Skill UI

A specialized workflow guide for comprehensive security testing of REST and GraphQL APIs. It systematically covers critical security aspects such as authentication validation (OAuth2, JWT), authorization checks (IDOR, privilege escalation), input validation (SQL/NoSQL injection), rate limiting enforcement, and secure error handling. Ideal for vulnerability assessment, bug bounty programs, and pre-deployment security audits.

A comprehensive guide covering advanced offensive techniques for AWS cloud environments. Techniques include detailed IAM enumeration, privilege escalation paths, SSRF exploitation targeting metadata endpoints (IMDSv1/v2), S3 bucket exploitation, and Lambda function code extraction. Essential for security professionals and red team operations conducting authorized cloud vulnerability assessments.

Automates OWASP Top 10 (2021) security assessments via the owasp-compliance-checker plugin, scanning codebases for vulnerabilities, reporting compliance gaps, and suggesting remediation advice for developers or auditors.

Walks through broken authentication assessments by analyzing login flows, password policies, brute-force/credential-stuffing, and session/token security to document vulnerabilities and mitigation steps for web applications.

Run comprehensive web application security assessments through Burp Suite’s proxy, repeater, and scanner features to intercept, modify, and analyze HTTP traffic while spotting vulnerabilities for remediation planning.

Systematic code maturity assessment using Trail of Bits' 9-category framework, analyzing arithmetic safety, access controls, documentation, MEV risks, testing, and more to deliver evidence-backed scorecards and actionable recommendations.

This skill simulates a senior engineer conducting comprehensive code reviews. It analyzes code diffs and files to identify bugs, security vulnerabilities (e.g., SQL injection, XSS), performance issues (N+1), code smells, and architectural flaws. It is ideal for reviewing pull requests, performing code quality audits, or conducting security assessments, providing structured, actionable, and prioritized feedback.

A comprehensive expert system for analyzing software codebases to identify, quantify, and prioritize technical debt across various dimensions (code, architecture, testing, infrastructure). It provides detailed metrics, impact assessments (development velocity, quality loss), and actionable, prioritized remediation roadmaps with clear ROI projections.

This skill automatically generates comprehensive and highly structured Pull Request (PR) descriptions directly from Git diffs. It goes beyond simple summaries by automatically adding detailed change categories (e.g., source, test, config), security risk assessments, and required review checklists based on the modified file types. Use this when submitting complex code changes or when the diff is large and requires explicit structure for thorough review.

Guides systematic detection and exploitation of cross-site scripting and HTML injection flaws, covering stored/reflected/DOM vectors, payload crafting, and remediation advice for web security assessments.

Guides CTOs and tech leaders through strategy, architecture governance, team scaling, and crisis response, with workflows for technical debt assessment, ADR creation, and vendor evaluation to keep engineering healthy.

Performs authorized file path traversal assessments to map web inputs, craft traversal payloads, and document sensitive files that can be read, aiding defenders in hardening filesystem handling during security reviews.