Skill UI

A comprehensive methodology for conducting deep security assessments and penetration tests against GraphQL APIs. This guide covers the entire attack lifecycle, including endpoint discovery, blind schema reconstruction, authentication/authorization bypass, SQL/NoSQL injection, Denial of Service (DoS) via depth bombs, and abusing advanced features like file uploads and subscriptions. It provides actionable steps and tool guidance for professional security researchers and ethical hackers.

This comprehensive checklist details how to test for XML External Entity (XXE) injection vulnerabilities. It covers classic, blind, error-based, and out-of-band techniques, enabling testers to identify weaknesses in XML parsers. The methodology includes finding various injection points (e.g., file uploads, SOAP/REST endpoints) and exploiting potential risks like file disclosure, SSRF, and DoS. Use this guide for robust web application security testing and bug bounty hunting.

This skill automates the migration of existing frontend code (including React, Vue, Angular, and Next.js components) into a structured Stitch Design. It orchestrates the extraction of a self-contained HTML file, analyzes the source code to build a comprehensive design system document, and finally uploads both assets into your Stitch project for iteration and improvement.

Neon Object Storage provides S3-compatible, branch-aware object storage directly integrated with your Neon Postgres project. It ensures that files (images, documents, user uploads) remain perfectly synchronized with the database schema across all development branches (dev, preview, staging, production). Use this skill when you need a single backend for both database rows and file assets, eliminating the need for separate cloud storage providers.

Adds existing Dataverse tables to Power Apps code apps with generated TypeScript models and services, or creates new Dataverse tables via API. Supports schema planning, dependency ordering, CRUD, and file/image uploads. Use when connecting to Dataverse or querying table data.

Specialist in secure file uploads and cloud storage management. Covers S3, R2, presigned URLs, and multipart uploads. Implements magic byte validation to prevent malware and path traversal attacks. Optimizes large file streaming to avoid blocking.

Authorized-use hunting guide for XXE vulnerabilities: maps XML entry points, tests file uploads, SAML and SOAP endpoints, then escalates from inline file read to blind out-of-band exfiltration, SSRF pivoting and internal service access.

Handle n8n files and binary data across uploads, downloads, transforms, multimodal inputs, agent tools, and chat surfaces. Covers where binary lives, how to read/write it, preventing data loss, and the AI-agent tool boundary.