Skill UI

Guides security testers through identifying CDN caching layers, crafting deceptive static URLs, and exploiting path normalization and cache-key quirks to expose authenticated content via web cache deception attacks.

Guides analysts through CVSS v4 scoring, vector parsing, and contextual factors (EPSS, CISA KEV, asset criticality) to prioritize vulnerabilities, adjust environmental scores, and blend threat telemetry for effective remediation planning.

Automates STIX 2.1 and TAXII 2.1 ingestion, validation, normalization, and routing so threat intelligence bundles can be onboarded from government or commercial feeds, mapped into SIEM/TIP schemas, and safely shared back through bi-directional TAXII pipelines.

Hardens process historian servers (OSIsoft PI, Honeywell PHD, GE Proficy, AVEVA Historian) in OT networks by covering Purdue-tier segmentation, secure interfaces, DMZ data replication, injection prevention, and integrity checks for safety, compliance, and optimization scenarios.

Walks testers through intercepting REST/GraphQL API calls, identifying object ID parameters, and swapping them with other users’ identifiers to confirm OWASP API1:BOLA protections in multi-tenant services.

Automates API testing for mass assignment vulnerabilities by identifying writable endpoints, injecting privileged parameters (e.g., role, isAdmin, balance), and verifying whether the server binds them without filtering, helping defenders confirm Broken Object Property Level Authorization risks before deployment.

Guide to systematically assess REST and GraphQL APIs against the OWASP API Security Top 10 risks using Burp Suite, Postman, ffuf, and curl to discover endpoints, probe auth/authorization flaws, and verify rate limiting before deployment.

A comprehensive skill for identifying and exploiting Cross-Site Scripting (XSS) vulnerabilities in web applications. It systematically tests reflected, stored, and DOM-based contexts by injecting various JavaScript payloads. The process involves mapping all user input points, identifying output contexts (HTML body, attribute, JS string, etc.), and crafting payloads to bypass sanitization and Content Security Policy (CSP) protections, simulating real-world attacks like session hijacking and credential theft.

Secures mobile application APIs by exercising authentication flows, JWT/OAuth/OIDC defenses, token misuse, broken object-level authorization, and session management to expose vulnerabilities during penetration testing.

Evaluates OAuth 2.0 and OpenID Connect deployments for redirect URI flaws, CSRF via missing state, PKCE bypasses, token leakage, and scope escalation to ensure secure authorization-code flows before production onboarding.

AgentHub spawns parallel git worktree agents that compete on tasks, evaluates their outputs via metrics or LLM judges, and merges the top branch for optimizations, research, or content variations.

A comprehensive toolset to scaffold, build, sign, and package SwiftPM-based macOS applications entirely without requiring an Xcode project. It guides users through the end-to-end process, including setting up the project, running the app, performing code signing, notarization, and generating update appcasts for robust, reproducible releases.