Skill UI

A comprehensive expert for configuration management, specializing in validating, testing, and ensuring the correctness of application settings. It creates robust validation schemas (e.g., JSON Schema) and performs critical checks, including identifying potential security secrets (API keys, passwords), ensuring data consistency across different environments (development, staging, production), and enforcing type safety for reliable deployments.

Guides teams through encryption-at-rest checker tasks, offering step-by-step advice, best practices, compliance insights, and production-ready configurations whenever you need help with advanced security, penetration testing, or enterprise compliance workflows.

A comprehensive expert resource for building high-performance, async-first APIs using FastAPI, SQLAlchemy 2.0, and Pydantic V2. Covers advanced topics like microservices architecture, WebSockets, advanced security (OAuth2, RBAC), robust testing strategies (pytest), performance optimization, and modern DevOps practices (Docker, Kubernetes). Ideal for mastering scalable, production-ready Python web services.

This skill provides structured guidance and patterns for performing comprehensive web fuzzing using the powerful command-line tool, ffuf. Web fuzzing is an essential security testing technique used by penetration testers to discover hidden directories, unlinked endpoints, or sensitive files on a web server by systematically brute-forcing potential paths and parameters. Use this skill when you need to audit the security posture of a web application or map out unknown parts of a website.

Performs authorized file path traversal assessments to map web inputs, craft traversal payloads, and document sensitive files that can be read, aiding defenders in hardening filesystem handling during security reviews.

Scans Android APKs for Firebase misconfigurations, testing databases, storage, authentication, and cloud functions to surface vulnerabilities during mobile security audits.

Automated fuzz testing of APIs via the /fuzz-api command to inject malformed, boundary, and random payloads, spotting crashes, SQL injection, XSS, and validation gaps during vulnerability scanning or security reviews.

A collection of production-ready GitHub Actions workflow patterns designed for automating the entire software development lifecycle (SDLC). Use these templates to streamline continuous integration (CI), build Docker images, deploy to Kubernetes clusters, perform security scans, and execute matrix testing across various tech stacks.

Automates HIPAA audit helper workflows within Security Advanced, offering guided best practices, production-ready configurations, and compliance validation for penetration testing and threat modeling scenarios.

Map web inputs for reflected or stored HTML injection, send crafted tags via URLs, POST bodies, or visible fields, and document appearance/phishing manipulations for authorized security assessments.

Guides security testers through identifying, exploiting, and remediating insecure direct object references in web apps, with methods covering reconnaissance, request manipulation, Burp Suite automation, and reportable mitigation steps.

Provides production-ready bash templates for Linux admins to automate backups, monitor resources, manage users, and handle security tasks across servers and pen-testing setups.