Skill UI

Automates feature delivery by reading specs, designing architecture, coding in src/, adding tests, and preparing handoff notes while following structured checklists.

Runs coding tasks as an acceptance-focused state machine, guiding issue intake through implementation, review, deployment, and evidence-backed verification while enforcing gates and escalation when DoD fails.

This skill provides methods for reliably extracting typed, validated, and structured data from Large Language Models (LLMs), moving beyond simple text parsing. It covers best practices across major APIs (OpenAI's response_format, Anthropic's tool_use, Google's responseSchema) and local models. Key workflows include defining schemas (Pydantic/Zod), implementing constrained decoding, and building robust retry loops for production-grade data pipelines.

Unpacks layered JavaScript obfuscation used in web attacks by extracting scripts, neutralizing anti-analysis tricks, and decoding string and control-flow hiding so analysts can recover the original malicious logic during phishing, skimmer or dropper investigations.

Guides authorized security testers through detecting and exploiting HTTP request smuggling when front- and back-end servers disagree on Content-Length vs Transfer-Encoding, covering architecture checks, automation tools, and impact scenarios.

Guide for writing YAML-based Semgrep rules to detect app-specific vulnerabilities, enforce coding standards, and plug into CI/CD for continuous SAST assurance across multiple languages.

Evaluates API rate limiting controls for bypass vulnerabilities by probing headers, IPs, methods, versions, and encodings, ensuring throttling defenses hold up during brute-force, credential stuffing, or DoS assessments.

This tool is designed for security professionals to test for Server-Side Request Forgery (SSRF) vulnerabilities. It systematically probes user-controllable URL parameters to identify access to internal network services, cloud metadata endpoints (AWS/GCP/Azure), and restricted local resources. It supports various payload techniques, including protocol handlers (gopher, file), IP encoding, and DNS rebinding, making it essential for thorough security assessments and penetration testing.

Techniques for bypassing Web Application Firewalls using encoding, HTTP tricks, payload splitting, and SQLMap tamper scripts to deliver SQLi and XSS payloads during penetration tests and red-team engagements.

Agent Eval Benchmarking orchestrates repeatable CLI comparisons of coding agents like Claude Code, Aider, and Codex, collecting pass rate, cost, time, and consistency metrics on your repository tasks so you can pick the right assistant with data.

Documented guidelines for running PowerShell and CMD commands reliably on Windows, covering encoding handling, path quoting, cmdlet substitutions, dotnet CLI best practices, environment variables, long paths, and troubleshooting common shell errors.

Blueprint turns a single objective into an executable, multi-step construction plan tailored for coding agents and multi-session teams, complete with context briefs, review gates, dependency awareness, and installable via `/blueprint <project> <objective>`.