Skill UI

This skill enables AI assistants to interact with the Hugging Face Hub via Model Context Protocol (MCP). Users can search for models, datasets, and papers, retrieve repository details, fetch documentation, and execute compute jobs on GPU or CPU. It also allows leveraging Gradio Spaces as functional AI tools. Ideal for developers and researchers needing direct access to the HF ecosystem for model discovery, training, and deployment workflows.

This skill helps you select and run large language models locally using llama.cpp and GGUF formats. It covers finding compatible models on the Hugging Face Hub, choosing quantization levels for different hardware like CPU, Mac Metal, CUDA, or ROCm, and launching servers via llama-cli or llama-server. It also includes instructions for converting weights and verifying OpenAI-compatible local serving endpoints.

Offensive security skill for hunting API security misconfigurations: mass assignment, JWT none/algorithm confusion, server-side prototype pollution, and server-side parameter pollution in backend URL construction. Requires explicit written authorization and a controlled lab or target scope.

This skill enables the identification and exploitation of client-side DOM vulnerabilities, including DOM Clobbering, PostMessage bypasses, Service Worker abuse, and CSS exfiltration. It is designed for authorized security assessments to discover high-value attack chains that bypass server-side filters. Users must obtain explicit written permission before testing any target.

Technique for authorized bug-bounty and penetration-testing engagements that hunts mishandled exceptional conditions in web apps, inducing unhandled exceptions with wrong-type, malformed, or boundary inputs to detect verbose stack traces, ORM internals, server paths, and framework version leaks.

This skill helps identify gRPC security vulnerabilities during penetration testing. It includes fingerprinting gRPC servers, enumerating services via reflection, testing authentication bypasses, and checking for DoS risks like HTTP/2 Rapid Reset. Requires explicit authorization for offensive use.

This skill covers identifying and exploiting HTTP request smuggling vulnerabilities (CL.TE, TE.CL, H2.CL, H2.TE). It includes fingerprinting front-end servers, crafting payloads for cache poisoning, and harvesting credentials via backend desyncs. Requires authorization and defensive guidance protocols.

This skill helps identify and exploit specific vulnerabilities in Next.js applications, such as Server Actions authentication bypasses, middleware bypasses, and SSRF via image optimization. It provides commands for fingerprinting, version detection, and testing attack vectors. Requires explicit written authorization for target scope.

Assess on-premises Microsoft SharePoint Server farms (2013/2016/2019/Subscription Edition) during authorized red-team or bug-bounty work: fingerprint versions via response headers, map exposed endpoints such as ToolPane.aspx and Authentication.asmx, and prioritize permanently unpatched legacy CVEs.

A security skill for hunting server-side request forgery (SSRF) vulnerabilities, covering cloud metadata, internal services, OOB confirmation, and authorized testing workflows.

Detects and exploits server-side template injection (SSTI) across Jinja2, Twig, Freemarker, ERB, Spring, Velocity, Mako, Thymeleaf, and Smarty, offering detection payloads, RCE escalation paths, and authorized testing guidance.

Enables deep static analysis of compiled binaries (PE/ELF/Mach-O) using IDA Pro via MCP automation. Supports decompilation, disassembly, data-flow tracking, and cross-references. Includes scripts for server management and file handling to bypass common MCP schema issues and handle system file permissions.