Skill UI

This skill provides a methodology and code framework to test APIs for Mass Assignment (Over-posting) vulnerabilities. It simulates malicious client requests by identifying writable endpoints and injecting unauthorized or privileged fields (e.g., role, isAdmin, balance) into the request body. The goal is to detect if the server blindly binds all client-supplied parameters to the data model without proper allowlisting or validation, potentially allowing unauthorized privilege escalation or data modification. This is crucial for adherence to OWASP API security standards.

Systematically test web applications for broken access control by mapping endpoints, configuring Burp Authorize, and exercising vertical/horizontal privilege escalation via API requests to surface unauthorized behaviors during penetration tests.

A comprehensive skill for identifying and exploiting Cross-Site Scripting (XSS) vulnerabilities in web applications. It systematically tests reflected, stored, and DOM-based contexts by injecting various JavaScript payloads. The process involves mapping all user input points, identifying output contexts (HTML body, attribute, JS string, etc.), and crafting payloads to bypass sanitization and Content Security Policy (CSP) protections, simulating real-world attacks like session hijacking and credential theft.

Evaluates OAuth 2.0 and OpenID Connect deployments for redirect URI flaws, CSRF via missing state, PKCE bypasses, token leakage, and scope escalation to ensure secure authorization-code flows before production onboarding.

Guides SOC analysts through triaging Splunk ES notable events by prioritizing queues, investigating context, correlating telemetry, enriching with threat intelligence, and documenting disposition for escalation or closure.

Guide security analysts through structured incident triage using IR playbooks—from alert intake and enrichment to severity scoring, playbook selection, and team paging—ensuring rapid, repeatable SOC responses.

Use CISA's SSVC decision tree to prioritize vulnerabilities, combining exploitation data, impact, automatability, and mission context to drive actionable remediation schedules.

Orchestrates WCAG 2.2 Level A/AA scans, fixes, and verifications across React, Next.js, Vue, Angular, Svelte, and plain HTML codebases, producing before/after diffs, contrast checks, compliance reports, and CI/CD-ready hooks.

AgentHub spawns parallel git worktree agents that compete on tasks, evaluates their outputs via metrics or LLM judges, and merges the top branch for optimizations, research, or content variations.

Ranks agent results for a session via metric runs, LLM judging, or hybrid workflows and updates session state so the winning agent can be merged.

Run NVIDIA Cosmos Policy evaluations on LIBERO and RoboCasa simulations, enabling headless EGL GPU rendering, inference profiling, and benchmark workflows via public eval entrypoints.

Guides on using SwanLab for open-source ML experiment tracking, offering local or self-hosted dashboards, rich media logging, and integrations with PyTorch, Transformers, Lightning, or Fastai for comparing runs and monitoring metrics.