Skill UI

Provides an enterprise-grade framework for managing Webflow access control using OAuth 2.0 and scope-based Role-Based Access Control (RBAC). This system enforces the principle of least privilege by mapping specific user roles (e.g., Viewer, Editor, Admin) to granular Webflow scopes. Key features include per-site token isolation and robust permission checking middleware, significantly enhancing security for complex SaaS integrations.

This skill provides a robust, schema-driven solution for managing and enforcing permissions in administrative user interfaces. It allows developers to define complex permission structures (the domain schema) and automatically generates associated UI forms, injectable permission checks, and component props. Use it to add granular permission controls to any admin section, supporting multi-entity, complex access scopes (e.g., full/own), and various operational actions.

This catalog provides core abstractions and hooks for robust security management in administrative applications. It includes essential tools for handling identity context, user authentication flows (login/logout), and granular authorization checks. Developers can use these components to build secure, feature-rich administrative panels with reliable access control.

This skill provides a robust, schema-based system for handling API authorization and access control. It enables developers to define detailed permission schemas (the domain layer) and create injectable, type-safe permissions abstractions (the feature layer). Use this system when implementing complex access control logic, checking granular read/write/delete permissions, or enforcing resource ownership scoping (`own` records) across API use cases.

A comprehensive playbook for bypassing 401/403 Forbidden errors. Covers advanced techniques like path normalization tricks (encoding, traversal), HTTP method tampering, IP spoofing headers, and protocol downgrade attacks. Essential knowledge for penetration testing and security auditing.

A comprehensive playbook detailing advanced techniques for exploiting misconfigured Active Directory Access Control Lists (ACLs). It covers BloodHound enumeration, abusing dangerous ACE types (GenericAll, WriteDACL), conducting DCSync attacks, leveraging shadow credentials, and exploiting GPO/LAPS weaknesses for privilege escalation and lateral movement in a deep dive for security professionals.

This guide serves as the core entry point for comprehensive security testing of identity and access control mechanisms. It is designed to help testers systematically identify vulnerabilities across login flows, session management, object authorization (IDOR), and modern protocols like JWT, OAuth, CORS, and SAML. Use this when planning security audits for any web application with user accounts.

A comprehensive playbook detailing advanced techniques for post-exploitation security bypass on Linux systems. Covers escaping restricted shells (rbash), evading noexec/read-only filesystems using in-memory execution (DDexec, memfd_create), and circumventing mandatory access controls like AppArmor and SELinux. Essential for penetration testing and red team operations.

A comprehensive playbook covering advanced smart contract audit techniques for Solidity/EVM. Focuses on critical patterns like reentrancy (cross-contract), integer overflows, access control misuse, delegatecall exploits, flash loans, and advanced MEV/front-running attacks. Essential for securing DeFi protocols.

A comprehensive guide detailing best practices for securing Quarkus applications. It covers robust authentication methods like JWT and OIDC, role-based access control (RBAC) for authorization, mandatory input validation using Bean Validation, preventing SQL injection, and secure secret management. Essential for developers building highly secure Java microservices.

A comprehensive, expert-level guideline for building Agentic User Interfaces (UIs). This system emphasizes conversational interactions, clear outcomes, and minimal user controls, allowing users to delegate complex tasks to AI. It provides structured rules covering color tokens, typography, accessibility (WCAG 2.2 AA), and component anatomy for professional developers and designers.

This skill simulates a comprehensive auditor pressure test for any Information Security Management System (ISMS) against ISO 27001 standards. It forces interrogation on six critical areas—including scope, risk management, access control, and incident response—ensuring compliance and readiness before internal audits, Stage 1 certification, or surveillance audits.