Skill UI

This comprehensive checklist provides guidance for integrating the Wispr Flow voice-to-text API into a production environment. It covers best practices for both WebSocket and REST API usage, addressing critical elements like authentication, robust error handling (e.g., 401 Unauthorized or network disconnections), and optimizing performance. It is essential for building reliable, voice-powered applications, especially those handling complex contexts like programming code and CLI commands.

This skill generates detailed implementation plans for multi-step tasks based on specifications before coding begins. It defines file structures, task granularity, and step-by-step instructions (TDD approach) to ensure clarity and testability. It includes self-check mechanisms and execution handoff options for AI agents or developers.

Generates a comprehensive, single-page HTML onboarding plan for new hires. This tool structures the entire new employee journey, including the first-week schedule, 30/60/90-day milestones, resource checklists, and key outcomes. Ideal for HR professionals needing standardized, visually appealing onboarding documentation.

Manage and apply custom policies to customize readiness scoring across development artifacts. Users can set pass-rate thresholds, override criteria impact, or disable irrelevant checks to tailor scoring to specific organizational standards or project needs. Essential for CI gating and ensuring compliance.

Covers Bluetooth Low Energy attack workflows, including GATT enumeration, unauthenticated characteristic access, pairing downgrade checks, MITM during pairing, sniffing, and companion app reverse engineering for IoT and consumer BLE devices.

A comprehensive playbook for identifying authentication vulnerabilities in web applications. Covers advanced topics including SQL injection login bypass, predictable password reset tokens, account enumeration techniques, multi-factor authentication bypass, and brute-force resistance checks. Essential for penetration testers assessing login mechanisms and session management.

An expert playbook detailing DNS rebinding techniques to bypass the Same-Origin Policy (SOP). This method is used in penetration testing to exploit client-side applications that rely on DNS resolution for origin checks, allowing attackers to trick the browser into sending requests to internal, non-publicly accessible services (like cloud metadata endpoints) while maintaining a seemingly trusted origin.

HTTP Parameter Pollution (HPP) occurs when a single request contains multiple instances of the same parameter key. Different components in the request path (e.g., WAFs, proxies, application frameworks) may parse these duplicate keys using different rules (first value, last value, array join). This skill teaches how to exploit these discrepancies to bypass security checks, execute SSRF, or manipulate business logic.

A comprehensive playbook for testing security flaws in OAuth 2.0 and OpenID Connect (OIDC) implementations. Use this guide to systematically check for misconfigurations in redirect URI handling, state and nonce validation, PKCE enforcement, token audience/issuer checks, and account binding vulnerabilities. Essential for reviewing applications linked to external identity providers.

A comprehensive methodology for identifying critical vulnerabilities in transactional applications (e-commerce, fintech, SaaS). This goes beyond standard OWASP Top 10 checks, focusing on flaws like workflow bypass, state machine violations, price manipulation, and role boundary abuse. It guides testers to map application flows, identify hidden endpoints, and quantify the potential financial impact of logic failures.

A comprehensive playbook for advanced security testing, focusing on race conditions and TOCTOU (Time-of-check to time-of-use) vulnerabilities in web applications. It guides users to exploit non-atomic, state-changing operations (e.g., coupons, balance deductions, single-use rewards) by sending highly synchronized, parallel requests (including HTTP/2 single-packet attacks). Essential for identifying weaknesses in authorization and transactional integrity.

This skill provides comprehensive testing for WebSocket APIs, covering protocol basics, Cross-Site WebSocket Hijacking (CSWSH), and common security flaws. Use it when testing applications that rely on real-time communication, chat features, or persistent data streams. It validates Origin checks, session binding, and message integrity.