Skill UI

A comprehensive guide and toolset for generating OpenAPI/Swagger documentation for Go APIs. By using annotations (@Summary, @Param, @Success, etc.), developers can treat documentation as a formal contract. Supports multiple popular Go frameworks (Gin, Echo, Fiber, net/http), defines complex security schemes (JWT, OAuth2), and guides the entire lifecycle from setup to auditing.

A comprehensive playbook for security testing APIs relying on JWT, bearer tokens, or API keys. It covers token validation weaknesses (e.g., 'alg:none', RS256 confusion), claim misuse, header spoofing, rate limit bypass, and mass assignment vulnerabilities. Ideal for penetration testers assessing authentication boundaries.

A comprehensive playbook for API reconnaissance and documentation review. Use this skill early in the testing process to enumerate all reachable endpoints, extract schemas, identify hidden versions (e.g., v1, v2, mobile), and discover undocumented parameters or fields across REST, GraphQL, and mobile APIs. Essential for mapping the full attack surface before deeper exploitation.

This comprehensive playbook guides the testing of Cross-Origin Resource Sharing (CORS) misconfigurations. It focuses on detecting critical vulnerabilities such as reflected origins, wildcard trust misuse, credentialed cross-origin reads, and bypasses in origin allowlists. Use this when analyzing browser-based access and trust boundaries for authenticated APIs.

This expert playbook provides comprehensive techniques for testing Cross-Site Request Forgery (CSRF) vulnerabilities in web applications. It covers identifying state-changing endpoints, bypassing anti-CSRF tokens (including missing validation and predictable tokens), and exploiting modern weaknesses like SameSite=Lax via GET methods or misconfigured JSON APIs. Essential reading for security professionals and penetration testers.

This expert playbook covers advanced techniques for email header injection and authentication bypass. It details exploiting CRLF vulnerabilities in SMTP headers (e.g., BCC/CC injection, body control) and bypassing modern email security standards like SPF, DKIM, and DMARC. Essential for penetration testing of contact forms, email APIs, and password reset workflows.

A comprehensive playbook for advanced API security testing targeting GraphQL and REST APIs. It guides users through schema introspection, discovering hidden or undocumented fields, analyzing batching capabilities, and identifying authorization gaps (like IDORs). Essential for deep reconnaissance and identifying privilege escalation vectors.

This guide outlines architectural patterns and best practices for building scalable, production-ready APIs with FastAPI. It covers proper project structure, separating concerns using routers, services, and CRUD layers, implementing dependency injection for database sessions and authentication, defining Pydantic schemas for request/response, handling asynchronous operations, and managing custom error responses.

Provides a comprehensive toolkit for integrating X API functionality into applications, data pipelines, and AI agents. Features include robust tweet searching, user profile lookups, timeline fetching, media downloading, and webhook monitoring. Supports multiple languages via official SDKs, REST APIs, and MCP server integration for advanced automation workflows.

An expert AI specializing in Slang shader programming for high-performance graphics and compute applications. This model excels at writing, reviewing, refactoring, and optimizing production-grade code for various graphics stages (vertex, fragment, compute, ray tracing, tessellation). It ensures cross-platform compatibility across major APIs (D3D12, Vulkan, Metal, OpenGL) and supports advanced concepts like generics, parameter blocks, and automatic differentiation. Use this skill when integrating shaders into C++ engines or requiring deep knowledge of low-level GPU pipelines.

This skill provides an end-to-end solution to transform existing REST APIs, defined by OpenAPI or Swagger specifications, into functional MCP servers. It maps every API operation to a dedicated, callable LLM tool, automatically generating robust parameter schemas (Zod) and handling authentication wiring. Use this to expose internal or third-party APIs to LLMs, providing a complete workflow from spec ingestion to local testing and cloud deployment.