Skill UI

Hardens GitHub Actions workflows by pinning actions to SHAs, limiting GITHUB_TOKEN permissions, shielding secrets, blocking script injection, and enforcing reviewer approvals so CI/CD pipelines resist supply-chain and privilege attacks.

Automates mass-assignment checks by injecting privileged properties (role, balance, pricing, permissions) into writable JSON/XML API endpoints so security teams can verify OWASP API3 Broken Object Property Level Authorization defenses and spot auto-binding vulnerabilities.

Structured guidance for penetration testers to map and manipulate workflows, pricing, and permissions manually when automated scanners miss business logic flaws in e-commerce, finance, or multi-step web applications.