Skill UI

A comprehensive guide to conducting authorized security assessments across API-driven applications. This skill covers REST, gRPC, and WebSocket protocols, addressing the full OWASP API Security Top 10 2023. Techniques include identifying Broken Object Level Authorization (BOLA/IDOR), broken authentication, excessive data exposure, and implementing fuzzing for various API endpoints. Designed for professional penetration testing engagements.

Detailed methodology for achieving NT AUTHORITY\SYSTEM or local Administrator privileges on Windows targets. Covers token impersonation (JuicyPotato, PrintSpoofer), exploiting service misconfigurations, DLL hijacking, UAC bypass techniques, persistent access, and credential harvesting (LSA, DPAPI). Essential toolkit for red team and penetration testing engagements.

This skill generates high-quality, styled code screenshots by calling the ray.tinte.dev API. It allows users to convert raw code snippets into professional PNG images, supporting multiple programming languages (e.g., Python, JavaScript, TypeScript), customizable themes, and various styling parameters like font size and padding. Use this when the user explicitly requests code images, code snippets as pictures, or mentions 'ray' to visualize code.

This advanced skill performs server-enforced security and privacy reviews for applications, including those rapidly developed with AI agents. It implements comprehensive models like STRIDE (security) and LINDDUN (privacy), screens dependencies against live CVE/CISA data, and evaluates applicability of major EU regulations (GDPR, AI Act, NIS2). The output is a formal, auditable compliance report, never a simulated chat response or legal verdict.

Reviews GitHub pull requests in the googleapis/mcp-toolbox repo against the team's reviewer checklist: title conventions, linked issues, logic errors, edge cases, breaking changes, tests, docs, security, and new dependencies, then proposes a paste-ready verdict for the maintainer.

This comprehensive wizard guides users through setting up various AI agent clients (e.g., Claude Code, Codex, CodeBuddy) to connect with a Memory Proxy. It handles configuration scanning, gathering necessary credentials (Proxy URL, User Key), selecting the specific agent, and validating connectivity via live API health checks for multiple protocols (Anthropic, OpenAI, etc.) before writing the final configuration.

This skill automates the final deployment phase of an agent system. It converts a validated build sheet into four ordered JSON payloads (environment, agent, session, kickoff) and generates a resumable `launch.sh` script. Crucially, this process enforces API-key safety by requiring the user to run the script in their shell, pulling the Anthropic API key from the environment variable, thus ensuring the key never appears in logs or files. It provides a structured, multi-step launch sequence.

This skill provides comprehensive, non-destructive testing for deployed Power Pages sites. It navigates the site, performs page crawling, verifies HTTP status codes, captures network API requests (Web API/OData), and detects console errors. It supports testing core site load, authentication flow, and data integrity.

Propose labels and categorize GitHub issues for maintainers without direct edits. Checks duplicates, verifies bug info, and drafts comments based on repository rules. Optimizes issue management workflow for googleapis/mcp-toolbox.

A comprehensive guide for implementing, gating, and managing feature flags within the Webiny system. Learn how to integrate simple boolean flags or complex nested groups, and apply checks at the API, admin UI, and configuration levels, ensuring robust feature rollout and kill switches.

This catalog provides fundamental abstractions for integrating and managing a structured GraphQL playground within an administrative panel. It includes essential components like client factories and tab registries, allowing developers to easily access and interact with complex GraphQL APIs in a standardized, scalable manner.

A robust utility for generating, summarizing, or rewriting Headless CMS entry content programmatically. Instead of calling an LLM directly, this skill delegates the process to the user's configured AI Power Ups, allowing the use of saved Writers/Readers Personas and Projects. Ideal for implementing bulk actions, lifecycle hooks, or custom mutations, ensuring secure content creation without needing to hardcode API keys or prompts.