Skill UI

A powerful technique used when full XSS is blocked by CSP, sanitizers, or WAFs, but HTML injection is possible. It leverages unclosed HTML tags (like <img> or <link>) to capture and exfiltrate sensitive page data (CSRF tokens, session IDs, form values) by forcing the browser to include the subsequent content in a request URL.

The Desktop Commander MCP grants agents deep reach across the user's entire operating environment, extending far beyond the typical IDE sandbox. Key capabilities include maintaining persistent shell sessions, managing long-running background processes, accessing arbitrary filesystems, and natively handling structured data formats (Excel, PDF, DOCX). It also enables remote operations via SSH and large-scale content search, making it ideal for complex, multi-turn development, DevOps, and data analysis workflows.

The Exa Web Toolkit provides advanced capabilities for high-quality web search and content extraction. It excels at handling scientific, technical, and academic queries, allowing users to filter results by specialized categories like 'research paper' and specific academic domains. Beyond search, it can fetch and extract content from multiple URLs, including articles and academic PDFs, making it essential for deep scholarly research and current information gathering.

This expert playbook covers advanced techniques for testing HTTP request smuggling and desynchronization vulnerabilities. It is critical when front proxies, CDNs, or load balancers disagree with the origin server on message framing (Content-Length vs Transfer-Encoding), or during protocol downgrades (HTTP/2 to HTTP/1). Use this to uncover deep security flaws like WAF bypass and session hijacking.

This skill provides a post-generation visual pass for academic presentation decks (Beamer/PPTX). It performs a per-page Codex review against a provided reference PDF to ensure visual weight, typography, and layout consistency. It specializes in fixing font scaling, text overflow, callout styles, and layout drift without altering core content, making sure the final output is polished and professional.

This playbook details the methodology for detecting and exploiting subdomain takeover vulnerabilities. It focuses on identifying CNAME/NS/MX records pointing to deprovisioned or unclaimed cloud resources (e.g., AWS S3 buckets, Heroku apps). Understanding these weaknesses allows attackers to serve malicious content under the victim's trusted domain, leading to phishing, credential theft, and security bypasses.

A comprehensive playbook detailing expert-level techniques for exploiting web cache vulnerabilities. Covers both Web Cache Deception (stealing authenticated user data) and Web Cache Poisoning (injecting malicious content). Techniques include path confusion, unkeyed header manipulation (X-Forwarded-Host), and exploiting CDN/reverse proxy caching logic. Essential reading for penetration testers and security researchers.

This guide assists developers in building robust Model Context Protocol (MCP) servers and clients using C#/.NET. It specifically targets the stable 1.x NuGet packages, providing detailed instructions for configuring various transports (STDIO, Streamable HTTP), defining custom tools, prompts, and resources. It helps solve common integration issues like stale preview pinning, complex HTTP wiring, and structured content handling, ensuring production-ready, standard-compliant code.

This tool performs SERP-based semantic topic clustering, grouping keywords based on actual Google search engine results page (SERP) overlap, rather than simple text similarity. It designs comprehensive hub-and-spoke content clusters, complete with internal link matrices and interactive visualizations. Ideal for SEO strategists planning large-scale content architecture and pillar pages.

This tool generates comprehensive, research-backed content briefs designed to outrank current search results. It analyzes competitor gaps, classifies search intent (informational, commercial, etc.), and provides detailed, section-by-section guidance including recommended word counts and keyword placement rules. Ideal for content strategists and writers.

A comprehensive tool for optimizing e-commerce listings and analyzing market competition across major platforms. It covers on-page SEO quality (title tags, schema, content structure validation), live Google Shopping visibility, Amazon marketplace intelligence, and identifying keyword gaps. Ideal for e-commerce sellers and SEO professionals needing detailed product listing and market positioning insights.

A full-featured tool for comprehensive SEO site auditing. It supports full-site crawling, mapping site structure (URL discovery), and deep scraping of JavaScript-rendered content. Ideal for technical SEO audits, content inventory, and identifying link gaps.