Skill UI

Analyzes a website’s HTTP security headers to identify missing or misconfigured directives, then produces a graded report with scores and recommendations for strengthening protections against common web threats.

An expert developer specializing in secure backend coding practices, vulnerability mitigation, and robust API design. Proficient in preventing common attacks such as SQL injection, XSS, and CSRF. Covers comprehensive areas including input validation, authentication mechanisms (OAuth 2.0, MFA), database security, and implementing necessary security headers (CSP, HSTS) for building secure-by-design applications. Ideal for implementing security fixes or building new, hardened backend services.

Assists with auditing HTTP headers by generating best-practice guidance, production-ready configurations, and validations triggered when header security is mentioned.

A comprehensive guide detailing security best practices for building and deploying applications on the Replit platform. Learn how to properly manage sensitive data using Replit Secrets (AES-256 encryption), implement secure service-to-service authentication via REPL_IDENTITY tokens, validate custom headers, and prevent common vulnerabilities like hardcoded API keys and SQL injection. Essential for auditing and securing production environments.

This skill guides users through implementing comprehensive security measures for Vercel deployments. It covers best practices for secret management (using sensitive environment variables), configuring critical HTTP security headers (such as CSP and HSTS), protecting preview environments, and enforcing robust access control for API routes and deployment tokens.

A command-line utility designed to search, extract, and analyze data from Burp Suite project files (.burp). It allows users to search request/response headers and bodies using complex regex patterns, extract security audit findings, or gather proxy/site map data. Essential for deep analysis of captured HTTP traffic in web security testing, while providing safeguards against large data overflows.

A comprehensive toolset for analyzing Cobalt Strike Malleable C2 profiles. It parses advanced C2 communication configurations to extract crucial Indicators of Compromise (IOCs) such as HTTP headers, DNS settings, URI patterns, and user agents. The analysis is vital for threat hunting, developing network detection signatures (Suricata/Snort), and understanding evasion techniques used by advanced persistent threats (APTs).

A comprehensive guide detailing advanced techniques for bypassing Web Application Firewalls (WAFs). It covers multiple evasion methods, including various encoding schemes (URL, Unicode, HTML entities), payload obfuscation (mixed case, comments), and manipulation of HTTP protocols (methods, headers, parameter pollution). This skill is crucial for penetration testing, red team engagements, and evaluating the robustness of perimeter security controls against sophisticated attacks like SQL Injection and XSS.

A comprehensive guide for security professionals detailing how to exploit web cache mechanisms (CDNs, reverse proxies) to inject malicious content. It covers identifying caching layers, discovering unkeyed headers (like X-Forwarded-Host), and executing poisoning attacks for authorized penetration testing.

A comprehensive guide for developers migrating between different versions of the Flexport API, specifically detailing changes from v1 to v2. It covers breaking changes in request headers, response parsing (e.g., _object to data), pagination formats, and error structures, ensuring smooth integration updates.

Provides a comprehensive production checklist specifically for WebContainer applications built using the StackBlitz SDK. This guide helps developers ensure that their web applications are robust and ready for deployment by checking essential aspects like security headers, cross-browser compatibility, and necessary fallback mechanisms.

A comprehensive guide and workflow for deploying static websites (e.g., Vue, React, Angular, Hugo, Jekyll) from a local environment to a production server using VSCode SFTP. This skill covers setting up secure SFTP connections, generating production-ready Nginx configurations (including security headers, caching, and HTTPS redirects), and providing a complete deployment checklist for smooth CI/CD-like workflows.