Skill UI

A skill for identifying Remote Code Execution (RCE) vulnerabilities across web applications and infrastructure. Based on bug bounty reports, it guides users to test command injection, template injection, and configuration flaws on admin consoles, APIs, and supply chain targets. Requires explicit authorization for ethical testing.

This skill identifies session management vulnerabilities like session fixation, failure to invalidate sessions after logout or password changes, and weak session ID generation. It is designed for authorized security assessments to prevent Account Takeover (ATO) and unauthorized access. Users must obtain explicit written permission before testing targets.

Extract backend API routes from SPA JavaScript bundles to identify missing authentication or broken access control vulnerabilities. Test endpoints without credentials to find unauthenticated data exposure and security gaps in web applications.

A security assessment tool designed to identify specific vulnerabilities in Spring Boot applications, such as exposed Actuator endpoints, H2 Console access, SpEL injection, and memory dumps containing secrets. Requires explicit written authorization for authorized security assessments.

This skill enables security professionals to identify subdomain takeover vulnerabilities by enumerating subdomains, analyzing DNS records, and verifying unclaimed third-party resources. It is used in authorized security assessments to find high-value targets like GitHub Pages, GitLab Pages, or S3 buckets that can be exploited to serve malicious content under a trusted domain.

A security assessment skill for identifying WebSocket vulnerabilities including Cross-Site WebSocket Hijacking (CSWSH), message tampering, handshake-layer attacks, and socket.io authorization bypasses. Requires explicit written authorization before testing. Includes reconnaissance, endpoint discovery, and exploit verification techniques for authorized security assessments.

Authorized-use hunting guide for XXE vulnerabilities: maps XML entry points, tests file uploads, SAML and SOAP endpoints, then escalates from inline file read to blind out-of-band exfiltration, SSRF pivoting and internal service access.

This skill provides systematic methodologies for identifying and exploiting Insecure Direct Object Reference (IDOR) vulnerabilities in web applications. It covers detection techniques using parameter manipulation, exploitation via Burp Suite, and remediation strategies. Requires authorized security assessments and multiple test accounts to verify cross-user access. Outputs include vulnerability reports, proof of concept, and remediation recommendations.

A specialized security auditor for Laravel applications. It analyzes code, APIs, and configurations against OWASP standards to detect vulnerabilities such as XSS, IDOR, SQL injection, and misconfigurations. Ideal for reviewing backend logic to ensure robust data protection and authorization.

This skill enables security professionals to conduct authorized assessments on Linux systems, identifying misconfigurations and vulnerabilities that allow privilege escalation from standard users to root. It covers techniques like SUID exploitation, sudo misconfigurations, and cron job hijacking, strictly requiring written authorization and defensive guardrails.

This skill enables security auditing of meme coins and tokens on EVM and Solana blockchains. It identifies critical vulnerabilities like hidden mint functions, honeypot transfer restrictions, fee manipulation, and liquidity pool drains. Users must obtain explicit authorization before scanning targets to ensure ethical use.

Provides cross-language patterns for developing memory-safe systems code. This skill covers crucial concepts like RAII, ownership models, smart pointers, and robust resource management. It is essential for preventing common vulnerabilities such as use-after-free, memory leaks, and ensuring reliable resource handling across complex systems.