Skill UI

A comprehensive collection of abstractions for managing API security and authentication across the application lifecycle. This includes hooks for authentication handlers, full lifecycle management for API keys (create, update, delete), and core utilities for user, role, and permission authorization. Essential for building highly secure and robust backend APIs.

This guide provides essential security and technical guidance for integrating Wispr Flow's voice-to-text API. It covers best practices for authentication (API keys, access tokens), utilizing streaming methods like WebSockets, handling common API errors, and optimizing context awareness for high-accuracy transcription in various applications.

This guide provides comprehensive security and integration details for the Workhuman Social Recognition and rewards API. Learn how to implement OAuth 2.0, manage peer-to-peer nominations, and sync data bidirectionally with major HRIS platforms like Workday and SAP SuccessFactors. Use cases include building custom recognition workflows and integrating with popular tools like Microsoft Teams and Slack.

A hands-on methodology for testing IoT and embedded devices, covering hardware reconnaissance, firmware extraction and analysis, bootloader access, runtime exploitation, wireless protocol attacks, companion app review, and cloud API abuse.

A comprehensive playbook for security testing APIs relying on JWT, bearer tokens, or API keys. It covers token validation weaknesses (e.g., 'alg:none', RS256 confusion), claim misuse, header spoofing, rate limit bypass, and mass assignment vulnerabilities. Ideal for penetration testers assessing authentication boundaries.

This comprehensive playbook guides security testers through deep API authorization checks, focusing specifically on BOLA (Broken Object Level Authorization) and BFLA (Broken Function Level Authorization). Use this skill to test scenarios where object identifiers, nested resources, or privileged functions are exposed, ensuring thorough checks for mass assignment and privilege escalation.

This expert playbook provides comprehensive techniques for testing Cross-Site Request Forgery (CSRF) vulnerabilities in web applications. It covers identifying state-changing endpoints, bypassing anti-CSRF tokens (including missing validation and predictable tokens), and exploiting modern weaknesses like SameSite=Lax via GET methods or misconfigured JSON APIs. Essential reading for security professionals and penetration testers.

This expert playbook covers advanced techniques for email header injection and authentication bypass. It details exploiting CRLF vulnerabilities in SMTP headers (e.g., BCC/CC injection, body control) and bypassing modern email security standards like SPF, DKIM, and DMARC. Essential for penetration testing of contact forms, email APIs, and password reset workflows.

A comprehensive playbook for advanced API security testing targeting GraphQL and REST APIs. It guides users through schema introspection, discovering hidden or undocumented fields, analyzing batching capabilities, and identifying authorization gaps (like IDORs). Essential for deep reconnaissance and identifying privilege escalation vectors.

This skill serves as the primary entry point and operating doctrine for authorized security tasks including web testing, API assessment, and penetration testing. It enforces strict authorization, scope management, and safety constraints while routing complex tasks to specialized deep skills like code audit or incident response.

An expert playbook for systematically testing Insecure Direct Object References (IDOR) and Broken Object/Function Level Authorization (BOLA/BFLA). This guide covers finding object identifiers across all request vectors (URL, body, headers, cookies), implementing A-B testing methodologies, identifying various ID patterns, and executing horizontal or vertical privilege escalation attacks. Essential for deep API security auditing.

A comprehensive CI/CD pipeline for Quarkus applications, designed to verify code quality and deployment readiness. It covers all phases: build, static code analysis (SonarQube, Checkstyle), rigorous functional testing (Unit, Integration, API), security scanning (OWASP, dependency checks), native image compatibility testing, performance load testing (K6), and container image validation (Trivy, Grype).