القائمة
Core pentesting tools and methodology - Burp Suite usage, Playwright automation, binary analysis, testing methodology, and professional reporting standards.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
Threat Intelligence Report Design System — ReportLab-based PDF generation for A4 reports with Transilience branding, typography, and layout standards.
Offensive AI security testing and exploitation framework. Systematically tests LLM applications for OWASP Top 10 vulnerabilities including prompt injection, model extraction, data poisoning, and supply chain attacks. Integrates with pentest workflows to discover and exploit AI-specific threats.
API security testing - GraphQL, REST API, WebSocket, and Web-LLM attack techniques.
Pentest coordination — orchestrates executor and validator agents with context-controlled spawning. Entry point for all engagements.
Cryptanalysis techniques — lattice attacks, padding oracles, weak-RNG exploitation, signature forgery, secret-sharing recovery.
Digital forensics and incident response - Windows event log analysis, PCAP forensics, filesystem artifact analysis, AD attack detection, and timeline correlation. Use when investigating security incidents, analyzing Sherlocks, or performing threat hunting on provided evidence files.
| name | essential-tools |
| description | Core pentesting tools and methodology - Burp Suite usage, Playwright automation, binary analysis, testing methodology, and professional reporting standards. |
Core tools, methodology, and reporting standards for penetration testing.
| Component | Purpose |
|---|---|
| Burp Suite | Proxy, scanner, intruder, repeater, sequencer |
| Playwright | Browser automation, evidence capture, SPA testing |
| Binary Analysis | Static analysis, reverse engineering, string extraction |
| Nuclei | Templated exposure & misconfiguration scanning |
| sslscan | TLS posture (protocols, ciphers, cert) |
| Methodology | PTES, OWASP WSTG, attack prioritization |
| Reporting | Professional report templates, PDF generation |
reference/essential-skills*.md - Burp Suite techniques and web security testing methodologyreference/playwright-automation.md - Playwright MCP usage for pentestingreference/binary-analysis-quickstart.md - Static analysis for executable files and reverse engineeringreference/web-application-attacks.md - Web application attack methodologyformats/transilience-report-style/pentest-report.md - Finding quality standards, compliance mapping, and pre-delivery checklistRun an availability check before declaring recon complete:
command -v subfinder nuclei sslscan httpx; curl -s "https://crt.sh/?q=%25.${DOMAIN}&output=json" | head -c1
If a tool-class is unavailable, record it as an explicit limitation — NEVER declare recon COMPLETE having skipped a whole class. Hand-rolled urllib is not a substitute (see skills/coordination/reference/principles.md 'Real tools before hand-rolled HTTP').