Skill UI

A comprehensive guide for manually assessing critical business rules and workflows in web applications. This technique goes beyond automated scanning by simulating attacks like price manipulation, multi-step process bypass, and privilege escalation. Ideal for securing e-commerce checkout funnels, financial transactions, and complex authorization systems.

A comprehensive guide and toolkit for performing deep security assessments on mobile application backends. It covers identifying vulnerabilities such as broken authentication, insecure token management (JWT, opaque tokens), session fixation, privilege escalation, and IDOR (Broken Object-Level Authorization) across various OAuth flows (OIDC, PKCE). Essential for penetration testers assessing API security.

A comprehensive security tool designed to assess the resilience of OAuth 2.0 and OpenID Connect (OIDC) implementations. It probes for critical misconfigurations and security flaws, including authorization code interception, redirect URI manipulation (open redirects), CSRF vulnerabilities, scope escalation, token leakage, and PKCE bypass. Essential for penetration testing of Single Sign-On (SSO) systems and API security.

A comprehensive guide and code suite for performing penetration testing on real-time WebSocket APIs (WS/WSS). This tool assesses vulnerabilities including Cross-Site WebSocket Hijacking (CSWSH), missing handshake authentication, message injection, input validation failures, and DoS risks. It guides users through analyzing the handshake process and testing authorization enforcement using Python and specialized tools.

Feishu plugin troubleshooting tool combining FAQ guidance with the /feishu doctor command to inspect permissions, API connectivity, app credentials, and user authorizations, then generate diagnostic reports and remediation steps.

A governance skill designed to secure AI agent tool calls using advanced authorization policies. It implements Cedar policies to control which tools agents can access and under what conditions. Key features include running in 'Shadow mode' for safe observation, 'Enforce mode' for strict blocking, and generating cryptographically signed Ed25519 receipts to provide an immutable, tamper-evident audit trail for every policy decision.

This skill guides users through advanced security auditing and best practices for Golang development. It acts as a senior security engineer, focusing on defense in depth by analyzing critical areas like injection patterns, cryptography, secrets management, and authorization flaws. It supports full codebase audits (using STRIDE and DREAD scoring) and precise PR vulnerability reviews, ensuring secure and resilient Go applications.

Provides secure, programmatic integration with the LabArchives ELN and Inventory APIs. This toolkit manages regional endpoint selection, handles complex signed-request authentication (HMAC-SHA-512), and facilitates user authorization flows for automated lab data management and record keeping. It is essential for developing robust, evidence-based science workflows.

Implements a robust, multi-tenant authorization layer for Cohere API v2. This solution enforces Role-Based Access Control (RBAC), manages individual API keys per team, and implements per-team usage limits and daily budget tracking. It is essential for large-scale applications requiring strict resource isolation and cost governance across multiple internal services.

This comprehensive guide details setting up a secure Canva Connect API integration using the OAuth 2.0 Authorization Code flow with PKCE (Proof Key for Code Exchange). It covers the entire lifecycle: client registration, token generation, code exchange for access tokens, and refreshing expired tokens. Use this skill when building applications that require programmatic access to Canva's design and asset management capabilities.

This skill helps test the robustness of an AI agent's authorization mechanisms. Use it when the agent handles user roles, permissions, or sensitive data (e.g., admin functions, cross-tenant data). It simulates attempts to bypass authentication, escalate privileges, or access data belonging to other users or tenants.

This comprehensive guide details how to implement robust webhook endpoints to receive, validate, and process data deliveries from Bright Data's Web Scraper and Datasets APIs. Learn best practices for handling large JSON/NDJSON payloads, verifying authorization headers, processing status notifications, and ensuring data deduplication in automated scraping pipelines.