Security Skills

Map an organization's external attack surface — domains, subdomains, exposed services, leaked credentials, and brand abuse.

Recon & OSINT·5 installs

Enumerate and exploit common Active Directory misconfigurations such as Kerberoasting, AS-REP roasting, delegation abuse, and ACL attacks.

Penetration Testing·4 installs

Build an automated, continuously-running reconnaissance pipeline for bug bounty programs — subdomain enumeration, service fingerprinting, and change detection.

Bug Bounty·3 installs

Write bug bounty reports that get triaged quickly and rated accurately — clear impact statements, minimal reproduction steps, and professional tone.

Bug Bounty·3 installs

Audit JSON Web Token implementations for algorithm confusion, weak secrets, missing validation, and token lifecycle flaws.

Web App Security·4 installs

Systematically review a web application against the OWASP Top 10 vulnerability classes with concrete test cases per category.

Web App Security·3 installs

Execute an authorized penetration test end-to-end, from scoping and rules of engagement through reconnaissance, exploitation, post-exploitation, and reporting.

Penetration Testing·3 installs

Find and exploit Server-Side Request Forgery across URL-fetching features, including cloud metadata bypasses and blind SSRF techniques.

Web App Security·3 installs

Review a development pipeline where AI coding agents write, commit and deploy — permission boundaries, approval gates on irreversible actions, credential scope, and what must never be delegated.

Agentic Security·2 installs

Audit AWS environments for IAM privilege escalation, exposed resources, logging gaps, and misconfigurations across accounts.

Cloud Security·2 installs

Harden Dockerfiles and container images — multi-stage builds, non-root users, minimal base images, and vulnerability gates.

Container & K8s·2 installs

Audit Kubernetes clusters for RBAC excesses, pod security gaps, network policy holes, and supply-chain risks.

Container & K8s·2 installs

Review network segmentation designs and verify enforcement — VLANs, firewalls, cloud security groups, and zero-trust boundaries.

Network Security·2 installs

Perform a security-focused code review — map trust boundaries, audit input paths and auth flows, and use vulnerability-class-driven checklists instead of line-by-line skimming.

Code Review·2 installs

Run a STRIDE-based threat modeling workshop — diagram the system, enumerate threats per element, rank them, and drive mitigations into the backlog.

Threat Modeling·2 installs

Perform digital forensics during incident response — evidence preservation, volatile data collection, artifact analysis, and timeline construction.

Digital Forensics·2 installs

Safely triage unknown malware samples — static indicators, sandbox execution, behavior extraction, and reporting.

Malware Analysis·2 installs

Turn changes authored by AI coding agents into evidence an auditor accepts — provenance, authorization, and mapping to change-management controls.

Agentic Security·2 installs

Build a GDPR-compliant data inventory — record of processing activities, lawful basis mapping, data subject rights readiness, and breach response procedures.

Compliance·2 installs

Scope a PCI DSS environment correctly — cardholder data flows, segmentation validation, and requirements mapping for compliance.

Compliance·2 installs

Prepare an organization for a SOC 2 Type I or II audit — trust services criteria mapping, evidence collection, control implementation, and remediation planning.

Compliance·2 installs