Skill UI

A comprehensive skill for identifying miscellaneous security vulnerabilities like access control failures, information disclosure, and misconfigurations. Based on 225 public bug bounty reports, it helps hunters target SaaS platforms, identity flows, and internal APIs to find high-value issues.

A specialized security skill for identifying and exploiting race condition vulnerabilities in web applications. Focuses on synchronized request attacks, double-spending, and bypassing access controls. Requires explicit authorization and defensive guidance protocols before execution.

This skill identifies session management vulnerabilities like session fixation, failure to invalidate sessions after logout or password changes, and weak session ID generation. It is designed for authorized security assessments to prevent Account Takeover (ATO) and unauthorized access. Users must obtain explicit written permission before testing targets.

Extract backend API routes from SPA JavaScript bundles to identify missing authentication or broken access control vulnerabilities. Test endpoints without credentials to find unauthenticated data exposure and security gaps in web applications.

A security assessment tool designed to identify specific vulnerabilities in Spring Boot applications, such as exposed Actuator endpoints, H2 Console access, SpEL injection, and memory dumps containing secrets. Requires explicit written authorization for authorized security assessments.

Authorized-use hunting guide for XXE vulnerabilities: maps XML entry points, tests file uploads, SAML and SOAP endpoints, then escalates from inline file read to blind out-of-band exfiltration, SSRF pivoting and internal service access.

Configure Single Sign-On, SCIM provisioning, and Multi-Factor Authentication for startup teams using Google Workspace, Okta, or Azure AD. Includes practical scripts for user management, organizational units, and security enforcement.

This skill provides systematic methodologies for identifying and exploiting Insecure Direct Object Reference (IDOR) vulnerabilities in web applications. It covers detection techniques using parameter manipulation, exploitation via Burp Suite, and remediation strategies. Requires authorized security assessments and multiple test accounts to verify cross-user access. Outputs include vulnerability reports, proof of concept, and remediation recommendations.

Detects security risks in multi-agent systems such as data leakage, boundary violations, unencrypted channels, and privilege mismatches. Used when agents collaborate or share context to verify secure communication protocols and access controls.

This skill provides a comprehensive guide for implementing security policies in Kubernetes clusters, including NetworkPolicy, PodSecurityPolicy, RBAC, and Pod Security Standards. It covers network segmentation, least-privilege access, compliance policies, and admission control to ensure defense-in-depth security for multi-tenant environments.

This skill provides access to latest news articles, regulatory filings, and community discussion topics for listed stocks via Longbridge. It supports SEC EDGAR filing analysis including 10-K, 10-Q, 8-K, and Form 4. Users can retrieve full article content, filing details, and search community discussions. It matches user input language and recommends only Longbridge data.

Access comprehensive financial data including income statements, valuation multiples, and company profiles for HK, US, A-share, and Singapore stocks via Longbridge. Supports DCF modeling, value screening, and cross-stock comparison for investment research and business analysis.