Skill UI

A comprehensive methodology for conducting deep security assessments and penetration tests against GraphQL APIs. This guide covers the entire attack lifecycle, including endpoint discovery, blind schema reconstruction, authentication/authorization bypass, SQL/NoSQL injection, Denial of Service (DoS) via depth bombs, and abusing advanced features like file uploads and subscriptions. It provides actionable steps and tool guidance for professional security researchers and ethical hackers.

A comprehensive checklist detailing advanced attack methodologies for JSON Web Tokens (JWT). Covers critical misconfigurations such as algorithm confusion (alg:none, RS256→HS256), weak secret brute forcing, header injection (kid, jku, jwk), cache poisoning, and improper validation. Also provides specific vectors for extracting JWTs from mobile environments (Android/iOS). Ideal for penetration testers conducting deep security assessments on authentication systems.

A comprehensive reference and bypass catalog covering modern operating system kernel mitigations such as KASLR, SMAP, SMEP, KPTI, DEP/NX, and CFI. It details how these security mechanisms function, how to detect their presence, and advanced bypass techniques (e.g., side-channel attacks, ROP chains, information leaks). This skill is essential for security professionals conducting deep penetration testing, exploit development, and target hardening assessments.

This comprehensive checklist details advanced methods for bypassing Web Application Firewalls (WAFs) during security assessments. Techniques covered include encoding bypass (URL, Unicode, double encoding), HTTP header manipulation, IP rotation, payload obfuscation, and fingerprinting specific WAF vendors (e.g., Cloudflare, Akamai). It is essential for penetration testers evaluating the robustness of web defenses.

This skill provides the OWASP Top 10 for Agentic Applications 2026 (ASI) framework for classifying security risks in AI agent systems. It maps detection findings to standardized risk categories like goal hijacking, tool misuse, and identity abuse, enabling consistent security assessment and remediation prioritization for agentic workflows.

Assess patent novelty and non-obviousness against prior art. Extracts claim elements, runs anticipation and obviousness analysis, includes cross-model examiner verification and jurisdiction-specific (USPTO/CNIPA/EPO) patentability verdicts.

This skill assesses the AI readiness of a codebase by running a comprehensive audit against multiple technical and governance pillars. It generates a self-contained, detailed HTML dashboard that provides an overall maturity score, identifies strengths, and, most importantly, delivers a prioritized remediation plan (Fix First / Fix Next). Ideal for auditing repositories before major AI feature development.

Guides assessment of KRACK and FragAttacks against WPA2 clients, including official test scripts, likely vulnerable embedded and legacy devices, practical impact, detection, and reporting for modern penetration testing.

Drafts self-assessments, peer reviews, and upward feedback using WorkIQ evidence from emails, meetings, and contributions. It helps you write honest, impact-focused performance reviews in your own voice with STAR-based structure.

An expert playbook for identifying and simulating dependency confusion attacks in software supply chains. It comprehensively covers how internal package names can be squatted on public registries, leading to malicious code execution via package manager lifecycle hooks (e.g., npm, pip, Maven). Use this guide for authorized red-team exercises and deep vulnerability assessment of build processes.

This skill serves as the primary entry point and operating doctrine for authorized security tasks including web testing, API assessment, and penetration testing. It enforces strict authorization, scope management, and safety constraints while routing complex tasks to specialized deep skills like code audit or incident response.

A comprehensive playbook for advanced mobile security assessments of iOS applications. Covers both jailbroken and non-jailbroken environments, focusing on critical attack vectors such as keychain extraction, URL scheme hijacking, Universal Links exploitation via AASA misconfigurations, runtime memory manipulation (Frida/Objection), and binary protection analysis.