agent-arsenal

Use when testing a web application for SQL injection on an authorized engagement.

7 skills

Use when planning or running nmap scans during authorized engagements: host discovery options, TCP SYN, connect, UDP, NULL, FIN, Xmas, and ACK scan types, service and OS detection, timing templates T0 to T5, evasion techniques (fragmentation, decoys, idle scans, source port tricks, data length padding), NSE script selection by category, and output formats for evidence.

6 skills

Use when you hold a low-privilege Linux shell on an authorized engagement, lab, or CTF and need a reliable path to root.

6 skills

Use when testing a web application for cross-site scripting on an authorized engagement.

6 skills

Use when mapping an authorized Active Directory environment during an internal assessment or assumed breach exercise.

5 skills

Use when testing REST, GraphQL, or internal APIs on an authorized engagement.

5 skills

Use when testing authentication on an authorized engagement.

5 skills

Use when reviewing code or pull requests for correctness, security, and maintainability, when auditing a codebase for vulnerabilities such as injection, broken authentication, insecure cryptography, and leaked secrets, and when you need a structured security-first checklist with ripgrep pattern sweeps, trust boundary mapping, manual data-flow tracing, and actionable findings that state severity, impact, proof, and a concrete fix.

5 skills

Use when you must investigate a disk image, memory dump, or compromised host under proper legal authority, on an authorized incident response engagement, lab, or CTF.

5 skills

Use when a security incident is suspected or confirmed and you need a disciplined response on authorized systems.

5 skills

Use when hardening a Linux server for production, when locking down SSH with key-only authentication, when writing a default-deny firewall with ufw or nftables, when disabling unneeded services, when enabling automatic security updates, when adding auditd rules for sensitive files, and when running a CIS-style checklist adapted for small teams.

5 skills

Use when cracking password hashes or auditing password strength on an authorized engagement.

5 skills

Use when authorized testing lands you inside a container and you need to determine whether escape to the host is possible.

5 skills

Use when authorized privilege escalation has exhausted misconfiguration vectors and the kernel is the remaining path, or when you need to rule the kernel out quickly.

5 skills

Use when you hold a low-privilege Windows shell on an authorized engagement, lab, or CTF and need a path to SYSTEM or Administrator.

5 skills

Use when you hold a low-privilege Windows shell or session on an authorized penetration test, lab, or CTF and need a systematic map of every local privilege escalation vector before you exploit anything.

5 skills

Use when you have written authorization and need to directly probe the target: DNS zone transfer attempts, authoritative NS interrogation, subdomain brute forcing, reverse DNS sweeps, ICMP and TCP host discovery, and initial service discovery with dig, nmap, masscan, gobuster, and ffuf.

5 skills

Use when authorized reconnaissance finds DNS records pointing at third-party services and you need to check for subdomain takeover.

5 skills

Use when writing or fixing code that handles untrusted input, when choosing safe APIs for SQL, shell, and file access, when implementing password hashing, session tokens, and output encoding, when managing secrets and dependencies, and when you need each practice mapped to its CWE so findings line up with code review and web testing.

5 skills

Use when planning or running a full web application penetration test on an authorized engagement.

5 skills

Use when reviewing a single sign-on integration on an authorized engagement.

4 skills

Use when enumerating an AWS environment during an authorized cloud assessment, bug bounty engagement, or lab exercise.

4 skills

Use when a binary under authorized lab analysis resists analysis resists debugging or sandboxing, covering debugger detection, timing checks, VM and sandbox fingerprinting, or stalling tricks.

4 skills

Use when you need to modify a compiled binary's behavior in an authorized lab, covering bypassing a license or trial check, neutralizing an anti-analysis routine, correcting a buggy code path, or testing how a program reacts to altered logic.

4 skills

Use when mapping Active Directory attack paths on an authorized engagement.

4 skills

Use when a finding is validated on an in-scope bug bounty target and you need to check it is not already known before writing the report.

4 skills

Use when hunting on an in-scope bug bounty program and you need a complete, repeatable methodology that takes you from scope reading to payout.

4 skills

Use when a validated in-scope finding needs to become a report that gets triaged fast and paid fairly.

4 skills

Use when starting a new in-scope bug bounty program and you need reconnaissance that stays strictly inside the authorized scope.

4 skills

Use when hunting on a bug bounty program and you need a repeatable, professional methodology from scope to payout.

4 skills

Use when designing the command and control layer of an authorized red team or adversary emulation exercise.

4 skills

Use when reviewing cloud security posture at concept level across AWS, GCP, and Azure, when checking IAM for least privilege and wildcard grants, when hunting public storage buckets and open security groups, when verifying audit logging such as CloudTrail, and when you need CLI checks with aws, az, and gcloud plus the reasoning behind each finding.

4 skills

Use when you face hashes, tokens, or ciphertext on an authorized test, CTF, or code review and need an operator-grade crypto workflow.

4 skills

Use when preparing for, competing in, or reviewing a CTF competition as an individual or team.

4 skills

Use when competing in a CTF cryptography challenge, practicing in a lab, or analyzing cryptographic constructions you are authorized to examine.

4 skills

Use when competing in a CTF forensics challenge, practicing in a lab, or analyzing evidence you are authorized to handle.

4 skills

Use when competing in a CTF OSINT challenge, practicing in a lab, or researching information you are authorized to collect.

4 skills

Use when competing in a CTF pwn (binary exploitation) challenge, practicing in a lab, or testing a binary on systems you are authorized to test.

4 skills

Use when competing in a CTF reverse engineering challenge, practicing in a lab, or analyzing a binary you are authorized to examine.

4 skills

Use when competing in a CTF web challenge, practicing in a lab, or testing a web application you are authorized to test.

4 skills

Use when examining a disk image or forensic copy of a drive during an investigation.

4 skills

Use when you must determine the full blast radius of a confirmed intrusion on systems you are authorized to defend.

4 skills

Use when a security incident is confirmed on systems you are authorized to defend and you must stop the bleeding without destroying evidence.

4 skills

Use when preparing for or running a security incident as a defender: writing and maintaining incident response playbooks, defining severity levels and SLAs, assigning roles, running communications, executing scenario playbooks for malware, business email compromise, data theft, and denial of service, and running tabletop exercises.

4 skills

Use when you need to reconstruct what happened and when during an authorized incident investigation.

4 skills

Use when testing Active Directory for Kerberoasting on an authorized engagement.

4 skills

Use when building a defensive Linux hardening baseline for a server fleet, audit, or compliance review.

4 skills

Use when investigating a Linux host for signs of intrusion using its logs, in a defensive incident response or threat hunting role.

4 skills

Use when securing systemd on a Linux server from a defensive posture across unit files, sandboxing, and logging.

4 skills

Use when you need to understand what malware does at runtime beyond a sandbox summary, covering API call sequences, process injection chains, persistence installation order, and defense evasion in action.

4 skills

Use when you need the malware's embedded configuration, covering C2 addresses, encryption keys, campaign IDs, mutex names, and operational parameters, pulled from the binary without full reverse engineering.

4 skills

Use when a malware sample appears packed, obfuscated, or otherwise resistant to static analysis and you need to identify the packer and recover the original payload.

4 skills

Use when you need to detonate a malware sample safely and extract structured behavioral evidence, covering process trees, file and registry activity, network traffic, and MITRE ATT&CK-mapped capabilities.

4 skills

Use when a suspicious file lands in the queue and you need a fast, safe verdict without executing it, covering what it is, what it can do, and how urgent it is.

4 skills

Use when you need a production-quality YARA rule written from malware triage findings and validated against clean and malicious corpora.

4 skills

Use when analyzing a RAM dump or live memory image during incident response or a forensic investigation.

4 skills

Use when you need to analyze a running Android app during an authorized engagement, such as a client mobile pentest or your own organization's release candidate.

4 skills

Use when you need to write custom Frida instrumentation for mobile apps during an authorized test, on Android or iOS.

4 skills

Use when you need to statically analyze an iOS application during an authorized engagement, such as a client mobile app pentest or a review of your own organization's App Store build.

4 skills

Use when an authorized engagement gives you a foothold host and you must reach deeper network segments through it.

4 skills

Use when you need to work with breach data during an authorized investigation or defensive security review.

4 skills

Use when you need to determine where a photograph was taken during an authorized investigation, using only the image and public sources.

4 skills

Use when planning and running an open source intelligence collection effort against public sources only.

4 skills

Use when you need to find accounts and profiles tied to a username or handle across the internet during an authorized investigation.

4 skills

Use when you hold a low-privilege Linux shell on an authorized penetration test, lab, or CTF and need a systematic map of every local privilege escalation vector before you exploit anything.

4 skills

Use when authorized reconnaissance needs to move from domain names to the organization's network infrastructure.

4 skills

Use when you want to mine certificate transparency logs for authorized reconnaissance on a target domain.

4 skills

Use when starting authorized reconnaissance on a target domain and you need the complete subdomain enumeration playbook.

4 skills

Use when you face an RSA challenge or misconfigured RSA on an authorized test, CTF, or code review and need an operator workflow for the classic attacks.

4 skills

Use when proactively hunting for undetected intruders in an environment you are authorized to defend.

4 skills

Use when securing an API gateway on an authorized engagement or review.

3 skills

Use when testing an AI agent that can call tools or take actions on an authorized engagement.

2 skills

Use when reviewing the supply chain of an AI system on an authorized assessment: model weights, datasets, base images, and third party integrations.

2 skills

Use when you need to anonymize a dataset for sharing or analysis.

2 skills

Use when assessing automotive Ethernet on a vehicle or bench setup you own or have authorization to test.

2 skills

Use when building a threat model for a vehicle or automotive component on an authorized engagement.

2 skills

Use when tracing cryptocurrency in an investigation on an authorized case.

2 skills

Use when assessing cross chain bridge security on an authorized engagement.

2 skills

Use when you need a repeatable, scripted reconnaissance pipeline for an in-scope bug bounty target instead of ad hoc manual enumeration.

2 skills

Use when a bug bounty report is in triage and you need to communicate with the program team, answer questions, handle a duplicate or out-of-scope or informative decision, request a severity review, or escalate a stalled report professionally.

2 skills

Use when operating Cobalt Strike in an authorized red team engagement or a licensed lab exercise.

2 skills

Use when designing or deploying a redirector for an authorized red team operation or a lab command and control exercise.

2 skills

Use when operating the Sliver command and control framework in a lab or an authorized red team engagement.

2 skills

Use when assessing CAN bus security on a vehicle or bench setup you own or have authorization to test.

2 skills

Use when implementing or auditing consent for data processing: cookie banners, app permissions, and marketing opt ins.

2 skills

Use when planning or executing communications during a security incident.

2 skills

Use when a CTF challenge targets a machine learning model, a language model API, or an AI powered application in an authorized test environment.

2 skills

Use when a CTF challenge involves a smart contract, an Ethereum style chain, or a token vault you must drain in an authorized test environment.

2 skills

Use when a CTF challenge does not fit crypto, web, pwn, reversing, or forensics, or when the category is literally misc.

2 skills

Use when reducing personal data collection and storage in a system you build or review.

2 skills

Use when assessing DeFi protocols for economic and technical attacks on an authorized engagement.

2 skills

Use when you need working knowledge of DNP3 for an OT assessment or lab.

2 skills

Use when analyzing ECU firmware on an authorized assessment or your own bench hardware.

2 skills

Use when you need to get firmware off a device or out of an update file on an authorized assessment.

2 skills

Use when building or reviewing systems for GDPR compliance from the engineering side.

2 skills

Use when assessing fault injection resistance of a device you own or have authorization to test.

2 skills

Use when testing whether an LLM application's safety guardrails can be bypassed on an authorized engagement.

2 skills

Use when reverse engineering an embedded device you own or have authorization to test.

2 skills

Use when responding to a suspected incident in an OT or SCADA environment.

2 skills

Use when assessing keyless entry and immobilizer systems on vehicles you own or have authorization to test, in a lab setting.

2 skills

Use when deploying Secure Boot and LUKS full-disk encryption on Linux systems you administer.

2 skills

Use when enforcing mandatory access control on Linux with SELinux or AppArmor on systems you administer.

2 skills

Use when running a structured red team exercise against an LLM application with authorization.

2 skills

Use when designing or reviewing how an AI agent stores, organizes, and reuses what it learns across tasks and sessions.

2 skills

Use when testing whether agent memory helps or harms task outcomes, or when diagnosing wrong, stale, or missing recall.

2 skills

Use when assessing Modbus TCP or Modbus RTU on an authorized OT engagement or lab.

2 skills

Use when assessing whether a machine learning model behind an API can be stolen or copied on an authorized engagement.

2 skills

Use when assessing NFT projects, marketplaces, or fraud patterns on an authorized engagement.

2 skills

Use when analyzing a printed circuit board on an authorized hardware assessment or in your own lab.

2 skills

Use when you need working knowledge of programmable logic controllers for an OT assessment or lab.

2 skills

Use when running a privacy impact assessment (DPIA) for a new feature or system.

2 skills

Use when building a privacy threat model for a system you design or review.

2 skills

Use when you hold a low-privilege domain account on an authorized Active Directory assessment and need to map every privilege escalation path to Domain Admins before you exploit any single one.

2 skills

Use when testing an LLM powered application for prompt injection on an authorized assessment.

2 skills

Use when starting authorized reconnaissance on a target domain or organization while staying off the target's own infrastructure.

2 skills

Use when you need to understand safety instrumented systems for OT security work.

2 skills

Use when designing or assessing network segmentation for OT and SCADA environments on an authorized engagement.

2 skills

Use when building or improving a security awareness program.

2 skills

Use when assessing a device for side channel leakage on an authorized hardware engagement or in your own lab.

2 skills

Use when auditing Solidity smart contracts on an authorized engagement or for your own project.

2 skills

Use when planning and running incident response tabletop exercises.

2 skills

Use when assessing a telematics unit or connected car backend on an authorized engagement.

2 skills

Use when working with embedded hardware on an authorized assessment or lab device you own.

2 skills

Use when reviewing cryptocurrency wallet security for users or on an authorized product assessment.

2 skills

Use when reviewing the intersection of accessibility and security in web applications.

1 skill

Use when assessing Active Directory trust relationships on an authorized engagement.

1 skill

Use when an agent needs to save where it is in a long task so it can resume later, or when handing a task to another agent without losing context.

1 skill

Use when designing, reviewing, or testing how AI agents communicate: agent-to-agent (A2A) protocols, Model Context Protocol (MCP) transports, agent discovery and capability advertisement, message authentication and integrity, and protocol comparison for a multi-agent system.

1 skill

Use when testing or defending an AI agent that calls tools, against tool-injection attacks: malicious tool outputs that carry instructions, confused deputy attacks where the agent misuses a trusted tool on an attacker's behalf, tool shadowing where a malicious tool impersonates a trusted one, and poisoned tool descriptions or schemas.

1 skill

Use when responding to a suspected security incident involving an AI system: a hijacked agent, a poisoned model, leaked prompts, or abusive use of inference infrastructure.

1 skill

Use when reviewing, hardening, or testing a Model Context Protocol (MCP) server that exposes tools, resources, or prompts to an AI agent.

1 skill

Use when you need to test a running Android app on an authorized engagement, such as a client mobile app pentest or a CTF APK that only reveals behavior at runtime.

1 skill

Use when hardening Android apps you build or review.

1 skill

Use when you need to reverse engineer an Android APK you are authorized to test, such as a client mobile application on a penetration test or a CTF challenge APK.

1 skill

Use when you need symbolic execution to explore program paths automatically, typically for CTF binaries, crackmes, or vulnerability research on code you are authorized to analyze.

1 skill

Use when automating server configuration with Ansible on an authorized engineering task.

1 skill

Use when reviewing or testing API key lifecycle on an authorized engagement.

1 skill

Use when testing API rate limits on an authorized assessment.

1 skill

Use when testing SOAP or XML based APIs on an authorized engagement.

1 skill

Use when designing or reviewing API versioning strategy.

1 skill

Use when testing or hardening webhook endpoints on an authorized engagement.

1 skill

Use when performing authorized man-in-the-middle testing on a local network segment.

1 skill

Use when testing Active Directory for AS-REP roasting on an authorized engagement.

1 skill

Use when testing account recovery flows on an authorized engagement.

1 skill

Use when testing SAML single sign-on on an authorized engagement.

1 skill

Use when enumerating a Microsoft Azure tenant or subscription during an authorized cloud assessment, bug bounty engagement, or lab exercise.

1 skill

Use when designing or auditing backup security.

1 skill

Use when writing production-grade Bash 5.2 scripts: strict mode (set -euo pipefail), safe quoting and word splitting, arrays and associative arrays, parameter expansion, traps and cleanup handlers, getopts argument parsing, process substitution, functions with local variables, debugging with set -x and PS4, or fixing a fragile script that fails silently.

1 skill

Use when assessing BGP security on an authorized network engagement or lab.

1 skill

Use when patching binaries in a lab on authorized targets: your own software, CTF binaries, or client approved test builds.

1 skill

Use when assessing Bluetooth Low Energy devices on authorized engagements, such as beacons, locks, wearables, or IoT sensors in scope.

1 skill

Use when analyzing browser artifacts in an authorized investigation.

1 skill

Use when you receive, join, or hunt on a private or invite-only bug bounty program and need to handle its different rules, reputation, and competition.

1 skill

Use when you need to choose which bug bounty programs to hunt on and how to scope your time across them instead of joining every program at random.

1 skill

Use when testing for web cache deception on an authorized assessment.

1 skill

Use when testing web cache poisoning and web cache deception on an authorized engagement.

1 skill

Use when running chaos experiments to prove resilience.

1 skill

Use when securing a CI/CD pipeline on an authorized engineering task.

1 skill

Use when reviewing how CI/CD pipelines handle secrets on an authorized assessment.

1 skill

Use when assessing cloud cost as an attack surface on an authorized engagement.

1 skill

Use when doing forensics in cloud environments on an authorized investigation.

1 skill

Use when you need working knowledge of consensus layer attacks for blockchain security assessments.

1 skill

Use when testing container escape during an authorized security assessment, CTF, or lab exercise.

1 skill

Use when assessing container image security on an authorized engagement or in your own pipeline.

1 skill

Use when testing cross-origin resource sharing (CORS) configuration on an authorized engagement.

1 skill

Use when testing a web application for Cross-Site Request Forgery on an authorized engagement.

1 skill

Use when assessing DAO governance security on an authorized engagement.

1 skill

Use when setting up monitoring for your organization's data on criminal forums and marketplaces.

1 skill

Use when examining a database file, database dump, or database server data directory during an authorized forensic investigation.

1 skill

Use when designing or reviewing database migration practices.

1 skill

Use when a security incident exposes personal data and triggers a legal duty to notify a regulator, affected people, or both.

1 skill

Use when pulling Active Directory credential material through directory replication on an authorized engagement.

1 skill

Use when diagnosing a bug or failure systematically: building a reproduction case, bisecting with git bisect, reading logs and stack traces, tracing syscalls with strace, debugging with gdb 15 or pdb, analyzing core dumps, forming and testing hypotheses one variable at a time, or writing a postmortem after an incident.

1 skill

Use when managing audit evidence for a compliance audit, certification, or internal review.

1 skill

Use when implementing or reviewing an ISO/IEC 27001 information security management system.

1 skill

Use when adopting the NIST Cybersecurity Framework or measuring maturity against it.

1 skill

Use when scoping PCI DSS cardholder data environment controls or HIPAA safeguards for protected health information.

1 skill

Use when designing or operating a risk register for a security or governance programme.

1 skill

Use when preparing for a SOC 2 audit or building SOC 2 readiness from scratch.

1 skill

Use when reviewing a third-party or vendor security posture before signing, renewing, or expanding a supplier relationship.

1 skill

Use when you must harden a fleet of macOS endpoints against a defined threat model, or audit an existing macOS baseline for gaps.

1 skill

Use when testing for insecure deserialization on an authorized assessment.

1 skill

Use when building detections as versioned, tested code.

1 skill

Use when designing or improving a DevSecOps delivery pipeline on an authorized engineering task.

1 skill

Use when building a forensic timeline for an authorized investigation.

1 skill

Use when assessing DHCP security on an authorized network or lab.

1 skill

Use when you need to publish statistics or train models on sensitive data without exposing individuals.

1 skill

Use when enumerating DNS on authorized engagements, internal or external.

1 skill

Use when building, hardening, or debugging Docker containers on an authorized engineering task.

1 skill

Use when investigating domains, DNS history, certificates, and hosting infrastructure from public sources on an authorized engagement.

1 skill

Use when testing for DOM clobbering on an authorized web assessment.

1 skill

Use when automating data subject requests: access, erasure, portability, and rectification at scale.

1 skill

Use when a suspicious file needs to be executed to reveal its behavior, and only inside an isolated sandbox or disposable VM with no route to production networks.

1 skill

Use when assessing eBPF usage on Linux systems you own or are authorized to review.

1 skill

Use when assessing elliptic curve cryptography on an authorized engagement.

1 skill

Use when deploying, operating, or triaging with Endpoint Detection and Response tooling on systems you are authorized to defend.

1 skill

Use when reviewing whether attacker techniques evade the deployed EDR on an authorized assessment.

1 skill

Use when running EDR tuning and detection engineering operations on a defended fleet.

1 skill

Use when investigating a suspicious email during phishing triage or incident response.

1 skill

Use when hardening email infrastructure for an organization you defend.

1 skill

Use when you need working knowledge of electromagnetic interference and compatibility for security hardware work.

1 skill

Use when building or auditing endpoint hardening baselines for Windows, macOS, or Linux fleets.

1 skill

Use when analyzing or defending against dependency confusion attacks on an authorized engineering task.

1 skill

Use when generating, distributing, or consuming a software bill of materials (SBOM) on an authorized engineering task.

1 skill

Use when detecting or defending against typosquatting in package registries on an authorized engineering task.

1 skill

Use when implementing or reviewing feature flags.

1 skill

Use when testing file upload functionality on an authorized engagement.

1 skill

Use when nmap scans are blocked, filtered, or rate limited by firewalls and IDS on authorized engagements.

1 skill

Use when analyzing a firmware image from a device you own or are authorized to test.

1 skill

Use when you must reconstruct what happened on a macOS host from a disk image, triage package, or live authorized collection.

1 skill

Use when building a single chronological timeline from many forensic sources during an authorized investigation.

1 skill

Use when you need to exploit a format string vulnerability on an authorized target, such as a CTF pwn challenge or lab binary that passes user input directly to printf or a similar function.

1 skill

Use when enumerating a Google Cloud project, folder, or organization during an authorized cloud assessment, bug bounty engagement, or lab exercise.

1 skill

Use when you need to reverse engineer a compiled binary on an authorized task, such as a CTF reversing challenge, malware triage in a lab, or auditing a binary you have permission to analyze.

1 skill

Use when writing or debugging GitHub Actions workflows on an authorized engineering task.

1 skill

Use when implementing or reviewing GitOps for Kubernetes deployments.

1 skill

Use when choosing a branching model for a team, when writing clean atomic commits, when rebasing a feature branch or resolving rebase conflicts, when running a disciplined pull request review, when adding git hooks for pre-commit checks, and when recovering from mistakes such as bad rebases, deleted branches, or bad commits using reflog, reset, revert, and cherry-pick.

1 skill

Use when writing, building, or reviewing Go programs on an authorized engineering task.

1 skill

Use when forging Kerberos tickets on an authorized Active Directory engagement after recovering the krbtgt account hash.

1 skill

Use when assessing Group Policy security on an authorized AD engagement.

1 skill

Use when testing a GraphQL API on an authorized engagement.

1 skill

Use when assessing gRPC services on an authorized engagement.

1 skill

Use when assessing embedded and IoT devices on authorized lab work, such as teardown and board analysis, UART and JTAG or SWD debug access, firmware extraction from flash and update files, and hardware rooted trust review covering secure boot, key storage, and debug port lockdown.

1 skill

Use when analyzing RFID and NFC security on authorized lab work, such as cloning analysis of low frequency and high frequency cards, replay and relay attack review, card emulation review, and reader authentication testing.

1 skill

Use when you need to recover plaintexts from password hashes on an authorized engagement, such as cracking NTLM hashes from a domain dump, testing password strength after extracting hashes in scope, or solving CTF crypto challenges.

1 skill

Use when testing for hash length extension attacks on an authorized assessment.

1 skill

Use when testing for HTTP header injection and response splitting on an authorized web assessment.

1 skill

Use when you need to exploit a heap memory bug on an authorized target, such as a CTF pwn challenge with use-after-free, heap overflow, or double free, or a lab binary using malloc and free unsafely.

1 skill

Use when assessing a process historian on an authorized OT engagement.

1 skill

Use when deploying and operating honeypots for detection and intelligence on your own network.

1 skill

Use when testing for HTTP request smuggling (desync) between a front-end proxy and a back-end server on an authorized engagement.

1 skill

Use when assessing AWS IAM privilege escalation paths during an authorized cloud assessment, bug bounty engagement, or lab exercise.

1 skill

Use when extracting intelligence from images on an authorized investigation.

1 skill

Use when a current or former employee, contractor, or partner is suspected of stealing data, sabotaging systems, or abusing legitimate access.

1 skill

Use when you need to assess an iOS application you are authorized to test, such as a client iPhone app on a penetration test or a CTF challenge IPA.

1 skill

Use when dynamically analyzing iOS apps on an authorized engagement with a test device you own.

1 skill

Use when testing IPv6 on authorized engagements, especially dual-stack networks where IPv6 is enabled but unmonitored.

1 skill

Use when assessing IPv6 on an authorized network engagement.

1 skill

Use when you need working knowledge of ISO/SAE 21434 for automotive cybersecurity work.

1 skill

Use when processing JSON on the command line with jq 1.7: selecting and filtering fields, transforming API responses, building JSON objects, aggregating with map/select/reduce, converting JSON to CSV or TSV, handling raw text input with slurp mode, parsing logs that contain JSON, or debugging why a filter returns null.

1 skill

Use when testing JSON Web Token handling on an authorized engagement.

1 skill

Use when penetration testing Kubernetes clusters on an authorized engagement.

1 skill

Use when learning kernel exploitation fundamentals in a lab with your own vulnerable VMs.

1 skill

Use when deploying or troubleshooting workloads on Kubernetes on an authorized engineering task.

1 skill

Use when enumerating and testing Kubernetes RBAC during an authorized cloud or cluster assessment, bug bounty engagement, or lab exercise.

1 skill

Use when testing a web application for Local and Remote File Inclusion on an authorized engagement.

1 skill

Use when hardening Linux containers you run.

1 skill

Use when assessing or hardening Linux container isolation boundaries on hosts you administer.

1 skill

Use when hunting Linux persistence mechanisms and suspected rootkits during authorized forensic analysis or lab investigation on systems you own or are authorized to examine.

1 skill

Use when capturing authentication hashes on authorized Windows LAN segments.

1 skill

Use when load testing a system you own or are authorized to test.

1 skill

Use when reconstructing an incident from system and application logs you are authorized to analyze.

1 skill

Use when writing or fixing Makefiles with GNU Make 4.4: understanding targets, prerequisites, and recipes, using automatic variables ($@, $<, $^), writing pattern rules, declaring .PHONY targets, using variables and functions (wildcard, patsubst), running parallel builds with -j, debugging with -n and --debug, or converting a pile of shell scripts into a reproducible build.

1 skill

Use when an agent needs to record what it learned so future runs can reuse it, or when an operator wants durable notes from a task that took real effort.

1 skill

Use when duplicate or overlapping memory entries pile up, or when repeated episodic observations should become one durable semantic fact.

1 skill

Use when the memory store needs a health check: removing duplicates safely, resolving contradictory entries, decaying stale confidence, redacting secrets that slipped in, keeping an audit trail, or enforcing size budgets.

1 skill

Use when hunting malware in memory images on an authorized investigation.

1 skill

Use when deciding what agent memory may be kept, who may read it, and when it must be deleted.

1 skill

Use when an agent needs to look up what it already knows before doing new work, or when an operator wants the facts behind a past decision.

1 skill

Use when an agent must find the right stored knowledge at the right time, or when recall returns noise, stale facts, or nothing at all.

1 skill

Use when doing forensics on mobile devices in an authorized investigation.

1 skill

Use when reviewing identity across multiple cloud providers on an authorized engagement.

1 skill

Use when analyzing NetFlow, sFlow, or IPFIX data for security investigations or baselining.

1 skill

Use when investigating network traffic from a packet capture or flow record during an authorized incident response or forensic examination.

1 skill

Use when assessing IoT protocol security on an authorized engagement, such as MQTT brokers, CoAP endpoints, Zigbee or Z-Wave gateways, and LwM2M device management servers.

1 skill

Use when designing network segmentation for an organization you defend.

1 skill

Use when hardening an nginx 1.27 web server or reverse proxy: writing secure server blocks, disabling version banners, configuring modern TLS, adding security headers (HSTS, CSP, X-Frame-Options), rate limiting with limit_req, restricting request sizes and methods, running workers as a non-root user with tight file permissions, setting up access and error logging for forensics, or reviewing an existing nginx config for common misconfigurations.

1 skill

Use when testing NoSQL-backed applications (MongoDB, CouchDB, Redis) for injection on an authorized engagement.

1 skill

Use when assessing OAuth 2.0 and OpenID Connect implementations on an authorized engagement.

1 skill

Use when testing OAuth 2.0 and OpenID Connect logins on an authorized engagement.

1 skill

Use when assessing OPC UA servers on an authorized OT engagement or lab.

1 skill

Use when reviewing an OpenAPI specification for security issues on an authorized engagement.

1 skill

Use when testing for unvalidated redirects and forwards on an authorized engagement.

1 skill

Use when static triage finds a packed or encrypted executable and you need the real payload underneath.

1 skill

Use when you encounter CBC-mode ciphertext with distinguishable padding errors on an authorized test, CTF, or code review, and need to decrypt or forge messages without the key.

1 skill

Use when making a system faster on purpose: establishing a baseline benchmark with hyperfine 1.18, profiling Python with cProfile, finding CPU, memory, disk, or network bottlenecks on Linux, tuning database queries and caches, sizing connection pools and workers, interpreting load test results, or deciding whether an optimization is worth the complexity.

1 skill

Use when defending an organization against phishing: hardening email authentication with SPF, DKIM, and DMARC, writing gateway and mailbox detection rules, triaging user-reported phish, analyzing headers URLs and attachments safely, running takedowns of phishing sites, and measuring resilience with simulations.

1 skill

Use when diagnosing or improving PostgreSQL performance on an authorized engineering task.

1 skill

Use when assessing postMessage communication between windows and iframes on an authorized engagement.

1 skill

Use when you need working knowledge of post quantum cryptography for planning and assessment.

1 skill

Use when you hold a low-privilege shell on a macOS host during an authorized penetration test, lab exercise, or red team engagement and need a systematic path to higher privilege.

1 skill

Use when setting up or debugging Prometheus monitoring on an authorized engineering task.

1 skill

Use when testing JavaScript applications for prototype pollution on an authorized assessment.

1 skill

Use when running purple team exercises that pair offense and defense on authorized systems.

1 skill

Use when you need to exploit a classic stack buffer overflow on an authorized target, such as a CTF pwn challenge or a lab binary you have permission to test.

1 skill

Use when writing or reviewing advanced Python code on an authorized engineering task.

1 skill

Use when building command-line tools in Python using only the standard library, when designing an argparse interface with subcommands, when adding --help, --version, --sample, and --output json conventions to a script, when defining typed exit codes for CI pipelines, and when packaging a tool as a single file or zipapp archive with no pip dependencies.

1 skill

Use when testing for race conditions (time-of-check to time-of-use flaws) on an authorized engagement.

1 skill

Use when assessing a retrieval augmented generation system on an authorized engagement.

1 skill

Use when ransomware encrypts hosts, exfiltrates data, or threatens to leak it unless a ransom is paid.

1 skill

Use when preparing for or responding to a ransomware incident as a defender.

1 skill

Use when an authorized engagement or defensive program needs a living inventory of everything an organization exposes to the internet and a way to keep it current.

1 skill

Use when authorized recon must find an organization's cloud footprint beyond its main domains.

1 skill

Use when authorized recon has a live web target and needs to find its hidden paths, files, JavaScript endpoints, and API routes without guessing blindly.

1 skill

Use when several recon tools have produced overlapping subdomain, IP, port, certificate, and service lists and you need one ranked target list instead of five conflicting ones.

1 skill

Use when building and executing an authorized pretext for a security assessment, when testing whether staff follow verification procedures before sharing information or granting access, or when documenting a social engineering scenario for a client report.

1 skill

Use when planning or running an authorized voice-phishing assessment, when testing how staff respond to phone-based social engineering, or when measuring help-desk and call-center resilience to pretext calls.

1 skill

Use when operating Redis 7.4 in development or production: installing and configuring a server, choosing data types (strings, hashes, lists, sets, sorted sets, streams), writing and reading keys with redis-cli, setting TTLs, configuring RDB and AOF persistence, setting up ACL users and passwords, tuning eviction and memory limits, taking backups, reading INFO and SLOWLOG output, or diagnosing a slow or unreachable Redis instance.

1 skill

Use when writing or debugging regular expressions: choosing between BRE, ERE, and PCRE flavors, crafting grep, sed, and awk patterns, using character classes, anchors, quantifiers, groups, backreferences, and lookarounds, extracting fields from logs with capture groups, validating inputs like IPs and emails, avoiding catastrophic backtracking, or testing patterns quickly with grep -P and Python re.

1 skill

Use when designing a REST API from scratch or reviewing an existing one: naming resources and URIs, choosing HTTP methods and status codes correctly, versioning the API, designing pagination, filtering, and sorting, writing consistent error envelopes, making operations idempotent, documenting with OpenAPI 3.1, adding rate limit headers, or choosing an authentication scheme.

1 skill

Use when assessing random number generation on an authorized engagement.

1 skill

Use when you need to build a Return Oriented Programming chain on an authorized target, such as a CTF pwn challenge with NX enabled and no easy win function.

1 skill

Use when writing, building, or reviewing Rust programs on an authorized engineering task.

1 skill

Use when testing Amazon S3 buckets for misconfigurations during an authorized cloud assessment, bug bounty engagement, or lab exercise.

1 skill

Use when reviewing the security of a SaaS application your organization uses or builds.

1 skill

Use when assessing SD-WAN deployments on an authorized engagement.

1 skill

Use when finding and removing secrets from source code on an authorized codebase.

1 skill

Use when assessing secure boot implementations on devices you own or have authorization to test.

1 skill

Use when assessing serverless applications (Lambda, Cloud Functions, Azure Functions) on an authorized engagement.

1 skill

Use when assessing session management on an authorized web engagement.

1 skill

Use when you need to write or use position-independent machine code payloads on an authorized target, such as a CTF pwn challenge where NX is disabled, a buffer you can execute, or a ROP chain that made memory writable and executable.

1 skill

Use when building, tuning, or operating SIEM detections on an authorized blue team engagement or in a lab SOC.

1 skill

Use when writing, converting, or testing Sigma detection rules for a defensive detection program.

1 skill

Use when enumerating SMB services on authorized Windows or Samba targets.

1 skill

Use when enumerating SNMP services on authorized targets, typically UDP 161.

1 skill

Use when planning and running adversary emulation with MITRE Caldera against systems you are authorized to test.

1 skill

Use when operating a MITRE Caldera server day to day for authorized adversary emulation.

1 skill

Use when researching publicly visible social media content on an authorized engagement.

1 skill

Use when planning an authorized red team operation from first scoping call to final report.

1 skill

Use when working with SQLite databases on an authorized engineering task.

1 skill

Use when learning Sigreturn Oriented Programming in a lab on CTF style binaries you own.

1 skill

Use when hardening OpenSSH 9.8 servers and clients: writing a secure sshd_config (key-only auth, no root login, modern ciphers and key exchange), auditing the effective config with sshd -T, managing host keys, deploying fail2ban or rate limits against brute force, configuring jump hosts and ProxyJump, understanding agent forwarding risks, using SSH certificates, or reviewing authorized_keys hygiene.

1 skill

Use when testing a web application for Server-Side Request Forgery on an authorized engagement.

1 skill

Use when testing a web application for Server-Side Template Injection on an authorized engagement.

1 skill

Use when you receive a suspicious file and must decide what it is without executing it.

1 skill

Use when assessing Spanning Tree Protocol on an authorized network or lab.

1 skill

Use when deploying, tuning, or troubleshooting Suricata as a network intrusion detection sensor on a network you are authorized to monitor.

1 skill

Use when working deeply with systemd 256 on Linux: writing and debugging service, timer, socket, and target units, using systemctl and journalctl effectively, replacing cron jobs with systemd timers, analyzing boot time with systemd-analyze, creating drop-in overrides without editing vendor units, applying service sandboxing directives (ProtectSystem, PrivateTmp, NoNewPrivileges), managing dependencies and ordering, or diagnosing failed units and boot hangs.

1 skill

Use when writing documentation people actually read: planning a doc for its audience, structuring tutorials, how-to guides, reference, and explanations (Diataxis), writing clear plain-English procedures with verifiable steps, documenting APIs and CLIs, reviewing docs for accuracy, linting prose with Vale and pandoc 3.4, or turning rough notes into a polished README or runbook.

1 skill

Use when writing or operating Terraform infrastructure as code on an authorized engineering task.

1 skill

Use when building a test strategy for a Python project: choosing what to test at each level of the test pyramid, writing pytest unit tests with fixtures and parametrize, mocking external services, measuring coverage, writing integration and end-to-end tests, fixing flaky tests, running tests in CI, or reviewing whether a codebase is under-tested.

1 skill

Use when building or reviewing threat actor profiles for intelligence or defense planning.

1 skill

Use when proactively searching for attackers who have evaded detection, rather than waiting for an alert.

1 skill

Use when designing or maturing a threat hunting program for an organization you defend.

1 skill

Use when working with cyber threat intelligence on a defensive team: collecting IOCs, evaluating feeds, running a MISP instance, writing STIX/TAXII sharing packages, scoring and aging indicators, and turning intel into detections and blocks.

1 skill

Use when assessing the TLS configuration of a service you own or are authorized to test, or when decrypting your own captured traffic for troubleshooting.

1 skill

Use when working with tmux 3.4 for persistent terminal sessions: creating and managing sessions, windows, and panes, customizing key bindings and the status bar in tmux.conf, using copy mode to search and copy scrollback, scripting reproducible layouts for projects, surviving SSH disconnects with detach and reattach, logging pane output, or pairing with a colleague in a shared session.

1 skill

Use when writing, building, or reviewing TypeScript on an authorized engineering task.

1 skill

Use when tracing USB and removable media use during an authorized forensic investigation.

1 skill

Use when investigating a username across platforms on an authorized investigation.

1 skill

Use when assessing vehicle to everything communication on an authorized engagement or lab setup.

1 skill

Use when you need fast, targeted forensic collection across many endpoints during incident response or proactive hunting.

1 skill

Use when editing text at speed with Vim 9.1: learning motions, operators, and text objects, combining them into composable editing commands, managing buffers, windows, and tabs, recording and replaying macros, using registers and marks, searching and replacing across files, editing columns with visual block mode, writing a sane vimrc, or fixing a broken Vim configuration.

1 skill

Use when testing VLAN segmentation on an authorized network assessment or lab.

1 skill

Use when building or running a vulnerability management program for an organization you defend.

1 skill

Use when deploying or operating Wazuh for host-based intrusion detection on infrastructure you are authorized to defend.

1 skill

Use when assessing or implementing WebAuthn and passkeys on an authorized engagement.

1 skill

Use when an application uses WebSockets (ws:// or wss://) on an authorized engagement.

1 skill

Use when examining a Windows host, disk image, or triage package during an authorized forensic investigation.

1 skill

Use when testing Wi-Fi security on authorized engagements with written permission covering the wireless network.

1 skill

Use when testing a web application for XML External Entity injection on an authorized engagement.

1 skill

Use when you need to write, test, or tune YARA rules for malware detection and hunting.

1 skill

Use when designing or assessing zero trust network architectures on an authorized engagement.

1 skill