Skills for your AI
Finds and verifies Host header injection vulnerabilities in authorized web targets, covering password reset poisoning, cache poisoning, routing and path-override SSRF, and OAuth/OIDC poisoning. Use when testing a target's forgot-password flow, CDN or reverse-p
Plans and drafts HR crisis response materials — communication plans, employee support programs, compliance briefs, risk assessments, training packages, policies, incident response plans, continuity plans, and team charters. Use when the EVP of HR needs crisis
Handles HRIS security and compliance work including access control, encryption, privacy impact assessments, compliance monitoring, incident response, audit trails, training, retention, policy enforcement, and vendor management. Use when reviewing HRIS access,
Loads the correct attack capability set for an authorized /hunt engagement by establishing engagement context, running a 404 baseline, fingerprinting hosts, and selecting platform capabilities. Use when starting a /hunt run, when the mode (redteam or wapt) and
Hunts IDOR vulnerabilities in web applications by mapping object references, replaying requests across accounts, testing cross-tenant and GraphQL access, chaining leaks, and documenting findings. Use when a security researcher has authorized access to a target
Use when a security incident has been detected or declared and needs classification, triage, escalation path determination, and forensic evidence collection. Covers SEV1-SEV4 classification, false positive filtering, incident taxonomy, and NIST SP 800-61 lifec
Supports the full incident response lifecycle — classification, escalation, documentation, containment, root cause analysis, communication, coordination, planning, training, and reporting. Use when an analyst needs to classify, escalate, contain, investigate,
Coordinates incident response across triage, stakeholder communication, resource allocation, documentation, root cause analysis, post-mortems, playbooks, training, and metrics reporting. Use when an incident is reported or suspected, when updates must go to st
Helps IT managers identify, categorize, prioritize, document, communicate, escalate, investigate, contain, resolve, and recover from incidents, and improve the incident response plan. Use when analyzing logs for incidents, drafting incident communications, bui
Guides compliance analysts through incident response planning, from detection to review, covering classification, escalation, communication, recovery, plan development, training, metrics, vendor coordination, and policy. Use when an analyst reports unusual act
ISO 27001 ISMS implementation and cybersecurity governance for HealthTech and MedTech companies. Use when designing an ISMS, running security risk assessments, implementing controls, pursuing ISO 27001 certification, preparing security audits, responding to se
Assesses, prioritizes, and reports information security risks from logs, incidents, and policies, and maintains the risk register. Use when analyzing threats, scoring likelihood and impact, checking ISO 27001 or NIST compliance, updating the risk register, or
Assesses IT infrastructure across network, servers, storage, security, cloud, backup, applications, data center, assets, and service management, producing evidence-based reports with prioritized recommendations. Use when the user supplies infrastructure data a
Analyzes network, server, storage, cloud, data center, security, and asset data to produce infrastructure optimization assessments and plans. Use when the user asks for bottleneck analysis, virtualization or consolidation assessments, storage capacity forecast
Analyzes IT infrastructure data into decision-ready reports on performance, security, assets, cloud, backup, cost, and modernization. Use when a consultant needs network or capacity analysis, security and compliance assessment, inventory or virtualization revi
Plans and manages IoT device integration across infrastructure, covering device selection, network design, data management, security, system integration, monitoring, scalability, training, and operational use cases. Use when an IT director needs IoT device com
Guides IoT network integration end to end, from planning and configuration through security, protocols, data, monitoring, scalability and device lifecycle. Use when planning or adjusting an IoT network, securing it, choosing MQTT or CoAP, managing IoT data, tr
Plans, secures, integrates and manages IoT devices across the network lifecycle, producing compatibility matrices, security protocols, data strategies, scalability plans, troubleshooting reports, policies and training guides. Use when a network administrator n
Produces IoT security analysis, policies, training, incident response plans, audits, architecture reviews, risk assessments, monitoring designs, and compliance or segmentation guidance from analyst-provided materials. Use when analyzing IoT device vulnerabilit
Performs IP addressing and subnetting calculations, VLSM planning, allocation documentation, inventory tracking, security analysis, and training. Use when the user needs network/broadcast addresses, host ranges, decimal-binary conversion, subnet plans, IP allo
Builds and maintains an organization's incident response plan, covering plan development, threat analysis, communications, training, tabletop exercises, incident documentation, automation, post-incident review, compliance, and business continuity integration.
Information Security Management System (ISMS) audit expert for ISO 27001 compliance verification, security control assessment, and certification support. Use when the user mentions ISO 27001, ISMS audit, Annex A controls, Statement of Applicability (SOA), gap
Designs and executes ISO 27001 ISMS audit programs, risk-based audit plans, security control assessments, technical testing integration, and compliance audits. Use when planning an audit program, prioritizing audits by risk, auditing controls against ISO 27001
/cs:iso27001-audit-prep <scope> — ISO 27001 ISMS audit readiness 6-question forcing interrogation. Use before annual Clause 9.2 internal audit, surveillance audit prep, or stage 1 certification readiness.
