Skill UI

This catalog provides core abstractions and hooks for robust security management in administrative applications. It includes essential tools for handling identity context, user authentication flows (login/logout), and granular authorization checks. Developers can use these components to build secure, feature-rich administrative panels with reliable access control.

This guide details how to integrate Auth0 as an external Identity Provider (IDP) for Webiny, replacing the default Cognito authentication. It involves creating an API config class to map Auth0's JWT claims to Webiny identities and implementing a React extension component. Users must set environment variables (AUTH0_ISSUER, AUTH0_CLIENT_ID) and register the necessary extensions for successful OIDC authentication flow.

This skill guides developers on integrating Okta as an external Identity Provider (IDP) for Webiny. It replaces default authentication methods (like Cognito) by utilizing the OpenID Connect (OIDC) standard. The process involves setting up an API configuration class to map Okta's JWT claims to Webiny identities, and creating a React extension component to wire the issuer URL, client ID, and configuration path, enabling seamless Single Sign-On (SSO) using Okta.

This pattern provides a robust method for extending and customizing existing GraphQL APIs. Developers can implement `GraphQLSchemaFactory` to add custom root queries and mutations, injecting complex business logic and use cases directly into the API layer. It fully supports per-resolver dependency injection (DI), ensuring that every resolver has access to critical request-scoped context, such as identity and tenancy, making it ideal for building modular, enterprise-grade backend services.

This guide explains the universal Dependency Injection (DI) pattern used across all Webiny extensions (API, Admin, CLI, Infrastructure). It details how to correctly implement constructor injection using the `dependencies` array to access core services like Logger, BuildParams, CMS use-cases, and IdentityContext. Mastering this pattern is crucial for building maintainable, type-safe, and cohesive Webiny extensions.

Methodology for red team testing of on-prem Active Directory, hybrid AD/Entra ID, and ADCS. Covers reconnaissance, credential abuse, privilege escalation, lateral movement, persistence, trust abuse, and Defender for Identity evasion.

This guide serves as the core entry point for comprehensive security testing of identity and access control mechanisms. It is designed to help testers systematically identify vulnerabilities across login flows, session management, object authorization (IDOR), and modern protocols like JWT, OAuth, CORS, and SAML. Use this when planning security audits for any web application with user accounts.

A comprehensive playbook for testing security flaws in OAuth 2.0 and OpenID Connect (OIDC) implementations. Use this guide to systematically check for misconfigurations in redirect URI handling, state and nonce validation, PKCE enforcement, token audience/issuer checks, and account binding vulnerabilities. Essential for reviewing applications linked to external identity providers.

This specialized agent allows applications to programmatically join, monitor, and leave live video conferences. It reads real-time events visible to the current identity, such as participants joining/leaving, speaking, chatting, and screen sharing. It is ideal for querying what happens during an active meeting or identifying the correct active meeting IDs. Note: It does not handle post-meeting tasks like transcriptions or recordings.

A comprehensive guide for integrating Microsoft Graph SDK into applications. It covers accessing Microsoft 365 data (users, mail, calendar, Teams, SharePoint) from various languages (.NET, Python, TypeScript). Key topics include robust authentication patterns (Managed Identity, OBO), advanced data retrieval techniques like pagination, delta queries, batch requests, and setting up change notifications via webhooks. Learn best practices for secure and efficient API interaction.

Analyzes any frontend codebase (React, Vue, Svelte, Angular, plain CSS, Tailwind) to document the complete design system. It extracts crucial visual elements—including color palettes, typography, spacing scales, and component patterns—directly from source files, without needing to build, render, or run the application. Ideal for design audits, visual language documentation, or migrating a project's identity into a design tool.

This skill guides the verification of software build provenance and signatures using industry standards like SLSA and Sigstore. It leverages tools like cosign and slsa-verifier to enforce keyless OIDC identity and confirm that artifacts were built by trusted sources without tampering. It is essential for hardening CI/CD pipelines and securing the entire software supply chain against advanced attacks.