Skill UI

Assess web apps for client-side injection flaws, covering stored, reflected, and DOM XSS plus HTML injection, demonstrate session hijacking payloads, and guide validation and sanitization checks.

A powerful toolkit utilizing Objection and Frida for authorized mobile penetration testing. It enables deep runtime analysis of iOS applications, allowing users to inspect sensitive data in the keychain, filesystem, and memory. Key capabilities include bypassing client-side protections such as SSL pinning and jailbreak detection without requiring source code access.

This skill guides the detection and exploitation of JavaScript prototype pollution vulnerabilities. It covers both client-side (DOM XSS) and server-side (RCE, Auth Bypass) attacks by injecting properties into Object.prototype using keys like `__proto__`. Use this when assessing APIs that deep-merge or clone user-controlled JSON data, or for general web application security testing.

This skill enables sophisticated runtime dynamic analysis of Android applications using industry-standard tools like Frida and Objection. It is used to observe application behavior, intercept API calls, monitor network traffic, and bypass client-side security protections (e.g., root detection, anti-debugging). Essential for identifying vulnerabilities and analyzing obfuscated code that static analysis cannot reach.

A comprehensive guide for performing security assessments to identify various forms of sensitive data exposure, such as leaked API keys, PII in API responses, insecure client-side storage, and unprotected data transmission. This workflow covers scanning JavaScript files, analyzing API responses, verifying data encryption, and examining browser storage.

A detailed methodology for identifying Cross-Site Scripting (XSS) vulnerabilities across web applications. It guides systematic testing for Reflected, Stored, and DOM-based XSS, covering payload bypass, output encoding evaluation, and assessing Content Security Policy (CSP) protection. Essential for OWASP WSTG testing and client-side security audits.

A comprehensive guide covering best practices for building and debugging Nuxt 4 applications. It details patterns for ensuring hydration safety, optimizing data fetching with `useFetch` and `useAsyncData`, managing complex routing rules, and implementing lazy loading for superior performance across SSR and client-side environments.

Transformers.js allows developers to run state-of-the-art machine learning models directly within JavaScript/TypeScript environments (browser, Node.js). It supports a comprehensive range of tasks including NLP (text generation, summarization, translation), Computer Vision (image classification, object detection), and Audio processing. This capability enables building fully client-side, multimodal AI applications without requiring a dedicated Python backend or server infrastructure.

This guide details how to configure and manage resource constraints in ClickHouse, addressing server-side limits, user quotas, and connection management. Use it when encountering "too many simultaneous queries," optimizing resource usage, or implementing robust rate limiting strategies in applications connecting to ClickHouse. Covers SQL quota setup and client-side pooling techniques.

This guide provides comprehensive instructions for setting up and authenticating Framer development environments. It covers two primary surfaces: the Plugin SDK (for UI running inside the editor) and the Server API (for headless CMS synchronization or CI/CD). Users will learn how to initialize projects, configure environment variables, and connect both client-side and server-side components.

A comprehensive guide to reducing Algolia operational costs. This guide details the pricing structure based on search requests and records, providing advanced techniques such as implementing virtual replicas instead of standard replicas, utilizing multi-query search for request batching, and implementing client-side caching. It also includes strategies for auditing, cleaning up unused indices, and monitoring usage via the Analytics API.

This integration facilitates the secure deployment of Alchemy-powered decentralized applications (dApps) across major cloud platforms like Vercel and Google Cloud Run. It is designed to ensure that sensitive Alchemy API keys are treated as server-side secrets, preventing client-side exposure. Use this when setting up backend services, RPC proxies, or deploying production-grade Web3 applications requiring secure access to blockchain data.