Skill UI

Provides a comprehensive audit of content quality, focusing on E-E-A-T (Experience, Expertise, Authoritativeness, Trustworthiness) signals, readability, and structural integrity. Use this tool when reviewing content for SEO optimization, assessing academic citation readiness, or ensuring adherence to modern search engine and AI best practices.

A comprehensive CLI for managing the entire lifecycle of Windows applications. It handles initialization, building, packaging into MSIX, signing, debugging, and advanced UI automation via Microsoft UI Automation. Supports multiple modern frameworks including .NET, C++, Electron, Rust, and Flutter, streamlining the deployment process to the Microsoft Store.

This guide outlines a mandatory, evidence-based protocol for declaring any work complete, fixing a bug, or submitting a pull request. It strictly mandates that all claims of success must be supported by fresh, verifiable evidence, such as passing test outputs, successful build logs, or comprehensive checklist verification. It eliminates reliance on assumptions, gut feelings, or trusting proxy reports.

Gtars is a high-performance toolkit written in Rust with Python bindings, designed for comprehensive analysis of genomic interval data. It provides specialized modules for overlap detection, generating coverage tracks (WIG/BigWig), tokenization for Machine Learning models, and detailed fragment analysis in single-cell genomics. Use it for robust bioinformatics pipelines and computational genomics research.

This skill performs a deep, cross-model audit of experimental results to ensure integrity before claiming findings. It systematically checks for common fraud patterns, such as generating fake ground truths, misleading score normalization, or citing phantom results. Use it when evaluating reported experimental outcomes to ensure methodological rigor and trustworthiness.

This comprehensive, zero-trust security auditor scans third-party AI agent skills before installation. It performs a rigorous 6-phase review process, analyzing surface patterns, script integrity, permissions, and supply chain risks. It is designed to detect malicious payloads, credential theft, instruction overrides, and prompt injection attacks, ensuring secure AI development and deployment.

Methodology for red team testing of on-prem Active Directory, hybrid AD/Entra ID, and ADCS. Covers reconnaissance, credential abuse, privilege escalation, lateral movement, persistence, trust abuse, and Defender for Identity evasion.

This comprehensive playbook guides the testing of Cross-Origin Resource Sharing (CORS) misconfigurations. It focuses on detecting critical vulnerabilities such as reflected origins, wildcard trust misuse, credentialed cross-origin reads, and bypasses in origin allowlists. Use this when analyzing browser-based access and trust boundaries for authenticated APIs.

This comprehensive guide details advanced techniques for circumventing Content Security Policies (CSP). It covers exploiting weaknesses in critical directives (e.g., base-uri, object-src), abusing nonces, leveraging trusted CDN endpoints, and executing code despite strict controls like script-src 'self' or 'strict-dynamic'. Essential knowledge for deep security auditing and penetration testing.

An expert playbook detailing DNS rebinding techniques to bypass the Same-Origin Policy (SOP). This method is used in penetration testing to exploit client-side applications that rely on DNS resolution for origin checks, allowing attackers to trick the browser into sending requests to internal, non-publicly accessible services (like cloud metadata endpoints) while maintaining a seemingly trusted origin.

This skill provides a comprehensive playbook for testing the security of SAML-based Single Sign-On (SSO) solutions. It focuses on validating assertion trust by checking signature coverage, audience and recipient restrictions, handling of Assertion Consumer Service (ACS), and identifying potential XML parsing weaknesses or IdP/SP confusion flaws. Use this when evaluating enterprise authentication systems for critical security vulnerabilities.

This playbook details the methodology for detecting and exploiting subdomain takeover vulnerabilities. It focuses on identifying CNAME/NS/MX records pointing to deprovisioned or unclaimed cloud resources (e.g., AWS S3 buckets, Heroku apps). Understanding these weaknesses allows attackers to serve malicious content under the victim's trusted domain, leading to phishing, credential theft, and security bypasses.