Skill UI

A comprehensive, 10-phase methodology for authorized security assessment of modern APIs, including REST, GraphQL, WebSocket, and SOAP. This guide covers the entire testing lifecycle—from endpoint discovery and authentication bypass (JWT/OAuth 2.0) to sophisticated authorization flaws (BOLA/IDOR/BFLA), input validation, rate limiting, and CI/CD integration testing.

This skill provides a comprehensive checklist for auditing de-identified Protected Health Information (PHI) against the 18 categories required by HIPAA Safe Harbor (45 CFR 164.514(b)(2)). It maps detected PII entities to these categories, identifies gaps (e.g., age > 89, rare geography), and guides the assessment of residual re-identification risk. This is essential for proving the completeness and compliance of de-identification efforts.

A specialized downstream skill for complex CTF challenges, focusing on cryptographic analysis, steganography, and mobile system forensics. It guides the user through recovering complex data chains, such as decoding blobs, tracing cryptographic transforms (keys, IVs, nonces), inspecting hidden media payloads, and analyzing mobile trust boundaries (e.g., APK/IPA signing logic, local storage, SSL pinning). This skill is designed to be used only after a main sandbox orchestrator has established the operational context.

A specialized skill for detecting discrepancies (drift) between declared API contracts (such as GraphQL schemas, OpenAPI specs, and RPC manifests) and the actual behavior of live backend handlers. It is used to identify hidden operations, contract mismatches, or vulnerabilities resulting from schema evolution, versioning skew, or implementation gaps. Must be used after initial sandbox assumptions are established.

The Diagram Generator converts complex, unstructured inputs—such as natural language, code snippets, schemas, and notes—into professional, editable visual diagrams. It supports diverse standards including Mermaid, PlantUML, and Graphviz, enabling the creation of flowcharts, sequence diagrams, UML models, ER diagrams, architecture maps, and more. Outputs are designed to be reviewable, version-controllable, and highly precise.

Integrate SharePoint Online sites, lists, and document libraries into Power Apps projects. Supports list discovery, creating new lists, and configuring the SharePoint connector using CLI and Microsoft Graph APIs.

Generates cryptographically-stamped, bar-compliant time entries and printable HTML audit packets from Claude Code session logs. Deterministic narratives, attorney signoff workflow, multi-jurisdiction disclosure support, strict audit invariants. Never auto-bills.

Turns one-shot external recon into a continuous monitoring program: scheduled re-scan-and-diff loop, adversary CTI chatter monitoring across six feeds, finding-lifecycle state machine with SLA and alert dedup, durable alert outbox, and cron recipes. For retainer/MSSP engagements to detect perimeter drift and telegraphed alerts.

Design branching dialogue and narrative graphs with conditions, variables, and localization hooks, and choose between Ink, Yarn Spinner, or a custom data-driven runner. Engine-neutral guidance for wiring conversations into a game loop.

A comprehensive guide to writing custom shaders in Godot 4.x using the Godot Shading Language. Learn to create advanced 2D (canvas_item) and 3D (spatial) visual effects, implement post-processing using screen textures, and manage uniforms and animations. Covers the core workflow, built-in functions, and common pitfalls for high-performance graphics.

Covers advanced API exploitation methodologies, focusing on business logic abuse, API call chaining, and sophisticated attack patterns that bypass traditional security controls. Topics include GraphQL abuse (batching, introspection), JWT manipulation (algorithm confusion), race conditions, and identifying API key leakage. This guide is designed for authorized penetration testers targeting deep-seated, logic-layer vulnerabilities.

A systematic methodology for performing offensive cryptographic analysis. This skill focuses on identifying and exploiting flaws arising from the misuse of cryptographic primitives in real-world applications, rather than breaking the underlying math. Techniques covered include Padding Oracle Attacks (CBC), ECB block manipulation, Hash Length Extension, RSA weaknesses, and PRNG exploitation. Ideal for penetration testing and deep security auditing.