Skill UI

Test JWT implementations for algorithm confusion, none bypass, kid/jku injections, and weak secrets to validate authentication and privilege controls during security assessments.

Identifies open redirect vulnerabilities in web apps by analyzing redirect parameters, applying bypass payloads, and chaining exploits for phishing or token theft during security assessments.

Step-by-step workflow for uncovering XML-based vulnerabilities such as XXE, XPath injection, SSRF, and entity bombs in web apps, covering prerequisites, payload templates, and out-of-band detection techniques.

A comprehensive skill for identifying and exploiting Cross-Site Scripting (XSS) vulnerabilities in web applications. It systematically tests reflected, stored, and DOM-based contexts by injecting various JavaScript payloads. The process involves mapping all user input points, identifying output contexts (HTML body, attribute, JS string, etc.), and crafting payloads to bypass sanitization and Content Security Policy (CSP) protections, simulating real-world attacks like session hijacking and credential theft.

Guide to using Burp Suite's proxy, scanner, intruder, repeater, and DOM Invader to identify and validate reflected, stored, and DOM-based XSS flaws during authorized web security assessments and bug bounties.

Performs targeted security assessments of JSON Web Token implementations, probing algorithm confusion, claim tampering, brute-force secrets, and misuse during penetration tests of APIs, SSO, and microservice authentication flows.

Evaluates WebSocket APIs for auth bypass, CSWSH, injection, DoS, and leakage by intercepting handshakes and messages with Burp Suite plus crafted payloads.

Provides end-to-end guidance for fine-tuning and serving Physical Intelligence’s OpenPI pi0 family (pi0, pi0-fast, pi0.5) with both JAX and PyTorch backends, covering dataset prep, norm stats, checkpoint conversion, and low-latency WebSocket policy inference for ALOHA, DROID, and LIBERO tasks.

Performs structured security assessments of SCADA HMI deployments by validating authentication, web interfaces, and PLC communication protections against IEC 62443 and NIST SP 800-82 requirements to guide OT risk reduction.

Astro is a modern web framework designed specifically for building high-performance, content-heavy websites like blogs, documentation sites, and portfolios. Its core innovation is the Islands Architecture, which ships zero JavaScript by default, drastically improving performance and Core Web Vitals. It supports multi-framework components (React, Vue, Svelte) in a single project, making it ideal for content developers prioritizing speed and flexibility.

GoldRush API by Covalent lets agents query wallet balances, token prices, transaction history, DEX pairs, and live OHLCV across 100+ chains via REST, CLI, SDK, or WebSocket, avoiding chain-specific plumbing.

Hono is a minimal and ultrafast web framework built entirely on Web Standards (Request/Response/fetch). It allows developers to build high-performance APIs and full-stack applications that run seamlessly across multiple environments, including Cloudflare Workers, Deno, Bun, and Node.js. It is ideal for edge deployment, Backend for Frontend (BFF) layers, and type-safe backend services.