Skill UI

A comprehensive tool to inspect and configure critical HTTP security headers (such as CSP, CORS, X-Frame-Options) for modern web applications. It identifies security gaps, assesses cross-origin permissions, and guides users through hardening settings like cookie behavior, ensuring the site meets current industry security standards.

A comprehensive guide covering advanced offensive methodologies for data exfiltration. Techniques include abusing DNS (dnscat2, iodine), tunneling over HTTPS/CDN, utilizing ICMP, and exploiting cloud storage services. This knowledge is critical for authorized red team engagements and post-exploitation simulations, mapping directly to MITRE ATT&CK tactics like T1048 and T1041.

This skill provides comprehensive, non-destructive testing for deployed Power Pages sites. It navigates the site, performs page crawling, verifies HTTP status codes, captures network API requests (Web API/OData), and detects console errors. It supports testing core site load, authentication flow, and data integrity.

Join and operate a signed agentbbs federation across hosts: pin peers, serve rooms, sync messages, and coordinate work claims using verified node identities.

This skill queries the NCATS Translator ARAX API for biomedical knowledge-graph relationships. It supports one-hop and two-hop lookups with Biolink constraints, entity normalization, and provider federation. Users can inspect provenance and edge bindings. It is designed for public research queries only, requiring Python 3.10+ and HTTPS access. Do not use for clinical guidance or sensitive data.

Use Upstash Redis over HTTP in serverless and edge runtimes with @upstash/redis. Covers client setup, cache-aside with TTLs, sliding-expiration sessions, and 429 rate limiting via fixed window, sliding window, or token bucket.

This skill deploys web applications with backend APIs and storage to a public URL. It supports frontend templates like React and Next.js. Users can deploy new apps or update existing ones via HTTP API calls. The workflow includes retrieving deployment instructions, fetching templates, and checking deployment status. It ensures secure API key management and tracks deployment lifecycle.

This skill empowers you to implement secure backend coding practices, focusing on input validation, authentication, and API security. It covers vulnerability prevention, defensive programming, and secure architecture implementation. Ideal for building security-first applications that resist common attack vectors like SQL injection, XSS, and CSRF. Includes expertise in database protection, secret management, and HTTP security headers.

Use Burp Suite to intercept and modify HTTP traffic, replay requests, scan web applications for vulnerabilities, and document security findings during authorized assessments.

A command-line utility to search and extract data from Burp Suite project files (.burp). It enables regex-based searches on response headers or bodies, extraction of security audit findings, and analysis of captured HTTP traffic. Requires Burp Suite Professional and the burpsuite-project-file-parser extension. Ideal for security auditing and traffic analysis workflows.

Cohesivity provides headless backend services for AI agents via a single HTTP API, including hosting, databases, storage, and LLM access. It supports ephemeral tenants with 72-hour expiration, requiring user approval for new backends. Ideal for bootstrapping new apps or adding services mid-build without vendor consoles.

This skill outlines a discipline for capturing and redacting evidence in bug bounty submissions. It guides users on masking sensitive data like session cookies and PII while preserving triage-useful metadata. It covers protocols for screenshots, HAR files, and HTTP requests to prevent data leaks.