Skill UI

Guides pentesters through detecting Broken Object Level Authorization in REST and GraphQL APIs by enumerating object IDs, intercepting requests, manipulating identifiers, and verifying per-object access controls during OWASP API1 assessments.

Automates mass-assignment checks by injecting privileged properties (role, balance, pricing, permissions) into writable JSON/XML API endpoints so security teams can verify OWASP API3 Broken Object Property Level Authorization defenses and spot auto-binding vulnerabilities.

Guides offensive and defensive teams through systematic REST, GraphQL, and gRPC API testing against the OWASP API Security Top 10, covering discovery, authorization flaws, authentication gaps, data exposure, and rate limiting checks with common tooling.

Provides a workflow for auditing web apps against OWASP A01 Broken Access Control by mapping endpoints, configuring Burp Authorize, and exercising privilege escalation tests across admin, manager, and user roles plus exposed APIs.

AuraKit converts a single /aura command into a secure full-stack Claude pipeline with 34 modes, OWASP SEC-01~15 safeguards, runtime hooks, tiered models, token savings, and multilingual reviewers.

Guides offensive security testing for web applications, APIs, infrastructure, dependencies, and secrets, including OWASP Top 10 audits, static/dependency scanning, API/infra checks, and report workflows that support authorized penetration tests.

Guides authorized iOS penetration testers through static and dynamic analysis, Frida/Objection instrumentation, SSL pinning bypass, keychain auditing, and IPA inspection to validate transport, data protection, and runtime defenses under OWASP MASTG.