Skill UI

A scientific, customer-centric framework for systematically improving conversion rates on websites and landing pages. This methodology guides users through funnel mapping, identifying core visitor objections, and conducting evidence-based A/B testing. It is essential for auditing underperforming funnels, optimizing checkout flows, and transforming general marketing hypotheses into measurable, statistically significant improvements.

A systematic framework for launching and validating new products and business models. It guides users through the Build-Measure-Learn loop, emphasizing validated learning over vanity metrics, and structuring Minimum Viable Product (MVP) experiments to test core assumptions and determine if a pivot or perseverance is necessary.

This methodology converts verbose, natural language system instructions into an atomic, structured-label format (e.g., trigger:, action:). By structuring rules, it bypasses the limitations of natural language processing, ensuring LLMs allocate full attention to every constraint, thereby maximizing compliance, improving reliability, and reducing token usage.

A structured methodology for de-risking product ideas and validating market opportunities. This framework guides teams through defining measurable outcomes, building Opportunity Solution Trees (OST), mapping critical assumptions (Desirability, Viability, Feasibility), and planning rigorous experiments (prototyping, interviews, usability tests) before committing to full development resources. Ideal for discovery sprints and pre-build validation.

Structured workflow turns papers, articles, and reports into actionable briefs that capture theses, findings, methodology notes, and formatted citations for product teams and analysts needing quick research clarity.

This skill provides a comprehensive methodology for simulating privilege escalation attacks on compromised Linux and Windows environments. It guides the user through identifying vectors—including SUID abuse, misconfigured services, kernel vulnerabilities, cron job exploitation, and credential harvesting—to elevate initial low-privilege access to root or SYSTEM control. It is crucial for deep-dive penetration testing and assessing system security hardening.

This guide details a comprehensive methodology for penetration testing desktop (thick client) applications. It covers static and dynamic analysis, focusing on identifying vulnerabilities such as hardcoded credentials, insecure local storage, DLL hijacking, memory manipulation, and API communication flaws. Tools like dnSpy, Procmon, and Burp Suite are utilized for in-depth security auditing of enterprise and banking software.

This tool provides a structured methodology for triaging raw vulnerability findings generated by DAST and SAST scanners. It utilizes the OWASP risk rating methodology to validate true positives, filter out false positives, and calculate a comprehensive risk score (Risk = Likelihood x Impact). This process significantly reduces alert fatigue and ensures development teams prioritize remediation efforts on the most critical and exploitable vulnerabilities.

This skill provides a methodology and code framework to test APIs for Mass Assignment (Over-posting) vulnerabilities. It simulates malicious client requests by identifying writable endpoints and injecting unauthorized or privileged fields (e.g., role, isAdmin, balance) into the request body. The goal is to detect if the server blindly binds all client-supplied parameters to the data model without proper allowlisting or validation, potentially allowing unauthorized privilege escalation or data modification. This is crucial for adherence to OWASP API security standards.

A robust, file-driven methodology for managing complex, multi-step projects and research tasks. By utilizing dedicated Markdown files (task_plan.md, findings.md, progress.md) as persistent 'disk memory,' this system helps users overcome the limitations of the context window, ensuring all critical decisions, findings, and workflow progress are permanently tracked and easily retrieved. Ideal for long-running development cycles and detailed research.

Provides offensive security testing methodology, tooling guidance, and workflows for scanning web apps, APIs, dependencies, secrets, and infrastructure to uncover vulnerabilities before attackers exploit them.

Provides an expert methodology to significantly reduce AI API spending (40-80%) without sacrificing user quality. The guide covers cost auditing, optimizing existing systems, and designing cost-efficient architectures using techniques like model routing, prompt caching, output length control, and prompt compression.