Skill UI

This guide details methodologies for identifying and exploiting XML External Entity (XXE) injection vulnerabilities in web applications. It covers basic file retrieval, blind XXE detection using out-of-band techniques, and data exfiltration, all critical steps during authorized penetration testing of XML-consuming APIs and services.

A comprehensive guide for assessing the security of JSON Web Token (JWT) implementations. This toolkit details attacks against cryptographic weaknesses, including algorithm confusion (e.g., RS256 to HS256), 'none' attacks, brute-forcing HMAC secrets, and claim manipulation. Ideal for penetration testing and security audits of modern APIs and SSO systems.

A comprehensive guide and code suite for performing penetration testing on real-time WebSocket APIs (WS/WSS). This tool assesses vulnerabilities including Cross-Site WebSocket Hijacking (CSWSH), missing handshake authentication, message injection, input validation failures, and DoS risks. It guides users through analyzing the handshake process and testing authorization enforcement using Python and specialized tools.

GoldRush API by Covalent lets agents query wallet balances, token prices, transaction history, DEX pairs, and live OHLCV across 100+ chains via REST, CLI, SDK, or WebSocket, avoiding chain-specific plumbing.

Hono is a minimal and ultrafast web framework built entirely on Web Standards (Request/Response/fetch). It allows developers to build high-performance APIs and full-stack applications that run seamlessly across multiple environments, including Cloudflare Workers, Deno, Bun, and Node.js. It is ideal for edge deployment, Backend for Frontend (BFF) layers, and type-safe backend services.

SvelteKit is the official full-stack framework built on Svelte, enabling developers to build fast, modern, and highly performant web applications. It provides comprehensive features including file-based routing, Server-Side Rendering (SSR), Static Site Generation (SSG), API routes, and progressive form actions, all while maintaining Svelte's zero runtime overhead. Use this skill when building complex, data-driven web platforms where performance and developer experience are paramount.

Automate web browsers using Playwright for data scraping, form filling, and structured data extraction. Supports multi-step workflows, screenshots, session management, and anti-detection patterns. Ideal for building production-grade data pipelines without writing browser tests.

Provides offensive security testing methodology, tooling guidance, and workflows for scanning web apps, APIs, dependencies, secrets, and infrastructure to uncover vulnerabilities before attackers exploit them.

A comprehensive tool for establishing performance baselines across multiple dimensions. It measures Core Web Vitals (LCP, CLS, INP), API latency (p50, p95, p99), and development build efficiency. Essential for detecting performance regressions before merging code, ensuring stability in CI/CD pipelines, and comparing alternative stack implementations.

Gradio is a powerful Python library designed for creating interactive web user interfaces and showcasing machine learning demos quickly. This skill covers core patterns like Interface, Blocks, and ChatInterface, allowing users to build complex applications, components, and event-driven chatbots with minimal effort. Ideal for rapid prototyping and deep learning model visualization.

This skill details the deployment of various canary tokens (DNS, HTTP, AWS API Keys) across enterprise network infrastructure. It establishes digital tripwires that detect behavioral anomalies, such as unauthorized access, credential leakage, or lateral movement. Tokens are configured with webhook alerts (Slack, SIEM) for real-time, low-false-positive notification, significantly enhancing traditional IDS/IPS capabilities.

This guide details the Hexagonal Architecture (Ports and Adapters) pattern, a robust method for decoupling core business logic from external infrastructure concerns. It teaches how to structure applications to make the domain model independent of databases, UI frameworks, or message queues. Implementing this pattern drastically improves testability, maintainability, and the ability to swap out external services without rewriting business rules.