Results for “secret-exfiltration”

Detect data staging activity before exfiltration by monitoring for archive creation with 7-Zip/RAR, unusual temp folder access, large file consolidation, and staging directory patterns via EDR and process telemetry.

Local-first secret scanning for repos and git history. Use before every push, when scanning for exposed keys, checking for committed credentials, or auditing a repo for accidental secret leaks. Designed for Nick's workflow and safer than forcing suspicious marketplace secret scanners.

Execute advanced evasion by injecting malicious code into the memory space of a legitimate, suspended process (Process Hollowing). This skill details techniques to bypass static and dynamic analysis by masking malicious activity behind trusted processes like svchost.exe or explorer.exe.

Audits codebases for leaked secrets and hardcoded credentials, generates .env templates, configures secrets management with AWS Secrets Manager, Vault, Doppler, or GCP Secret Manager, sets up credential rotation, and integrates secrets into CI/CD pipelines via OIDC federation.

Configure and manage GitHub secret scanning, push protection, custom patterns, and alert remediation.

Integrate gitleaks and trufflehog into CI/CD pipelines to detect leaked secrets before deployment.

Detect data exfiltration through DNS tunneling by analyzing query entropy, subdomain length, query volume, TXT record abuse, and response payload sizes using passive DNS monitoring.

Analyze Zeek dns.log files to detect DNS-based data exfiltration by computing Shannon entropy, flagging long subdomain labels, and identifying anomalous query patterns.

Analyze network traffic, logs, and data flows to detect potential data exfiltration via DNS tunneling, cloud storage uploads, encrypted channels, and other indicators of compromise.

Fork, sanitize, and package private projects for safe public release through a three-stage pipeline.

Detect and extract hidden data embedded in images, audio, and other media files using steganalysis tools to uncover covert communication channels.

明楼（谍战虚构）认知与表达框架（压缩蒸馏）：三面间谍、辞令层叠、亲情作人质 触发：伪装者 等。禁止间谍违法教程

Test LLM applications for system prompt leakage using manual payloads, garak, and Promptfoo to extract embedded secrets and routing logic.

Detect DNS tunneling and data exfiltration by analyzing Zeek dns.log for high-entropy subdomain queries, excessive query volume, long query lengths, and unusual DNS record types indicating covert channel communication.

Provides a structured 5-phase workflow for bug bounty and SRC vulnerability hunting, including 19 attack-type playbooks, 305 structured payloads, 263 WAF bypass variants, and 2,887 real HackerOne case studies.

Builds AWS Nitro Enclave-based confidential computing environments with cryptographic attestation, KMS policy integration, and secure vsock communication for processing sensitive data.

Detects DNS-based data exfiltration, tunneling, and DGA communication by analyzing query logs with entropy analysis, volume anomalies, and subdomain length detection in SIEM platforms.

CI security scanning: secrets, deps, SAST, triage, expiring exceptions

Provides a comprehensive security checklist and code patterns for authentication, input validation, secrets management, SQL injection prevention, XSS, CSRF, rate limiting, and sensitive data exposure.

Implements security-sensitive changes with conservative trust boundaries, secret protection, tests, and verification.

Composite skill — full security pass across secrets, dependencies, code paths, and OWASP risks. Chains security-audit (broad) + socket-audit (npm supply chain) + semgrep (pattern scan) + code-security (code review for vulns) in parallel, reconciles into one severity-ranked report with remediation plan. Use quarterly per active repo or before any release of security-sensitive code.

Detect insider threat behavioral indicators including unusual data access, off-hours activity, mass file downloads, privilege abuse, and resignation-correlated data theft.

Env & Secrets Manager

Persists app data on Android using Room, SQLite, SharedPreferences, DataStore, and encryption.

Discover and exploit XML External Entity injection vulnerabilities to read server files, perform SSRF, and exfiltrate data during authorized penetration tests.

Manage production secret infrastructure with HashiCorp Vault, cloud secret stores, automated rotation, and audit logging.

Creates temporary encrypted one-time handoffs between autonomous agents, supporting mission briefs, scoped secrets, artifacts, and receipts via CLI or API.

Analyzes prompt injection, retrieval poisoning, memory contamination, planner drift, and tool-boundary abuse in agentic systems, mapping trust boundaries and proving exploit chains.

Detect and defend against prompt injection hidden in documents, web pages, and images consumed by an agent.

Reviews authorized diffs for auth, input, filesystem, network, secrets, parsers, injection, CI/CD, and supply-chain regressions.

Detect poisoned training data and backdoored models across the ML pipeline using statistical analysis, activation clustering, and spectral signatures.

Chief Security Officer mode. (gstack)

Defense-in-depth security across Rust, TypeScript, and Bash for the Pump SDK — cryptographic key handling, memory zeroization, secure file I/O, input validation, privilege management, dependency auditing, and a 60+ item security checklist.

Detect process injection techniques (T1055) including CreateRemoteThread, process hollowing, and DLL injection via Sysmon Event IDs 8 and 10 and EDR process telemetry.

Detect abuse of elevation control mechanisms including UAC bypass, sudo exploitation, and setuid/setgid manipulation by monitoring registry modifications, process elevation flags, and unusual parent-child process relationships.