security

Files (113)

• SKILL.md
• SKILL.md · parts/api-security/
• jwt-oauth-testing.md · parts/api-security/references/
• rest-graphql-testing.md · parts/api-security/references/
• SKILL.md · parts/attack-chain/
• attack-playbooks.md · parts/attack-chain/references/
• evasion-cheatsheet.md · parts/attack-chain/references/
• lifecycle-checklist.md · parts/attack-chain/references/
• SKILL.md · parts/cloud-k8s/
• k8s-cloud-checklist.md · parts/cloud-k8s/references/
• LICENSE · parts/code-audit/
• SKILL.md · parts/code-audit/
• docker.md · parts/code-audit/infrastructure/
• javascript.md · parts/code-audit/languages/
• python.md · parts/code-audit/languages/
• sast-review-checklist.md · parts/code-audit/references/
• SKILL.md · parts/database-security/
• db-misconfig-checklist.md · parts/database-security/references/
• SKILL.md · parts/digital-forensics/
• forensics-triage.md · parts/digital-forensics/references/
• SKILL.md · parts/edr-bypass-re/
• hook-survey.md · parts/edr-bypass-re/references/
• telemetry-blinding.md · parts/edr-bypass-re/references/
• unhook-techniques.md · parts/edr-bypass-re/references/
• SKILL.md · parts/email-security/
• email-auth-checklist.md · parts/email-security/references/
• SKILL.md · parts/firmware-pentest/
• emba-automated-analysis.md · parts/firmware-pentest/references/
• emulation-and-fuzz.md · parts/firmware-pentest/references/
• extraction-methodology.md · parts/firmware-pentest/references/
• SKILL.md · parts/hardware-security/
• debug-interface-triage.md · parts/hardware-security/references/
• SKILL.md · parts/identity-federation/
• sso-flow-checklist.md · parts/identity-federation/references/
• SKILL.md · parts/llm-security/
• agent-obedience-engineering.md · parts/llm-security/references/
• agent-security-testing.md · parts/llm-security/references/
• owasp-llm-top10.md · parts/llm-security/references/
• prompt-injection-methodology.md · parts/llm-security/references/
• SKILL.md · parts/malware-analysis/
• anti-analysis-techniques.md · parts/malware-analysis/references/
• sandbox-orchestration.md · parts/malware-analysis/references/
• yara-sigma-rules.md · parts/malware-analysis/references/
• SKILL.md · parts/ot-ics/
• ot-safe-assessment.md · parts/ot-ics/references/
• SKILL.md · parts/patch-diff-exploit/
• diff-tools-comparison.md · parts/patch-diff-exploit/references/
• patch-tuesday-workflow.md · parts/patch-diff-exploit/references/
• root-cause-and-poc.md · parts/patch-diff-exploit/references/
• SKILL.md · parts/pentest-tools/
• README.md · parts/pentest-tools/payloads/
• ai-pentest-agents.md · parts/pentest-tools/references/
• ai-pentesting-landscape-2026.md · parts/pentest-tools/references/
• automation-loop-pattern.md · parts/pentest-tools/references/
• awesome-pentest-digest.md · parts/pentest-tools/references/
• burpsuite-mcp-guide.md · parts/pentest-tools/references/
• client-side-lab-playbook.md · parts/pentest-tools/references/
• kali-mcp-ecosystem.md · parts/pentest-tools/references/
• msf-protocol.md · parts/pentest-tools/references/
• network-attack-defense.md · parts/pentest-tools/references/
• …and 53 more

SKILL.md (first lines)

# security — per-surface assessment router

> Home branch in Memora: `root/skill/security`.
>
> Written authorization and scope confirmation come before any active technique.

## Choosing a part

| Surface | Part |
|---|---|
| Source-code security review, SAST triage (Semgrep/CodeQL), vulnerability audit | `parts/code-audit/` |
| REST/GraphQL/WebSocket/SOAP APIs | `parts/api-security/` |
| Cloud, containers, Kubernetes, IAM | `parts/cloud-k8s/` |
| Databases (Postgres/MySQL/MSSQL/Mongo/Redis exposure) | `parts/database-security/` |
| Memory dumps, disk timelines, PCAP forensics | `parts/digital-forensics/` |
| EDR bypass and detection reasoning | `parts/edr-bypass-re/` |
| Email security: phishing, SPF/DKIM/DMARC | `parts/email-security/` |
| Firmware and embedded devices | `parts/firmware-pentest/` |
| LLM applications and AI agents (prompt injection, tool poisoning) | `parts/llm-security/` |
| Malware static/dynamic/behavioral analysis | `parts/malware-analysis/` |
| OT/ICS, Purdue model, PLC/SCADA | `parts/ot-ics/` |
| Patch-diff (1-day) exploitation | `parts/patch-diff-exploit/` |
| Multi-stage enterprise/web attack-path planning | `parts/attack-chain/` |
| Binary/CTF pwn exploit chains | `parts/pwn-chain/` |
| Threat modeling and attack surface mapping | `parts/security-threat-model/` |
| Security ownership and blast-radius mapping | `parts/security-ownership-map/` |
| Hardened baseline security best practices | `parts/security-best-practices/` |
| Federated identity, SAML, OIDC assessments | `parts/identity-federation/` |
| Supply chain: SBOM, SCA, CI/CD | `parts/supply-chain-security/` |
| Blue-team hunting, Sigma/YARA, SIEM queries | `parts/threat-hunting/` |
| Active Directory, Kerberos, AD CS | `parts/windows-ad/` |
| Wi-Fi capture, WPA handshakes | `parts/wifi-wireless/` |
| RF/SDR signal research | `parts/radio-sdr/` |
| Desktop thick clients | `parts/thick-client/` |
| Hardware interfaces: UART/JTAG | `parts/hardware-security/` |
| General toolkit, payload templates and playbooks | `parts/pentest-tools/` |

## Rules

- Confirm target scope and active vs. passive mode via `ask_questions` before sending any network probe or payload.
- Walk `root/skill/security` in Memora before starting; record findings and verified CVEs/configs as nodes.
- Verify installed tools in the current environment; describe static checks vs. live execution in plain text in chat (no caps labels).

## Related

`reverse-engineering` (binary/bytecode analysis), `osint` (reconnaissance and exposure), `dev` (remediation and patches).

From youlianvr/oper-share, CC-BY-4.0.

More from youlianvr/oper-share