Skill UI

MarkItDown converts PDFs, DOCX, PPTX, XLSX, HTML, JSON, XML, archives, YouTube links, images via OCR, and audio via transcription into clean Markdown, providing token-efficient text ready for LLMs and documentation workflows.

A comprehensive skill guide for implementing all forms of data fetching and networking in React Native/Expo environments. Covers best practices for using the native fetch API, managing state with React Query (TanStack Query), implementing robust error handling with retry logic, handling offline scenarios, and securely managing authentication tokens. Essential for building reliable, scalable mobile applications that interact with external APIs.

A comprehensive guide to configuring secure OAuth 2.0 authorization flows, covering best practices for Authorization Code with PKCE, Client Credentials, and Device Authorization Grant. Learn how to implement mandatory security controls, manage token lifecycles, and align with OAuth 2.1 standards to build robust identity and access management systems.

A comprehensive solution for identifying and preventing the accidental commitment of exposed AWS credentials, API keys, and session tokens within source code, configuration files, and git history. It integrates TruffleHog and git-secrets into CI/CD pipelines and pre-commit hooks, providing critical protection against credential theft and unauthorized cloud access in a DevSecOps environment. Essential for security auditing and compliance.

This skill uses the Python azure-mgmt-storage SDK to perform comprehensive security audits on Azure Blob and ADLS storage accounts. It detects critical misconfigurations, including public access exposure, weak or long-lived SAS tokens, lack of encryption at rest, failure to enforce HTTPS, and outdated TLS versions. The output is a detailed, risk-scored report with remediation recommendations, essential for SOC analysts and security posture management.

This skill demonstrates how to exploit JWT algorithm confusion vulnerabilities. It targets APIs that do not strictly enforce the cryptographic algorithm (alg) specified in the token header. Techniques covered include downgrading from asymmetric algorithms (RS256) to symmetric ones (HS256) using the public key as the secret, performing alg:none bypasses, and manipulating key identifiers (kid, jku, x5u) to achieve authentication bypass and token forgery.

A comprehensive guide for penetration testers detailing methods to identify and exploit misconfigurations in OAuth 2.0 and OpenID Connect (OIDC) flows. Techniques cover redirect URI manipulation, authorization code theft, token leakage via headers, and scope escalation during security assessments.

This script is designed for malware analysis, specifically targeting .NET-based Remote Access Trojans (RATs) like Agent Tesla. It automatically extracts embedded and obfuscated configuration data, including SMTP credentials, FTP endpoints, Telegram tokens, and C2 webhooks. It utilizes advanced techniques such as regex pattern matching, Base64 decoding, and simulating XOR/SHA256 decryption to reveal critical threat intelligence for security research.

This guide details the implementation of robust API abuse detection mechanisms. It covers advanced rate limiting techniques, such as the Token Bucket and Sliding Window algorithms, to defend APIs against DDoS attacks, brute force attempts, and credential stuffing. It emphasizes using distributed stores like Redis for accurate, scalable, and adaptive security controls in an API gateway context.

This skill covers implementing robust API rate limiting and throttling controls using advanced algorithms like token bucket and sliding window. It teaches how to protect backend systems against attacks such as brute force, credential stuffing, and resource exhaustion. Key components include configuring limits per user, per IP, and per endpoint, utilizing Redis for distributed counting, and implementing proper HTTP 429 responses for effective abuse prevention.

This skill utilizes the Thinkst Canary REST API to programmatically deploy various decoy tokens, including web bugs, DNS records, MS Word documents, and AWS API keys. By monitoring these fake resources, the system detects unauthorized internal or external access attempts, providing early warnings and generating detailed deception coverage reports to strengthen security architecture.

This skill provides comprehensive knowledge on using JSON Web Tokens (JWT) for secure authentication and authorization. It covers implementing various cryptographic signing algorithms (such as HS256, RS256, ES256, and EdDSA), validating signatures, enforcing claim constraints (like expiration time), and implementing robust defenses against common JWT vulnerabilities, including algorithm confusion and the 'none' algorithm attack. Ideal for building secure, scalable web APIs.