Skill UI

This skill provides guidance on Apple's Human Interface Guidelines for designing user interfaces across different Apple platforms including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. It covers key principles like touch-first interaction for mobile, pointer and keyboard usage for desktop, and spatial interaction for visionOS. It helps developers and designers adapt layouts, navigation, and interactions to match platform conventions and user expectations, ensuring a native feel and consistent brand experience.

This skill creates or updates a shared Apple design context document for other HIG skills. It auto-discovers project details from code and assets, then gathers information on product overview, platforms, technology stack, design system, accessibility, and user context. The output is a structured markdown file used to tailor subsequent design guidance.

This skill guides users on running evaluations against models on the Hugging Face Hub using local hardware. It covers using inspect-ai and lighteval frameworks with local inference backends like vllm, Transformers, or accelerate. It includes task selection, smoke testing, and hardware guidance for different model sizes. It does not cover remote orchestration or publishing results to the community workflow.

This skill detects when AI agents exploit human trust through social engineering, deceptive guidance, or false assurances. It identifies prompts that induce unsafe actions, request sensitive credentials, or impersonate authority figures. Use this when evaluating agent safety, security advice, or decision-influencing workflows. Skip for static information.

A security testing skill that maps nine account takeover paths, including password reset poisoning, token leakage, JWT manipulation, and email change flaws, with proof and false-positive guidance for authorized assessments.

This skill covers identifying and exploiting HTTP request smuggling vulnerabilities (CL.TE, TE.CL, H2.CL, H2.TE). It includes fingerprinting front-end servers, crafting payloads for cache poisoning, and harvesting credentials via backend desyncs. Requires authorization and defensive guidance protocols.

Hunt LDAP injection and XPath injection vulnerabilities in web applications. Covers authentication bypass, blind attribute exfiltration, and Active Directory vs generic LDAP differences. Includes attack surface signals, filter grammar, and authorized-use guidance.

A specialized security skill for identifying and exploiting race condition vulnerabilities in web applications. Focuses on synchronized request attacks, double-spending, and bypassing access controls. Requires explicit authorization and defensive guidance protocols before execution.

Hunt SAML/SSO attacks including XML Signature Wrapping, comment injection, signature stripping, XXE, and NameID manipulation. Provides attack surface discovery, manual exploitation workflows, and triage guidance for authorized security assessments.

Detects and exploits server-side template injection (SSTI) across Jinja2, Twig, Freemarker, ERB, Spring, Velocity, Mako, Thymeleaf, and Smarty, offering detection payloads, RCE escalation paths, and authorized testing guidance.

Hunt TLS/SSL and DNS misconfigurations for authorized security assessments. Covers testssl.sh, sslyze, OpenSSL checks, and guidance on reporting realistic findings.

Authorized assessment of federated identity systems: SAML, OIDC, OAuth2 flows, SSO misconfiguration, and token-confusion issues. Provides workflow checklists and toolchain guidance for validating SSO flows, signature checks, redirect_uri handling, PKCE, and more.