Skill UI

This comprehensive guide covers security best practices for building robust Quarkus applications. It details how to implement secure authentication (JWT, OIDC), role-based authorization (RBAC), robust input validation (Bean Validation), and advanced protection against vulnerabilities like SQL injection and CSRF. Essential for securing resource access and managing application secrets.

A guide for security researchers focused on finding exploitable, remote-reachable vulnerabilities for bug bounties or responsible disclosure. It emphasizes high-signal flaws such as SSRF, RCE, and SQL injection, while guiding users through the professional triage and PoC creation process for penetration testing.

A comprehensive security auditing tool designed for Claude Code environments. It scans the entire configuration directory for security vulnerabilities, misconfigurations, injection risks, hardcoded secrets, and overly permissive settings. Ideal for initial project setup, pre-commit checks, or routine security hygiene.

This skill provides deep intelligence by systematically scraping and analyzing a competitor's paid advertising campaigns across platforms like Meta and Google. It goes beyond simple ad collection, performing structured analysis on creative patterns, common hooks (e.g., Fear/Loss, Outcome), CTAs, and reverse-engineering their landing page funnels to reveal their core positioning and potential vulnerabilities. Ideal for product marketing, growth strategy, and campaign optimization.

Performs a comprehensive security audit of Model Context Protocol (MCP) implementations, including servers, clients, and tools. This skill reviews code against critical security baselines (MCP-01 to MCP-05), OWASP MCP Top 10, and common Remote Code Execution (RCE) vectors (e.g., command injection, deserialization, SSRF). The output provides a detailed report with file and line references, ensuring compliance and identifying vulnerabilities before release. Use this when auditing network-exposed services or client security posture.

This comprehensive guide provides a structured workflow for academic submissions to the NDSS security symposium. It maps out the distinct summer and fall submission cycles, detailing critical milestones from the initial paper deadline through early-reject, rebuttal, notification, and final camera-ready stages. It emphasizes strategic backward planning, managing the sensitive disclosure clock for vulnerabilities, and positioning research within the broader security research lifecycle.

This tool provides a comprehensive, multi-faceted audit of a codebase's health. It scores the project across critical areas like security vulnerabilities, exposed secrets, dependency risks, and structural integrity. Ideal for senior engineers performing pre-commit or pre-release quality assessments to identify weak spots and generate a prioritized remediation plan.

A comprehensive white-box security auditing workflow designed for proprietary source code. It integrates static analysis security testing (SAST) tools like Semgrep and CodeQL to detect common vulnerabilities (e.g., injection, IDOR, crypto misuse), followed by mandatory manual threat modeling and verification steps. Applicable for PR reviews and pre-deployment security checks.

A specialized downstream skill for CTF-sandbox workflows. Used to analyze complex security challenges driven by AI agent interactions, prompt injection, or infrastructure vulnerabilities. Focuses on tracing control chains involving untrusted input, tool side effects, deployment drift, container runtime issues, and CI/CD supply chain provenance. Ideal for rigorous vulnerability assessment in modern, distributed systems.

A specialized skill for detecting discrepancies (drift) between declared API contracts (such as GraphQL schemas, OpenAPI specs, and RPC manifests) and the actual behavior of live backend handlers. It is used to identify hidden operations, contract mismatches, or vulnerabilities resulting from schema evolution, versioning skew, or implementation gaps. Must be used after initial sandbox assumptions are established.

A specialized downstream skill for deep security analysis of JSON Web Tokens (JWT), JWS, and JWE. It guides the identification of vulnerabilities where token components (headers, claims, keying) lead to unauthorized identity assumption or privilege escalation. Use this to trace the full path from token supply to final application acceptance.

A specialized deep-dive skill for analyzing container-to-host escape vulnerabilities. This tool is used after a sandbox orchestrator establishes initial assumptions, focusing on mapping isolation boundaries (namespaces, cgroups, seccomp, capabilities). It helps prove boundary crossings, identify minimal exploit primitives, and determine if an exploit can break out of the container context to the host kernel.