Skill UI

This skill provides comprehensive strategies for handling rate limits when interacting with the Webflow Data API v2. It covers using SDK built-in retries, implementing custom exponential backoff with jitter, controlling concurrency using request queues, and optimizing calls with bulk endpoints (e.g., createItemsBulk). Use this guide when encountering 429 errors or when maximizing API throughput is critical for robust applications.

This skill provides a detailed guide on extending the Webiny Command Line Interface (CLI) by implementing custom commands. It utilizes the `CliCommandFactory` pattern to define structured commands, manage typed parameters, and execute complex logic. Use cases include automating data migrations, generating boilerplate code, executing custom deployment workflows, and performing CMS content exports.

Master the art of automating Adobe Illustrator using ExtendScript (JavaScript/JSX). This comprehensive skill covers the entire Illustrator Document Object Model (DOM), enabling programmatic control over layers, paths, text frames, colors, and artboards. Ideal for scripting complex workflows, data-driven artwork generation, batch processing, and automating print and export tasks.

This skill performs a proactive, comprehensive audit to quantify the business and regulatory impact of a potential data breach before it occurs. It inventories sensitive data (PII, PHI, PCI-DSS), traces complex data flows through the codebase, identifies all exposure vectors, and calculates the 'blast radius.' The output provides law-sourced figures (e.g., GDPR, CCPA, HIPAA fine maximums) alongside heuristic risk estimates, guiding proactive hardening roadmaps for compliance and security.

This skill provides a structured workflow for developing and modifying content management systems (CMS), applicable to platforms like WordPress, Shopify, and Drupal. It covers crucial architectural seams, including theme and template design, plugin/module development, content modeling, media asset pipelines, and static export processes, ensuring changes maintain structural integrity.

Performs a comprehensive external audit of a deployed repository's state, going beyond simple code review. It checks for critical production gaps, including RLS misconfigurations, webhook idempotency issues, secret exposure, deployment health, and prompt injection vulnerabilities. Ideal for pre-launch gates and ensuring code stability before going live.

A practical offensive methodology for Android and iOS app testing. It covers static analysis, Frida/Objection instrumentation, SSL pinning bypass, exported component abuse, insecure storage review, and mobile API reconnaissance for pentest and bug bounty work.

Methodology for assessing WPS-enabled routers using Pixie Dust offline recovery, online PIN brute force, lockout handling, and PBC edge cases. Useful for wireless security testing and understanding WPS exposure on consumer APs.

A comprehensive playbook for expert-level Android application security testing. It covers advanced exploitation techniques, including SSL pinning bypass (using Frida/Objection), detecting component exposure (activities, providers, services), and exploiting WebView vulnerabilities (RCE, XSS). Essential for authorized mobile penetration testing assessments.

This comprehensive playbook guides security testers through deep API authorization checks, focusing specifically on BOLA (Broken Object Level Authorization) and BFLA (Broken Function Level Authorization). Use this skill to test scenarios where object identifiers, nested resources, or privileged functions are exposed, ensuring thorough checks for mass assignment and privilege escalation.

This skill details advanced techniques for exploiting formula injection vulnerabilities within CSV, Excel, LibreOffice, and Google Sheets environments. It covers DDE, obfuscation methods, and high-risk functions like IMPORT* that can be triggered when user-controlled data is exported or imported into spreadsheet software. Use this for penetration testing of data pipelines and export features.

A comprehensive playbook detailing expert techniques for exploiting common network services (such as Redis, Rsync, PHP-FPM, AJP, etc.) when they are exposed without proper authentication or weak access controls. This guide covers various methods including RCE, data theft, and file reading, crucial for advanced penetration testing and infrastructure security assessments.