Helps users discover and install Rifteo agent skills when they ask questions like "is there a skill for X", "how do I write a finding", "find a skill that can...", or want to extend their agent for security and audit work.
Maps every entry point, component, and trust boundary of a target before testing begins prevents missed coverage and prioritizes the highest-value attack paths. Trigger when the user provides a target and wants to know where to start, says "map the attack surface", "what should I test", or "where do I begin", or is starting any engagement after scope-grill is complete.
Converts raw bug bounty findings into a complete, triage-ready report clear description, numbered reproduction steps, self-contained PoC, risk, and remediation. Trigger when the user has a confirmed bug bounty finding and needs to write it up, says "write this up", "report this", or "format this for H1/Bugcrowd/Intigriti", or has raw notes, a request/response, or a PoC needing a submission-ready report.
Ultra-compressed response mode for cybersecurity contexts strips filler while keeping CVEs, payloads, CVSS scores, and findings exact. User-triggered only never self-activated. Trigger when the user explicitly says "/caveman", "caveman mode", "be brief", "tl;dr", "just the findings", "straight to the point", "keep it short", or similar explicit brevity requests.
Search known exploit databases and sources for a given service, version, or CVE, from searchsploit to Vulners, MSF, and beyond. Trigger when the user has identified a service/version and wants to know if public exploits exist, provides a CVE ID and wants PoC or weaponized exploit references, ran nmap/banner grabbing and wants to cross-reference exploit databases, wants to know if a vulnerability is actively exploited in the wild, or is preparing a pentest report needing exploit evidence references.
Complete clickjacking (UI redressing) methodology framing protection detection, single-click and multi-step PoC construction, JS frame-busting bypass, drag-and-drop and OAuth consent variants, and report structure. Trigger when the user asks to test for clickjacking or UI redressing, wants to check if a sensitive endpoint (account delete, 2FA disable, OAuth consent) is frameable, needs to build a clickjacking PoC for a report, or wants to bypass JavaScript frame-busting protections.
Aggregates audit findings mapped to framework controls, classifies each control, identifies blind spots, prioritizes gaps by severity, and produces a complete gap report supports ISO 27001, NIST CSF, PCI-DSS, and OWASP. Trigger when the user provides audit findings tagged to framework controls and asks for a gap report, asks what controls are failing or what their biggest compliance gaps are, needs to identify blind spots or untested controls, wants to compare current compliance posture against a previous audit, or shares pentest/audit results wanting them mapped to a compliance framework.
Looks up any control ID across ISO 27001, NIST CSF, PCI-DSS v4, and OWASP returns the full control card, cross-framework mappings with confidence level, related controls, and testing hints. Trigger when the user provides a control ID and asks what it means, asks how controls map across frameworks, searches for a control by keyword or description, needs testing hints or evidence criteria before writing a finding, or wants to understand related or prerequisite controls within a framework.