AI Agent Skills

Systematic data quality validation before modeling. Use when checking for gaps, outliers, stale prices, or schema violations in datasets.

Abuse Active Directory object ACLs/DACLs for lateral movement and escalation — GenericAll, WriteDACL, GenericWrite, WriteOwner, AddMember, ForceChangePassword, and DCSyn…

Abuse Kerberos delegation to impersonate users and take over hosts — unconstrained, constrained (S4U2Self/S4U2Proxy), and resource-based (RBCD), including the coercion →…

Kerberoasting & AS-REP roasting — request/crack Kerberos tickets to recover service/user passwords offline. Load with any domain foothold or valid domain creds, on "kerb…

Abuse an LLM agent's tools/functions — coerce it to call tools with attacker-chosen args for SSRF, RCE, data exfil, or privilege abuse. Load when the target is an agent…

Bypass an LLM's safety/guardrails to make it produce restricted output or ignore its policy. Load when testing an AI product's content controls, "jailbreak", "guardrail…

Unbounded-consumption / denial-of-wallet attacks on LLM apps — force runaway tokens, cost, or latency. Load when testing an LLM product's limits/billing, on "LLM DoS", c…

Extract or steal an ML/LLM model's parameters, training data, or system prompt via query access — model stealing, membership inference, training-data extraction. Load wh…

Poison a RAG/knowledge-base pipeline so retrieved content hijacks the model (indirect prompt injection at scale) or exfiltrates data. Load when the app does retrieval ov…

Attack the ML/LLM supply chain — poisoned models, datasets, plugins, and unsafe model deserialization. Load when an app loads third-party models/weights (HuggingFace, .p…

Break API authentication: token handling, key leakage, weak session/JWT, and no-auth endpoints. Load on REST/GraphQL APIs using API keys, Bearer tokens, HMAC signing, or…

Broken Object/Function Level Authorization in REST/JSON APIs (the #1 API risk). Load on any REST API with object ids in paths/bodies (/api/v1/users/123, /orders/{id}), B…

Discover and fuzz API endpoints, methods, params, and versions systematically. Load when you have an API base but not its full surface, an OpenAPI/Swagger/Postman spec,…

Test gRPC / Protocol Buffers APIs — reflection, method enumeration, authz, and injection. Load on gRPC services (HTTP/2, content-type application/grpc, .proto files, por…

Mass assignment / auto-binding privilege escalation. Load when an API binds JSON directly to a model (Rails, Spring, Django REST, Node/Mongoose), on signup/profile-updat…

A fast, ordered methodology for assessing an API end to end — REST/GraphQL/gRPC/SOAP — so nothing gets skipped. Load when the target is an API (or recon found one), on "…