Skill UI

A comprehensive guide and implementation pattern for enforcing granular Role-Based Access Control (RBAC) on the Exa search API in multi-tenant or enterprise environments. This skill demonstrates how to implement API key scoping, restrict search domains by role, enforce maximum result limits, and track daily usage to ensure robust data governance and security.

This comprehensive guide details essential security practices for integrating the Exa API. It covers key areas such as secure API key management using environment variables, implementing content moderation to filter unsafe results, restricting results via domain allow/block lists, and sanitizing user queries to prevent injection attacks. Use this when hardening or auditing an Exa-powered application.

A comprehensive expert resource for building high-performance, async-first APIs using FastAPI, SQLAlchemy 2.0, and Pydantic V2. Covers advanced topics like microservices architecture, WebSockets, advanced security (OAuth2, RBAC), robust testing strategies (pytest), performance optimization, and modern DevOps practices (Docker, Kubernetes). Ideal for mastering scalable, production-ready Python web services.

This skill provides structured guidance and patterns for performing comprehensive web fuzzing using the powerful command-line tool, ffuf. Web fuzzing is an essential security testing technique used by penetration testers to discover hidden directories, unlinked endpoints, or sensitive files on a web server by systematically brute-forcing potential paths and parameters. Use this skill when you need to audit the security posture of a web application or map out unknown parts of a website.

Performs authorized file path traversal assessments to map web inputs, craft traversal payloads, and document sensitive files that can be read, aiding defenders in hardening filesystem handling during security reviews.

Provides expert guidance on secure and performant file upload mechanisms for cloud environments. Covers best practices for using services like AWS S3 and Cloudflare R2, including implementing presigned URLs, handling large files via streaming, and optimizing images. Crucially emphasizes critical security measures such as validating file types using magic bytes, enforcing size limits, and preventing path traversal attacks.

Performs a structured, multi-phase audit on local branch changes (diffs) to identify security vulnerabilities, bugs, and code quality issues. It systematically checks for common risks like Injection (SQL, XSS), Broken Authentication, IDOR, CSRF, and business logic flaws, providing detailed severity, evidence, and suggested fixes. Ideal for pre-merge code reviews and security audits.

Scans infrastructure-as-code, application, and system configurations via the security-misconfiguration-finder plugin to expose vulnerabilities and compliance gaps, enabling proactive remediation before deployment.

This comprehensive skill covers the full scope of Firebase services, including Authentication, Firestore, Cloud Functions, and Hosting. It goes beyond basic implementation, focusing on critical architectural principles: adopting a query-first, denormalized NoSQL mindset. Key insights include mandatory security rule design, optimal data modeling for performance, and correctly utilizing modular SDKs to build scalable and secure backends.

Scans Android APKs for Firebase misconfigurations, testing databases, storage, authentication, and cloud functions to surface vulnerabilities during mobile security audits.

Automatically assists with generating Firebase security rules, offering best-practice guidance, template configurations, and validation checks tailored for GCP compute, storage, and data workloads.

This guide outlines essential security best practices for integrating Firecrawl. It covers secure API key storage (using environment variables and .gitignore), verifying webhook signatures with HMAC-SHA256 for data integrity, implementing key rotation strategies across different environments (dev/staging/prod), and sanitizing scraped content to mitigate XSS and PII risks. Essential for building secure, production-grade systems.