Skill UI

A comprehensive, 10-phase methodology for authorized security assessment of modern APIs, including REST, GraphQL, WebSocket, and SOAP. This guide covers the entire testing lifecycle—from endpoint discovery and authentication bypass (JWT/OAuth 2.0) to sophisticated authorization flaws (BOLA/IDOR/BFLA), input validation, rate limiting, and CI/CD integration testing.

This specialized skill is designed for advanced forensic analysis and penetration testing within Windows environments. It focuses on extracting and proving the replayability of credentials, tickets, and secrets stored in LSASS memory, Kerberos ticket caches, DPAPI, and SSP artifacts. Use it to establish the minimal, actionable chain (host artifact -> extracted material -> accepted privilege) that proves a decisive edge for privilege escalation.

Creates task-oriented technical documentation with progressive disclosure for READMEs, API docs, architecture docs, and markdown. Also generates formal security reports (reverse engineering, penetration testing, CTF, malware/APT analysis) in the user's project directory with Evidence-Finding-Path chain.

A comprehensive guide to conducting authorized security assessments across API-driven applications. This skill covers REST, gRPC, and WebSocket protocols, addressing the full OWASP API Security Top 10 2023. Techniques include identifying Broken Object Level Authorization (BOLA/IDOR), broken authentication, excessive data exposure, and implementing fuzzing for various API endpoints. Designed for professional penetration testing engagements.

Detailed methodology for achieving NT AUTHORITY\SYSTEM or local Administrator privileges on Windows targets. Covers token impersonation (JuicyPotato, PrintSpoofer), exploiting service misconfigurations, DLL hijacking, UAC bypass techniques, persistent access, and credential harvesting (LSA, DPAPI). Essential toolkit for red team and penetration testing engagements.

This skill provides comprehensive, non-destructive testing for deployed Power Pages sites. It navigates the site, performs page crawling, verifies HTTP status codes, captures network API requests (Web API/OData), and detects console errors. It supports testing core site load, authentication flow, and data integrity.

This specialized sub-agent is responsible for transforming high-level feature proposals and technical specifications into a formal, comprehensive 'design.md' document. It systematically captures all necessary technical details, including architectural decisions, data flow diagrams, detailed file changes, API contracts, and thorough testing strategies. Use this skill during the planning phase of any complex software change to ensure technical completeness and feasibility.

Provides techniques for testing REST, SOAP, and GraphQL APIs during authorized bug bounty and penetration testing, covering endpoint discovery, auth bypass, IDOR, injection, and API-specific attack vectors.

This skill provides a structured methodology for authorized security assessments of REST, GraphQL, WebSocket, and SOAP APIs. It covers discovery, authentication flaws (JWT/OAuth), authorization issues (BOLA/IDOR), rate-limit testing, and CI/CD integration. Includes 10-phase workflow from reconnaissance to reporting, utilizing tools like Entropy, Burp, and FireTail for comprehensive vulnerability identification.

Workflow for assessing REST and GraphQL API security, covering discovery, authentication, authorization, input validation, rate limiting, GraphQL testing, error handling, and reporting.

This skill specializes in creating realistic mock services for development, testing, and demonstration purposes. It simulates real API behavior to enable parallel development and facilitate thorough testing. Use it for building mock APIs for frontend or integration testing, simulating partner APIs, creating demo environments, and validating API contracts before backend completion. Avoid using for production systems or security testing.

Create, modify, debug and deploy Apify Actors with the apify CLI. Covers template selection in JS/TS/Python, input/output schemas, runtime logic, local testing, secrets handling and secure deployment.