Skill UI

A comprehensive, 10-phase methodology for authorized security assessment of modern APIs, including REST, GraphQL, WebSocket, and SOAP. This guide covers the entire testing lifecycle—from endpoint discovery and authentication bypass (JWT/OAuth 2.0) to sophisticated authorization flaws (BOLA/IDOR/BFLA), input validation, rate limiting, and CI/CD integration testing.

This specialized skill is designed for advanced forensic analysis and penetration testing within Windows environments. It focuses on extracting and proving the replayability of credentials, tickets, and secrets stored in LSASS memory, Kerberos ticket caches, DPAPI, and SSP artifacts. Use it to establish the minimal, actionable chain (host artifact -> extracted material -> accepted privilege) that proves a decisive edge for privilege escalation.

Creates task-oriented technical documentation with progressive disclosure for READMEs, API docs, architecture docs, and markdown. Also generates formal security reports (reverse engineering, penetration testing, CTF, malware/APT analysis) in the user's project directory with Evidence-Finding-Path chain.

A comprehensive guide to conducting authorized security assessments across API-driven applications. This skill covers REST, gRPC, and WebSocket protocols, addressing the full OWASP API Security Top 10 2023. Techniques include identifying Broken Object Level Authorization (BOLA/IDOR), broken authentication, excessive data exposure, and implementing fuzzing for various API endpoints. Designed for professional penetration testing engagements.

Detailed methodology for achieving NT AUTHORITY\SYSTEM or local Administrator privileges on Windows targets. Covers token impersonation (JuicyPotato, PrintSpoofer), exploiting service misconfigurations, DLL hijacking, UAC bypass techniques, persistent access, and credential harvesting (LSA, DPAPI). Essential toolkit for red team and penetration testing engagements.

This skill provides comprehensive, non-destructive testing for deployed Power Pages sites. It navigates the site, performs page crawling, verifies HTTP status codes, captures network API requests (Web API/OData), and detects console errors. It supports testing core site load, authentication flow, and data integrity.

This specialized sub-agent is responsible for transforming high-level feature proposals and technical specifications into a formal, comprehensive 'design.md' document. It systematically captures all necessary technical details, including architectural decisions, data flow diagrams, detailed file changes, API contracts, and thorough testing strategies. Use this skill during the planning phase of any complex software change to ensure technical completeness and feasibility.

Conduct authorized security assessments for REST, GraphQL, and WebSocket APIs. Covers discovery, authentication flaws (JWT/OAuth), authorization bypasses (BOLA/IDOR), rate limiting, and a structured 10-phase testing workflow using specialized tools.

Workflow for assessing REST and GraphQL API security, covering discovery, authentication, authorization, input validation, rate limiting, GraphQL testing, error handling, and reporting.

This skill specializes in creating realistic mock services for development, testing, and demonstration purposes. It simulates real API behavior to enable parallel development and facilitate thorough testing. Use it for building mock APIs for frontend or integration testing, simulating partner APIs, creating demo environments, and validating API contracts before backend completion. Avoid using for production systems or security testing.

Convert existing software into reusable serverless Actors on the Apify platform. Covers SDK integration for JS/TS, Python and CLI tools, input/output schemas, local testing with apify run, Docker packaging, deployment and monetization.

This skill provides a template for creating project-specific guidelines based on production applications. It includes architecture overviews, file structures, code patterns, testing requirements, and deployment workflows. Ideal for standardizing development practices across teams using technologies like Next.js, FastAPI, and AI integrations.