Skill UI

This skill provides a comprehensive framework for security auditing LLM agents that possess external tools (file system access, command execution, network calls). It employs advanced dialogue probing techniques—such as command injection, path traversal, and SSRF attempts—to identify vulnerabilities where the agent might be induced to execute unexpected or malicious code, or access sensitive resources. Essential for red teaming and securing agent functionalities.

This tool extracts and formalizes the core business terminology (Ubiquitous Language) from a conversational context. It generates a structured glossary, identifies ambiguities, resolves conflicting terms, and proposes canonical names. It is essential for building consistent and unambiguous domain models, particularly when following Domain-Driven Design (DDD).

This comprehensive protocol mandates the use of structured skills (tools) at the very beginning of every conversation or response. It establishes a strict, non-negotiable workflow, requiring the AI agent to check for skill applicability even if the task appears simple or direct. It defines skill priority, platform-specific usage methods, and ensures systematic, disciplined tool application to enhance consistency and reliability.

This guide explains the universal Dependency Injection (DI) pattern used across all Webiny extensions (API, Admin, CLI, Infrastructure). It details how to correctly implement constructor injection using the `dependencies` array to access core services like Logger, BuildParams, CMS use-cases, and IdentityContext. Mastering this pattern is crucial for building maintainable, type-safe, and cohesive Webiny extensions.

This powerful compiler ingests heterogeneous research inputs, including PDF papers, code repositories, experiment logs, and raw notes. It transforms this diverse data into a comprehensive, structured Agent-Native Research Artifact (ARA). The system extracts core knowledge atoms, builds cognitive maps (claims, concepts, heuristics), and generates a verifiable, executable knowledge package for advanced AI consumption and research iteration.

This tool functions as a post-task epilogue, designed to audit and record the entire research journey. It scans the conversation history at the end of a coding or research session to extract critical research artifacts, including decisions, experiments, dead ends, claims, heuristics, and major pivots. It systematically writes this provenance data into the structured `ara/` directory, ensuring a faithful and auditable trace of how the project truly evolved.

This tool reads your local GitHub Copilot CLI conversation history using the specialized `vardoger` CLI. It analyzes your behavioral patterns, coding conventions, and usage style to generate a personalized instructions block. This block is written directly to your local Copilot configuration file, allowing the assistant to adapt its guidance and suggestions specifically to your unique habits and preferences. The process runs entirely offline, ensuring maximum privacy.

This skill simulates a hostile academic peer review process. A primary reviewer constructs the single strongest, most damaging rejection memo (200 words), followed by a second fresh reviewer who point-by-point defends the paper, surfacing unresolved critical issues. Use this to stress-test theory papers and identify fatal flaws before submission.

A comprehensive playbook for bypassing 401/403 Forbidden errors. Covers advanced techniques like path normalization tricks (encoding, traversal), HTTP method tampering, IP spoofing headers, and protocol downgrade attacks. Essential knowledge for penetration testing and security auditing.

A comprehensive guide detailing advanced security threats in Machine Learning and AI systems. Covers model supply chain attacks (RCE via pickle, poisoning), adversarial examples (FGSM, PGD, physical-world), data privacy breaches, and LLM-specific vulnerabilities. Essential for building robust, secure AI pipelines.

This router entry point is designed for comprehensive testing of file access, download endpoints, and file upload workflows. Use this guide when validating file paths, detecting Local File Inclusion (LFI), or analyzing vulnerabilities in preview, storage, or extraction processes. It helps categorize whether the security issue relates to path traversal or insecure data processing chains.

A sophisticated payload bypass technique targeting Java applications. It exploits the silent loss of high 8 bits when 16-bit Java characters are cast or written as 8-bit bytes. This allows attackers to bypass WAF/IDS security measures by making the WAF see harmless Unicode, while the backend service processes the original malicious ASCII byte payload. Ideal for blind SQLi, deserialization RCE, and path traversal. This primitive affects major frameworks like Tomcat, Spring, Jackson, and HttpClient.