Skill UI

This skill manages complex coding tasks from initial implementation through testing, review incorporation, deployment, and final runtime verification. It ensures the task meets explicit Definition of Done (DoD) criteria iteratively, minimizing the need for manual prompting across multiple development stages.

This skill provides methods for reliably extracting typed, validated, and structured data from Large Language Models (LLMs), moving beyond simple text parsing. It covers best practices across major APIs (OpenAI's response_format, Anthropic's tool_use, Google's responseSchema) and local models. Key workflows include defining schemas (Pydantic/Zod), implementing constrained decoding, and building robust retry loops for production-grade data pipelines.

A forensic tool for performing post-mortem analysis on AI-assisted coding sessions. It goes beyond simply stating what was done, determining *why* work deviated (e.g., spec ambiguity, repo friction, agent error), identifying scope creep, and classifying rework patterns. It provides evidence-backed recommendations to improve prompts, codebase health, and future development workflows.

AWT provides AI coding tools with the ability to perform sophisticated End-to-End (E2E) web testing using a real browser. It accepts declarative YAML scenarios and executes them via Playwright. Key features include visual matching (OpenCV + OCR) instead of relying on fragile DOM selectors, automatic platform detection (React, Vue, etc.), and structured failure diagnosis for improved AI coding workflows.

Unpacks layered JavaScript obfuscation used in web attacks by extracting scripts, neutralizing anti-analysis tricks, and decoding string and control-flow hiding so analysts can recover the original malicious logic during phishing, skimmer or dropper investigations.

Guides authorized security testers through detecting and exploiting HTTP request smuggling when front- and back-end servers disagree on Content-Length vs Transfer-Encoding, covering architecture checks, automation tools, and impact scenarios.

Guide for writing YAML-based Semgrep rules to detect app-specific vulnerabilities, enforce coding standards, and plug into CI/CD for continuous SAST assurance across multiple languages.

Evaluates API rate limiting controls for bypass vulnerabilities by probing headers, IPs, methods, versions, and encodings, ensuring throttling defenses hold up during brute-force, credential stuffing, or DoS assessments.

This tool is designed for security professionals to test for Server-Side Request Forgery (SSRF) vulnerabilities. It systematically probes user-controllable URL parameters to identify access to internal network services, cloud metadata endpoints (AWS/GCP/Azure), and restricted local resources. It supports various payload techniques, including protocol handlers (gopher, file), IP encoding, and DNS rebinding, making it essential for thorough security assessments and penetration testing.

Techniques for bypassing Web Application Firewalls using encoding, HTTP tricks, payload splitting, and SQLMap tamper scripts to deliver SQLi and XSS payloads during penetration tests and red-team engagements.

Agent Eval Benchmarking orchestrates repeatable CLI comparisons of coding agents like Claude Code, Aider, and Codex, collecting pass rate, cost, time, and consistency metrics on your repository tasks so you can pick the right assistant with data.

This guide assists developers in designing and architecting Model Context Protocol (MCP) servers that integrate deeply with LLMs like Claude. It is not a coding skill, but a comprehensive consultation process that guides users through use case interrogation, determines the optimal deployment model (e.g., Remote HTTP, MCPB), and selects the appropriate tool-design pattern for seamless, robust integration.