Skill UI

A comprehensive, 10-phase methodology for authorized security assessment of modern APIs, including REST, GraphQL, WebSocket, and SOAP. This guide covers the entire testing lifecycle—from endpoint discovery and authentication bypass (JWT/OAuth 2.0) to sophisticated authorization flaws (BOLA/IDOR/BFLA), input validation, rate limiting, and CI/CD integration testing.

A comprehensive guide for conducting authorized database security assessments across various platforms (PostgreSQL, MySQL, MSSQL, Mongo, Redis). Covers critical areas including exposure analysis, authentication, authorization checks, misconfiguration review, and attack chain validation, ensuring non-destructive testing practices are followed.

A comprehensive guide for embedding OpenMed-powered tools into Electronic Health Records (EHRs) like Epic or Cerner. It covers the entire SMART on FHIR workflow, including OAuth2 PKCE authorization, granular scoping (e.g., patient/DocumentReference.rs), secure token handling, and processing clinical notes locally on-device for de-identification and Named Entity Recognition (NER).

A thin primary skill for orchestrating multi-type CTF/AWD/competition sandboxes. It triggers on keywords like CTF or AWD, delegates to a sidecar orchestrator, and enforces authorization before any external network action. Designed to avoid routing duplication and maintain safety boundaries.

Comprehensive skill for FedRAMP certification and compliance under CR26. Covers authorization paths, Certification Classes A-D, SSP/SAP/SAR/POA&M documentation, NIST SP 800-53 control mapping, FedRAMP 20x, OSCAL mandate, 3PAO assessments, continuous monitoring, and gap assessments. Ideal for cloud service providers and security teams navigating federal cloud authorization.

A comprehensive guide to conducting authorized security assessments across API-driven applications. This skill covers REST, gRPC, and WebSocket protocols, addressing the full OWASP API Security Top 10 2023. Techniques include identifying Broken Object Level Authorization (BOLA/IDOR), broken authentication, excessive data exposure, and implementing fuzzing for various API endpoints. Designed for professional penetration testing engagements.

A comprehensive skill to configure authentication (login/logout) and role-based authorization for Power Pages code sites. It supports multiple identity providers (Microsoft Entra ID, Okta, Google, Facebook, etc.) and handles framework-appropriate patterns, generating necessary service files, utilities, and UI components.

Apply Istio/Linkerd service mesh patterns to AI inference traffic: strict mTLS, per-service authorization, egress allowlists, canary and A/B model routing, circuit breaking, and cross-cluster resilience for GPU-backed model services.

This skill provides authorized security techniques for analyzing protected binaries and malware. It is designed for educational purposes, penetration testing, and CTF competitions. Users must confirm written authorization before bypassing protections or extracting data. It focuses on understanding anti-debugging and obfuscation for defensive security research.

A comprehensive guide and skill for building robust, production-ready REST API endpoints. This skill covers full lifecycle development, including input validation, centralized error handling, authentication/authorization checks, CRUD operations, pagination, and generating proper API documentation. It ensures that back-end services are secure, scalable, and adhere to industry best practices.

Conduct authorized security assessments for REST, GraphQL, and WebSocket APIs. Covers discovery, authentication flaws (JWT/OAuth), authorization bypasses (BOLA/IDOR), rate limiting, and a structured 10-phase testing workflow using specialized tools.

Implement secure API design patterns including authentication, authorization, input validation, and protection against vulnerabilities. Covers JWT token contracts, refresh sessions, resource authorization, and input parsing. Suitable for backend developers securing endpoints, preventing abuse, and ensuring data integrity in production environments.