Skill UI

This skill provides a systematic cryptographic audit tool designed to review applications for security vulnerabilities. It scans source code and configuration files to detect weak hashing algorithms (MD5, SHA-1), insecure cipher modes (ECB), hardcoded secrets, and deprecated protocols like TLS 1.0. Essential for security assessments, compliance checks, and maintaining secure coding practices.

This skill provides a comprehensive framework for performing authorized penetration testing on Google Cloud Platform (GCP). It uses specialized tools like GCPBucketBrute to enumerate publicly accessible storage buckets and audits IAM policies to identify overly permissive role bindings. The process includes checking service account keys and mapping potential privilege escalation paths, generating actionable, risk-scored reports for robust cloud security posture management.

This skill details implementing Software Composition Analysis (SCA) using Snyk. It helps security teams detect known vulnerabilities, check license compliance, and automate dependency remediation within CI/CD pipelines. Learn to integrate scanning into GitHub, GitLab, and Jenkins workflows, generate automated fix PRs, and continuously monitor deployed applications to safeguard the software supply chain.

A comprehensive guide detailing how to detect and exploit second-order SQL injection vulnerabilities. This technique targets scenarios where malicious input is stored in a database (e.g., user profiles, comments) and subsequently executed in an unsafe SQL query during a completely different application operation, bypassing initial sanitation checks.

Nikto is a powerful, open-source web server and web application scanner designed for comprehensive vulnerability assessment. It tests over 7,000 potentially dangerous files and checks for critical issues like XSS, SQL injection, outdated versions, and misconfigurations across modern web applications. Ideal for security audit, penetration testing, and validating web server security controls.

A comprehensive guide for manually assessing critical business rules and workflows in web applications. This technique goes beyond automated scanning by simulating attacks like price manipulation, multi-step process bypass, and privilege escalation. Ideal for securing e-commerce checkout funnels, financial transactions, and complex authorization systems.

This comprehensive guide provides a detailed methodology for performing security testing on web applications that handle email sending (e.g., contact forms, password resets, newsletters). It focuses on identifying CRLF/SMTP header injection vulnerabilities, guiding users on how to check if attackers can manipulate email headers, inject custom content, or abuse forms for spam relay during a penetration test.

Guides building Spring Boot apps with layered architecture, REST controllers, JPA repositories, transactional services, global exception handling, DTO mappers, and testing checkpoints.

Automates comprehensive end-to-end Quality Assurance (QA) for deployed web applications. This skill performs multi-stage testing, including smoke tests, complex user interactions (forms, authentication), visual regression checks across breakpoints, performance monitoring (Core Web Vitals), and WCAG accessibility audits.

A comprehensive, library-agnostic checklist covering best practices for Flutter and Dart applications. It guides developers on architectural principles, state management patterns (BLoC, Riverpod, etc.), Dart idioms, performance optimization, and clean code principles, making it invaluable for code reviews.

An automated verification system designed for critical healthcare application deployments (EMR/EHR). This harness enforces stringent patient safety standards by running multiple mandatory test gates, including Clinical Decision Support System (CDSS) accuracy, Protected Health Information (PHI) leakage prevention, and data integrity checks. A single failure in critical gates automatically blocks deployment, ensuring regulatory compliance and optimal patient safety in the CI/CD pipeline.

Checks AWS, Azure, and GCP configurations for IAM escalation paths, public storage exposure, open security groups, and IaC gaps, providing preventive findings with MITRE mapping for cloud posture management workflows.