Skill UI

This skill guides the development of robust, security-focused full-stack web applications. It ensures layered security coverage across the entire application stack, from database queries (parameterized queries) to API endpoints (authentication/authorization) and frontend components (input validation, output encoding). Use this when building end-to-end features, microservices, or REST APIs that require simultaneous attention to Frontend, Backend, and Security best practices.

Automated fuzz testing of APIs via the /fuzz-api command to inject malformed, boundary, and random payloads, spotting crashes, SQL injection, XSS, and validation gaps during vulnerability scanning or security reviews.

This guide details how to implement Role-Based Access Control (RBAC) for Perplexity API in enterprise environments. Since Perplexity lacks native RBAC, the solution involves building a middleware gateway. This gateway enforces granular policies, including team-specific API key usage, model restriction (e.g., limiting access to 'sonar' only), budget caps, rate limiting, and mandatory search domain filtering for compliance and security.

A comprehensive guide for configuring and managing organizational access control in Replit Enterprise. This skill covers defining role hierarchies (Owner, Admin, Manager, Editor, Viewer), implementing custom groups, integrating Single Sign-On (SSO/SAML), restricting deployment permissions (Production/Staging), and setting up detailed audit logging. Use this when securing a large development team, setting up strict security policies, or performing quarterly access reviews.

Guides Spring Boot 3.x engineers through configuration scaffolds, REST controllers, Spring Security 6 authentication flows, Spring Data JPA repositories, and reactive WebFlux endpoints, making it easier to build microservices and Java REST APIs.

Provides comprehensive expertise for building robust WordPress sites. Specializing in custom theme and plugin development, implementing modern Gutenberg blocks, extending WooCommerce functionality, and managing the WordPress REST API. Core focus areas include advanced security hardening (nonces, sanitization, capability checks), performance optimization (caching, query tuning), and adhering strictly to WordPress coding standards.

This guide provides a deep, investigation-driven methodology for reviewing Django and Django REST Framework (DRF) codebases. It helps identify critical authorization gaps, focusing on Insecure Direct Object References (IDOR) and object-level access failures. Learn how to trace data flows, analyze custom managers, and verify that users can only access resources they are explicitly authorized to view or modify.

A comprehensive utility designed to assess the security posture of modern APIs, including REST, GraphQL, and gRPC. It strictly follows the OWASP API Security Top 10 framework, testing for critical vulnerabilities such as Broken Object/Function Level Authorization (BOLA/BFLA), SQL/NoSQL injection flaws, and weaknesses in authentication mechanisms like JWT manipulation. Essential for security engineers and penetration testers validating complex microservice architectures and API gateways.

This skill uses the Python azure-mgmt-storage SDK to perform comprehensive security audits on Azure Blob and ADLS storage accounts. It detects critical misconfigurations, including public access exposure, weak or long-lived SAS tokens, lack of encryption at rest, failure to enforce HTTPS, and outdated TLS versions. The output is a detailed, risk-scored report with remediation recommendations, essential for SOC analysts and security posture management.

This skill guides security testers in identifying excessive data exposure in REST and GraphQL APIs. It involves intercepting API responses and analyzing them for leaked Personally Identifiable Information (PII), internal identifiers, or sensitive business data that the client UI does not display but the API transmits. It maps directly to OWASP API3:2023 Broken Object Property Level Authorization, helping prevent data leaks via over-fetching.

A detailed guide on discovering and exploiting Mass Assignment vulnerabilities in REST APIs. Users learn to inject unexpected parameters into API requests (POST, PUT, PATCH) to bypass authorization controls, escalate privileges (e.g., changing 'role'), and modify sensitive fields (e.g., 'balance', 'isAdmin') during security assessments and bug bounty hunting.

This guide details how to implement multi-layered API threat protection using Google Apigee. It covers critical security policies including JSON/XML content validation, OAuth 2.0 enforcement, SpikeArrest rate limiting, and advanced regex patterns to defend against OWASP Top 10 threats. Ideal for establishing robust API security controls and meeting compliance requirements.