Skill UI

This comprehensive guide provides essential security protocols for building robust Laravel applications. It covers best practices for authentication (Sanctum, Passport), authorization (Policies), input validation, and protecting against common vulnerabilities like CSRF, XSS, and SQL injection. Key topics include secure file uploads, rate limiting, environment variable management, and implementing robust middleware.

Perform comprehensive and structured API security testing using Postman. This skill covers testing for OWASP API Security Top 10 vulnerabilities, including authentication bypass, authorization flaws (BOLA), injection, and data exposure. It guides users through setting up multi-role environments, writing automated test scripts for regression testing, and integrating the workflow with CI/CD tools like Newman and OWASP ZAP.

A comprehensive framework for testing REST and GraphQL APIs against Broken Object Level Authorization (BOLA) and Insecure Direct Object Reference (IDOR). This tool simulates an attacker's behavior by systematically intercepting and modifying object identifiers (IDs, UUIDs, slugs) within API calls. It helps identify critical authorization flaws, ensuring that an authenticated user cannot access or modify resources belonging to other tenants or users, adhering to OWASP API Security Top 10.

A comprehensive guide and toolkit for performing deep security assessments on mobile application backends. It covers identifying vulnerabilities such as broken authentication, insecure token management (JWT, opaque tokens), session fixation, privilege escalation, and IDOR (Broken Object-Level Authorization) across various OAuth flows (OIDC, PKCE). Essential for penetration testers assessing API security.

This comprehensive tool assesses critical security flaws in OAuth 2.0 and OpenID Connect (OIDC) implementations. It systematically tests for common vulnerabilities like authorization code interception, redirect URI manipulation, CSRF in OAuth flows, token leakage, and scope escalation. Ideal for penetration testers and security engineers evaluating the robustness of identity providers and client applications.

Feishu plugin troubleshooting tool combining FAQ guidance with the /feishu doctor command to inspect permissions, API connectivity, app credentials, and user authorizations, then generate diagnostic reports and remediation steps.

Implements a robust, multi-tenant authorization layer for Cohere API v2. This solution enforces Role-Based Access Control (RBAC), manages individual API keys per team, and implements per-team usage limits and daily budget tracking. It is essential for large-scale applications requiring strict resource isolation and cost governance across multiple internal services.

This comprehensive guide details setting up a secure Canva Connect API integration using the OAuth 2.0 Authorization Code flow with PKCE (Proof Key for Code Exchange). It covers the entire lifecycle: client registration, token generation, code exchange for access tokens, and refreshing expired tokens. Use this skill when building applications that require programmatic access to Canva's design and asset management capabilities.

This skill helps test the robustness of an AI agent's authorization mechanisms. Use it when the agent handles user roles, permissions, or sensitive data (e.g., admin functions, cross-tenant data). It simulates attempts to bypass authentication, escalate privileges, or access data belonging to other users or tenants.

This comprehensive guide details how to implement robust webhook endpoints to receive, validate, and process data deliveries from Bright Data's Web Scraper and Datasets APIs. Learn best practices for handling large JSON/NDJSON payloads, verifying authorization headers, processing status notifications, and ensuring data deduplication in automated scraping pipelines.

A comprehensive diagnostic tool for resolving complex issues within Feishu plugins. It offers FAQs for common errors and features the deep diagnostic command (`/feishu_doctor`). This command systematically checks account configuration, API connectivity, application permissions, and user authorization status, generating a detailed report to resolve persistent technical failures.

A comprehensive skill for building enterprise-grade integrations with Figma. It covers the full OAuth 2.0 authorization code flow, token refreshing, and secure handling of user access tokens. It provides methods for managing team structures, listing projects, accessing components/styles, and utilizing advanced, enterprise-only features like the Variables API.