Skill UI

Guide to systematically assess REST and GraphQL APIs against the OWASP API Security Top 10 risks using Burp Suite, Postman, ffuf, and curl to discover endpoints, probe auth/authorization flaws, and verify rate limiting before deployment.

Manual penetration testing focused on business logic vulnerabilities in web applications, covering price manipulation, workflow bypasses, privilege escalation, and race conditions when automated scanners miss critical flaws.

Guide to using Burp Suite's proxy, scanner, intruder, repeater, and DOM Invader to identify and validate reflected, stored, and DOM-based XSS flaws during authorized web security assessments and bug bounties.

Evaluates OAuth 2.0 and OpenID Connect deployments for redirect URI flaws, CSRF via missing state, PKCE bypasses, token leakage, and scope escalation to ensure secure authorization-code flows before production onboarding.

Implements AWS Nitro Enclave deployments with PCR-aware attestation, KMS key policies, and secure vsock communication so sensitive workloads stay isolated and auditable.

Uses AWS Athena to define forensic tables and run queries against CloudTrail, VPC Flow, S3 access, and ALB logs, helping security teams detect unauthorized access, data exfiltration, lateral movement, and privilege escalation during incident investigations.

Checks AWS, Azure, and GCP configurations for IAM escalation paths, public storage exposure, open security groups, and IaC gaps, providing preventive findings with MITRE mapping for cloud posture management workflows.

Hunt for threats in AWS environments by leveraging Detective behavior graphs, correlated GuardDuty findings, and automated entity timelines spanning IAM users, EC2 instances, and IP addresses to streamline cloud-native incident investigations.

Provides step-by-step techniques for assessing AWS security, covering IAM enumeration, privilege escalation, SSRF metadata attacks, S3/Lambda exploitation, and red-team persistence workflows with recommended tools and commands.

Enables structured cloud penetration testing across Azure, AWS, and GCP by guiding reconnaissance, authentication, enumeration, exploitation, and persistence workflows for authorized assessments.

This comprehensive guide provides step-by-step instructions for setting up a development environment to use AWS CDK (Cloud Development Kit) with Python. It covers installing prerequisites (Node.js, AWS CLI), initializing a CDK project, managing Python dependencies, and mastering the full deployment workflow, enabling users to define and deploy scalable AWS infrastructure as code.

This guide outlines the structured methodology for initiating code reviews using a dedicated sub-agent. It dictates when (after completing tasks, implementing critical features, or before merging) and how to provide the necessary context (SHA hashes, implemented code, requirements) to ensure the work product is thoroughly evaluated. By adopting this process, developers can catch architectural flaws and bugs early in the development lifecycle, improving code quality and maintainability.