Skill UI

This skill enables users to build reusable command-line scripts and utilities for interacting with the Hugging Face API. It supports chaining API calls, automating repetitive tasks, and processing model or dataset data efficiently. Scripts utilize HF_TOKEN for authentication and can leverage the hf CLI for advanced repository interactions.

This skill detects when AI agents exploit human trust through social engineering, deceptive guidance, or false assurances. It identifies prompts that induce unsafe actions, request sensitive credentials, or impersonate authority figures. Use this when evaluating agent safety, security advice, or decision-influencing workflows. Skip for static information.

This skill is designed to detect and rewrite text that exhibits common characteristics of AI-generated Chinese writing, such as rigid structures, mechanical connectors, and over-polished phrasing. It helps users 'de-AI' their content by restoring natural human rhythm. Key use cases include reducing AIGC signals in academic papers (for CNKI/VIP checks), and converting the writing tone to specific styles like Zhihu, Xiaohongshu, or literary prose.

Offensive security skill for hunting API security misconfigurations: mass assignment, JWT none/algorithm confusion, server-side prototype pollution, and server-side parameter pollution in backend URL construction. Requires explicit written authorization and a controlled lab or target scope.

Techniques for hunting ASP.NET-specific attack surfaces, including ViewState deserialization, Telerik, WCF, and SharePoint. Requires explicit authorization and mandates a confirmation gate before any probing.

A security testing skill that maps nine account takeover paths, including password reset poisoning, token leakage, JWT manipulation, and email change flaws, with proof and false-positive guidance for authorized assessments.

A skill for identifying and exploiting authentication bypass vulnerabilities in web applications, including SSO/SAML, OAuth, XMLRPC, and API auth layers. Provides a step-by-step methodology, attack surface signals, and crown jewel targets. For authorized security assessments only.

A skill for identifying and exploiting business logic vulnerabilities in web applications, focusing on payment flows, verification bypasses, rate-limiting issues, and unprotected internal surfaces. Requires explicit authorization for testing.

Authorized security testing skill for hunting web cache poisoning and password reset host-header injection. Maps CDN caching layers, probes unkeyed headers such as X-Forwarded-Host, and verifies cache HIT signals to confirm exploitable poisoned responses.

This skill focuses on identifying clickjacking vulnerabilities where malicious sites overlay transparent iframes over legitimate pages to trick users into unintended actions. It involves checking security headers like X-Frame-Options and CSP, verifying if sensitive actions can be triggered via framing, and ensuring proper authorization before testing. It is strictly for authorized security assessments and bug bounty programs.

Authorized-only guide for hunting CORS misconfigurations, validating credentialed cross-origin reads with browser PoCs, and prioritizing high-impact targets.

This skill acts as a loader for the /hunt orchestrator, facilitating authorized security assessments. It enforces strict scope boundaries and requires explicit written authorization before execution. The tool includes baseline checks to avoid false positives and fingerprinting capabilities to identify technology stacks like Next.js or cloud providers. It focuses on generating reproducible findings for remediation rather than exploitation.