Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys) online or offline using SharpDPAPI, SharpChrome, Mimikatz, or Impacket's dpapi.py, including domain-wide decryption via the DPAPI backup key. Use during authorized red-team…
An authorized red-team framework for testing systems through stated assumptions. Red teaming is a permitted security exercise that imitates attacks to find weaknesses.
Audit an AI agent benchmark for hackability. Detects evaluation vulnerabilities like missing isolation, leaked answers, eval() on untrusted input, prompt injection in LLM judges, weak scoring, logic gaps, and trust of untrusted output. Use when analyzing whether a benchmark can be gamed or exploited.
Authorized penetration tester persona — offensive security specialist for network, web app, cloud, and Active Directory assessments. Requires explicit authorization.
Autonomous offensive security pipeline. Use when the user wants to hunt bugs, run pentests, do recon, or manage huntbot targets. Triggers on security testing, bug bounty, vulnerability scanning, or any mention of huntbot commands.
Use to adversarially review a technical document that already exists as a file — PRD, ADR, technical spec, design doc, RFC, or system/architecture documentation — to catch what would lead to a bad architecture, design, or implementation decision. Also use when asked to "review", "sanity check", "poke holes in", "red…
An interactive review tool for unclear findings from a security scan. It asks questions so you can decide whether each finding is a real vulnerability or an intentional choice.
A security-scanning workflow that checks a directory or application for vulnerabilities and produces a JSON result. It can also run dynamic tests against a supplied URL.
A structured process for getting several role-specific reviewers to examine a paper, business plan, presentation, code, or other submission before it is sent out.
Orchestrate a static + dynamic, exploit-validated red-team of an AI agent — read the source to find candidate vulnerable paths, then run the dynamic skills to confirm or refute each one empirically. The arbiter of truth is whether the exploit works, not a model vote. Authorized testing of agents you own or are…
The end-to-end methodology for red-teaming a specific AI agent — adaptively, exploit-validated, and honestly. Read THIS target's own code, stand up a disposable harness, and prove or refute each weakness through a real attacker-reachable entry point. This is the orchestration + discipline that makes a finding…
Evidence-driven dissection of an existing service, written plan, or codebase area. Interrogates every entity (table, field, component, endpoint, module, boundary) against ground truth from multiple sources at once, red-teams each verdict devil's-advocate style, and arrives at the minimal-build optimization plan. Runs…
Production-grade red-team security audit skill for AI coding assistants. Audits codebases for OWASP Top 10 vulnerabilities, auth flaws, IDOR, XSS, SSRF, JWT misuse, Supabase policies, and provides drop-in secure code replacements with zero exfiltration risk.