All authors
Claude Skills by zero-lab-ai
github.com/zero-lab-ai57 skills0 installs56 views
- Agent Runtime ValidationPlans and evaluates bounded runtime tests of AI agents, tools, memory, hooks, approvals, and scope enforcement. Use when static review is complete and an authorized assessment must determine how the deployed agent actually behaves.Votes: 0GitHub stars: 53
- Agent Surface AuditReviews an MCP server's tool surface for tool poisoning, over-broad parameters, missing descriptions, and privilege escalation paths. Use when auditing, onboarding, or writing an MCP server, or when a user asks whether a server is safe to connect to an agent.Votes: 0GitHub stars: 53
- Agent Trust Boundary AuditMaps identity, authority, instruction, data, memory, and approval propagation across agents and agent-to-agent handoffs. Use when reviewing multi-agent systems, orchestrators, delegated tools, or confused-deputy exposure.Votes: 0GitHub stars: 53
- Prompt Injection AssessmentAssesses whether direct, indirect, multi-turn, retrieved, or tool-mediated instructions can override an AI system's intended policy or scope. Use when conducting an authorized prompt-injection test with benign canaries and evidence-bound outcomes.Votes: 0GitHub stars: 53
- Cloud Attack PathMaps cloud identity and authorization paths across AWS, Azure, GCP, and hybrid trust boundaries, separating proven access from plausible and blocked routes. Use during an authorized cloud penetration test when tracing how a starting identity could assume roles, use credentials, execute workloads, cross providers, or reach sensitive data.Votes: 0GitHub stars: 53
- Firmware Hardware AssessmentTracks embedded-device and firmware assessment coverage across exact units, acquisition methods, debug interfaces, stored secrets, update trust, radios, physical safety, and delegated external systems. Use when planning, conducting, reviewing, or handing over an authorized hardware or IoT penetration test.Votes: 0GitHub stars: 53
- Mobile Application AssessmentTracks Android and iOS application assessment coverage across packages, platform components, local storage, device behavior, WebViews, native code, network trust, and delegated backend APIs. Use when planning, conducting, reviewing, or handing over an authorized mobile app penetration test.Votes: 0GitHub stars: 53
- Password Audit PlanPlans authorized offline password-strength audits across supplied hash datasets while enforcing compute budgets, progressive pass order, cohort coverage, aggregate-only reporting, and restricted handling. Use when preparing or documenting password cracking without online authentication, spraying, stuffing, replay, or credential reuse testing.Votes: 0GitHub stars: 53
- Persistence Surface AssessmentMeasures local Windows and Linux endpoint persistence exposure from supplied evidence by deriving consumer, authority, lifecycle, prevention, context, telemetry, and coverage state. Use when auditing durable-execution risk without creating, activating, testing, ranking, or removing a persistence mechanism.Votes: 0GitHub stars: 53
- Web Assessment CoverageTracks web application assessment coverage across endpoints, inputs, roles, authentication states, and test families, preventing untested or blocked work from being reported as clean. Use when planning, conducting, reviewing, or handing over an authorized web or API penetration test.Votes: 0GitHub stars: 53
- Binary Fault TriageTriages supplied binary, crash, sanitizer, dump, static-analysis, and external reproduction evidence to distinguish a lead, observed fault, reproducible fault, security relevance, and demonstrated non-weaponized impact without executing, mutating, exploiting, or weaponizing a binary.Votes: 0GitHub stars: 53
- Binary Fault Validation ReadinessGoverns an exact current binary-fault-triage assessment result and recorded validation-readiness handoff for separate isolated-lab review. Use when checking defensive authority, isolation, budget, stop, cleanup, custody, and independent-review readiness without analyzing faults, creating tests or inputs, determining exploitability, or authorizing execution or development.Votes: 0GitHub stars: 53
- Memory Forensics TriageTriages supplied Windows, Linux, or other volatile-memory images while preserving acquisition provenance, image integrity, process and region evidence, network and object correlations, extracted-artifact custody, timeline limits, and claim confidence. Use for offline memory-forensics review and handoff, not live rootkit trust assessment or full malware reverse engineering.Votes: 0GitHub stars: 53
- Rootkit TriageTriages suspected rootkits, bootkits, hidden processes, kernel hooks, driver or module anomalies, concealed network activity, eBPF implants, and boot-integrity failures. Use when host tools may be lying and the incident needs evidence-preserving cross-view analysis, containment, or forensic handoff.Votes: 0GitHub stars: 53
- Defensive Control Evidence SynthesisSynthesizes supplied evidence-backed defensive assessment results and administrative receipts into a scope-bound control-evidence matrix that preserves lineage, freshness, contradictions, unknowns, and gaps. Use when consolidating defensive control evidence without scanning, scoring, certifying, or rewriting findings.Votes: 0GitHub stars: 53
- Detection EngineeringBuilds detection rules that are proven before they ship — fire on known-bad, stay silent on known-good — and keeps false positives from blinding the SOC. Use when writing a Sigma/Suricata/YARA rule, reviewing a detection before deployment, triaging alert fatigue, or deciding whether a rule has earned production.Votes: 0GitHub stars: 53
- Detection Resilience Test PlanPlans and records bounded defensive tests of whether preventive controls, telemetry, and detections remain effective across pre-approved opaque technique variations. Use when a blue or purple team needs authorization-, safety-, evidence-, cleanup-, and remediation-gated resilience measurement without generating bypass procedures, commands, payloads, or stealth rankings.Votes: 0GitHub stars: 53
- Detection ValidateRuns attacker techniques and confirms whether detections actually fire, producing an honest ATT&CK coverage map that separates real gaps from accepted ones. Use when running a purple-team exercise, measuring detection coverage, validating that a SOC can see a technique, or turning 'we think we're covered' into evidence per technique.Votes: 0GitHub stars: 53
- Incident Validation CorrelationCorrelates supplied sanitized incident observations with separately approved isolated defensive-validation receipts across prevent, observe, detect, contain, and recover. Use for defensive learning comparison without live response, hunting, technique design or execution, detection authoring, case management, findings, or reporting.Votes: 0GitHub stars: 53
- Telemetry Coverage AuditAudits supplied sanitized passive telemetry evidence for policy-defined visibility, retention, custody, and investigation readiness. Use when reviewing evidence quality or profile-specific telemetry usability without contacting sources or claiming detection coverage.Votes: 0GitHub stars: 53
- Agent Action ProofGrades evidence for an AI agent's downstream actions without overstating what a callback, tool trace, file read, command result, or target change proves. Use when validating impact, writing findings, or reviewing agent test receipts.Votes: 0GitHub stars: 53
- Ai Threat ModelBuilds an evidence-bound AI threat model from partial architecture, trust, identity, data-flow, and control information. Use when scoping an AI assessment, reviewing a design, or prioritizing realistic attack paths under uncertainty.Votes: 0GitHub stars: 53
- Assessment Sequence GovernanceValidates supplied immutable ordered manifests of opaque defensive assessment actions for authority, safeguards, evidence, and separate-operator review. Use when reviewing assessment sequencing without creating, changing, or executing actions.Votes: 0GitHub stars: 53
- Engagement Report AssemblyAssembles supplied validated artifacts, immutable final findings, scope, methods, coverage, limitations, contradictions, and evidence indexes into a complete review-ready engagement package without rewriting, rescoring, hiding, closing, publishing, or contacting.Votes: 0GitHub stars: 53
- Findings ReportWrites security findings that survive triage: reproducible, severity-justified, and fixable, in a fixed structure with a severity rubric. Use when turning a discovered vulnerability, misconfiguration, or weakness into a report entry, ticket, or disclosure.Votes: 0GitHub stars: 53
- Security Test Tool GovernanceGoverns supplied benign security-test tool artifacts through purpose, authority, provenance, artifact integrity, safety-test evidence, version-bound review, custody, change control, and defensive handoff. Use when reviewing proposed security tooling or deciding whether an externally supplied artifact is ready for an authorized isolated test, without generating source code, payloads, build procedures, bypasses, or deployment instructions.Votes: 0GitHub stars: 53
- Social Engineering Engagement PlanPlans authorized defensive phishing simulations, vishing exercises, and other social-engineering engagements with explicit channel and cohort scope, pretext approval, participant safety, data minimization, readiness gates, metrics, and debrief. Use before measuring human-security exposure or reviewing a proposed campaign.Votes: 0GitHub stars: 53
- Active Directory Attack PathAnalyzes and prioritizes Active Directory and BloodHound attack paths using evidence freshness, disabled principals, prerequisites, authorization, operational noise, and remediation coverage. Use during an authorized red-team operation when reviewing AD graphs, nested groups, ACL abuse, delegation, sessions, GPO control, or routes to Tier Zero.Votes: 0GitHub stars: 53
- Adcs Exposure AuditAudits Active Directory Certificate Services configuration for dangerous certificate templates, PKI ACLs, enrollment interfaces, mapping policy, and identity escalation paths. Use during an authorized identity security review when assessing AD CS, certificate templates, enterprise CAs, or Certipy-style inventory without exercising an attack path.Votes: 0GitHub stars: 53
- Credential Exposure AuditAudits supplied evidence when passwords, hashes, private keys, browser or vault entries, cloud CLI credentials, application secrets, tokens, or credential-bearing artifacts may be exposed. Use for defensive review that must distinguish indicators from material and validity from privilege without decrypting, cracking, replaying, or authenticating.Votes: 0GitHub stars: 53
- Directory Persistence AuditAudits supplied sanitized directory-service governance evidence for durable control and persistence exposure without contacting live systems. Use when reviewing defensive directory control, baseline, monitoring, or exception evidence.Votes: 0GitHub stars: 53
- Kerberos Exposure AuditAudits supplied sanitized Kerberos governance evidence for policy, protection, monitoring, and evidence-handling exposure without contacting live systems. Use when reviewing a defensive Kerberos evidence package or assessing identity-control coverage.Votes: 0GitHub stars: 53
- Lateral Movement MapMaps lateral movement candidates and multi-hop routes across Windows, Linux, network, DevOps, and cloud environments while separating transport reachability, authentication material, destination rights, authorization, execution proof, resulting access, detection exposure, and cleanup. Use when planning or documenting remote access paths after a foothold.Votes: 0GitHub stars: 53
- Lateral Movement ReadinessReviews an already-supplied lateral movement candidate for exact upstream map binding, authorization, non-production isolation, containment, telemetry, stop control, rollback, cleanup ownership, custody, tool governance, and a separate-validation handoff. Use before transferring a candidate to a lab validation team.Votes: 0GitHub stars: 53
- Privilege Escalation AssessmentAssesses and ranks Windows, Linux, and cloud privilege-escalation paths using observed prerequisites, execution authority, operational signal, reliability, risk, cleanup, and verification. Use after gaining an authorized foothold or cloud identity when deciding whether elevation is necessary and which candidate path is defensible.Votes: 0GitHub stars: 53
- Dataset Integrity AssessmentAudits dataset sources, labels, transformations, review, versioning, split integrity, retraining triggers, and rollback controls for poisoning and targeted degradation risk. Use when reviewing an ML training or evaluation data supply chain.Votes: 0GitHub stars: 53
- Ml Decision Boundary AssessmentEvaluates classifiers and scoring models used as security gates for adversarial robustness, preprocessing differences, thresholds, abstention, and fallback behavior. Use when an authorized assessment must measure whether bounded input changes alter a security decision.Votes: 0GitHub stars: 53
- Model Artifact Lifecycle AuditAudits how model artifacts are accepted, validated, stored, selected, loaded, executed, monitored, and retired. Use when reviewing model registries, loaders, CI/CD pipelines, scanner-to-runtime gaps, or ML supply-chain controls.Votes: 0GitHub stars: 53
- Model Serving Exposure AuditAudits model-serving APIs, administrative and debug surfaces, vector stores, object storage, caches, workload identity, metadata access, and orchestration credentials. Use when reviewing the deployed infrastructure around model inference.Votes: 0GitHub stars: 53
- Command Channel Defense AssessmentAssesses supplied defensive evidence for prevention, visibility, detection, containment, and recovery coverage against opaque command-channel scenarios. Use when reviewing command-and-control exposure or control gaps without designing infrastructure, live tests, or operational guidance.Votes: 0GitHub stars: 53
- Covert Channel AssessmentAssesses covert-channel and data-egress exposure, then plans or records bounded purple-team validation with synthetic data. Use when evaluating DNS, web, cloud, ICMP, tunnel, timing, steganographic, or dead-drop paths without turning a plausible route into a claim of successful exfiltration.Votes: 0GitHub stars: 53
- Protocol Exploitation AssessmentAssesses network protocol exploitation candidates while separating observed service behavior, advisory applicability, reproduced faults, demonstrated impact, authorization, disruption risk, telemetry, and coverage. Use when a banner, scanner result, packet trace, reset, legacy protocol, or suspected handshake weakness needs a defensible validation plan.Votes: 0GitHub stars: 53
- Protocol Traffic AnalysisAnalyzes supplied PCAP and packet-capture evidence into hosts, conversations, dependencies, authentication exposure, timing patterns, blind spots, and defensible follow-up. Use when reviewing network traffic without transmitting to the observed systems.Votes: 0GitHub stars: 53
- Wireless Assessment PlanPlans authorized Wi-Fi, Bluetooth, RFID/NFC, SDR, and other radio assessments with explicit physical scope, transmission authority, disruption budgets, capture handling, coverage, and handoffs. Use before conducting or reviewing a wireless penetration test.Votes: 0GitHub stars: 53
- Rag Data Exposure AuditAssesses document authorization, tenant isolation, raw-chunk fields, citations, caches, exports, and sensitive-source leakage in retrieval systems. Use when an authorized RAG assessment must determine what data each identity can retrieve or disclose.Votes: 0GitHub stars: 53
- Rag Surface ReconMaps an authorized retrieval system's sources, connectors, chunking, embeddings, indexes, filters, ranking, caches, citations, and exposed retrieval fields. Use when scoping a RAG security assessment or explaining observed retrieval behavior.Votes: 0GitHub stars: 53
- Retrieval Integrity AssessmentAssesses whether an authorized retrieval-augmented AI system preserves source, index, retrieval, context, and output integrity. Use when testing RAG poisoning, retrieval hijacking, context saturation, semantic substitution, or citation controls with benign canaries.Votes: 0GitHub stars: 53
- Ai Surface ReconMaps an authorized AI system's externally observable models, retrieval paths, agent tools, guardrails, endpoints, and privileged consumers. Use when scoping an AI security assessment or building an evidence-bound attack-surface inventory.Votes: 0GitHub stars: 53
- Network ReconPlans authorized network reconnaissance, checks proposed targets against explicit IP scope, chooses scanning tools by cost, and audits completed scans for coverage. Use when mapping a network, enumerating hosts and services, deciding which scanner to run, or determining whether an empty scan is a finding or a failure.Votes: 0GitHub stars: 53
- Opsec PlanningBuilds red-team OPSEC plans that connect an authorized objective to observable artifacts, detection risk, countermeasures, abort conditions, cleanup, and post-operation review. Use before a significant action or attack chain when stealth matters, when choosing between noisy and quiet approaches, or when an operator needs an auditable go/no-go decision.Votes: 0GitHub stars: 53