Skill UI

A comprehensive, 10-phase methodology for authorized security assessment of modern APIs, including REST, GraphQL, WebSocket, and SOAP. This guide covers the entire testing lifecycle—from endpoint discovery and authentication bypass (JWT/OAuth 2.0) to sophisticated authorization flaws (BOLA/IDOR/BFLA), input validation, rate limiting, and CI/CD integration testing.

Automates the entire Continuous Integration (CI) workflow, crucial before opening a Pull Request (PR). It systematically runs local unit tests for multiple languages (Python, Node, Rust), performs type checking, pushes the current branch to the remote repository, and finally provides the direct URL and status check for the CI platform (GitHub Actions/GitLab). This single command replaces multiple manual steps.

Quickly retrieve and display the current Continuous Integration/Continuous Deployment (CI/CD) pipeline status for the active branch or a specific Pull/Merge Request. This tool supports major Git platforms including GitLab CI and GitHub Actions, providing developers with an immediate snapshot of build and test results.

This tool provides a unified interface to run test suites for various programming stacks (Python, Node.js, Rust) within a CI/CD pipeline. It automatically detects the project's environment (by checking lock files or config) and executes the appropriate testing framework (e.g., pytest, vitest, cargo test), ensuring consistent code quality checks regardless of the underlying language. Ideal for pre-commit or CI/CD integration.

This skill implements a critical CI gate to ensure the privacy and performance integrity of de-identification models. It automatically fails the build if the model's recall on held-out PHI data drops below the defined threshold, or if any critical Personally Identifiable Information (PHI) is leaked (leakage must be zero). It enforces strict privacy standards in continuous integration pipelines, blocking unsafe merges.

A comprehensive guide for performing reverse engineering using Ghidra. This skill is essential for scenarios where commercial tools like IDA are unavailable, or when performing large-scale, automated headless analysis. It covers the entire workflow, from project setup and function decompilation to advanced headless scripting and integration with other exploit tools.

This skill implements an advanced reference pattern for integrating with Monitoring Control Platform (MCP) servers. It ensures accurate data retrieval by first reading a domain-specific 'gotchas' reference file, mitigating query failures caused by complex server behaviors, pagination limits, or subtle API quirks. It analyzes issue data, groups errors by root cause, and generates a structured, actionable markdown report for improved system health visibility.

This skill validates FHIR R4 resources and Bundles against mandatory US Core profiles (USCDI). It goes beyond mere syntactic checks to ensure that data prepared for submission to major Electronic Health Records (EHRs) like Epic or Cerner meets the required US-specific conformance standards. It detects common data gaps, checks 'must-support' elements, and converts the comprehensive validation report into a standard FHIR OperationOutcome for seamless pipeline integration.

This methodology guides the development of new features, product slices, or integrations while mitigating the risk of overbuilding. It mandates an architecture-first approach, requiring the definition of clear acceptance criteria and explicit non-goals. The process focuses on delivering a coherent end-to-end path across responsible system layers, omitting unnecessary configuration, polish, or complexity, and halting immediately upon successful acceptance testing.

This tool reviews and migrates deprecated wildcard (*) values found in Power Pages Web API field settings. It replaces them with explicit, least-privilege Dataverse column definitions. Use this when addressing Web API wildcard deprecation, reviewing data exposure, or fixing integration failures across traditional and SPA site architectures.

A comprehensive methodology for exploiting modern Continuous Integration/Continuous Delivery (CI/CD) pipelines. This skill covers advanced attack vectors across major platforms, including GitHub Actions expression injection, Jenkins RCE, GitLab YAML abuse, and Azure DevOps compromise. Techniques focus on privilege escalation, credential theft, and supply chain poisoning, mapping to MITRE ATT&CK T1195.002.

A comprehensive methodology for offensive security, detailing how to systematically extract secrets from Continuous Integration/Continuous Deployment (CI/CD) pipelines. Techniques covered include dumping environment variables, exploiting misconfigurations in HashiCorp Vault, AWS Secrets Manager, and cloud platform tokens (GitHub, GitLab, etc.). It also guides attackers on OIDC federation abuse, build log analysis, and advanced exfiltration methods, mapping to MITRE ATT&CK T1552.