Skill UI

Guides API developers through automatic response schema generation, offering best practices, code/configuration samples, and validation to keep REST, GraphQL, or OpenAPI responses compliant.

A comprehensive guide and setup for building a fast, reliable local development workflow for language learning applications. It includes setting up mock tutor responses for offline testing, generating audio test fixtures using TTS, and implementing a debug mode for detailed pronunciation scoring analysis. Ideal for engineers setting up a new Speak-based integration or refining existing test pipelines.

Validates API contracts using Pact and OpenAPI, generating consumer-driven contract tests, verifying responses, and ensuring backward compatibility for CI/CD workflows.

This skill validates API responses against predefined schemas, including OpenAPI and JSON Schema, to ensure strict contract compliance and data integrity. Use it for implementing robust contract tests in middleware or CI/CD pipelines, detecting schema drift, and guaranteeing backward compatibility across API versions.

Automatically checks application metrics such as load times, bundle sizes, and API responses against predefined performance budgets, surfacing regressions and preventing slippage before deployments—ideal for CI/CD workflows.

This skill answers technical questions about a codebase by grounding all responses strictly within the provided source files. It is ideal for users who need to understand how a specific function works, locate definitions, or gain an overview of a component's implementation. All answers include inline citations to ensure accuracy and traceability.

MolyKit is a comprehensive toolkit designed for building robust, cross-platform AI chat applications. It provides core utilities for integrating large language models (LLMs) like OpenAI, handling real-time SSE streaming responses, and managing complex cross-platform asynchronous patterns (PlatformSend, spawn()). The kit includes ready-to-use widgets for messages, prompt inputs, and avatars, making it ideal for developers creating sophisticated, multilingual chat experiences.

This skill provides methods for reliably extracting typed, validated, and structured data from Large Language Models (LLMs), moving beyond simple text parsing. It covers best practices across major APIs (OpenAI's response_format, Anthropic's tool_use, Google's responseSchema) and local models. Key workflows include defining schemas (Pydantic/Zod), implementing constrained decoding, and building robust retry loops for production-grade data pipelines.

This tool helps detect Broken Object Property Level Authorization (BOPLA) vulnerabilities, which are critical security flaws detailed in OWASP API3:2023. It scans APIs for excessive data exposure (reading sensitive fields) and mass assignment risks (modifying unintended properties) by simulating malicious requests and analyzing responses. Ideal for security testing, threat hunting, and implementing robust API security controls.

This skill guides security testers in identifying excessive data exposure in REST and GraphQL APIs. It involves intercepting API responses and analyzing them for leaked Personally Identifiable Information (PII), internal identifiers, or sensitive business data that the client UI does not display but the API transmits. It maps directly to OWASP API3:2023 Broken Object Property Level Authorization, helping prevent data leaks via over-fetching.

This skill covers implementing robust API rate limiting and throttling controls using advanced algorithms like token bucket and sliding window. It teaches how to protect backend systems against attacks such as brute force, credential stuffing, and resource exhaustion. Key components include configuring limits per user, per IP, and per endpoint, utilizing Redis for distributed counting, and implementing proper HTTP 429 responses for effective abuse prevention.

A comprehensive guide for performing security assessments to identify various forms of sensitive data exposure, such as leaked API keys, PII in API responses, insecure client-side storage, and unprotected data transmission. This workflow covers scanning JavaScript files, analyzing API responses, verifying data encryption, and examining browser storage.