Skill UI

This comprehensive playbook details advanced techniques for detecting Prototype Pollution vulnerabilities in JavaScript environments (Node.js and browser). It covers various attack vectors, including using `__proto__` and `constructor.prototype` paths, and provides black-box testing payloads for JSON parsing, query string merging, and deep object assignment. Use this when analyzing applications for potential Remote Code Execution (RCE) or unintended property leakage via object merging sinks.

A comprehensive, expert playbook for challenging insecure file upload mechanisms. It provides advanced attack vectors covering validation bypass (magic bytes, extension), storage path abuse (traversal, overwrite), and exploitation of post-upload processing chains (XXE, RCE, CMDi). Essential for deep security auditing of file-handling workflows.

An expert-level playbook covering non-obvious XSS techniques, advanced payload selection across various sinks (DOM, SVG, HTML attributes, JavaScript), and sophisticated defense bypass strategies. Use this guide for real-world penetration testing, including WAF bypass, CSP bypass, HttpOnly bypass, and XS-Leaks side channel exploitation. It assumes deep knowledge of web vulnerability mechanics.

A comprehensive CI/CD quality gate for Quarkus microservices. This pipeline guides developers through critical stages: build integrity, static code analysis (Checkstyle, SonarQube), thorough unit/integration/API testing with coverage enforcement, dependency vulnerability scanning, native compilation validation (GraalVM), and performance load testing using K6. It ensures high code quality before PR or deployment.

A guide for security researchers focused on finding exploitable, remote-reachable vulnerabilities for bug bounties or responsible disclosure. It emphasizes high-signal flaws such as SSRF, RCE, and SQL injection, while guiding users through the professional triage and PoC creation process for penetration testing.

This skill provides an active penetration testing toolchain covering information gathering, port scanning, vulnerability scanning, web attacks (SQL injection, XSS), directory brute-forcing, and password cracking. It exposes 20+ security tools to AI agents via MCP servers for authorized security assessments.

A comprehensive, black-box workflow designed for professional bug bounty hunting and penetration testing. It guides users through a 5-stage methodology (Intake, Recon, Enum, Hunt, Report), covering 19+ advanced attack playbooks (e.g., RCE, SQLi, XSS, SSRF). The skill integrates real-world exploit cases, structured payloads, and WAF bypass techniques for maximizing vulnerability discovery in web applications and APIs.

Comprehensive techniques for testing REST, SOAP, and GraphQL APIs during bug bounty hunting and penetration testing. Covers vulnerability discovery, authentication bypass, IDOR exploitation, injection attacks, and API-specific vectors.

A specialized workflow guide for comprehensive security testing of REST and GraphQL APIs. It systematically covers critical security aspects such as authentication validation (OAuth2, JWT), authorization checks (IDOR, privilege escalation), input validation (SQL/NoSQL injection), rate limiting enforcement, and secure error handling. Ideal for vulnerability assessment, bug bounty programs, and pre-deployment security audits.

Execute comprehensive web application security testing with Burp Suite, covering HTTP interception, request modification, Repeater, scope filtering, and vulnerability scanning for authorized assessments.

Audit authorized codebases for exploitable vulnerabilities using scoped reconnaissance, adversarial review, validation, and structured reporting. Use for security reviews, pen-testing, and vulnerability hunting in web apps, APIs, services, CLI tools, libraries, and daemons.

Orchestrate multi-dimensional code reviews covering quality, security, performance, and testing using specialized AI agents. Includes architecture analysis, vulnerability assessment, and test coverage evaluation with actionable remediation guidance.