Skill UI

A comprehensive bash script designed to collect critical diagnostic evidence for troubleshooting SalesLoft API issues. It checks authentication status, current rate limit headers, and the operational health of key endpoints. This bundle is ideal for preparing detailed, reproducible support tickets when encountering persistent API connectivity or authorization problems.

This guide provides a comprehensive walkthrough for setting up secure API access to the SalesLoft REST API v2. It covers multiple authentication methods, including OAuth 2.0 flows (Authorization Code and Client Credentials) and API Key usage. Use this when integrating SalesLoft features into external applications, scripts, or automated workflows.

This guide provides comprehensive steps for installing the official Webflow JS SDK (`webflow-api`) and securely configuring authentication. It covers both API Token setup for server-side tools and the full OAuth 2.0 authorization flow for public, user-facing applications. Use this when building web integrations or automated workflows that require programmatic access to Webflow data and site management.

This catalog provides core abstractions and hooks for robust security management in administrative applications. It includes essential tools for handling identity context, user authentication flows (login/logout), and granular authorization checks. Developers can use these components to build secure, feature-rich administrative panels with reliable access control.

This skill provides a robust, schema-based system for handling API authorization and access control. It enables developers to define detailed permission schemas (the domain layer) and create injectable, type-safe permissions abstractions (the feature layer). Use this system when implementing complex access control logic, checking granular read/write/delete permissions, or enforcing resource ownership scoping (`own` records) across API use cases.

This comprehensive playbook guides security testers through deep API authorization checks, focusing specifically on BOLA (Broken Object Level Authorization) and BFLA (Broken Function Level Authorization). Use this skill to test scenarios where object identifiers, nested resources, or privileged functions are exposed, ensuring thorough checks for mass assignment and privilege escalation.

This skill serves as the central entry point for comprehensive API security testing. It guides testers to systematically categorize and prioritize potential vulnerabilities by focusing on core dimensions such as documentation review (Recon), object-level authorization (BOLA), token integrity (JWT), and complex data structures (GraphQL/Hidden Params). Use this as the initial step when assessing a new REST or GraphQL endpoint.

This guide serves as the core entry point for comprehensive security testing of identity and access control mechanisms. It is designed to help testers systematically identify vulnerabilities across login flows, session management, object authorization (IDOR), and modern protocols like JWT, OAuth, CORS, and SAML. Use this when planning security audits for any web application with user accounts.

A comprehensive playbook for advanced API security testing targeting GraphQL and REST APIs. It guides users through schema introspection, discovering hidden or undocumented fields, analyzing batching capabilities, and identifying authorization gaps (like IDORs). Essential for deep reconnaissance and identifying privilege escalation vectors.

An expert playbook for systematically testing Insecure Direct Object References (IDOR) and Broken Object/Function Level Authorization (BOLA/BFLA). This guide covers finding object identifiers across all request vectors (URL, body, headers, cookies), implementing A-B testing methodologies, identifying various ID patterns, and executing horizontal or vertical privilege escalation attacks. Essential for deep API security auditing.

A comprehensive playbook for advanced security testing, focusing on race conditions and TOCTOU (Time-of-check to time-of-use) vulnerabilities in web applications. It guides users to exploit non-atomic, state-changing operations (e.g., coupons, balance deductions, single-use rewards) by sending highly synchronized, parallel requests (including HTTP/2 single-packet attacks). Essential for identifying weaknesses in authorization and transactional integrity.

A comprehensive guide detailing best practices for securing Quarkus applications. It covers robust authentication methods like JWT and OIDC, role-based access control (RBAC) for authorization, mandatory input validation using Bean Validation, preventing SQL injection, and secure secret management. Essential for developers building highly secure Java microservices.