Skill UI

A comprehensive playbook for bypassing 401/403 Forbidden errors. Covers advanced techniques like path normalization tricks (encoding, traversal), HTTP method tampering, IP spoofing headers, and protocol downgrade attacks. Essential knowledge for penetration testing and security auditing.

This expert playbook details advanced techniques for converting an arbitrary memory write primitive into full Remote Code Execution (RCE). It covers targeting multiple system structures across different glibc versions, including GOT entries, __malloc_hook, __free_hook, _IO_FILE vtables, and function arrays. Essential for exploiting modern, hardened binaries and mastering advanced binary exploitation.

The Desktop Commander MCP grants agents deep reach across the user's entire operating environment, extending far beyond the typical IDE sandbox. Key capabilities include maintaining persistent shell sessions, managing long-running background processes, accessing arbitrary filesystems, and natively handling structured data formats (Excel, PDF, DOCX). It also enables remote operations via SSH and large-scale content search, making it ideal for complex, multi-turn development, DevOps, and data analysis workflows.

A comprehensive playbook for testing XSLT injection vulnerabilities. This guide details advanced attack chains, starting with processor fingerprinting (Java, PHP, .NET, libxslt). It covers critical vectors including XXE (External Entities), Server-Side Request Forgery (SSRF) via document(), arbitrary file writing (EXSLT), and achieving Remote Code Execution (RCE) through language-specific extensions.

This meta-skill runs three independent code reviewers—safety, test coverage, and style—in parallel over the current uncommitted diff. It then arbitrates a single, authoritative verdict (BLOCK, BLOCK_WITH_OVERRIDE, or PASS_WITH_NOTES) based on strict priority rules, offering a comprehensive second opinion before committing code.

A powerful meta-skill that enforces rigorous security compliance by running three independent gates on a proposed operation: policy/governance review, secret/credential scanning, and audit log emission. It uses a strict arbitration rule (DENY > WARN > ALLOW) to provide a comprehensive safety verdict for code changes or environment manipulations. Ideal for enforcing high-security coding standards.

This skill guides the entire development lifecycle for reusable, interactive Power BI custom visuals (.pbiviz). Using TypeScript and the pbiviz toolchain, developers can scaffold, implement the IVisual interface, manage complex formatting models, perform live preview, package the asset, and certify/publish the visual to AppSource.

Design responsive game cameras: 2D smooth follow with deadzone, look-ahead, and level-bounds clamping; 3D third-person orbit with collision push-in; first-person look; multi-target framing; and a shake hook. Use with any engine or camera rig system.

A comprehensive AI sparring partner designed to prepare lawyers for high-stakes adversarial proceedings, such as oral arguments, depositions, or hearings. It profiles judges/arbitrators based on their prior opinions and questions, predicts likely lines of questioning, maps narrow 'escape routes' they can take, and simulates relentless, real-time adversarial questioning to sharpen arguments until only the strongest answers survive.

This skill covers setting up a foundational Three.js scene. It includes configuring import maps, initializing the Scene, PerspectiveCamera, and WebGLRenderer trio, establishing a responsive render loop, and adding OrbitControls. Use this when bootstrapping a new Three.js application or debugging rendering issues like blank canvases. It excludes model loading and material lighting setup.

Identify and exploit file path traversal vulnerabilities to read arbitrary server files. Used in security assessments to test web application security against directory traversal attacks.

Direct advanced Three.js camera systems for scale-aware chase rigs, thrust lag, side/orbit cameras, body-relative up vectors, quaternion handoffs, authored cinematic framing, floating origins, pointer-look controls, camera collision constraints, projection ownership, and lifecycle restoration.