Skill UI

This skill guides users through analyzing suspicious URLs using the URLScan.io platform or API. It provides a safe environment to capture screenshots, DOM content, network traffic, and analyze JavaScript behavior to investigate phishing attempts, credential harvesting, and sophisticated malicious redirects without risking the analyst's system.

This comprehensive toolkit provides deep static analysis capabilities for suspicious PDF documents. Using tools like PDFiD, pdf-parser, and peepdf, it identifies embedded malicious structures—including JavaScript code, shellcode, auto-actions, and exploit kits—without opening or rendering the file. It is essential for security analysts conducting threat triage, forensic investigation, and assessing potential attack vectors from suspicious attachments.

Bun is a high-performance, all-in-one JavaScript runtime and toolchain. It functions as a runtime, package manager, bundler, and test runner, offering significant speed improvements over traditional Node.js setups. It is ideal for modern, fast-paced development, new projects, and deployment environments like Vercel.

A comprehensive, multi-step workflow for analyzing and deobfuscating highly complex and malicious JavaScript code. It guides users through extracting scripts from phishing pages and web skimmers, identifying obfuscation techniques (Base64, Unicode escapes, eval chains), neutralizing anti-analysis features, and progressively decoding string layers to reveal the original malicious payload for thorough threat intelligence and malware analysis.

A comprehensive tool and guide for detecting and exploiting NoSQL injection vulnerabilities in MongoDB, CouchDB, and similar databases. It simulates advanced attacks such as authentication bypass, blind data extraction using regex, and JavaScript execution via the $where operator. Ideal for penetration testers and security researchers assessing APIs and web applications backed by NoSQL backends.

This skill guides the detection and exploitation of JavaScript prototype pollution vulnerabilities. It covers both client-side (DOM XSS) and server-side (RCE, Auth Bypass) attacks by injecting properties into Object.prototype using keys like `__proto__`. Use this when assessing APIs that deep-merge or clone user-controlled JSON data, or for general web application security testing.

A comprehensive guide for performing security assessments to identify various forms of sensitive data exposure, such as leaked API keys, PII in API responses, insecure client-side storage, and unprotected data transmission. This workflow covers scanning JavaScript files, analyzing API responses, verifying data encryption, and examining browser storage.

Astro is a modern web framework designed specifically for building high-performance, content-heavy websites like blogs, documentation sites, and portfolios. Its core innovation is the Islands Architecture, which ships zero JavaScript by default, drastically improving performance and Core Web Vitals. It supports multi-framework components (React, Vue, Svelte) in a single project, making it ideal for content developers prioritizing speed and flexibility.

Transformers.js allows developers to run state-of-the-art machine learning models directly within JavaScript/TypeScript environments (browser, Node.js). It supports a comprehensive range of tasks including NLP (text generation, summarization, translation), Computer Vision (image classification, object detection), and Audio processing. This capability enables building fully client-side, multimodal AI applications without requiring a dedicated Python backend or server infrastructure.

This guide addresses the critical difference between standard Node.js SHA3-256 and the Keccak-256 hash function required by Ethereum. Using the wrong hash function can silently corrupt calculated function selectors, event topics, storage slots, and derived addresses. It provides best practices and code examples for using dedicated libraries (like ethers, viem, web3.js) to ensure correct, Ethereum-compliant hashing in JavaScript and TypeScript environments.

Controls BrowserWing-based browsers via HTTP endpoints to navigate pages, interact with elements (click/type/select), capture accessibility snapshots, run JavaScript, take screenshots, and execute batch sequences for data extraction workflows.

This skill provides a comprehensive workflow to transform raw data into professional visual charts. It intelligently analyzes data features (e.g., trends, comparisons, flows) to select the optimal chart type (line, bar, pie, etc.). Users provide data and specifications, and the skill generates a high-quality, detailed chart image using a structured JavaScript process.