Skill UI

Generates high-quality, deterministic, and editable vector diagrams (SVG) for system architecture, workflows, and pipelines. By using a structured JSON specification (FigureSpec), it ensures that the same input always yields the identical output, making it ideal for reproducible technical documentation, academic papers, and formal system modeling where precise layout and connections are critical. It is optimized for non-data-plot, formal diagrams.

A guide and toolkit for optimizing Grammarly API costs in large-scale applications. It addresses common cost overruns associated with high text volume by implementing strategies such as result caching, chunking long documents, sample-based scoring, and setting usage budget alerts. Use this when integrating Grammarly into enterprise workflows or managing billing for high-volume content analysis.

A comprehensive checklist for ensuring Intercom integrations are robust and production-ready. It covers critical areas such as authentication, error handling (rate limits, retries), secure webhook validation, data privacy (PII, GDPR), and monitoring setup. Includes sample TypeScript and Bash scripts for pre-flight verification and graceful rollback procedures.

A comprehensive guide to securing Navan integrations and API access. This skill covers OAuth 2.0 best practices, secure credential storage, automated credential rotation, configuring Single Sign-On (SSO) via SAML/OpenID Connect, and implementing automated user lifecycle management using SCIM provisioning. Essential for hardening enterprise-level integrations.

This guide serves as the core entry point for comprehensive security testing of identity and access control mechanisms. It is designed to help testers systematically identify vulnerabilities across login flows, session management, object authorization (IDOR), and modern protocols like JWT, OAuth, CORS, and SAML. Use this when planning security audits for any web application with user accounts.

This expert playbook provides comprehensive techniques for testing Cross-Site Request Forgery (CSRF) vulnerabilities in web applications. It covers identifying state-changing endpoints, bypassing anti-CSRF tokens (including missing validation and predictable tokens), and exploiting modern weaknesses like SameSite=Lax via GET methods or misconfigured JSON APIs. Essential reading for security professionals and penetration testers.

HTTP Parameter Pollution (HPP) occurs when a single request contains multiple instances of the same parameter key. Different components in the request path (e.g., WAFs, proxies, application frameworks) may parse these duplicate keys using different rules (first value, last value, array join). This skill teaches how to exploit these discrepancies to bypass security checks, execute SSRF, or manipulate business logic.

This skill provides a comprehensive playbook for testing the security of SAML-based Single Sign-On (SSO) solutions. It focuses on validating assertion trust by checking signature coverage, audience and recipient restrictions, handling of Assertion Consumer Service (ACS), and identifying potential XML parsing weaknesses or IdP/SP confusion flaws. Use this when evaluating enterprise authentication systems for critical security vulnerabilities.

A comprehensive toolkit for structuring prospective clinical study designs. It assists in selecting and classifying primary/secondary endpoints, estimating sample size and power for various designs (means, proportions, survival), and scoring overall study plan feasibility (GO/NO-GO). All outputs are estimates routed to specified human experts (clinicians, biostatisticians, regulatory owners), never presented as final facts or regulatory submissions.

NetExec is a powerful, protocol-oriented tool for penetration testing, designed for assessing and exploiting Windows and Active Directory environments. It facilitates lateral movement by authenticating over protocols like SMB, WinRM, LDAP, and MSSQL. Key functions include password spraying, comprehensive network enumeration, command execution, and dumping critical credentials (SAM, LSA, NTDS) during post-exploitation phases.