Skill UI

A comprehensive guide and skill for building robust, production-ready REST API endpoints. This skill covers full lifecycle development, including input validation, centralized error handling, authentication/authorization checks, CRUD operations, pagination, and generating proper API documentation. It ensures that back-end services are secure, scalable, and adhere to industry best practices.

This skill provisions instant, temporary PostgreSQL databases via Neon. It eliminates the need for user sign-up, logins, or credit cards, making it ideal for rapid local development, API prototyping, and isolated testing environments. Supports multiple methods including REST API calls, CLI commands, and SDK integration.

A robust, production-grade REST API gateway designed to wrap ComfyUI servers. It provides comprehensive features including workflow templating, job queuing (with priorities), webhooks, result caching, authentication, and rate limiting. It transforms ComfyUI into a universal, scalable, and secure service for automated image generation pipelines.

A comprehensive set of architectural patterns for building robust and maintainable HTTP servers using Kotlin Coroutines and the Ktor framework. It covers essential topics including REST routing DSL, plugin configuration (Authentication, CORS, StatusPages), Dependency Injection (Koin), serialization, WebSockets, and integration testing using testApplication.

A comprehensive utility designed to assess the security posture of modern APIs, including REST, GraphQL, and gRPC. It strictly follows the OWASP API Security Top 10 framework, testing for critical vulnerabilities such as Broken Object/Function Level Authorization (BOLA/BFLA), SQL/NoSQL injection flaws, and weaknesses in authentication mechanisms like JWT manipulation. Essential for security engineers and penetration testers validating complex microservice architectures and API gateways.

A specialized security testing skill designed to identify excessive data exposure in REST or GraphQL APIs, adhering to OWASP API3:2023 guidelines. It works by intercepting raw API responses and systematically comparing the returned data against what the frontend UI actually displays. This helps auditors detect leaked PII, internal identifiers, debug fields, or other sensitive business data that should have been filtered out by the endpoint response. Use cases include auditing microservice boundaries, assessing mobile API responses designed for multiple clients, and verifying proper respons...

This guide provides a comprehensive methodology for identifying and exploiting Insecure Direct Object Reference (IDOR) vulnerabilities in web applications and APIs. It teaches testers how to systematically manipulate object identifiers (such as numerical IDs, UUIDs, or slugs) within API requests and URLs. Techniques involve using advanced tools like Burp Suite's Authorize extension to test object-level access control, validating both horizontal (same privilege) and vertical (different privilege) access restrictions during authorized penetration tests or bug bounty engagements.

A specialized skill for discovering and exploiting Mass Assignment vulnerabilities (autobinding) in REST APIs. It guides the injection of unexpected or hidden parameters (such as role or isAdmin) into create/update requests. This technique is crucial during API security assessments to test for privilege escalation, authorization bypass, and unintended parameter binding in ORM-backed endpoints (e.g., Rails, Django).

This guide details implementing comprehensive API security using Google Apigee. It covers multiple advanced policies, including JSON/XML content validation, regex injection detection (SQLi, XSS), rate limiting (SpikeArrest), and robust OAuth 2.0 enforcement. Use this when shielding critical APIs from OWASP API Top 10 threats and malicious client abuse patterns.

This skill uses the Thinkst Canary REST API to programmatically deploy and monitor various tripwire mechanisms, including web bugs, DNS tokens, MS Word documents, and AWS API keys. It is designed for early breach detection by simulating attacker activity and generating comprehensive deception coverage reports and alert histories.

This skill automates the entire phishing incident response lifecycle using the Splunk SOAR REST API. It processes reported emails, extracts indicators of compromise (IOCs) like URLs and IPs, creates incident containers, attaches artifacts, and triggers automated playbooks for deep analysis and reporting. It is essential for security operations teams needing robust, programmatic incident handling and compliance alignment.

This guide details how to integrate OWASP ZAP (Zed Attack Proxy) into CI/CD pipelines (GitHub Actions/GitLab) for comprehensive Dynamic Application Security Testing (DAST). It covers configuring baseline, full, and API scans to identify common vulnerabilities like XSS, SQLi, and CSRF in running web applications and REST/GraphQL APIs, ensuring security quality gates in the development lifecycle.