Skill UI

This comprehensive catalog provides essential abstractions for securing web APIs. It covers the entire lifecycle of authentication, including handling roles, users, and teams. Features include robust mechanisms for managing API keys (before/after events) and dedicated use cases for user and role creation/deletion, ensuring highly scalable and secure backend development.

This guide provides comprehensive troubleshooting and error handling documentation for integrating the Wispr Flow voice-to-text API. It covers common issues across WebSocket streaming, REST API calls, and general dictation workflows. Users will learn how to address errors like 'Unauthorized' keys, network disconnections, and poor accuracy by utilizing best practices for context setting and API reconnection strategies.

This guide provides essential security and technical guidance for integrating Wispr Flow's voice-to-text API. It covers best practices for authentication (API keys, access tokens), utilizing streaming methods like WebSockets, handling common API errors, and optimizing context awareness for high-accuracy transcription in various applications.

Manage global n8n instances, runtime state, tunnels, API keys, credentials, projects, and workflow presentation links. Useful for setting up local Docker, connecting remote instances, and controlling n8n execution environments.

A comprehensive playbook for security testing APIs relying on JWT, bearer tokens, or API keys. It covers token validation weaknesses (e.g., 'alg:none', RS256 confusion), claim misuse, header spoofing, rate limit bypass, and mass assignment vulnerabilities. Ideal for penetration testers assessing authentication boundaries.

HTTP Parameter Pollution (HPP) occurs when a single request contains multiple instances of the same parameter key. Different components in the request path (e.g., WAFs, proxies, application frameworks) may parse these duplicate keys using different rules (first value, last value, array join). This skill teaches how to exploit these discrepancies to bypass security checks, execute SSRF, or manipulate business logic.

This skill generates comprehensive Entity Relationship Diagrams (ERDs) and database schemas as D2 source code from an existing Entity Framework Core codebase. It analyzes DbContexts, DbSet declarations, Fluent API mappings, and migrations to accurately visualize tables, columns, primary/foreign keys, relationships (including many-to-many joins), owned types, and constraints. The output is a structured .d2 file, suitable for rendering into SVG or PNG, helping developers document the persistence model.

Provides comprehensive, programmatic control over tmux sessions. Users can list, capture output from, send specific keystrokes, and programmatically navigate panes/windows in remote, long-running interactive CLI sessions. Essential for monitoring AI code generation tools (like Claude/Codex) or managing complex multi-terminal workflows via scripting.

This guide outlines a comprehensive workflow for detecting and preventing the exposure of sensitive AWS credentials (access keys, session tokens) within source code repositories, CI/CD pipelines, and configuration files. It utilizes TruffleHog for deep historical scanning and integrates git-secrets for robust pre-commit hooks, significantly reducing the risk of credential theft and unauthorized account access.

This technique exploits the Active Directory attribute `msDS-KeyCredentialLink` by injecting attacker-controlled public keys (Shadow Credentials). Using tools like pyWhisker and Certipy, the attacker forces the target account to register a new key. Subsequently, by leveraging PKINIT (Public Key Cryptography for Initial Authentication in Kerberos), the attacker can obtain a service ticket and recover the target's NT hash, achieving a stealthy, password-less, complete account takeover.

Plaso (log2timeline) is an open-source engine used to generate forensic super-timelines. This skill guides the process of normalizing hundreds of diverse artifact types—including MACB times, registry keys, EVTX logs, and browser history—into a single, cohesive chronological view. The workflow covers extraction, filtering, and importing the timeline into Timesketch for collaborative analysis, which is crucial for incident response, correlating complex activity chains, and detecting anti-forensic techniques like timestomping.

This guide provides a structured approach to red-teaming Large Language Models (LLMs) to detect sensitive data leakage from system prompts. It simulates advanced attacks—including prompt injection, instruction override, and encoding tricks—to identify embedded secrets, API keys, and proprietary business logic. Essential for validating adherence to OWASP LLM07 and securing AI applications against data exfiltration.