Skill UI

This comprehensive skill guides the testing of web applications for Cross-Site Scripting (XSS) vulnerabilities. It covers reflected, stored, and DOM-based injection points. Testers learn to map input/output contexts, craft context-appropriate payloads, and bypass complex sanitization and CSP protections, ensuring thorough client-side security assessment.

A comprehensive guide and toolkit for performing deep security assessments on mobile application backends. It covers identifying vulnerabilities such as broken authentication, insecure token management (JWT, opaque tokens), session fixation, privilege escalation, and IDOR (Broken Object-Level Authorization) across various OAuth flows (OIDC, PKCE). Essential for penetration testers assessing API security.

This tool parses Software Bill of Materials (SBOM) in CycloneDX and SPDX formats. It correlates components against the NVD CVE database to identify known supply chain vulnerabilities. Key features include building dependency graphs, calculating transitive risk scores, and generating compliance reports for regulatory assessment.

A comprehensive skill for conducting authorized Bluetooth Low Energy (BLE) security assessments. It covers detecting various attacks, including sniffing, Man-in-the-Middle interception, replay attacks, and GATT enumeration abuse. The workflow guides users through packet capture using specialized sniffers (Ubertooth, nRF Sniffer), analyzing services and characteristics via Python/bleak, and performing cryptographic analysis using tools like crackle.

repo-scan is a powerful tool designed to audit large, complex, cross-stack codebases (C++, Java, iOS, Web). It classifies every file into project code, third-party dependencies, or build artifacts. Key features include detecting embedded libraries (e.g., FFmpeg, OpenSSL) and providing a practical 4-stage assessment (Core Asset / Extract / Refactor / Deprecate) via an interactive HTML report. Essential for managing monorepos and planning major refactoring efforts.

Enables structured cloud penetration testing across Azure, AWS, and GCP by guiding reconnaissance, authentication, enumeration, exploitation, and persistence workflows for authorized assessments.

Covers comprehensive HTML injection attack scenarios, detection tips, and tooling so security testers can validate and document injection points, phishing overlays, and reflected or stored payloads during vulnerability assessments.

Structured checklist guiding the planning, scoping, environment prep, tester selection, and reporting phases of penetration tests to keep security assessments thorough and compliant.

Provides quick reference to penetration testing commands for network scanning, exploitation, password cracking, and web testing workflows, helping security professionals run tools like Nmap, Metasploit, Nikto, and SQLMap during assessments.

This advanced prompt simulates a Senior Project Manager and DevOps specialist. It takes comprehensive feature artifacts (PRD, technical breakdowns, testing plans) and generates a structured, automated GitHub project plan. It enforces Agile best practices (Epic > Feature > Story > Enabler > Task) and includes templates for issue creation, dependency management, risk assessment, and Definition of Done, ensuring robust project tracking within GitHub.

Conducts STRIDE-A threat modeling on repositories or systems, running either a full single-pass analysis with architectures, DFDs, prioritized findings, and executive assessments, or an incremental update that compares a baseline report to the current code and highlights deltas.

This guide outlines a rigorous, technical framework for receiving and responding to code review feedback. It emphasizes that code review is a technical assessment, not an emotional exchange. Users learn how to verify assumptions, ask clarifying questions, professionally refute incorrect suggestions, and implement changes iteratively, ensuring code quality and architectural integrity.