Skill UI

This skill provides comprehensive best practices for securing highly sensitive financial and tax data processed by SaaS platforms, such as handling SSNs, EINs, and bank details. It covers critical security mechanisms including API key lifecycle management, webhook signature verification (HMAC), robust input validation (Zod), and PII redaction to ensure compliance with standards like SOC 2 and industry best practices.

A comprehensive checklist and guide for deploying Klaviyo integrations to a production environment. This utility covers all critical stages from pre-deployment validation to go-live, including API authentication, webhook security, robust error handling (retry logic, exponential backoff), and essential monitoring setup. It ensures stable and reliable execution of email and SMS marketing campaigns.

A comprehensive guide detailing best practices for securing MindTickle integrations. It covers critical technical requirements including using `Company-Id` for multi-tenant isolation, implementing HMAC-SHA256 verification for webhooks, strict SCIM payload validation, and PII redaction. Essential for developers ensuring compliance with GDPR and SOC2 standards when handling sensitive employee and HR data.

A comprehensive checklist detailing advanced attack methodologies for JSON Web Tokens (JWT). Covers critical misconfigurations such as algorithm confusion (alg:none, RS256→HS256), weak secret brute forcing, header injection (kid, jku, jwk), cache poisoning, and improper validation. Also provides specific vectors for extracting JWTs from mobile environments (Android/iOS). Ideal for penetration testers conducting deep security assessments on authentication systems.

This comprehensive checklist guides thorough security testing of OAuth 2.0 and OpenID Connect (OIDC) protocols. It covers advanced vulnerabilities such as authorization code interception, PKCE bypass, CSRF flaws, and improper scope validation. The methodology emphasizes modern industry standards like FAPI (DPoP, JAR, PAR), making it essential for penetration testers and security researchers assessing web application integrity and API security.

Implement comprehensive automated policy enforcement for Shopify apps, ensuring security and adherence to App Store guidelines. This skill includes ESLint rules for detecting hardcoded API secrets, enforcing GraphQL query cost budgets, and running pre-commit hooks and CI checks for critical compliance validations (e.g., GDPR webhooks). Use it when hardening a production-ready Shopify application.

This comprehensive guide details essential security practices for deploying WebContainers. It covers implementing Content Security Policy (CSP) headers, ensuring robust sandbox isolation, and performing rigorous input validation to mitigate common web vulnerabilities. Use this when developing applications with WebContainers or the StackBlitz SDK.

This guide covers essential security best practices for utilizing Together AI's OpenAI-compatible API for inference, fine-tuning, and model deployment. It provides code examples and architectural advice on secure API key management, robust webhook signature verification, input validation using schemas (like Zod), and implementing data redaction pipelines to protect sensitive information in logs and datasets. Essential for building secure AI applications.

Provides comprehensive, enterprise-grade patterns for setting up and managing Veeva Vault across multiple environments. This guide is essential for implementing advanced, compliant deployment strategies in the regulated life sciences sector, covering API usage (VQL, VAPIL) and best practices for data validation and security.

This skill performs comprehensive, feature-level integration validation after all associated development tasks are implemented. It goes beyond checking individual tasks to ensure cross-task consistency, full test suite passage, and complete specification coverage. It validates data flow, architectural adherence, and performs critical security scans for residual issues (e.g., TODOs, hardcoded secrets), providing a holistic GO/NO-GO assessment for deployment. Use this skill as a final quality gate to verify that the completed feature set respects the designed boundaries and dependencies end-...

A comprehensive playbook for security testing APIs relying on JWT, bearer tokens, or API keys. It covers token validation weaknesses (e.g., 'alg:none', RS256 confusion), claim misuse, header spoofing, rate limit bypass, and mass assignment vulnerabilities. Ideal for penetration testers assessing authentication boundaries.

This expert playbook provides comprehensive techniques for testing Cross-Site Request Forgery (CSRF) vulnerabilities in web applications. It covers identifying state-changing endpoints, bypassing anti-CSRF tokens (including missing validation and predictable tokens), and exploiting modern weaknesses like SameSite=Lax via GET methods or misconfigured JSON APIs. Essential reading for security professionals and penetration testers.