yanacuti1121/Yana-AI - الصفحة ٢٥

openhack-security-review

Scenario-first whitebox security vulnerability research using the OpenHack methodology (Hadrian Security). 12 OWASP 2025-aligned expert families, recon → route → scenario → triage pipeline. Use for deep source-code audit on a target repo — not for quick…

لغة النص الأصلي: الإنجليزية

opentelemetry-distributed-tracing

OpenTelemetry JS SDK for distributed tracing across agent chains. Span creation, context propagation (W3C Trace Context), OTLP export, baggage passing, and auto-instrumentation for Node.js. Sources: open-telemetry/opentelemetry-js (Apache-2.0).

لغة النص الأصلي: الإنجليزية

opentelemetry-semantic-telemetry

Instrument multi-agent swarms with OpenTelemetry spans, semantic drift monitoring, anomaly detection, distributed trace propagation across 87 agents, and SIEM bridge export for security events.

لغة النص الأصلي: الإنجليزية

openwork-agent

Desktop app local-first cho AI agent workflows, thay thế mã nguồn mở cho Claude Cowork/Codex desktop. Dùng khi cần chạy OpenCode với GUI, chia sẻ workflow với team, hoặc kết nối remote OpenCode server. Triggers: "openwork", "openwork agent", "opencode…

لغة النص الأصلي: الفيتنامية

output-enforcement

Run a final quality gate on UI output before delivering it to the user. Checks code quality, visual correctness, accessibility baseline, and that no placeholder content remains. Use when about to deliver any frontend implementation — before saying "done",…

لغة النص الأصلي: الإنجليزية

overlayfs-runtime-isolation

Isolate agent file-system writes using OverlayFS and bubblewrap (bwrap). Core directories mounted read-only; all agent writes go to RAM-backed tmpfs. Zero persistence on session end. Anti-graffiti immutable surface pattern.

لغة النص الأصلي: الإنجليزية

owasp-llm-top10

OWASP Top 10 for LLM applications — full checklist for AI agent systems. Prompt injection, insecure output, training data poisoning, DoS, supply chain, sensitive info disclosure, insecure plugins, excessive agency, overreliance, and model theft. Sources:…

لغة النص الأصلي: الإنجليزية

p2p-chronicle-log

P2P append-only action log for distributed agent audit trails. Peer-to-peer replication, content-addressed entries, causal ordering, and tamper-evident chain without central coordinator. Sources: mafintosh/chronicle (MIT).

لغة النص الأصلي: الإنجليزية

paddlepaddle-paddleocr

PaddleOCR — OCR toolkit 80+ ngôn ngữ: PP-OCR (general), PP-Structure (layout+table), PP-ChatOCR (LLM key extraction). PDF/image → text/structured data. Apache-2.0.

لغة النص الأصلي: الفيتنامية

performing-access-recertification-with-saviynt

Configure and execute access recertification campaigns in Saviynt Enterprise Identity Cloud to validate user entitlements, revoke excessive access, and maintain compliance with SOX, SOC2, and HIPAA.

لغة النص الأصلي: الإنجليزية

performing-access-review-and-certification

Conduct systematic access reviews and certifications to ensure users have appropriate access rights aligned with their roles. This skill covers review campaign design, reviewer selection, risk-based p

لغة النص الأصلي: الإنجليزية

performing-active-directory-bloodhound-analysis

Use BloodHound and SharpHound to enumerate Active Directory relationships and identify attack paths from compromised users to Domain Admin.

لغة النص الأصلي: الإنجليزية

performing-active-directory-compromise-investigation

Investigate Active Directory compromise by analyzing authentication logs, replication metadata, Group Policy changes, and Kerberos ticket anomalies to identify attacker persistence and lateral movement paths.

لغة النص الأصلي: الإنجليزية

performing-active-directory-forest-trust-attack

Enumerate and audit Active Directory forest trust relationships using impacket for SID filtering analysis, trust key extraction, cross-forest SID history abuse detection, and inter-realm Kerberos ticket assessment.

لغة النص الأصلي: الإنجليزية

performing-active-directory-penetration-test

Conduct a focused Active Directory penetration test to enumerate domain objects, discover attack paths with BloodHound, exploit Kerberos weaknesses, escalate privileges via ADCS/DCSync, and demonstrate domain compromise.

لغة النص الأصلي: الإنجليزية

performing-active-directory-vulnerability-assessment

Assess Active Directory security posture using PingCastle, BloodHound, and Purple Knight to identify misconfigurations, privilege escalation paths, and attack vectors.

لغة النص الأصلي: الإنجليزية

performing-adversary-in-the-middle-phishing-detection

Detect and respond to Adversary-in-the-Middle (AiTM) phishing attacks that use reverse proxy kits like EvilProxy, Evilginx, and Tycoon 2FA to bypass MFA and steal session tokens.

لغة النص الأصلي: الإنجليزية

performing-agentless-vulnerability-scanning

Configure and execute agentless vulnerability scanning using network protocols, cloud snapshot analysis, and API-based discovery to assess systems without installing endpoint agents.

لغة النص الأصلي: الإنجليزية

performing-ai-driven-osint-correlation

Use AI and LLM-based reasoning to correlate findings across multiple OSINT sources—username enumeration, email lookups, social media profiles, domain records, breach databases, and dark-web mentions—into unified intelligence profiles with confidence scoring…

لغة النص الأصلي: الإنجليزية

performing-alert-triage-with-elastic-siem

Perform systematic alert triage in Elastic Security SIEM to rapidly classify, prioritize, and investigate security alerts for SOC operations.

لغة النص الأصلي: الإنجليزية

performing-android-app-static-analysis-with-mobsf

Performs automated static analysis of Android applications using Mobile Security Framework (MobSF) to identify hardcoded secrets, insecure permissions, vulnerable components, weak cryptography, and code-level security flaws without executing the application.…

لغة النص الأصلي: الإنجليزية

performing-api-fuzzing-with-restler

Uses Microsoft RESTler to perform stateful REST API fuzzing by automatically generating and executing test sequences that exercise API endpoints, discover producer-consumer dependencies between requests, and find security and reliability bugs. The tester…

لغة النص الأصلي: الإنجليزية

performing-api-inventory-and-discovery

Performs API inventory and discovery to identify all API endpoints in an organization's environment including documented, undocumented, shadow, zombie, and deprecated APIs. The tester uses passive traffic analysis, active scanning, DNS enumeration, JavaScript…

لغة النص الأصلي: الإنجليزية

performing-api-rate-limiting-bypass

Tests API rate limiting implementations for bypass vulnerabilities by manipulating request headers, IP addresses, HTTP methods, API versions, and encoding schemes to circumvent request throttling controls. The tester identifies rate limit headers, determines…

لغة النص الأصلي: الإنجليزية

performing-api-security-testing-with-postman

Uses Postman to perform structured API security testing by building collections that test for OWASP API Security Top 10 vulnerabilities including authentication bypass, authorization flaws, injection, and data exposure. The tester creates environments with…

لغة النص الأصلي: الإنجليزية

performing-arp-spoofing-attack-simulation

Simulates ARP spoofing attacks in authorized lab or pentest environments using arpspoof, Ettercap, and Scapy to demonstrate man-in-the-middle risks, test network detection capabilities, and validate ARP inspection countermeasures.

لغة النص الأصلي: الإنجليزية

performing-asset-criticality-scoring-for-vulns

Develop and apply a multi-factor asset criticality scoring model to weight vulnerability prioritization based on business impact, data sensitivity, and operational importance.

لغة النص الأصلي: الإنجليزية

performing-authenticated-scan-with-openvas

Configure and execute authenticated vulnerability scans using OpenVAS/Greenbone Vulnerability Management with SSH and SMB credentials for comprehensive host-level assessment.

لغة النص الأصلي: الإنجليزية

performing-authenticated-vulnerability-scan

Authenticated (credentialed) vulnerability scanning uses valid system credentials to log into target hosts and perform deep inspection of installed software, patches, configurations, and security sett

لغة النص الأصلي: الإنجليزية

performing-automated-malware-analysis-with-cape

Deploy and operate CAPEv2 sandbox for automated malware analysis with behavioral monitoring, payload extraction, configuration parsing, and anti-evasion capabilities.

لغة النص الأصلي: الإنجليزية

performing-aws-account-enumeration-with-scout-suite

Perform comprehensive security posture assessment of AWS accounts using ScoutSuite to enumerate resources, identify misconfigurations, and generate actionable security reports.

لغة النص الأصلي: الإنجليزية

performing-aws-privilege-escalation-assessment

Performing authorized privilege escalation assessments in AWS environments to identify IAM misconfigurations that allow users or roles to elevate their permissions using Pacu, CloudFox, Principal Mapper, and manual IAM policy analysis techniques.

لغة النص الأصلي: الإنجليزية

performing-bandwidth-throttling-attack-simulation

Simulates bandwidth throttling and network degradation attacks using tc, iperf3, and Scapy in authorized environments to test quality-of-service controls, application resilience, and network monitoring detection of traffic manipulation attacks.

لغة النص الأصلي: الإنجليزية

performing-binary-exploitation-analysis

Analyze binary exploitation techniques including buffer overflows and ROP chains using pwntools Python library. Covers checksec analysis, gadget discovery with ROPgadget, and exploit development for CTF and authorized security assessments.

لغة النص الأصلي: الإنجليزية

performing-blind-ssrf-exploitation

Detect and exploit blind Server-Side Request Forgery vulnerabilities using out-of-band techniques, DNS interactions, and timing analysis to access internal services and cloud metadata endpoints.

لغة النص الأصلي: الإنجليزية

performing-bluetooth-security-assessment

Assess Bluetooth Low Energy device security by scanning, enumerating GATT services, and detecting vulnerabilities

لغة النص الأصلي: الإنجليزية

performing-brand-monitoring-for-impersonation

Monitor for brand impersonation attacks across domains, social media, mobile apps, and dark web channels to detect phishing campaigns, fake sites, and unauthorized brand usage targeting your organization.

لغة النص الأصلي: الإنجليزية

performing-clickjacking-attack-test

Testing web applications for clickjacking vulnerabilities by assessing frame embedding controls and crafting proof-of-concept overlay attacks during authorized security assessments.

لغة النص الأصلي: الإنجليزية

performing-cloud-asset-inventory-with-cartography

Perform comprehensive cloud asset inventory and relationship mapping using Cartography to build a Neo4j security graph of infrastructure assets, IAM permissions, and attack paths across AWS, GCP, and Azure.

لغة النص الأصلي: الإنجليزية

performing-cloud-forensics-investigation

Conduct forensic investigations in cloud environments by collecting and analyzing logs, snapshots, and metadata from AWS, Azure, and GCP services.

لغة النص الأصلي: الإنجليزية