Skill UI

A comprehensive guide for deploying Attio-powered applications to major production platforms including Vercel, Fly.io, Cloud Run, and Railway. This guide covers essential DevOps practices such as secure secrets injection, robust health check endpoints, webhook URL configuration, and platform-specific deployment commands to ensure reliable, production-grade integration.

This comprehensive checklist guides thorough security testing of OAuth 2.0 and OpenID Connect (OIDC) protocols. It covers advanced vulnerabilities such as authorization code interception, PKCE bypass, CSRF flaws, and improper scope validation. The methodology emphasizes modern industry standards like FAPI (DPoP, JAR, PAR), making it essential for penetration testers and security researchers assessing web application integrity and API security.

A comprehensive methodology and checklist for identifying and exploiting race conditions (TOCTOU) in web applications. It guides users to find timing windows, detect vulnerabilities like double-spend or rate limit bypass, and exploit concurrent request flaws in state-changing business logic. Essential for penetration testing and bug bounty hunting.

Automates the deployment of static web files (HTML, CSS, JS, images) to a specified domain using Cloudflare Pages via the Wrangler CLI. This skill is ideal for hosting Single-Page Applications (React, Vue), landing pages, portfolios, or documentation sites. It stages the site files and injects necessary cache revalidation headers to ensure content freshness after redeployment.

A comprehensive playbook detailing how web applications can be vulnerable to attacks by manipulating the HTTP Host header. Covers critical techniques such as password reset poisoning, Web Cache Poisoning, Server-Side Request Forgery (SSRF), and Virtual Host bypass. Essential reading for penetration testers and security researchers.

A comprehensive playbook for advanced security testing, focusing on race conditions and TOCTOU (Time-of-check to time-of-use) vulnerabilities in web applications. It guides users to exploit non-atomic, state-changing operations (e.g., coupons, balance deductions, single-use rewards) by sending highly synchronized, parallel requests (including HTTP/2 single-packet attacks). Essential for identifying weaknesses in authorization and transactional integrity.

This skill provides comprehensive testing for WebSocket APIs, covering protocol basics, Cross-Site WebSocket Hijacking (CSWSH), and common security flaws. Use it when testing applications that rely on real-time communication, chat features, or persistent data streams. It validates Origin checks, session binding, and message integrity.