Skill UI

Automates guidance and code for identifying insecure deserialization flaws, following Security Fundamentals best practices to help with authentication, input validation, and secure coding checks when that phrase is mentioned.

Guides you through diagnosing Next.js getServerSideProps, getStaticProps, and API route failures by checking terminal logs, adding explicit try-catch handling, and reviewing hosting logs or common causes like env vars, DB, or serialization issues.

A comprehensive guide covering critical pitfalls and best practices for writing robust PowerShell scripts on Windows. It details essential rules for operator syntax (parentheses), safe path handling, null checking, advanced error management (try/catch), and correct JSON serialization, ensuring your automation code is highly reliable and maintainable.

A comprehensive security scanner designed to audit AI agent skills before deployment. It analyzes source code (Python, Bash, JS), detects critical vulnerabilities like command injection, network exfiltration, and unsafe deserialization. Furthermore, it scans markdown files for prompt injection attacks, and assesses dependency supply chain risks, providing a clear PASS/WARN/FAIL verdict and remediation guidance.

This skill provides best practices for managing application state and ensuring data persistence within large-scale applications, particularly for systems using Makepad architecture (Robrix/Moly). It details core structures like AppState, techniques for passing state through widget trees (Scope), and handling persistent data serialization (serde) across sessions, making it essential for building robust, multi-session UIs.

A comprehensive set of architectural patterns for building robust and maintainable HTTP servers using Kotlin Coroutines and the Ktor framework. It covers essential topics including REST routing DSL, plugin configuration (Authentication, CORS, StatusPages), Dependency Injection (Koin), serialization, WebSockets, and integration testing using testApplication.

A comprehensive guide for authorized penetration testers on identifying and exploiting insecure deserialization vulnerabilities across multiple languages (Java, PHP, Python, .NET). Covers techniques for generating payloads using tools like ysoserial and phpggc, and testing various application components such as cookies, HTTP parameters, and message queues to achieve potential Remote Code Execution (RCE).

A comprehensive guide to advanced design patterns in Go, focusing on writing highly testable and clear code. It covers principles like keeping interfaces small and composable, defining contracts where they are consumed, preferring concrete return types, utilizing generics over 'any', and mastering the use of struct embedding and field tags for serialization.

A comprehensive guide covering advanced exploitation techniques for insecure deserialization vulnerabilities across multiple languages (Java, PHP, Python, .NET, Node.js). It details how to enumerate data sinks (cookies, message queues), fingerprint various serialization formats (e.g., Pickle, Marshal, JSON.NET), and construct complex gadget chains using tools like ysoserial. This is essential for penetration testers reviewing applications that process untrusted serialized input.

This skill provides a comprehensive, structured methodology and checklist for identifying Remote Code Execution (RCE) vulnerabilities across various web applications. It covers advanced attack vectors such as OS command injection, Server-Side Template Injection (SSTI), insecure deserialization, file upload flaws, and XXE. Use this guide during web application penetration testing or bug bounty hunting to systematically discover arbitrary code execution paths.

A comprehensive playbook detailing advanced techniques for exploiting insecure deserialization flaws across Java, PHP, and Python. It covers traffic fingerprinting, identifying specific gadget chains (e.g., Commons Collections, Shiro), and utilizing tools like ysoserial to achieve Remote Code Execution (RCE) and privilege escalation.

A sophisticated payload bypass technique targeting Java applications. It exploits the silent loss of high 8 bits when 16-bit Java characters are cast or written as 8-bit bytes. This allows attackers to bypass WAF/IDS security measures by making the WAF see harmless Unicode, while the backend service processes the original malicious ASCII byte payload. Ideal for blind SQLi, deserialization RCE, and path traversal. This primitive affects major frameworks like Tomcat, Spring, Jackson, and HttpClient.