Skill UI

A comprehensive guide for setting up production-grade CI/CD pipelines for Go projects using GitHub Actions. It covers all critical stages: unit testing (with race detection), linting, static application security testing (SAST), vulnerability scanning, automated dependency updates (Dependabot/Renovate), Docker image builds, and automated releases via GoReleaser. Ideal for DevOps engineers establishing or improving Go project quality gates.

Covers comprehensive HTML injection attack scenarios, detection tips, and tooling so security testers can validate and document injection points, phishing overlays, and reflected or stored payloads during vulnerability assessments.

This comprehensive guide details how to configure and manage GitHub Dependabot. It covers everything from setting up initial dependency updates (npm, pip, docker, etc.) to advanced strategies like monorepo glob patterns, cross-directory grouping, and multi-ecosystem updates. Learn how to automate dependency vulnerability detection and version upgrades efficiently.

This skill provides a comprehensive, structured methodology and checklist for identifying Remote Code Execution (RCE) vulnerabilities across various web applications. It covers advanced attack vectors such as OS command injection, Server-Side Template Injection (SSTI), insecure deserialization, file upload flaws, and XXE. Use this guide during web application penetration testing or bug bounty hunting to systematically discover arbitrary code execution paths.

This skill provides a comprehensive solution for monitoring brand impersonation attacks across multiple digital vectors. It systematically scans domains, social media platforms, mobile app stores, and the dark web to detect phishing campaigns, typosquatting, and unauthorized brand usage. It is essential for security teams conducting proactive threat intelligence gathering and vulnerability assessments to safeguard brand integrity.

Perform authorized static analysis on source code to identify security vulnerabilities using tools like Semgrep and CodeQL. This workflow covers pattern hunting, dangerous API detection, and verification of vulnerability fixes. Essential for white-box audits and PR security reviews.

This skill enables scanning third-party package dependencies for known security vulnerabilities using tools like Snyk, Dependabot, and OWASP Dependency-Check. It covers managing software composition analysis, securing the software supply chain, and meeting compliance requirements. Users learn to configure scanners, interpret results, handle exceptions, and integrate security checks into CI/CD pipelines to automate vulnerability detection and remediation.

This skill helps identify and exploit specific vulnerabilities in Next.js applications, such as Server Actions authentication bypasses, middleware bypasses, and SSRF via image optimization. It provides commands for fingerprinting, version detection, and testing attack vectors. Requires explicit written authorization for target scope.

This skill helps identify and exploit specific vulnerabilities in Node.js applications. It covers techniques like prototype pollution, Express trust proxy abuse, and template engine SSTI. Users must have explicit authorization before testing. It includes fingerprinting, detection, and exploitation chains for critical security issues.

This skill provides systematic methodologies for identifying and exploiting Insecure Direct Object Reference (IDOR) vulnerabilities in web applications. It covers detection techniques using parameter manipulation, exploitation via Burp Suite, and remediation strategies. Requires authorized security assessments and multiple test accounts to verify cross-user access. Outputs include vulnerability reports, proof of concept, and remediation recommendations.

This skill provides a comprehensive command reference for penetration testing tools. It covers network scanning with Nmap, exploitation via Metasploit, password cracking, and web application testing. Users can quickly lookup commands for security assessments, vulnerability identification, and payload generation. It includes examples for host discovery, port scanning, service detection, and common exploit usage.

This skill enables comprehensive SQL injection vulnerability assessments on web applications to identify database security flaws and validate input sanitization. It supports detection of in-band, blind, and out-of-band attack vectors. Users can demonstrate exploitation techniques and extract data for authorized security testing purposes only. Requires explicit written permission before execution.