Skill UI

A comprehensive guide and set of payloads for penetration testing web applications that process XML input. It details how to test for major vulnerabilities such as XXE, XPath injection, SSRF, and XML parsing attacks, providing step-by-step workflows and advanced payloads for identifying data exposure and security flaws.

A comprehensive guide detailing how to identify and validate Cross-Site Scripting (XSS) vulnerabilities using Burp Suite's advanced tools (Repeater, Intruder, DOM Invader). This methodology covers reflected, stored, and DOM-based XSS, and includes strategies for bypassing security filters and Content Security Policy (CSP), making it essential for web application penetration testing and bug bounty programs.

This guide details methodologies for identifying and exploiting XML External Entity (XXE) injection vulnerabilities in web applications. It covers basic file retrieval, blind XXE detection using out-of-band techniques, and data exfiltration, all critical steps during authorized penetration testing of XML-consuming APIs and services.

tRPC allows developers to build highly type-safe APIs in a full-stack environment without needing to write or maintain separate schemas. It provides end-to-end type safety from server routers to client components, supporting queries, mutations, subscriptions, and robust middleware. Ideal for building modern TypeScript monorepos, Next.js, or Remix applications.

Vibers provides a human code review workflow for AI-generated GitHub projects; add the collaborator, GitHub Action, and commit guidance to receive spec- and security-focused feedback plus follow-up PR fixes.

Orchestrates WCAG 2.2 Level A/AA scans, fixes, and verifications across React, Next.js, Vue, Angular, Svelte, and plain HTML codebases, producing before/after diffs, contrast checks, compliance reports, and CI/CD-ready hooks.

Automatically reverse-engineers any codebase (frontend, backend, or fullstack) into a comprehensive Product Requirements Document (PRD). It analyzes complex elements like routes, components, API integrations, state management, and business logic across major stacks (React, Vue, Next.js, Django, FastAPI). The resulting PRD is detailed enough for both product managers (understanding 'what') and engineers/AI agents (understanding 'how' to reconstruct the system).

Executes a structured VC valuation workflow that ingests SaaS or startup metrics, runs DCF, comparable revenue multiples, and SaaS health models via Python, and synthesizes a defensible valuation, runway, and capital-efficiency narrative for users planning fundraising or benchmarking.

Guides users through a structured 23-step interview to design, generate, and deploy Claude plugins across claude.ai and Claude Code, handling activation prompts, platform quirks, and GitHub pushes.

A lightweight CLI tool for systematically comparing various coding AI agents (such as Claude Code, Aider, and Codex) head-to-head. It measures crucial metrics—pass rate, API cost, execution time, and consistency—on reproducible tasks defined via YAML manifests. Use this to objectively select the best agent for your codebase or to validate model updates before production deployment.

This skill helps developers structure and record critical architectural decisions (ADRs) made during coding sessions. It automatically detects moments of decision, capturing the context, alternatives considered, and the rationale (trade-offs and consequences). This maintains a living log that explains 'why' the code base was built the way it is, preventing knowledge loss and improving project maintainability.

GoldRush API by Covalent lets agents query wallet balances, token prices, transaction history, DEX pairs, and live OHLCV across 100+ chains via REST, CLI, SDK, or WebSocket, avoiding chain-specific plumbing.