Skill UI

This comprehensive guide details how to implement robust webhook endpoints for CodeRabbit, an AI-powered code review tool. It covers essential security practices, including signature validation (HMAC-SHA256), and provides structured methods for handling various event types (e.g., PR reviews, check run completions, comments). Use this skill when integrating CodeRabbit into CI/CD pipelines to automate notifications, track metrics, and enforce quality gates.

Auto-activating skill provides guidance for HTTP method helper tasks, covering REST, GraphQL, OpenAPI, authentication, and API design patterns while producing production-ready code and validations.

Centralizes proven red team methodologies into an automated reconnaissance and vulnerability discovery workflow that sequences asset discovery, live host validation, fingerprinting, content hunting, and exploit surface analysis for bug bounty and defensive assessments.

An expert specialist for rigorous visual validation, focusing on UI testing, design system compliance, and WCAG accessibility verification. This skill systematically analyzes visual evidence for cross-platform consistency, pixel-perfect accuracy, and adherence to modern design standards, utilizing principles from visual regression testing and comprehensive QA methodologies.

This skill provides a comprehensive guide and methodology for identifying and exploiting Cross-Origin Resource Sharing (CORS) misconfigurations in web applications. It covers testing origin validation bypasses, analyzing preflight requests, and simulating data exfiltration during authorized penetration tests, crucial for assessing API security.

Refactors a specified method into smaller helper routines so the cognitive complexity stays below a given threshold while keeping validation, error handling, and behavior intact.

Implements approved development tasks using Test-Driven Development methodology with autonomous or manual sub-agent dispatch. Supports multiple review modes (required/inline/off) and integrates with project specifications, requirements, and design documents for comprehensive implementation validation. Automatically discovers validation commands and establishes repository baselines before execution.

A comprehensive checklist detailing advanced attack methodologies for JSON Web Tokens (JWT). Covers critical misconfigurations such as algorithm confusion (alg:none, RS256→HS256), weak secret brute forcing, header injection (kid, jku, jwk), cache poisoning, and improper validation. Also provides specific vectors for extracting JWTs from mobile environments (Android/iOS). Ideal for penetration testers conducting deep security assessments on authentication systems.

This expert playbook provides comprehensive techniques for testing Cross-Site Request Forgery (CSRF) vulnerabilities in web applications. It covers identifying state-changing endpoints, bypassing anti-CSRF tokens (including missing validation and predictable tokens), and exploiting modern weaknesses like SameSite=Lax via GET methods or misconfigured JSON APIs. Essential reading for security professionals and penetration testers.

A comprehensive guide detailing best practices for securing Quarkus applications. It covers robust authentication methods like JWT and OIDC, role-based access control (RBAC) for authorization, mandatory input validation using Bean Validation, preventing SQL injection, and secure secret management. Essential for developers building highly secure Java microservices.

This skill validates the correctness and completeness of any API request. It rigorously checks the HTTP method, URL structure, required headers, body format, authentication details, and query parameters. Use it to debug cURL commands, verify endpoint calls, or ensure API structures adhere to best practices, providing immediate, actionable feedback on required fixes.

This guide covers essential security best practices for Spring Boot applications. Learn how to implement robust authentication (JWT, OAuth2), authorization using method security, secure input validation, prevent SQL injection, manage secrets, and configure vital security headers (CORS, CSRF). Essential for building production-ready, secure Java backend services.