Identity & Access Bundle

Skills to help manage authentication, authorization, and secure access to resources.

Browse all skill bundles

Included Skills (28)

  1. B2B Org Manager — Helps developers implement multi-tenant apps with org switching, roles, and enterprise SSO.
  2. Dpop Adoption — Implement and debug OAuth 2.0 DPoP (RFC 9449) refresh token sender-constraining for WebCrypto, Node.js ES6, and browser runtimes integrating with Google's OAuth platform. Use when configuring non-extractable asymmetric key pairs (P-256), generating DPoP Proof JWTs for authorization code exchange and token refresh, or handling 400 use_dpop_nonce challenge retry loops at oauth2.googleapis.com/token. Don't use for unconstrained OAuth 2.0 flows (where refresh tokens are not bound to a client key pair), or for Google Cloud IAM / service account authentication.
  3. Azure Authentication Helper — This tool assists Python developers in implementing secure Microsoft Entra ID authentication across local environments and various Azure-hosted cloud service workloads.
  4. Doca Hardware Safety — Use this skill whenever the agent is about to recommend or apply a change that touches DPU / NIC hardware state on a live system — mlxconfig firmware-parameter write, NIC firmware burn, BFB reflash, NIC ↔ DPU mode flip, SR-IOV or device-emulation slot enable, kernel boot-parameter change (IOMMU, hugepages, VFIO), PCIe rebind / rescan / link-state flip, BlueField cold reboot, or remediation of a BlueField thermal shutdown. Wrap the change in pre-flight inventory, OOB reachability, a maintenance window, replica rehearsal, and rollback. Trigger on implicit phrasing: "flip BlueField mode over SSH", "enable SR-IOV and reboot", "burned firmware but mlxconfig shows old value", "BlueField thermal shutdown". Not for read-only inventory or version queries (doca-version, doca-caps). Refuse orientation (doca-public-knowledge-map), install or env debug (doca-setup), and program-side debug (doca-debug, doca-programming-guide).
  5. Vercel CLI With Tokens — Deploy and manage projects on Vercel using token-based authentication. Use when working with Vercel CLI using access tokens rather than interactive login — e.g. \"deploy to vercel\", \"set up vercel\", \"add environment variables to vercel\".
  6. Hunting Bootkits In Efi System Partition — Baseline the EFI System Partition and hunt malicious EFI binaries such as ESPecter, BlackLotus, Bootkitty, and Glupteba by mounting the ESP, hashing and verifying boot loaders, scanning with YARA, and flagging anomalous non-EFI files or out-of-band bootloader changes. Use during proactive threat hunts for firmware/bootkit persistence (MITRE ATT&CK T1542.003) or when investigating suspected UEFI-level compromise that survives OS reinstall.
  7. Azure Openai — Azure OpenAI is Microsoft's hosted service for OpenAI models (GPT, gpt-image, Whisper, embeddings) on Azure infrastructure. Use when calling OpenAI models through Azure, authenticating with Managed Identity or Entra ID, setting up content filters, or deploying with enterprise compliance, regional data residency or private networking.
  8. Palo Alto Deployment — This skill assists network security engineers in configuring and deploying Palo Alto next-generation firewalls with advanced application-aware and identity-based security policies.
  9. Exploiting Constrained Delegation Abuse — The skill exploits Kerberos Constrained Delegation misconfigurations in Active Directory by employing Impacket's findDelegation.py and getST.py or Rubeus/Kekeo on Windows to abuse S4U2Self and S4U2Proxy, enabling impersonation of privileged users. It is applied during authorized Active Directory penetration tests or red‑team engagements to facilitate lateral movement and privilege escalation after identifying an account trusted for constrained delegation.
  10. Credential Rotation Automator — This tool automates service account credential rotation across diverse platforms to eliminate stale secrets and significantly reduce the risk of unauthorized system compromise.
  11. Jwt Handler — When the user needs to generate, validate, refresh, or debug JSON Web Tokens. Use when the user mentions "JWT," "access token," "refresh token," "token rotation," "token expiration," "token validation," "bearer token," or "decode JWT." Handles secure token lifecycle including signing, verification, refresh rotation, and revocation. For full auth system design, see auth-system-setup.
  12. Azure Identity Rust — Azure Identity SDK for Rust authentication. Use for DeveloperToolsCredential, ManagedIdentityCredential, ClientSecretCredential, and token-based authentication.
  13. Hunt Saml — Hunt SAML / SSO attacks.
  14. Privileged Access Auditor — This tool systematically validates privileged account permissions to ensure compliance, enforce least privilege, and identify stale access for security and identity governance teams.
  15. Microsoft Graph Integrator — This skill assists developers in integrating Microsoft Graph SDKs into .NET, TypeScript, or Python projects to securely access Microsoft 365 data and services.
  16. CyberArk PAM Implementation — This skill assists security engineers in deploying CyberArk PAM to secure, vault, and monitor privileged credentials while ensuring compliance with NIST access control standards.
  17. Conducting Pass The Ticket Attack — The skill extracts Kerberos TGT/TGS tickets from LSASS memory on a compromised host and injects them into another session, enabling the attacker to impersonate the ticket owner without a password. It is used in authorized post‑exploitation to move laterally or elevate privileges by reusing stolen tickets, and it also validates detection mechanisms for Kerberos ticket theft. This capability benefits penetration testers and red‑team analysts who require precise lateral‑movement techniques and detection validation.
  18. OAuth2 Flow Architect — Configures secure OAuth 2.0 and 2.1 authorization flows for developers building robust authentication systems across web, mobile, and machine-to-machine client applications.
  19. Eval — Evaluate and rank agent results by metric or LLM judge for an AgentHub session. Use when the user runs /hub:eval or asks to score, compare, or pick a winner among completed AgentHub agents.
  20. Privileged Access Architect — This skill assists security engineers in designing and implementing hardened Privileged Access Workstations to secure sensitive administrative operations within a tiered infrastructure model.
  21. Passwordless Authentication Architect — This skill assists developers in implementing secure FIDO2 and WebAuthn passwordless authentication systems to replace traditional passwords with phishing-resistant biometric and hardware-based credentials.
  22. Zero-Knowledge Authentication Implementation — This skill implements Schnorr-based zero-knowledge proofs to enable secure, password-less authentication, helping developers verify user credentials without ever exposing or storing sensitive secrets.
  23. Active Directory Tiering — This skill helps security architects implement Microsoft's ESAE tiered administration model to harden Active Directory environments against lateral movement and credential theft.
  24. OAuth2/OIDC Assistant — Guides developers in implementing secure OAuth 2.0 and OpenID Connect authentication and authorization flows for various applications and APIs.
  25. Azure Lateral Detection — This skill assists security analysts in identifying lateral movement within Azure and Entra ID environments using advanced KQL hunting and log correlation.
  26. Golden Ticket Detector — This tool identifies Kerberos Golden Ticket forgery by analyzing Windows Event logs for encryption downgrades and abnormal ticket lifetimes to assist security analysts.
  27. Quarkus Code Generator — Writes and refines production-ready Quarkus code for REST, validation, security, and more.
  28. Slack App Developer — This skill assists developers in building production-ready Slack applications using the Bolt framework, covering interactive components, Block Kit UIs, and OAuth integration.

Opening your workspace…