Skill UI

Four-phase debugging methodology with root cause analysis. Use when investigating bugs, fixing test failures, or troubleshooting unexpected behavior. Emphasizes NO FIXES WITHOUT ROOT CAUSE FIRST.

A methodology for managing project context as structured artifacts alongside code to ensure consistent AI interactions and team alignment. It involves defining product vision, tech stack, and workflows before implementation, supporting both new and existing projects.

This specialized skill guides the creation of long-form structural critical essays and detailed academic dossiers, primarily for Chinese academic contexts. It utilizes the CrossFrame methodology to first establish a foundational structure, define evidence boundaries, and identify key mechanisms, before applying a critical matrix. The output is highly structured, ensuring depth, rigorous source checking, and comprehensive critical analysis suitable for complex intellectual work.

This skill provides a structured methodology for tackling complex bugs, performance bottlenecks, and production incidents. It guides users through reproducing issues, forming hypotheses, performing controlled experiments, and narrowing down the scope using proven strategies and tools. Ideal for deep dive troubleshooting and root cause analysis in complex software systems.

Master the full penetration testing lifecycle: reconnaissance, scanning, vulnerability analysis, exploitation and reporting. Covers tools like Nmap, Nikto, theHarvester, OSINT techniques, OWASP web testing and professional report deliverables for authorized security assessments only.

A skill for identifying and exploiting authentication bypass vulnerabilities in web applications, including SSO/SAML, OAuth, XMLRPC, and API auth layers. Provides a step-by-step methodology, attack surface signals, and crown jewel targets. For authorized security assessments only.

A security-testing methodology for hunting fintech-specific GraphQL flaws such as ledger desync, decimal rounding abuse, idempotency replay, source-account IDOR and KYC field authorization gaps. For authorized assessments only.

Hunting skill for GraphQL vulnerabilities. Provides methodology to discover endpoints, test introspection, map schemas, and exploit authorization flaws across GraphQL and REST APIs.

A security skill for identifying and exploiting Host header injection vulnerabilities, including password reset poisoning, web cache poisoning, and routing-based SSRF. Provides step-by-step testing methodology and commands for authorized assessments only. Built from public research and real-world findings.

A security hunting skill for IDOR vulnerabilities, built from 26 public bug bounty reports. Provides methodology, attack surface signals, and payload patterns for authorized security assessments.

Hunting methodology for OAuth vulnerabilities from 22 bug bounty reports, covering redirect_uri bypass, CSRF state, nonce replay, referrer leakage, and mobile deep link attacks for authorized security assessments.

Methodology for hunting open redirect flaws in web apps: parameter discovery, bypass payloads, DOM-based sinks, OAuth auth-code theft chains and SSRF escalation. Docs-only, for authorized bug bounty and pentest use.