API Security Bundle

Skills to secure APIs from design and development to deployment and monitoring.

Browse all skill bundles

Included Skills (100)

  1. Azure Authentication Helper — This tool simplifies implementing secure Microsoft Entra ID authentication for .NET developers using the Azure Identity library and credential chains.
  2. Tm7 Threat Model — Creates valid Microsoft Threat Modeling Tool (.tm7) files compatible with the Microsoft Threat Modeling Tool v7.3+. Use this skill whenever asked to create, generate, or modify a .tm7 threat model file, or when performing STRIDE threat modeling that should output a .tm7 file that opens cleanly in the Microsoft Threat Modeling Tool.
  3. Doca Aes Gcm — Use this skill when the user is doing hands-on DOCA AES-GCM work on a BlueField DPU or ConnectX NIC — configuring `doca_aes_gcm_task_encrypt` / `_task_decrypt`, querying `doca_aes_gcm_cap_*` for per-key-type (only `DOCA_AES_GCM_KEY_128` / `_256` — AES-192 not supported) and per-task support, sizing plaintext against the max-buf cap, setting source / destination mmap permissions, validating with a NIST GCMVS or RFC 5288 vector, or debugging DOCA_ERROR_* including the security-critical tag-verification-failed outcome on decrypt. Trigger even when the user does not explicitly mention "DOCA AES-GCM" or "AEAD" — typical implicit phrasings: "decrypt completion IO_FAILED", "auth tag isn't verifying", "NOT_PERMITTED on my encrypt buffer", "is AES-192-GCM on this BlueField" (no), or "encrypted record came back tampered". Refuse and route elsewhere for non-GCM AES modes (CBC / CTR / XTS — CPU OpenSSL), key management (KMS / HSM / rotation), SHA (doca-sha), or general AEAD background.
  4. Doca Dpa — Use this skill when the user is doing hands-on DOCA DPA host-side work on a BlueField — creating the `doca_dpa` Core context, loading a DPACC-compiled DPA app image (`doca_dpa_app`), creating DPA threads, launching kernels via `doca_dpa_kernel_launch_update_*`, draining `doca_dpa_completion`, running `doca_dpa_cap_*` discovery, choosing between the DPA comm component (inter-DPA messaging) and the DPA verbs component (in-kernel RDMA), or debugging `DOCA_ERROR_*` from `doca_dpa_*`. Trigger even without "DOCA DPA" or "Data-Path Accelerator": "run compute on the DPA from my host", "DPA kernel hangs, no completion", "DOCA_ERROR_DRIVER on launch", "DOCA/DPACC version skew", or "does this BlueField expose a DPA". Route elsewhere for DPA-side kernel programming itself, DPACC compiler internals, host↔DPU messaging (doca-comch), host-side RDMA (doca-rdma), and GPU-initiated networking (doca-gpunetio).
  5. Doca Dpa Hl Tracer — Use this skill when the user runs doca_dpa_hl_tracer to capture/decode DPA-side traces at the programming-events layer (kernel entry/exit, sync points, comm primitive calls, RDMA WR submission, completion drain) — picking TRACE vs CRIT, tuning the JSON config (file-size limits + file_size_limit_policy, thread priorities/cores), decoding against the matching DPA-side ELF, or diagnosing empty/noisy captures. Trigger even when the user does not explicitly mention "DOCA DPA tracer" or "high-level tracer" — typical implicit phrasings include "DPA kernel returns wrong result but host completions look clean", "kernel-entry to first-comm latency is huge", "RDMA WR to drain gap on the DPA", "trace file truncated mid-run", "TRACE doubled my DPA latency", or "tracer wrote a file but parser shows zero events". Refuse and route elsewhere for writing DPA kernels, DPA-Comms/DPA-Verbs programming, raw per-cycle DPA profiling, host-side doca-dpa debugging, or production DPA telemetry — those belong to other skills.
  6. Doca Flow Grpc Server — Remote control of DOCA Flow over gRPC with the shipped `doca_flow_grpc` server: program Flow pipes and entries from Python, Go, Rust or Java, or from another host, instead of linking `libdoca_flow.so`. PLAINTEXT-ONLY: the server uses `grpc::InsecureServerCredentials()` with NO TLS / mTLS / token-auth knob; transport security must come from external infrastructure (e.g. an mTLS proxy / sidecar) on a trusted segment. Trigger even without "gRPC": "program Flow rules from Python on another host", "remotely configure pipes on the BlueField", "client times out connecting to the Flow server", "where is the .proto for Flow", "UNAUTHENTICATED / FAILED_PRECONDITION on a Flow RPC". Covers bringing up, configuring, hardening and debugging the server. Route elsewhere for the underlying doca-flow C API, generic gRPC tooling (protoc, language bindings), or DOCA install / BFB bring-up.
  7. Azure Networking — Configure Azure VNets, NSGs, and Azure Firewall. Implement hub-spoke
  8. Zero Trust Browser Isolation — Deploys remote browser isolation to harden web access against zero-day exploits and phishing for security engineers building robust Zero Trust architectures.
  9. Migrating To Post Quantum Cryptography — Build a cryptographic inventory/CBOM with OpenSSL 3.5+, deploy hybrid post-quantum key exchange (X25519MLKEM768) on TLS/VPN/SSH endpoints, generate ML-KEM/ML-DSA keys and PQC/hybrid certificates, and prioritize migration by harvest-now-decrypt-later (HNDL) exposure per NIST SP 1800-38. Use when inventorying enterprise cryptography for quantum-readiness, enabling hybrid PQC key exchange, or issuing and verifying PQC/hybrid certificates.
  10. Testing For Email Header Injection — Tests web application email functionality (contact forms, password reset,
  11. Frontend Mobile Security Xss Scan — Inspect frontend code for XSS injection points, unsafe DOM manipulation, and missing sanitization.
  12. Performing Web Application Vulnerability Triage — Triages web application vulnerability findings from DAST/SAST scanners
  13. Reverse Engineer Anything — Use REA to investigate shipped apps, binaries, packages, and runtimes; trace features with evidence, compare versions, or guide reconstruction. Skip ordinary source-code analysis.
  14. Sigstore Signing Implementation — Automates Sigstore-based software signing and verification to help security engineers establish cryptographic provenance and secure supply chain workflows for containerized artifacts.
  15. Fintech GraphQL Hunter — Identifies security vulnerabilities in fintech GraphQL APIs for authorized security professionals.
  16. Azure Keyvault Keys Ts — Manage cryptographic keys using Azure Key Vault Keys SDK for JavaScript (@azure/keyvault-keys). Use when creating, encrypting/decrypting, signing, or rotating keys.
  17. Cloudflare DDoS Protection — This skill helps security engineers configure Cloudflare's multi-layer defense stack to mitigate volumetric, protocol, and application-layer attacks against their infrastructure.
  18. Detecting Compromised Cloud Credentials — Detect compromised cloud credentials across AWS, Azure, and GCP by analyzing
  19. Insider Threat Investigator — This tool assists cybersecurity professionals in investigating and documenting potential data misuse or policy violations by employees, contractors, and other trusted internal users.
  20. Performing API Rate Limiting Bypass — Tests API rate limiting for bypass vulnerabilities using Python (requests/aiohttp)
  21. Testing Oauth2 Implementation Flaws — Tests OAuth 2.0 and OpenID Connect implementations for authorization code
  22. Exploiting Idor Vulnerabilities — Identifies and exploits Insecure Direct Object Reference (IDOR) vulnerabilities by manipulating object identifiers (numeric IDs, UUIDs, slugs) in API requests and URLs, using Burp Suite proxy history, Intruder, and the Authorize extension to test object-level authorization across sessions. Use during authorized penetration tests or bug bounty work to validate that CRUD endpoints and multi-tenant applications enforce per-object access control.
  23. Analyzing Prefetch Files For Execution History — Parse Windows Prefetch files (versions 17, 23, 26, 30) with tools like PECmd, WinPrefetchView, or python-prefetch to determine program execution history, including run counts, execution timestamps, and referenced files/DLLs. Use when building a timeline of program execution on a Windows system, confirming whether a suspicious binary ran, or correlating execution evidence with other forensic artifacts during an investigation.
  24. API Security — Authorized security assessment of REST, GraphQL, WebSocket, and SOAP APIs: discovery, authentication and authorization flaws (BOLA/IDOR, JWT/OAuth), rate-limit testing, and a structured multi-phase methodology.
  25. Exploiting Bgp Hijacking Vulnerabilities — Analyzes and simulates BGP hijacking scenarios in authorized lab environments
  26. Detecting Container Escape With Falco Rules — Writes and tunes Falco rule syntax for container escape detection - conditions, macros, lists, priorities, and output fields - covering host filesystem mounts, sensitive host path access, kernel module loading, and privileged capability abuse, including how to drive down false positives. Use when authoring or tuning a specific Falco rule for breakout behaviour, or triaging a noisy escape-related Falco alert. Keywords: Falco rule, macro, list, condition, priority, falco_rules.local.yaml, tuning, false positive. Do not use for deploying and operating Falco itself - use detecting-container-runtime-threats-with-falco; for tool-agnostic escape signals use detecting-container-escape-attempts.
  27. Analyzing Network Covert Channels In Malware — Detect and analyze covert communication channels used by malware, including
  28. Scanning Iac And Images With Trivy — Scans container images, Infrastructure-as-Code (Terraform, CloudFormation,
  29. Mtls Configuration — Configure mutual TLS (mTLS) for zero-trust service-to-service communication. Use when implementing zero-trust networking, certificate management, or securing internal service communication.
  30. Trivy Image Scanner — This skill scans Docker images for vulnerabilities, misconfigurations, and secrets to help security engineers and developers maintain secure containerized application environments.
  31. Implementing API Security Testing With 42crunch — Implements API security testing on the 42Crunch platform, combining
  32. GitHub Actions Hardener — Hardens GitHub Actions workflows against supply chain attacks and credential theft to help DevSecOps engineers secure CI/CD pipelines and production deployments.
  33. Differential Review — Security-focused code review for PRs, commits, and diffs.
  34. Sqlmap Database Pentesting — Provide systematic methodologies for automated SQL injection detection and exploitation using SQLMap.
  35. Azure Keyvault Manager — This tool provides Python developers with secure programmatic access to manage secrets, cryptographic keys, and certificates within Azure Key Vault environments.
  36. Fail2ban Intrusion Prevention — Automates network security by configuring Fail2ban to detect and block malicious port scanning and brute force attempts for system administrators.
  37. RBAC Role Optimizer — This tool utilizes clustering and formal concept analysis to help identity administrators consolidate excessive permissions into efficient, least-privilege roles for improved access governance.
  38. Auditing Tls Certificate Transparency Logs — Monitors Certificate Transparency (CT) logs to detect unauthorized certificate
  39. Performing Ios App Security Assessment — Performs comprehensive iOS application security assessments using Frida
  40. Performing AWS Privilege Escalation Assessment — Performing authorized privilege escalation assessments in AWS environments
  41. PCI DSS Compliance — Implements PCI DSS requirements to help developers secure payment card data environments.
  42. Ransomware Canary Deployment — Deploys strategic honeytokens across file systems to provide security teams with real-time alerts upon detecting unauthorized ransomware encryption activity.
  43. Analyzing Certificate Transparency For Phishing — Monitor Certificate Transparency logs using crt.sh and Certstream to
  44. API Gateway Backend Security And Rate Limiting — Secures and rate limits backend services behind Google Cloud API Gateway across OpenAPI 2.0 and OpenAPI 3.0.x API configurations, including MCP-enabled gateways. Use when configuring API key or JWT authentication, locking down Cloud Run or Cloud Run functions backends with a gateway service account, reading authenticated claims from X-Apigateway-Api-Userinfo, setting per-project request quotas, or diagnosing HTTP 429 and HTTP 500 Service Control Quota errors. Do not use for Apigee, GKE Gateway API, Cloud Load Balancing custom domain setup, or LLM model routing.
  45. Detecting Model Extraction Attacks — Detect MITRE ATLAS AML.T0024 attacks (model stealing, inversion, membership inference) performed via inference-API abuse, by monitoring per-principal query volume/distribution, rate-limiting and perturbing outputs, and red-teaming your model's extractability. Use for a public or partner inference API needing cloning/inversion/membership-inference detection, or a pre-deployment red-team exercise to measure extraction risk.
  46. Exploiting AWS With Pacu — The skill deploys the Pacu AWS exploitation framework, configuring sessions and credentials, enumerating IAM, and executing automated privilege‑escalation scans. It also provides persistence and backdoor modules that enable authorized penetration tests or red‑team engagements to assess blast radius from compromised IAM credentials. The results generate realistic attacker telemetry to support purple‑team detection testing.
  47. Scanning Containers With Trivy In Cicd — Integrates Aqua Security''s Trivy scanner into CI/CD pipelines to detect
  48. Pwn Chain — Go from reverse engineering to a working exploit: stack/heap/kernel pwn workflows with pwntools, libc-database, ROP, and stabilization from CTF to authorized remote targets.
  49. API Security Manager — This tool continuously discovers, classifies, and risk-scores APIs to help security teams unify visibility and mitigate configuration drift across their entire organization.
  50. Performing Authenticated Scan With Openvas — Configure and execute authenticated (credentialed) vulnerability scans using OpenVAS/Greenbone
  51. Zero Trust Architect — This skill deploys identity-aware proxies and micro-segmentation across cloud environments to help security engineers replace traditional VPNs with robust, continuous verification architectures.
  52. Steganography Detection Tool — This tool identifies and extracts hidden data from media files to assist cybersecurity professionals in uncovering covert communication channels and potential data exfiltration.
  53. Exploiting SQL Injection With Sqlmap — Detecting and exploiting SQL injection vulnerabilities using sqlmap to
  54. Zero Trust Architect — This tool helps cybersecurity professionals assess, gap-analyze, and implement the CISA Zero Trust Maturity Model across federal and enterprise infrastructure environments.
  55. MITRE ATT&CK Threat Modeler — This skill assists SOC teams in mapping adversary TTPs to organizational assets to identify detection gaps and prioritize strategic defensive security investments.
  56. Detecting Dns Exfiltration With Dns Query Analysis — Detect data exfiltration via DNS tunneling (tools like iodine, dnscat2, dns2tcp) by analyzing query entropy, subdomain length, query volume to single domains, TXT/CNAME/NULL record abuse, and oversized response payloads using passive DNS monitoring and statistical/ML methods. Use when hunting for covert DNS-based data exfiltration or building a passive DNS anomaly detection capability.
  57. Performing Arp Spoofing Attack Simulation — Simulates ARP spoofing/cache-poisoning attacks in authorized lab or
  58. Conducting Cloud Penetration Testing — This skill outlines methodologies for performing authorized penetration
  59. Exploiting Nopac Cve 2021 42278 42287 — Exploits the noPac Active Directory privilege-escalation chain (CVE-2021-42278
  60. Vulnerability Prioritization Assistant — This tool fetches real-world exploitation probabilities from the FIRST EPSS API to help security teams prioritize vulnerability remediation based on actual risk.
  61. Intercepting Mobile Traffic With Burpsuite — Intercepts and analyzes HTTP/HTTPS traffic from mobile applications
  62. Llm Gateway — Deploy an API gateway for LLM traffic with load balancing, rate limiting,
  63. Hunting Saas Sso Token Abuse — Hunts for stolen-session and OAuth/PRT token replay (T1550.001) by correlating Microsoft Entra ID SigninLogs SessionId/UniqueTokenIdentifier fields and Okta System Log sso/session events to spot impossible travel, refresh-token reuse, and token use from anomalous ASNs. Use when hunting MFA-bypass via stolen cookies/tokens, investigating impossible-travel alerts, or scoping SaaS lateral movement after phishing.
  64. AWS Ses — The skill enables developers and marketers to send and receive email through Amazon SES, handling transactional and marketing mail, template creation, and bulk dispatch. It supports domain verification, DKIM setup, sandbox removal, attachment and unsubscribe header addition, and bounce and complaint handling via SNS, while incoming mail can be routed to S3 with receipt rules. The suppression list is managed through the SES v2 API, providing a complete email workflow.
  65. Historian Security Hardener — Audits and secures industrial process historian servers in OT environments to ensure data integrity and robust network segmentation for cybersecurity professionals.
  66. Performing Credential Access With Lazagne — Extract stored credentials from compromised endpoints using the LaZagne
  67. Context Engineering — Optimizes agent context setup. Use when starting a new session, when agent output quality degrades, when switching between tasks, or when you need to configure rules files and context for a project.
  68. Apigee Threat Protection — Configures Google Apigee security policies to shield APIs from malicious traffic, rate limiting abuse, and common OWASP security vulnerabilities for developers.
  69. GCP IAM Auditor — This tool helps cloud security engineers identify overly permissive IAM bindings and potential access risks within Google Cloud Platform environments.
  70. Cloud Security — Use when assessing cloud infrastructure for security misconfigurations, IAM privilege escalation paths, S3 public exposure, open security group rules, or IaC security gaps. Covers AWS, Azure, and GCP posture assessment with MITRE ATT&CK mapping.
  71. Implementing Canary Tokens For Network Intrusion — Deploys DNS, HTTP, and AWS API key canary tokens across network infrastructure
  72. Vulnerability Management Orchestrator — Automates vulnerability scanning, prioritization, and remediation tracking workflows to help SOC teams secure infrastructure and manage security risks effectively.
  73. Detecting Network Scanning With Ids Signatures — Detect network reconnaissance and port scanning using Suricata and Snort
  74. Implementing Code Signing For Artifacts — Implements code signing for build artifacts (binaries, packages, containers)
  75. Implementing Kubernetes Network Policy With Calico — Installs Calico as the cluster CNI and writes standard Kubernetes NetworkPolicy under it, covering default-deny baselines, policy ordering and precedence, service-account-based selectors, and verifying that policy is genuinely being enforced. Use when adopting Calico as the enforcement CNI, establishing a default-deny baseline, or debugging why a NetworkPolicy is not taking effect under Calico. Keywords: Calico CNI, NetworkPolicy, default deny, policy order, Felix, service account selector. Do not use for Calico-only CRDs such as GlobalNetworkPolicy or DNS egress - use implementing-container-network-policies-with-calico; for CNI-agnostic policy use implementing-network-policies-for-kubernetes.
  76. Performing User Behavior Analytics — Performs User and Entity Behavior Analytics (UEBA) to detect anomalous
  77. Securing AWS Iam Permissions — Hardens AWS IAM configurations to enforce least-privilege access, covering
  78. Reverse Engineering — General reverse-engineering methodology for compiled, obfuscated, packed, or virtualized targets: GDB, Frida, angr, Unicorn, and Qiling workflows across languages and platforms, with anti-analysis countermeasures.
  79. Conducting Domain Persistence With Dcsync — Perform DCSync attacks by abusing MS-DRSR replication rights (DS-Replication-Get-Changes/-All) to impersonate a Domain Controller and extract KRBTGT, Domain Admin, and service account hashes for Golden Ticket forging, typically with Mimikatz. Use in authorized engagements after finding principals with replication rights, to establish long-term domain persistence, or to validate detections for replication abuse.
  80. GCP Network Architect — Designs and configures secure VPC networks, firewall rules, and Cloud NAT on Google Cloud.
  81. Analyzing Ransomware Encryption Mechanisms — Analyzes encryption algorithms, key management, and file encryption
  82. Analyzing Dns Logs For Exfiltration — Analyzes DNS query logs to detect data exfiltration via DNS tunneling,
  83. Kubernetes RBAC Hardener — This skill secures Kubernetes environments by implementing least-privilege access controls, auditing role bindings, and integrating OIDC to prevent unauthorized privilege escalation.
  84. Testing For Broken Access Control — Systematically tests web applications and APIs for broken access control
  85. BeyondCorp Access Architect — This tool helps security engineers implement Google's BeyondCorp zero trust model to secure remote application access without relying on traditional VPN infrastructure.
  86. Bypassing Authentication With Forced Browsing — Discovering and accessing unprotected pages, APIs, and administrative
  87. Performing Clickjacking Attack Test — Testing web applications for clickjacking vulnerabilities by assessing
  88. Prisma Access Deployer — Automates the deployment of Palo Alto Prisma Access to provide enterprise-grade SASE and zero-trust network security for remote users and branch offices.
  89. Investigating Insider Threat Indicators — Investigates insider threat indicators including data exfiltration attempts,
  90. Auditing Kubernetes Rbac Privilege Escalation — The skill audits Kubernetes RBAC to identify over‑permissive roles and service‑account token abuse paths, using tools such as kubectl auth can‑i, rbac‑police, kubectl‑who‑can, and rakkess. It traces subjects that can potentially elevate to cluster‑admin, enabling security teams to review privilege‑escalation risks, hunt exploitable RoleBindings during authorized reviews, and validate least privilege after RBAC changes.
  91. Performing Second Order SQL Injection — Detect and exploit second-order SQL injection vulnerabilities where malicious
  92. Container Image Provenance — This skill enables developers and security engineers to sign, verify, and enforce container image provenance using Sigstore Cosign and SLSA attestations.
  93. Azure Authentication Manager — This tool streamlines Microsoft Entra ID authentication for Python developers by implementing secure, multi-method credential chains for seamless local and cloud deployments.
  94. Adversary Infrastructure Tracker — This tool automates the discovery and mapping of threat actor command-and-control networks by pivoting across DNS, WHOIS, and certificate data for security analysts.
  95. Performing API Security Testing With Postman — Uses Postman to build structured API security test collections covering
  96. Implementing Secrets Management With Vault — Deploy HashiCorp Vault for centralized secrets management, covering dynamic
  97. Exploiting Kerberoasting With Impacket — Performs Kerberoasting (MITRE ATT&CK T1558.003) using Impacket's GetUserSPNs.py to request Kerberos TGS tickets for SPN-registered service accounts, then cracks the extracted RC4/AES-encrypted hashes offline to recover service account credentials. Use during authorized Active Directory penetration tests or red-team engagements for credential access against service accounts via Kerberos ticket-granting-service requests.
  98. Zscaler ZTNA Configurator — This tool assists security engineers in deploying Zscaler Private Access to replace traditional VPNs with secure, identity-based zero trust network access.
  99. Implementing Network Intrusion Prevention With Suricata — Deploys and configures Suricata as an inline network intrusion prevention system,
  100. Zero Trust Architect — This skill guides security engineers through implementing identity-centric zero trust architectures across multi-cloud environments using NIST and BeyondCorp principles for enhanced access control.

Opening your workspace…