factual timeline, legal defenses, mitigation, and proposed corrective action. Use when responding to environmental enforcement actions, regulatory citations, compliance violations, or governmental NOVs from agencies including EPA, OSHA, state environmental departments, or local code enforcement.

Imported skill cla from openai

Use this skill when the user asks about FCRA adverse action procedures — what to do when a background check (MVR, criminal, drug test) returns information that may lead to denying employment or terminating a CDL driver. Covers the 5-business-day pre-adverse-action notice, FCRA Summary of Rights, final adverse action notice, state-specific add-ons (CA, NY, etc.), and how to handle disputes. Cite 15 USC § 1681 (FCRA) and 49 CFR 391.

Identify and exploit Insecure Direct Object Reference (IDOR) or Broken Object Level Authorization (BOLA) vulnerabilities specifically within GraphQL APIs. This skill focuses on manipulating node IDs, changing variables, and utilizing aliases to access unauthorized data.

Prepare a DMCA 512(c) takedown notice or a 512(g) counter-notice for online copyright infringement with all statutory elements.

Agent C3 - Mixed Methods Design Consultant Comprehensive mixed methods research design specialist covering sequential, concurrent, embedded, and multiphase designs with Morse notation. Core Capabilities: - Sequential Explanatory (QUAN → qual): Explain quantitative results - Sequential Exploratory (QUAL → quan): Develop instruments - Convergent Parallel (QUAN + QUAL): Comprehensive understanding - Embedded (QUAN(qual)): Secondary strand addresses different question - Multiphase: Long-term projects with iterative phases - Morse notation interpretation and recommendation

Detect and exploit Cross-Site Request Forgery vulnerabilities by testing for missing or predictable CSRF tokens, absent SameSite cookie attributes, and JSON endpoints accepting text/plain Content-Type, with payloads and bypass techniques for security testing.

Parse Office 365 Unified Audit Logs via Microsoft Graph API to detect email forwarding rule creation, inbox delegation, suspicious OAuth app grants, and other indicators of account compromise.

Technical architecture guide for building a multi-purpose consent preference center. Covers per-purpose granularity, easy withdrawal under Article 7(3), version history, audit trails, and IAB Transparency and Consent Framework v2.2 integration. Includes database schema, API design, and UI component specifications.

Perform reconnaissance, persistence, privilege escalation, and data pillaging on Microsoft 365/Entra ID tenants via the Microsoft Graph API using the GraphRunner PowerShell toolset.

Give a decisive, project-grounded point of view in the subject's own shape: a graded verdict on an external-adoption question, a holistic take on a document, or a position on a user-supplied approach set. Use for a solo POV, a mid-session second opinion, a named-peer cross-check, any request to consult other models or reconcile their opinions, an `oracle` panel, or a correction-cost-gated proactive cross-check offer. Not for findings review (use ce-doc-review), neutral explainers, or generating options (use ce-ideate or ce-brainstorm).

Audit a codebase, UI, or copy for machine-generated tells across prose, visual/UI, code, and structure/IA, then produce a phased de-slop burndown. Use when the user says "feels AI-generated", "looks like AI slop", "reads like ChatGPT", "feels generic/soulless", or wants an authenticity/voice pass before launch.

Prepare PRINCE2 Directing a Project gate briefs for project board decisions, including initiation authorization, stage authorization, exception decisions, and closure authorization.

Detect and exploit Server-Side Request Forgery vulnerabilities by identifying user-controlled URL parameters, testing for internal service access, cloud metadata endpoints, and file scheme reads, with bypass techniques for common filters.