Vulnerability Management

detecting-misconfigured-azure-storage is a security-audit skill for reviewing Azure Storage accounts for public blob access, weak encryption, open network rules, unsafe SAS usage, and missing logging. It is useful for repeatable cloud security checks across subscriptions with Azure CLI-backed guidance.

exploiting-idor-vulnerabilities helps authorized security audits test Insecure Direct Object Reference flaws across APIs, web apps, and multi-tenant systems with cross-session checks, object mapping, and read/write verification.

configuring-host-based-intrusion-detection guide for setting up HIDS with Wazuh, OSSEC, or AIDE to monitor file integrity, system changes, and compliance-focused endpoint security for Security Audit workflows.

The exploiting-insecure-deserialization skill helps authorized penetration testers identify serialized inputs, match Java, PHP, Python, and .NET targets, and validate exploitability safely. It includes workflow guidance, detection cues, and tool references for focused testing.

Learn how the exploiting-broken-link-hijacking skill finds and validates broken link hijacking risks from expired domains, abandoned services, and claimable external resources. Built for Security Audit workflows, it helps separate harmless dead links from takeover candidates with a practical triage process.

detecting-typosquatting-packages-in-npm-pypi helps identify suspicious npm and PyPI packages by comparing name similarity, publish recency, and download anomalies. Use it for security audit workflows, dependency review, and first-pass supply-chain risk screening with a reproducible registry-check process.

exploiting-excessive-data-exposure-in-api helps security audit teams inspect API responses for over-shared fields, including PII, secrets, internal IDs, and debug data. It provides a focused workflow, reference patterns, and analyzer logic for comparing returned data against expected schema and roles.

deploying-edr-agent-with-crowdstrike helps plan, install, and verify CrowdStrike Falcon sensor rollout across Windows, macOS, and Linux endpoints. Use this deploying-edr-agent-with-crowdstrike skill for install guidance, policy setup, telemetry-to-SIEM integration, and Incident Response readiness.

conducting-api-security-testing helps authorized testers assess REST, GraphQL, and gRPC APIs for auth, authorization, rate limiting, input validation, and business-logic flaws using an OWASP API Security Top 10 workflow. Use it for structured, evidence-based API security testing and security audit reviews.

building-vulnerability-scanning-workflow helps SOC teams design a repeatable vulnerability scanning process for discovery, prioritization, remediation tracking, and reporting across assets. It supports Security Audit use cases with scanner orchestration, KEV-aware risk ranking, and workflow guidance beyond a one-off scan.