Skill UI

A comprehensive playbook for advanced security testing, focusing on race conditions and TOCTOU (Time-of-check to time-of-use) vulnerabilities in web applications. It guides users to exploit non-atomic, state-changing operations (e.g., coupons, balance deductions, single-use rewards) by sending highly synchronized, parallel requests (including HTTP/2 single-packet attacks). Essential for identifying weaknesses in authorization and transactional integrity.

This expert playbook covers advanced techniques for testing HTTP request smuggling and desynchronization vulnerabilities. It is critical when front proxies, CDNs, or load balancers disagree with the origin server on message framing (Content-Length vs Transfer-Encoding), or during protocol downgrades (HTTP/2 to HTTP/1). Use this to uncover deep security flaws like WAF bypass and session hijacking.

This skill provides a comprehensive playbook for testing the security of SAML-based Single Sign-On (SSO) solutions. It focuses on validating assertion trust by checking signature coverage, audience and recipient restrictions, handling of Assertion Consumer Service (ACS), and identifying potential XML parsing weaknesses or IdP/SP confusion flaws. Use this when evaluating enterprise authentication systems for critical security vulnerabilities.

This skill provides comprehensive testing for WebSocket APIs, covering protocol basics, Cross-Site WebSocket Hijacking (CSWSH), and common security flaws. Use it when testing applications that rely on real-time communication, chat features, or persistent data streams. It validates Origin checks, session binding, and message integrity.

This skill enforces disciplined SLO definition based on SRE principles, ensuring that reliability promises are measurable and actionable. It guides users in selecting the right SLI (Service Level Indicator), accurately calculating error budgets, setting multi-window burn-rate alerts, and reviewing existing SLO documents for common architectural flaws (e.g., targets too aggressive, wrong SLI selection). Ideal for defining, reviewing, and maintaining service reliability commitments.

Luna serves as the final quality gate, rigorously reviewing code for objective correctness, security vulnerabilities, and overall reliability. It checks for critical flaws such as injection vulnerabilities, authorization bypasses, race conditions, and adherence to the architectural blueprint. It ensures that only high-quality, safe code progresses to QA and deployment.

This skill performs a systematic, visual, and structural audit of PowerPoint presentations. It checks for layout flaws, text overflow, style inconsistencies, and weak visual hierarchy. Ideal for QAing a deck before a meeting, ensuring readability for specific audiences (e.g., executives, clients), and pinpointing precise fixes with severity ranking.