Skill UI

Automates validation of OpenAPI, JSON Schema, and GraphQL contracts by linting, structural checks, and breaking-change detection so API teams catch incomplete docs, naming drift, or security holes before release.

Validating Authentication Implementations assesses authentication mechanisms like JWT, OAuth, sessions, and API keys against security standards, then reports vulnerabilities and recommendations for password policy, MFA, token handling, and session security.

Covers securing Vast.ai API keys, rotating secrets, and enforcing least-privilege controls so teams can audit and protect access across dev/staging/production environments.

Applies Vercel security best practices around secret management and access control, covering secure API key storage, least-privilege workflows, scoped environments, and audit logging for safer deployments.

Explains how to store Windsurf API keys safely, rotate secrets, enforce least-privilege scopes, validate webhooks, and log audits so teams can secure Windsurf integrations across dev/staging/prod environments.

A comprehensive WordPress development workflow bundle guiding theme, plugin, WooCommerce, performance, and security work while incorporating WordPress 7.0 features like RTC, AI connectors, Abilities API, DataViews, and PHP-only blocks to build production-ready sites.

Practical workflow for building WordPress plugins with solid architecture, hook management, admin interfaces, REST endpoints, security hardening, and modern WordPress 7.0 features like RTC, AI connectors, Abilities API, DataViews, and PHP-only blocks.

Provides comprehensive expertise for building robust WordPress sites. Specializing in custom theme and plugin development, implementing modern Gutenberg blocks, extending WooCommerce functionality, and managing the WordPress REST API. Core focus areas include advanced security hardening (nonces, sanitization, capability checks), performance optimization (caching, query tuning), and adhering strictly to WordPress coding standards.

Provides red team workflows combining subdomain enumeration, live host discovery, technology fingerprinting, XSS hunting, API fuzzing, and automated recon scripting to support bug bounty hunters and security researchers.

Automatically scans modern API frameworks (Next.js, Express, FastAPI, Django) to generate comprehensive, ready-to-run test suites. It ensures complete coverage for critical areas including authentication, input validation (boundary/injection), error code matrices, pagination, file uploads, and rate limiting. Ideal for TDD, contract testing, and security audits.

Operates as a CISO-grade engine to discover, classify, protect, and govern every credential or secret (API keys, tokens, vaulted accounts) across clouds, CI/CD, containers, and logs, enforcing rotation, least privilege, and auditing.

Guide that enumerates hidden web paths and APIs with ffuf/Gobuster, compares authenticated vs unauthenticated outcomes, and validates endpoint enforcement during authorized security tests.