Skill UI

This router serves as the main entry point for comprehensive injection testing. It helps security professionals classify dangerous input flows—such as XSS, SQLi, SSRF, XXE, etc.—by determining the final sink or interpreter (e.g., browser context, database, XML parser, shell). Use it when unsure which specific injection vector to prioritize.

A comprehensive playbook detailing advanced techniques for bypassing core macOS security features, including TCC, Gatekeeper, SIP, and sandbox restrictions. This guide is essential for authorized red team operations and penetration testing targeting macOS endpoints, covering methods like direct database manipulation, extended attribute removal, and privilege escalation paths.

A comprehensive and advanced playbook for mastering SQL injection techniques. It covers critical areas including WAF bypass, out-of-band data exfiltration, second-order injection, and exploitation strategies across major database systems (MySQL, MSSQL, Oracle, PostgreSQL). Essential for professional penetration testing and security auditing.

A comprehensive pre-production audit tool that scans a codebase for critical issues across eight dimensions: security, database, deployment, code quality, AI/LLM usage, dependencies, frontend, and observability. It intercepts deployment commands, forcing users to resolve critical failures before shipping code. The audit is stack-agnostic and provides detailed pass/fail/manual reports.

This skill guides the implementation of dynamic secrets using HashiCorp Vault. It focuses on generating short-lived, ephemeral credentials for services like databases (PostgreSQL, MySQL), AWS IAM, and PKI certificates. By automating credential generation, lease management, and rotation, it eliminates the risk associated with storing long-lived static secrets, ensuring compliance with zero-trust security models (PCI-DSS, NIST).

This guide provides a comprehensive reference and usage guide for the Redis Command Line Interface (redis-cli). It covers connecting, executing commands in different modes, and offers detailed cheat sheets for all core Redis data structures (Strings, Hashes, Lists, Sets, Sorted Sets). Crucially, it also includes important security considerations and best practices, ensuring users can manage and troubleshoot Redis databases safely from the command line.

A comprehensive guide for developers working with Supabase. Covers best practices for database interaction, robust authorization using Row Level Security (RLS), secure authentication (Auth), and integrating various Supabase products (Storage, Realtime, Edge Functions). Essential for preventing common security vulnerabilities like BOLA/IDOR and ensuring data integrity across your application stack.

This comprehensive tool scans all project dependencies against databases of known CVEs (Common Vulnerabilities and Exposures) and security vulnerabilities. It is essential for conducting thorough security audits of third-party packages, ensuring code quality before major releases, or responding to specific security advisories. It provides actionable reports categorized by severity.

A comprehensive, multi-phase checklist for ensuring the quality, security, and deployment readiness of Django applications. It covers linting (ruff, mypy), unit testing (pytest), database migrations, security audits (bandit, pip-audit), and performance checks, making it an essential quality gate for CI/CD pipelines before merging or deploying to production.

A comprehensive guide to PostgreSQL best practices, covering advanced indexing (GIN, BRIN, Partial), schema design, performance tuning, and security implementation (RLS). It details optimizing common SQL patterns like cursor pagination and UPSERT, essential for building high-performance, reliable database systems.

A comprehensive guide for conducting authorized database security assessments across various platforms (PostgreSQL, MySQL, MSSQL, Mongo, Redis). Covers critical areas including exposure analysis, authentication, authorization checks, misconfiguration review, and attack chain validation, ensuring non-destructive testing practices are followed.

A comprehensive, multi-phase security scanner designed to audit development environments (Claude Code setup). It checks MCP servers, installed skills, agents, and hooks against known threat databases, malicious patterns, and supply chain vulnerabilities. Key checks include CVE screening, prompt injection detection, and unauthorized network access patterns.