Skill UI

Detects operations in cryptographic code that leak secrets via timing side channels, guiding developers through multi-language analysis and CLI flags for warnings, filtering, architecture, and optimization levels.

Constant-time testing spots timing side channels in crypto code by verifying execution paths stay independent of secrets, guiding security reviews during audits and pull requests.

This skill covers the implementation of Ed25519 digital signatures, a high-performance algorithm utilizing the Curve25519 structure. It details key pair generation, message signing, and signature verification. Ed25519 offers superior performance, determinism, and side-channel resistance compared to RSA and ECDSA. Use this skill for establishing robust authentication, ensuring data integrity, and securing system components like code or APIs.

A comprehensive reference and bypass catalog covering modern operating system kernel mitigations such as KASLR, SMAP, SMEP, KPTI, DEP/NX, and CFI. It details how these security mechanisms function, how to detect their presence, and advanced bypass techniques (e.g., side-channel attacks, ROP chains, information leaks). This skill is essential for security professionals conducting deep penetration testing, exploit development, and target hardening assessments.

Covers WPA3/SAE attack techniques including transition-mode downgrade, Dragonblood side-channel analysis, SAE authentication flooding, H2E checks, and Wi-Fi 6E implications. Useful for assessing wireless security gaps and validating defensive hardening.

A comprehensive playbook covering advanced cryptographic hash attack techniques. Learn how to exploit inherent weaknesses such as length extension attacks (MD5, SHA-256), generating identical-prefix or chosen-prefix collisions, and analyzing side-channel timing leaks. Essential for CTF challenges and authorized penetration testing scenarios.

An expert-level playbook covering non-obvious XSS techniques, advanced payload selection across various sinks (DOM, SVG, HTML attributes, JavaScript), and sophisticated defense bypass strategies. Use this guide for real-world penetration testing, including WAF bypass, CSP bypass, HttpOnly bypass, and XS-Leaks side channel exploitation. It assumes deep knowledge of web vulnerability mechanics.

A comprehensive REST API for sending and receiving multi-channel messages, including iMessage (blue bubbles), SMS, and RCS. This skill allows developers to integrate messaging capabilities into server-side applications, supporting advanced features such as group messaging, reactions, typing indicators, and status callbacks. It also handles inbound messages via webhooks, making it ideal for building robust, real-time communication services that require programmatic control over messaging lifecycles.

A comprehensive REST API for sending and receiving multi-channel messages, including iMessage (blue bubbles), SMS, and RCS. This skill allows developers to integrate messaging capabilities into server-side applications, supporting advanced features such as group messaging, reactions, typing indicators, and status callbacks. It also handles inbound messages via webhooks, making it ideal for building robust, real-time communication services that require programmatic control over messaging lifecycles.

This skill enables authorized security testing of desktop thick clients. It focuses on local storage, update channels, IPC, traffic interception, and client-side trust-boundary review. Techniques include reverse engineering, network analysis, and vulnerability assessment for C/S architectures like Electron or .NET.