Skill UI

This generator provides a comprehensive, production-ready template for building a Model Context Protocol (MCP) server using Kotlin. It sets up the full Gradle structure, integrates essential dependencies (MCP SDK, Ktor, Coroutines), and includes robust placeholders for custom tools, error handling, and testing, accelerating the development of context-aware backend services.

This tool scaffolds a complete, production-ready Model Context Protocol (MCP) server project written in Rust. It utilizes the official `rmcp` SDK to ensure full compatibility. The generated structure includes modules for handling logic, defining tools, managing prompts, and providing resources. Users can configure different transports (stdio, SSE, HTTP) and immediately run the server for integration testing or production use.

This comprehensive checklist guides thorough security testing of OAuth 2.0 and OpenID Connect (OIDC) protocols. It covers advanced vulnerabilities such as authorization code interception, PKCE bypass, CSRF flaws, and improper scope validation. The methodology emphasizes modern industry standards like FAPI (DPoP, JAR, PAR), making it essential for penetration testers and security researchers assessing web application integrity and API security.

This guide outlines best practices and structured workflows for automating complex tasks within the Unity Editor using the Model Context Protocol (MCP). It provides programmatic methods for managing GameObjects, applying script edits, analyzing the editor state, executing batch commands, and capturing detailed, multi-view screenshots. Ideal for developers needing robust, repeatable, and automated testing or operational tasks within Unity projects.

Captures complete, full-page screenshots of any modern web page using the Chrome DevTools Protocol (CDP). Unlike standard tools, this utility handles Single Page Applications (SPAs), scrolling content, lazy-loaded images, and complex scroll containers, ensuring the entire visible content is captured in a single, high-fidelity PNG file. Ideal for documenting complex web flows and testing.

A hands-on methodology for testing IoT and embedded devices, covering hardware reconnaissance, firmware extraction and analysis, bootloader access, runtime exploitation, wireless protocol attacks, companion app review, and cloud API abuse.

A comprehensive playbook for bypassing 401/403 Forbidden errors. Covers advanced techniques like path normalization tricks (encoding, traversal), HTTP method tampering, IP spoofing headers, and protocol downgrade attacks. Essential knowledge for penetration testing and security auditing.

This guide serves as the core entry point for comprehensive security testing of identity and access control mechanisms. It is designed to help testers systematically identify vulnerabilities across login flows, session management, object authorization (IDOR), and modern protocols like JWT, OAuth, CORS, and SAML. Use this when planning security audits for any web application with user accounts.

This skill serves as the primary entry point and operating doctrine for authorized security tasks including web testing, API assessment, and penetration testing. It enforces strict authorization, scope management, and safety constraints while routing complex tasks to specialized deep skills like code audit or incident response.

This expert playbook details advanced attack vectors specific to the HTTP/2 protocol. It covers sophisticated techniques such as h2c smuggling, exploiting pseudo-header discrepancies, HPACK compression vulnerabilities, and abusing stream multiplexing. Use this skill for professional penetration testing and security auditing of H2 services, especially for bypassing proxy-level controls and WAFs.

This expert playbook covers advanced techniques for testing HTTP request smuggling and desynchronization vulnerabilities. It is critical when front proxies, CDNs, or load balancers disagree with the origin server on message framing (Content-Length vs Transfer-Encoding), or during protocol downgrades (HTTP/2 to HTTP/1). Use this to uncover deep security flaws like WAF bypass and session hijacking.

This skill provides comprehensive testing for WebSocket APIs, covering protocol basics, Cross-Site WebSocket Hijacking (CSWSH), and common security flaws. Use it when testing applications that rely on real-time communication, chat features, or persistent data streams. It validates Origin checks, session binding, and message integrity.