Skill UI

Automatically generates robust, schema-compliant mock API servers directly from OpenAPI specifications. This tool supports advanced testing features, including stateful CRUD operations, Faker-driven dynamic data generation, configurable latency simulation, and detailed request recording for contract testing. Ideal for frontend parallel development and isolated integration testing.

This skill provides a practical guide for comprehensive accessibility validation of web applications. It helps users test compatibility with various screen readers, validate ARIA implementations, and debug issues related to assistive technologies. Ideal for ensuring that web forms, dynamic content, and navigation are fully usable by people with disabilities.

A comprehensive toolkit for automating and testing local web applications using Python and Playwright. It supports complex dynamic interactions, managing server lifecycles, identifying stable selectors, capturing visual evidence (screenshots), and debugging UI behavior. The guides follow a robust 'Reconnaissance-Then-Action' pattern for reliable end-to-end testing.

A comprehensive guide for conducting penetration testing on iOS and Android mobile applications, adhering to the OWASP MASTG. This skill covers the full mobile attack surface, including static analysis of binaries, dynamic runtime testing, and deep API security assessment. Techniques taught include bypassing certificate pinning, analyzing local data storage (Keychain, SQLite), and identifying vulnerabilities in authentication and network communication.

Guide for performing Android and iOS mobile application penetration testing with OWASP MASTG/MASVS, covering static/dynamic analysis, data storage checks, API abuse, and runtime manipulation using Frida, Objection, and MobSF.

This skill implements comprehensive API security testing using the 42Crunch platform. It combines static analysis (API Audit) on OpenAPI definitions, dynamic vulnerability scanning (API Conformance Scan) against running APIs, and runtime threat protection. Ideal for integrating OWASP API Security Top 10 checks into CI/CD pipelines and IDEs, enabling 'shift-left' security practices.

This guide details how to integrate OWASP ZAP (Zed Attack Proxy) into CI/CD pipelines (GitHub Actions/GitLab) for comprehensive Dynamic Application Security Testing (DAST). It covers configuring baseline, full, and API scans to identify common vulnerabilities like XSS, SQLi, and CSRF in running web applications and REST/GraphQL APIs, ensuring security quality gates in the development lifecycle.

This comprehensive guide details advanced techniques for circumventing Content Security Policies (CSP). It covers exploiting weaknesses in critical directives (e.g., base-uri, object-src), abusing nonces, leveraging trusted CDN endpoints, and executing code despite strict controls like script-src 'self' or 'strict-dynamic'. Essential knowledge for deep security auditing and penetration testing.

A powerful skill for generating scripts using Puppeteer, enabling robust browser automation, data scraping, and PDF creation. Use this when you need to simulate user interactions, perform complex web testing, or extract content from dynamic websites, including handling wait strategies, network interception, and generating media files.

A comprehensive methodology for deep security testing of both Android (APK) and iOS (IPA) applications. This guide covers the entire workflow, from initial information gathering and static analysis (decompilation, code structure analysis) to advanced dynamic instrumentation, network interception, and bypassing modern security measures like SSL Pinning, Root/Jailbreak detection, and anti-debugging.

A comprehensive firmware and IoT penetration testing skill following OWASP FSTM. Covers firmware acquisition, static analysis, file system extraction with binwalk/unblob, automated EMBA scanning, system emulation via Firmadyne/QEMU, dynamic debugging, and binary exploitation for ARM/MIPS devices. Ideal for auditing routers, cameras, smart home devices, reproducing IoT CVEs, and discovering embedded 0-days.