Skill UI

An expert-level playbook covering non-obvious XSS techniques, advanced payload selection across various sinks (DOM, SVG, HTML attributes, JavaScript), and sophisticated defense bypass strategies. Use this guide for real-world penetration testing, including WAF bypass, CSP bypass, HttpOnly bypass, and XS-Leaks side channel exploitation. It assumes deep knowledge of web vulnerability mechanics.

This workflow automates the AWS Well-Architected Framework (WAF) review. It scans Infrastructure as Code (IaC) files (Terraform, CloudFormation, CDK) and deployed AWS resources against 6 pillars (Security, Reliability, etc.). It identifies risks, generates detailed findings, and automatically creates trackable GitHub issues for remediation, ensuring adherence to industry best practices.

This workflow performs a comprehensive review against the Azure Well-Architected Framework (WAF) using your existing Infrastructure as Code (IaC) and deployed resources. It systematically checks the five pillars—Reliability, Security, Cost Optimization, Operational Excellence, and Performance Efficiency—identifying architectural risks, drift, and compliance gaps. Findings are automatically logged and converted into actionable GitHub issues for streamlined remediation.

This skill provides comprehensive management of the Web Application Firewall (WAF) for Power Pages production sites. It allows users to check the current protection status, recommend necessary security measures, and apply granular rules such as IP blocking, country restrictions, path access controls, and rate limits. Use it to secure sites against brute-force attacks or common web vulnerabilities.

A comprehensive, black-box workflow designed for professional bug bounty hunting and penetration testing. It guides users through a 5-stage methodology (Intake, Recon, Enum, Hunt, Report), covering 19+ advanced attack playbooks (e.g., RCE, SQLi, XSS, SSRF). The skill integrates real-world exploit cases, structured payloads, and WAF bypass techniques for maximizing vulnerability discovery in web applications and APIs.

Audit and fix a site's readiness for AI browsing agents: the Lighthouse Agentic Browsing fraction, accessibility tree, robots.txt and Content-Signal, WAF treatment of agent traffic, llms.txt, Markdown delivery, ai-catalog.json, /.well-known files and WebMCP tools.

Methodology for detecting client SOC patches, attacker activity, and security-state changes that occur during a red-team engagement. Triggers on recheck failures, timing shifts, new WAF cookies, and lockout anomalies. Provides investigation discipline, WAF-evasion confirmation, and positive finding templates for IR responsiveness.

A security payload collection containing XSS, SSRF, and SQL injection payloads, CSP/WAF bypass techniques, wordlists, and submission rules for authorized penetration testing.

A comprehensive five-phase methodology for bug bounty and SRC vulnerability hunting, covering intake, reconnaissance, enumeration, active hunting, and reporting. Includes attack playbooks for SQLi, XSS, RCE, SSRF, IDOR, and more, with WAF bypass techniques and prioritization strategies for efficient security assessments.

Deploy and tune Web Application Firewalls (AWS WAF, Cloudflare WAF, ModSecurity) with managed rules for OWASP Top 10 protection, rate limiting, and geo-blocking.