Skill UI

This skill provides comprehensive management of the Web Application Firewall (WAF) for Power Pages production sites. It allows users to check the current protection status, recommend necessary security measures, and apply granular rules such as IP blocking, country restrictions, path access controls, and rate limits. Use it to secure sites against brute-force attacks or common web vulnerabilities.

A comprehensive tool to inspect and configure critical HTTP security headers (such as CSP, CORS, X-Frame-Options) for modern web applications. It identifies security gaps, assesses cross-origin permissions, and guides users through hardening settings like cookie behavior, ensuring the site meets current industry security standards.

A comprehensive guide to conducting authorized security assessments across API-driven applications. This skill covers REST, gRPC, and WebSocket protocols, addressing the full OWASP API Security Top 10 2023. Techniques include identifying Broken Object Level Authorization (BOLA/IDOR), broken authentication, excessive data exposure, and implementing fuzzing for various API endpoints. Designed for professional penetration testing engagements.

This skill provides an active penetration testing toolchain covering information gathering, port scanning, vulnerability scanning, web attacks (SQL injection, XSS), directory brute-forcing, and password cracking. It exposes 20+ security tools to AI agents via MCP servers for authorized security assessments.

Runs a comprehensive security scan on a live, deployed Power Pages site. It analyzes the site's public surface for vulnerabilities, fetching the latest report and providing a plain-language summary of findings, categorized by severity. Ideal for auditing, testing, or assessing the safety of a production environment.

A deterministic method for placing signature, date, and text fields in a web e-signature composer via browser automation. It uses fixed signature pages and numeric coordinates instead of drag-and-drop. This skill ensures repeatable field positions, correct recipient ownership, and security gates before sending. Ideal for automating envelope preparation for generated agreements when API access is unavailable.