Skill UI

Automates guidance for building SDK wrappers within API integration workflows, offering best-practice patterns, code scaffolding, validation, and configuration details to streamline third-party API, webhook, and OAuth onboarding.

Provides authentication, authorization, encryption, secrets, and hardening patterns for designing secure auth flows, managing tokens, configuring CORS, and implementing best practices around API keys, JWT, OAuth, and rate limiting.

Guides engineers through setting up Server Sent Events connections as part of API integration work, providing best practices, sample configurations, and validated code for third-party webhooks, SDKs, and OAuth flows.

Expert in building and debugging comprehensive Shopify solutions. Specializes in theme development using Liquid, implementing headless commerce via the Storefront API, and developing custom Shopify applications (OAuth, webhooks). Proficient in modern e-commerce architectures, including Hydrogen/React frontends, managing Shopify CLI workflows, and optimizing performance for high-volume online stores.

Provides a comprehensive guide and framework for building robust, production-grade Slack applications. Utilizes the recommended Bolt framework to handle authentication, event routing, and request verification across Python, JavaScript, and Java. Covers advanced topics like interactive UI design using Block Kit, implementing slash commands, managing OAuth flows, and integrating with Workflow Builder. Ideal for developers building sophisticated, enterprise-level team communication tools.

Validating Authentication Implementations assesses authentication mechanisms like JWT, OAuth, sessions, and API keys against security standards, then reports vulnerabilities and recommendations for password policy, MFA, token handling, and session security.

A lightweight integration for automating Google Docs tasks. It allows users to programmatically create, read, search, edit, append, and replace content in Google Workspace documents. With standalone OAuth authentication, it is ideal for local scripts that require direct document content manipulation without relying on a centralized server.

Integrates with X/Twitter via OAuth to post tweets or threads, read timelines, search, upload media, and track engagement for bots or analytics workflows.

Configures OAuth 2.0 flows (Authorization Code with PKCE, Client Credentials, Device Authorization) with secure scope, token lifecycle, PKCE validation, and RFC 9700 guidance so teams can deploy compliant IAM controls.

Guides security teams through detecting and responding to OAuth token theft, covering Microsoft Entra ID/Azure AD protections, conditional access policies, and sign-in log investigations to block token replay, PRT abuse, and session hijacking in cloud deployments.

Detects illicit OAuth consent grants in Azure AD / Microsoft Entra ID by enumerating OAuth2 permission grants, reviewing consent audit logs, analyzing permission scopes and publisher verification via Microsoft Graph, and generating risk reports for SOC analysts.

Identifies and exploits OAuth 2.0/OpenID Connect misconfigurations during authorized security assessments, covering redirect URI manipulation, token leakage, authorization code theft, and scope escalation to evaluate provider and consumer defenses.