Skill UI

This guide details essential best practices for securing applications integrated with Anthropic's Claude API. It covers critical security measures including secure API key management (server-side only), robust input validation to prevent cost attacks, defense mechanisms against prompt injection, and implementing per-user rate limiting. Essential reading for maintaining data privacy and system integrity in production environments.

This skill guides the comprehensive process of crash triage, enabling the assessment of vulnerability exploitability. It covers advanced techniques using debuggers (WinDbg/GDB), sanitizers (ASAN/MSAN), and interpreting low-level data like stack traces and register dumps. It is essential for vulnerability researchers analyzing crash dumps or fuzzer-generated failures to identify root causes and potential attack vectors.

This is a detailed offensive checklist for identifying and exploiting insecure deserialization vulnerabilities across multiple programming languages (Java, Python, PHP, .NET, Node.js, etc.). It covers techniques like gadget chain generation, magic method abuse, type confusion, and modern attack vectors, providing a deep methodology for penetration testing and vulnerability research.

A comprehensive checklist designed for assessing the security posture of GraphQL endpoints. It covers advanced vulnerabilities such as introspection abuse, IDOR, query depth/complexity DoS, injection attacks (SQLi/NoSQLi), and authorization bypass mechanisms. Essential for professional penetration testing and bug bounty hunting.

A comprehensive checklist detailing advanced attack methodologies for JSON Web Tokens (JWT). Covers critical misconfigurations such as algorithm confusion (alg:none, RS256→HS256), weak secret brute forcing, header injection (kid, jku, jwk), cache poisoning, and improper validation. Also provides specific vectors for extracting JWTs from mobile environments (Android/iOS). Ideal for penetration testers conducting deep security assessments on authentication systems.

A comprehensive reference and bypass catalog covering modern operating system kernel mitigations such as KASLR, SMAP, SMEP, KPTI, DEP/NX, and CFI. It details how these security mechanisms function, how to detect their presence, and advanced bypass techniques (e.g., side-channel attacks, ROP chains, information leaks). This skill is essential for security professionals conducting deep penetration testing, exploit development, and target hardening assessments.

A comprehensive methodology for offensive security, red team intelligence gathering, and bug bounty reconnaissance. Covers domain recon, email harvesting, social media profiling, code leaks, infrastructure mapping, cryptocurrency tracing, and geospatial intelligence. Essential for building detailed attack-surface maps against organizations or individuals.

This skill provides a comprehensive, structured methodology and checklist for identifying Remote Code Execution (RCE) vulnerabilities across various web applications. It covers advanced attack vectors such as OS command injection, Server-Side Template Injection (SSTI), insecure deserialization, file upload flaws, and XXE. Use this guide during web application penetration testing or bug bounty hunting to systematically discover arbitrary code execution paths.

A deep-dive curriculum into core memory corruption vulnerability classes, covering topics like stack/heap buffer overflows, Use-After-Free (UAF), integer overflows, and format strings. This guide uses real-world CVE case studies (e.g., QNAP, Chrome) to illustrate attack vectors, impact analysis, and modern mitigation techniques. Ideal for cybersecurity professionals, penetration testers, and students learning exploit development.

This comprehensive guide outlines best practices for securing SalesLoft API access and integrations. It details secure token lifecycle management (OAuth refresh), implementing robust webhook signature verification using HMAC-SHA256 to prevent replay attacks, and enforcing scope minimization for least-privilege access. Use this when designing production-grade, secure enterprise integrations.

This comprehensive, zero-trust security auditor scans third-party AI agent skills before installation. It performs a rigorous 6-phase review process, analyzing surface patterns, script integrity, permissions, and supply chain risks. It is designed to detect malicious payloads, credential theft, instruction overrides, and prompt injection attacks, ensuring secure AI development and deployment.

Covers Bluetooth Low Energy attack workflows, including GATT enumeration, unauthenticated characteristic access, pairing downgrade checks, MITM during pairing, sniffing, and companion app reverse engineering for IoT and consumer BLE devices.