Skill UI

A comprehensive guide for systematically assessing REST and GraphQL API endpoints against the OWASP API Security Top 10 risks. This includes practical workflows for testing critical vulnerabilities such as Broken Object Level Authorization (BOLA), broken authentication, excessive data exposure, and rate limiting, using tools like Burp Suite, Postman, and ffuf. Ideal for pre-deployment audits and authorized penetration testing engagements.

A comprehensive methodology for penetration testing web applications to identify broken access control vulnerabilities. This guide covers systematic testing for Role-Based Access Control (RBAC), privilege escalation, insecure direct object references (IDOR), and API authorization flaws in multi-tenant environments. It outlines the use of tools like Burp Suite and ffuf to map endpoints and simulate various user roles.

A comprehensive guide detailing how to identify and validate Cross-Site Scripting (XSS) vulnerabilities using Burp Suite's advanced tools (Repeater, Intruder, DOM Invader). This methodology covers reflected, stored, and DOM-based XSS, and includes strategies for bypassing security filters and Content Security Policy (CSP), making it essential for web application penetration testing and bug bounty programs.

A comprehensive guide for assessing the security of JSON Web Token (JWT) implementations. This toolkit details attacks against cryptographic weaknesses, including algorithm confusion (e.g., RS256 to HS256), 'none' attacks, brute-forcing HMAC secrets, and claim manipulation. Ideal for penetration testing and security audits of modern APIs and SSO systems.

A comprehensive guide and toolkit for performing deep security assessments on mobile application backends. It covers identifying vulnerabilities such as broken authentication, insecure token management (JWT, opaque tokens), session fixation, privilege escalation, and IDOR (Broken Object-Level Authorization) across various OAuth flows (OIDC, PKCE). Essential for penetration testers assessing API security.

A comprehensive guide and framework for assessing real-time WebSocket APIs (ws:// or wss://). This skill covers critical security checks, including Cross-Site WebSocket Hijacking (CSWSH), authentication bypass, message injection attacks, input validation flaws, and denial-of-service (DoS) via message flooding. It utilizes tools like Burp Suite and Python for simulating malicious payloads and ensuring secure real-time communication channels.

This playbook guides Security Operations Center (SOC) analysts through a comprehensive, multi-step process for triaging and prioritizing security incidents. It covers receiving alerts from SIEM/EDR, enriching data using threat intelligence feeds (VirusTotal, AbuseIPDB), classifying the incident type (MITRE ATT&CK mapping), and calculating a severity score based on asset criticality and data sensitivity. The workflow culminates in automating ticket creation and triggering immediate response procedures via tools like PagerDuty.

This tool implements the Stakeholder-Specific Vulnerability Categorization (SSVC) framework, providing a structured decision-tree methodology for advanced vulnerability prioritization. It moves beyond traditional CVSS scoring by incorporating critical factors such as active exploitation status (CISA KEV), technical impact, automatability, and mission prevalence. It generates actionable remediation priorities (Track, Attend, Act) to guide security teams in managing risk and improving security program maturity.

This guide assists developers in designing and architecting Model Context Protocol (MCP) servers that integrate deeply with LLMs like Claude. It is not a coding skill, but a comprehensive consultation process that guides users through use case interrogation, determines the optimal deployment model (e.g., Remote HTTP, MCPB), and selects the appropriate tool-design pattern for seamless, robust integration.

A comprehensive toolset to scaffold, build, sign, and package SwiftPM-based macOS applications entirely without requiring an Xcode project. It guides users through the end-to-end process, including setting up the project, running the app, performing code signing, notarization, and generating update appcasts for robust, reproducible releases.

A comprehensive guide to diagnosing and resolving performance bottlenecks in React applications. This skill teaches advanced techniques like state isolation, memoization (using `useMemo`, `useCallback`, and `React.memo`), and list virtualization. It guides users through profiling using React DevTools to identify render hotspots, ensuring components render efficiently and maintain high application responsiveness.

This tool guides users through professional customer research methodologies. It enables the analysis of existing assets (transcripts, surveys, support tickets, reviews) to extract deep insights like Jobs to Be Done, pain points, and emotional triggers. It also guides the gathering of new intelligence from online sources (Reddit, forums, reviews) to ensure all product, marketing, and copy decisions are grounded in verifiable customer reality, minimizing assumption bias.