index.json

{
  "version": "2.0.0",
  "generated_at": "2026-05-07T23:01:57Z",
  "domain": "cybersecurity",
  "scope": "mobile-app + tauri-desktop + supabase-backend security audit",
  "total_skills": 68,
  "skills": [
    {
      "name": "analyzing-ios-app-security-with-objection",
      "description": "Performs runtime mobile security exploration of iOS applications using Objection, a Frida-powered toolkit that",
      "subdomain": "mobile-security",
      "domain": "cybersecurity",
      "path": "skills/analyzing-ios-app-security-with-objection"
    },
    {
      "name": "auditing-tauri-capabilities",
      "description": "",
      "subdomain": "application-security",
      "domain": "cybersecurity",
      "path": "skills/auditing-tauri-capabilities"
    },
    {
      "name": "conducting-api-security-testing",
      "description": "Conducts security testing of REST, GraphQL, and gRPC APIs to identify vulnerabilities in authentication, authorization,",
      "subdomain": "penetration-testing",
      "domain": "cybersecurity",
      "path": "skills/conducting-api-security-testing"
    },
    {
      "name": "conducting-mobile-app-penetration-test",
      "description": "Conducts penetration testing of iOS and Android mobile applications following the OWASP Mobile Application Security",
      "subdomain": "penetration-testing",
      "domain": "cybersecurity",
      "path": "skills/conducting-mobile-app-penetration-test"
    },
    {
      "name": "exploiting-deeplink-vulnerabilities",
      "description": "Tests and exploits deep link (URL scheme and App Link) vulnerabilities in Android and iOS mobile applications",
      "subdomain": "mobile-security",
      "domain": "cybersecurity",
      "path": "skills/exploiting-deeplink-vulnerabilities"
    },
    {
      "name": "exploiting-insecure-data-storage-in-mobile",
      "description": "Identifies and exploits insecure local data storage vulnerabilities in Android and iOS mobile applications including",
      "subdomain": "mobile-security",
      "domain": "cybersecurity",
      "path": "skills/exploiting-insecure-data-storage-in-mobile"
    },
    {
      "name": "exploiting-sql-injection-vulnerabilities",
      "description": "Identifies and exploits SQL injection vulnerabilities in web applications during authorized penetration tests",
      "subdomain": "penetration-testing",
      "domain": "cybersecurity",
      "path": "skills/exploiting-sql-injection-vulnerabilities"
    },
    {
      "name": "exploiting-sql-injection-with-sqlmap",
      "description": "Detecting and exploiting SQL injection vulnerabilities using sqlmap to extract database contents during authorized",
      "subdomain": "web-application-security",
      "domain": "cybersecurity",
      "path": "skills/exploiting-sql-injection-with-sqlmap"
    },
    {
      "name": "implementing-devsecops-security-scanning",
      "description": "Integrates Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and Software",
      "subdomain": "application-security",
      "domain": "cybersecurity",
      "path": "skills/implementing-devsecops-security-scanning"
    },
    {
      "name": "implementing-github-advanced-security-for-code-scanning",
      "description": "Configure GitHub Advanced Security with CodeQL to perform automated static analysis and vulnerability detection",
      "subdomain": "devsecops",
      "domain": "cybersecurity",
      "path": "skills/implementing-github-advanced-security-for-code-scanning"
    },
    {
      "name": "implementing-secret-scanning-with-gitleaks",
      "description": "This skill covers implementing Gitleaks for detecting and preventing hardcoded secrets in git repositories.",
      "subdomain": "devsecops",
      "domain": "cybersecurity",
      "path": "skills/implementing-secret-scanning-with-gitleaks"
    },
    {
      "name": "implementing-secrets-scanning-in-ci-cd",
      "description": "Integrate gitleaks and trufflehog into CI/CD pipelines to detect leaked secrets before deployment",
      "subdomain": "devsecops",
      "domain": "cybersecurity",
      "path": "skills/implementing-secrets-scanning-in-ci-cd"
    },
    {
      "name": "implementing-semgrep-for-custom-sast-rules",
      "description": "Write custom Semgrep SAST rules in YAML to detect application-specific vulnerabilities, enforce coding standards,",
      "subdomain": "devsecops",
      "domain": "cybersecurity",
      "path": "skills/implementing-semgrep-for-custom-sast-rules"
    },
    {
      "name": "integrating-dast-with-owasp-zap-in-pipeline",
      "description": "This skill covers integrating OWASP ZAP (Zed Attack Proxy) for Dynamic Application Security Testing in CI/CD",
      "subdomain": "devsecops",
      "domain": "cybersecurity",
      "path": "skills/integrating-dast-with-owasp-zap-in-pipeline"
    },
    {
      "name": "integrating-sast-into-github-actions-pipeline",
      "description": "This skill covers integrating Static Application Security Testing (SAST) tools\u2014CodeQL and Semgrep\u2014into GitHub",
      "subdomain": "devsecops",
      "domain": "cybersecurity",
      "path": "skills/integrating-sast-into-github-actions-pipeline"
    },
    {
      "name": "intercepting-mobile-traffic-with-burpsuite",
      "description": "Intercepts and analyzes HTTP/HTTPS traffic from mobile applications using Burp Suite proxy to identify insecure",
      "subdomain": "mobile-security",
      "domain": "cybersecurity",
      "path": "skills/intercepting-mobile-traffic-with-burpsuite"
    },
    {
      "name": "performing-android-app-static-analysis-with-mobsf",
      "description": "Performs automated static analysis of Android applications using Mobile Security Framework (MobSF) to identify",
      "subdomain": "mobile-security",
      "domain": "cybersecurity",
      "path": "skills/performing-android-app-static-analysis-with-mobsf"
    },
    {
      "name": "performing-api-fuzzing-with-restler",
      "description": "Uses Microsoft RESTler to perform stateful REST API fuzzing by automatically generating and executing test sequences",
      "subdomain": "api-security",
      "domain": "cybersecurity",
      "path": "skills/performing-api-fuzzing-with-restler"
    },
    {
      "name": "performing-api-inventory-and-discovery",
      "description": "Performs API inventory and discovery to identify all API endpoints in an organization''s environment including",
      "subdomain": "api-security",
      "domain": "cybersecurity",
      "path": "skills/performing-api-inventory-and-discovery"
    },
    {
      "name": "performing-api-rate-limiting-bypass",
      "description": "Tests API rate limiting implementations for bypass vulnerabilities by manipulating request headers, IP addresses,",
      "subdomain": "api-security",
      "domain": "cybersecurity",
      "path": "skills/performing-api-rate-limiting-bypass"
    },
    {
      "name": "performing-api-security-testing-with-postman",
      "description": "Uses Postman to perform structured API security testing by building collections that test for OWASP API Security",
      "subdomain": "api-security",
      "domain": "cybersecurity",
      "path": "skills/performing-api-security-testing-with-postman"
    },
    {
      "name": "performing-binary-exploitation-analysis",
      "description": "Analyze binary exploitation techniques including buffer overflows and ROP chains using pwntools Python library.",
      "subdomain": "offensive-security",
      "domain": "cybersecurity",
      "path": "skills/performing-binary-exploitation-analysis"
    },
    {
      "name": "performing-blind-ssrf-exploitation",
      "description": "Detect and exploit blind Server-Side Request Forgery vulnerabilities using out-of-band techniques, DNS interactions,",
      "subdomain": "web-application-security",
      "domain": "cybersecurity",
      "path": "skills/performing-blind-ssrf-exploitation"
    },
    {
      "name": "performing-clickjacking-attack-test",
      "description": "Testing web applications for clickjacking vulnerabilities by assessing frame embedding controls and crafting",
      "subdomain": "web-application-security",
      "domain": "cybersecurity",
      "path": "skills/performing-clickjacking-attack-test"
    },
    {
      "name": "performing-content-security-policy-bypass",
      "description": "Analyze and bypass Content Security Policy implementations to achieve cross-site scripting by exploiting misconfigurations,",
      "subdomain": "web-application-security",
      "domain": "cybersecurity",
      "path": "skills/performing-content-security-policy-bypass"
    },
    {
      "name": "performing-cryptographic-audit-of-application",
      "description": "A cryptographic audit systematically reviews an application's use of cryptographic primitives, protocols, and",
      "subdomain": "cryptography",
      "domain": "cybersecurity",
      "path": "skills/performing-cryptographic-audit-of-application"
    },
    {
      "name": "performing-csrf-attack-simulation",
      "description": "Testing web applications for Cross-Site Request Forgery vulnerabilities by crafting forged requests that exploit",
      "subdomain": "web-application-security",
      "domain": "cybersecurity",
      "path": "skills/performing-csrf-attack-simulation"
    },
    {
      "name": "performing-cve-prioritization-with-kev-catalog",
      "description": "Leverage the CISA Known Exploited Vulnerabilities catalog alongside EPSS and CVSS to prioritize CVE remediation",
      "subdomain": "vulnerability-management",
      "domain": "cybersecurity",
      "path": "skills/performing-cve-prioritization-with-kev-catalog"
    },
    {
      "name": "performing-directory-traversal-testing",
      "description": "Testing web applications for path traversal vulnerabilities that allow reading or writing arbitrary files on",
      "subdomain": "web-application-security",
      "domain": "cybersecurity",
      "path": "skills/performing-directory-traversal-testing"
    },
    {
      "name": "performing-dynamic-analysis-of-android-app",
      "description": "Performs runtime dynamic analysis of Android applications using Frida, Objection, and Android Debug Bridge to",
      "subdomain": "mobile-security",
      "domain": "cybersecurity",
      "path": "skills/performing-dynamic-analysis-of-android-app"
    },
    {
      "name": "performing-http-parameter-pollution-attack",
      "description": "Execute HTTP Parameter Pollution attacks to bypass input validation, WAF rules, and security controls by injecting",
      "subdomain": "web-application-security",
      "domain": "cybersecurity",
      "path": "skills/performing-http-parameter-pollution-attack"
    },
    {
      "name": "performing-ios-app-security-assessment",
      "description": "Performs comprehensive iOS application security assessments using Frida for dynamic instrumentation, Objection",
      "subdomain": "mobile-security",
      "domain": "cybersecurity",
      "path": "skills/performing-ios-app-security-assessment"
    },
    {
      "name": "performing-mobile-app-certificate-pinning-bypass",
      "description": "Bypasses SSL/TLS certificate pinning implementations in Android and iOS applications to enable traffic interception",
      "subdomain": "mobile-security",
      "domain": "cybersecurity",
      "path": "skills/performing-mobile-app-certificate-pinning-bypass"
    },
    {
      "name": "performing-oauth-scope-minimization-review",
      "description": "Performs OAuth 2.0 scope minimization review to identify over-permissioned third-party application integrations,",
      "subdomain": "identity-access-management",
      "domain": "cybersecurity",
      "path": "skills/performing-oauth-scope-minimization-review"
    },
    {
      "name": "performing-sca-dependency-scanning-with-snyk",
      "description": "This skill covers implementing Software Composition Analysis (SCA) using Snyk to detect vulnerable open-source",
      "subdomain": "devsecops",
      "domain": "cybersecurity",
      "path": "skills/performing-sca-dependency-scanning-with-snyk"
    },
    {
      "name": "performing-second-order-sql-injection",
      "description": "Detect and exploit second-order SQL injection vulnerabilities where malicious input is stored in a database and",
      "subdomain": "web-application-security",
      "domain": "cybersecurity",
      "path": "skills/performing-second-order-sql-injection"
    },
    {
      "name": "performing-security-headers-audit",
      "description": "Auditing HTTP security headers including CSP, HSTS, X-Frame-Options, and cookie attributes to identify missing",
      "subdomain": "web-application-security",
      "domain": "cybersecurity",
      "path": "skills/performing-security-headers-audit"
    },
    {
      "name": "performing-serverless-function-security-review",
      "description": "Performing security reviews of serverless functions across AWS Lambda, Azure Functions, and GCP Cloud Functions",
      "subdomain": "cloud-security",
      "domain": "cybersecurity",
      "path": "skills/performing-serverless-function-security-review"
    },
    {
      "name": "performing-ssl-tls-security-assessment",
      "description": "Assess SSL/TLS server configurations using the sslyze Python library to evaluate cipher suites, certificate chains,",
      "subdomain": "network-security",
      "domain": "cybersecurity",
      "path": "skills/performing-ssl-tls-security-assessment"
    },
    {
      "name": "performing-ssrf-vulnerability-exploitation",
      "description": "Test for Server-Side Request Forgery vulnerabilities by probing cloud metadata endpoints, internal network services,",
      "subdomain": "security-operations",
      "domain": "cybersecurity",
      "path": "skills/performing-ssrf-vulnerability-exploitation"
    },
    {
      "name": "performing-thick-client-application-penetration-test",
      "description": "Conduct a thick client application penetration test to identify insecure local storage, hardcoded credentials,",
      "subdomain": "penetration-testing",
      "domain": "cybersecurity",
      "path": "skills/performing-thick-client-application-penetration-test"
    },
    {
      "name": "performing-threat-modeling-with-owasp-threat-dragon",
      "description": "Use OWASP Threat Dragon to create data flow diagrams, identify threats using STRIDE and LINDDUN methodologies,",
      "subdomain": "devsecops",
      "domain": "cybersecurity",
      "path": "skills/performing-threat-modeling-with-owasp-threat-dragon"
    },
    {
      "name": "performing-web-application-penetration-test",
      "description": "Performs systematic security testing of web applications following the OWASP Web Security Testing Guide (WSTG)",
      "subdomain": "penetration-testing",
      "domain": "cybersecurity",
      "path": "skills/performing-web-application-penetration-test"
    },
    {
      "name": "performing-web-application-vulnerability-triage",
      "description": "Triage web application vulnerability findings from DAST/SAST scanners using OWASP risk rating methodology to",
      "subdomain": "vulnerability-management",
      "domain": "cybersecurity",
      "path": "skills/performing-web-application-vulnerability-triage"
    },
    {
      "name": "prioritizing-vulnerabilities-with-cvss-scoring",
      "description": "The Common Vulnerability Scoring System (CVSS) is the industry standard framework maintained by FIRST (Forum",
      "subdomain": "vulnerability-management",
      "domain": "cybersecurity",
      "path": "skills/prioritizing-vulnerabilities-with-cvss-scoring"
    },
    {
      "name": "reverse-engineering-android-malware-with-jadx",
      "description": "Reverse engineers malicious Android APK files using JADX decompiler to analyze Java/Kotlin source code, identify",
      "subdomain": "malware-analysis",
      "domain": "cybersecurity",
      "path": "skills/reverse-engineering-android-malware-with-jadx"
    },
    {
      "name": "reverse-engineering-ios-app-with-frida",
      "description": "Reverse engineers iOS applications using Frida dynamic instrumentation to understand internal logic, extract",
      "subdomain": "mobile-security",
      "domain": "cybersecurity",
      "path": "skills/reverse-engineering-ios-app-with-frida"
    },
    {
      "name": "reverse-engineering-rust-malware",
      "description": "Reverse engineer Rust-compiled malware using IDA Pro and Ghidra with techniques for handling non-null-terminated",
      "subdomain": "malware-analysis",
      "domain": "cybersecurity",
      "path": "skills/reverse-engineering-rust-malware"
    },
    {
      "name": "testing-android-intents-for-vulnerabilities",
      "description": "Tests Android inter-process communication (IPC) through intents for vulnerabilities including intent injection,",
      "subdomain": "mobile-security",
      "domain": "cybersecurity",
      "path": "skills/testing-android-intents-for-vulnerabilities"
    },
    {
      "name": "testing-api-authentication-weaknesses",
      "description": "Tests API authentication mechanisms for weaknesses including broken token validation, missing authentication",
      "subdomain": "api-security",
      "domain": "cybersecurity",
      "path": "skills/testing-api-authentication-weaknesses"
    },
    {
      "name": "testing-api-for-broken-object-level-authorization",
      "description": "Tests REST and GraphQL APIs for Broken Object Level Authorization (BOLA/IDOR) vulnerabilities where an authenticated",
      "subdomain": "api-security",
      "domain": "cybersecurity",
      "path": "skills/testing-api-for-broken-object-level-authorization"
    },
    {
      "name": "testing-api-for-mass-assignment-vulnerability",
      "description": "Tests APIs for mass assignment (auto-binding) vulnerabilities where clients can modify object properties they",
      "subdomain": "api-security",
      "domain": "cybersecurity",
      "path": "skills/testing-api-for-mass-assignment-vulnerability"
    },
    {
      "name": "testing-api-security-with-owasp-top-10",
      "description": "Systematically assessing REST and GraphQL API endpoints against the OWASP API Security Top 10 risks using automated",
      "subdomain": "web-application-security",
      "domain": "cybersecurity",
      "path": "skills/testing-api-security-with-owasp-top-10"
    },
    {
      "name": "testing-cors-misconfiguration",
      "description": "Identifying and exploiting Cross-Origin Resource Sharing misconfigurations that allow unauthorized cross-domain",
      "subdomain": "web-application-security",
      "domain": "cybersecurity",
      "path": "skills/testing-cors-misconfiguration"
    },
    {
      "name": "testing-for-broken-access-control",
      "description": "Systematically testing web applications for broken access control vulnerabilities including privilege escalation,",
      "subdomain": "web-application-security",
      "domain": "cybersecurity",
      "path": "skills/testing-for-broken-access-control"
    },
    {
      "name": "testing-for-business-logic-vulnerabilities",
      "description": "Identifying flaws in application business logic that allow price manipulation, workflow bypass, and privilege",
      "subdomain": "web-application-security",
      "domain": "cybersecurity",
      "path": "skills/testing-for-business-logic-vulnerabilities"
    },
    {
      "name": "testing-for-host-header-injection",
      "description": "Test web applications for HTTP Host header injection vulnerabilities to identify password reset poisoning, web",
      "subdomain": "web-application-security",
      "domain": "cybersecurity",
      "path": "skills/testing-for-host-header-injection"
    },
    {
      "name": "testing-for-json-web-token-vulnerabilities",
      "description": "Test JWT implementations for critical vulnerabilities including algorithm confusion, none algorithm bypass, kid",
      "subdomain": "web-application-security",
      "domain": "cybersecurity",
      "path": "skills/testing-for-json-web-token-vulnerabilities"
    },
    {
      "name": "testing-for-open-redirect-vulnerabilities",
      "description": "Identify and test open redirect vulnerabilities in web applications by analyzing URL redirection parameters,",
      "subdomain": "web-application-security",
      "domain": "cybersecurity",
      "path": "skills/testing-for-open-redirect-vulnerabilities"
    },
    {
      "name": "testing-for-sensitive-data-exposure",
      "description": "Identifying sensitive data exposure vulnerabilities including API key leakage, PII in responses, insecure storage,",
      "subdomain": "web-application-security",
      "domain": "cybersecurity",
      "path": "skills/testing-for-sensitive-data-exposure"
    },
    {
      "name": "testing-for-xml-injection-vulnerabilities",
      "description": "Test web applications for XML injection vulnerabilities including XXE, XPath injection, and XML entity attacks",
      "subdomain": "web-application-security",
      "domain": "cybersecurity",
      "path": "skills/testing-for-xml-injection-vulnerabilities"
    },
    {
      "name": "testing-for-xss-vulnerabilities",
      "description": "Tests web applications for Cross-Site Scripting (XSS) vulnerabilities by injecting JavaScript payloads into",
      "subdomain": "penetration-testing",
      "domain": "cybersecurity",
      "path": "skills/testing-for-xss-vulnerabilities"
    },
    {
      "name": "testing-for-xss-vulnerabilities-with-burpsuite",
      "description": "Identifying and validating cross-site scripting vulnerabilities using Burp Suite's scanner, intruder, and repeater",
      "subdomain": "web-application-security",
      "domain": "cybersecurity",
      "path": "skills/testing-for-xss-vulnerabilities-with-burpsuite"
    },
    {
      "name": "testing-for-xxe-injection-vulnerabilities",
      "description": "Discovering and exploiting XML External Entity injection vulnerabilities to read server files, perform SSRF,",
      "subdomain": "web-application-security",
      "domain": "cybersecurity",
      "path": "skills/testing-for-xxe-injection-vulnerabilities"
    },
    {
      "name": "testing-jwt-token-security",
      "description": "Assessing JSON Web Token implementations for cryptographic weaknesses, algorithm confusion attacks, and authorization",
      "subdomain": "web-application-security",
      "domain": "cybersecurity",
      "path": "skills/testing-jwt-token-security"
    },
    {
      "name": "testing-mobile-api-authentication",
      "description": "Tests authentication and authorization mechanisms in mobile application APIs to identify broken authentication,",
      "subdomain": "mobile-security",
      "domain": "cybersecurity",
      "path": "skills/testing-mobile-api-authentication"
    },
    {
      "name": "testing-oauth2-implementation-flaws",
      "description": "Tests OAuth 2.0 and OpenID Connect implementations for security flaws including authorization code interception,",
      "subdomain": "api-security",
      "domain": "cybersecurity",
      "path": "skills/testing-oauth2-implementation-flaws"
    },
    {
      "name": "testing-websocket-api-security",
      "description": "Tests WebSocket API implementations for security vulnerabilities including missing authentication on WebSocket",
      "subdomain": "api-security",
      "domain": "cybersecurity",
      "path": "skills/testing-websocket-api-security"
    }
  ]
}