Skill UI

Autonomously iterates review, fix, and re-review cycles until an independent reviewer approves the work or the maximum round limit is reached. Supports multiple reviewer backends and difficulty levels for research and code improvement.

This guide provides a comprehensive methodology for identifying and exploiting Insecure Direct Object Reference (IDOR) vulnerabilities in web applications and APIs. It teaches testers how to systematically manipulate object identifiers (such as numerical IDs, UUIDs, or slugs) within API requests and URLs. Techniques involve using advanced tools like Burp Suite's Authorize extension to test object-level access control, validating both horizontal (same privilege) and vertical (different privilege) access restrictions during authorized penetration tests or bug bounty engagements.

This comprehensive guide details how to design, deploy, and measure a robust anti-phishing security awareness program. By combining regular simulations, interactive role-based learning modules, and metric tracking, organizations can build a strong security-conscious culture. It covers initial baseline assessments, continuous difficulty scaling, and compliance alignment using industry-leading tools like KnowBe4 and Proofpoint.

Automate the deployment of osquery scheduled queries to continuously monitor endpoints, covering process inventory, network listeners, file integrity, and persistence mechanisms; generate osquery.conf, configure differential logging, analyze suspicious results, and produce a security report.

Provides a structured, risk-based framework for managing patches in Operational Technology (OT) and Industrial Control Systems (ICS). It addresses the critical difference between IT and OT environments, prioritizing safety and availability over immediate remediation. The guide covers risk scoring, vendor compatibility testing, staged deployment, and defining compensating controls for unpatchable assets.

This file serves as the dedicated translation resource for the MCP Server Patterns library. It is used to localize key strings and texts to ensure accurate user experience across different languages. Developers should refer to the original skill file for the core English content.

A comprehensive guide detailing Next.js 16+ usage with Turbopack. Turbopack, written in Rust, is an incremental bundler designed to drastically speed up development startup and Hot Module Replacement (HMR) by utilizing file system caching. This document guides developers on best practices, differentiating between the default Turbopack usage and when to revert to Webpack for debugging or compatibility.

This skill details how to execute HTTP Parameter Pollution (HPP) attacks. HPP exploits differences in how web applications and Web Application Firewalls (WAFs) process duplicate parameters within a single request (e.g., query strings or POST bodies). It is crucial for penetration testing to bypass input validation, WAF rules, and uncover parameter parsing inconsistencies in APIs and web forms.

A comprehensive guide detailing how to detect and exploit second-order SQL injection vulnerabilities. This technique targets scenarios where malicious input is stored in a database (e.g., user profiles, comments) and subsequently executed in an unsafe SQL query during a completely different application operation, bypassing initial sanitation checks.

An interactive tool designed to discover, select, and assemble specialized teams of AI agents. It supports structured agent collections across different domains (e.g., Engineering, Marketing). Users select multiple roles for a specific task, and the skill launches them in parallel, synthesizing their independent findings into a unified report, including consensus and conflict analysis.

This skill systematically probes an AI model's core behavioral patterns across six critical dimensions, including reasoning, refusal, formatting, and grounding. It generates a comprehensive, styled HTML report with radar charts and actionable insights, allowing users to understand a model's true capabilities, compare different models, or perform compliance and red-team assessments without needing an external API key.

Use the understand-diff skill to analyze git changes against the stored knowledge graph so you can quickly summarize modified files, affected components, and risk areas before reviewing or merging.