Skill UI

A comprehensive, multi-step framework for conducting systematic QA testing on web applications. This guide covers scope detection (diff-aware), tiered testing depth (Quick, Standard, Exhaustive), detailed issue taxonomy (Functional, Visual, UX, etc.), structured bug documentation, and the critical fix-and-verify loop, ensuring high code quality throughout the development cycle.

A comprehensive guide to conducting authorized security assessments across API-driven applications. This skill covers REST, gRPC, and WebSocket protocols, addressing the full OWASP API Security Top 10 2023. Techniques include identifying Broken Object Level Authorization (BOLA/IDOR), broken authentication, excessive data exposure, and implementing fuzzing for various API endpoints. Designed for professional penetration testing engagements.

This skill provides an active penetration testing toolchain covering information gathering, port scanning, vulnerability scanning, web attacks (SQL injection, XSS), directory brute-forcing, and password cracking. It exposes 20+ security tools to AI agents via MCP servers for authorized security assessments.

Runs a comprehensive security scan on a live, deployed Power Pages site. It analyzes the site's public surface for vulnerabilities, fetching the latest report and providing a plain-language summary of findings, categorized by severity. Ideal for auditing, testing, or assessing the safety of a production environment.

This skill provides comprehensive, non-destructive testing for deployed Power Pages sites. It navigates the site, performs page crawling, verifies HTTP status codes, captures network API requests (Web API/OData), and detects console errors. It supports testing core site load, authentication flow, and data integrity.

A comprehensive, black-box workflow designed for professional bug bounty hunting and penetration testing. It guides users through a 5-stage methodology (Intake, Recon, Enum, Hunt, Report), covering 19+ advanced attack playbooks (e.g., RCE, SQLi, XSS, SSRF). The skill integrates real-world exploit cases, structured payloads, and WAF bypass techniques for maximizing vulnerability discovery in web applications and APIs.

This expert conducts comprehensive audits to ensure digital products comply with WCAG standards. It specializes in identifying accessibility barriers, testing user experiences for users with disabilities, and providing step-by-step remediation guidance. Use it for auditing web or mobile platforms, establishing compliance, and improving overall inclusivity.

Create, edit, validate, and run Agent QA tests, suites, and hooks via MCP or CLI while preserving canonical IDs and schema contracts. Supports web and mobile testing with strict ID validation and safe execution.

Conduct authorized security assessments for REST, GraphQL, and WebSocket APIs. Covers discovery, authentication flaws (JWT/OAuth), authorization bypasses (BOLA/IDOR), rate limiting, and a structured 10-phase testing workflow using specialized tools.

AWT provides AI coding tools with visual perception and interaction capabilities for web applications. It executes declarative YAML test scenarios using Playwright, featuring visual matching via OpenCV and OCR without relying on stable DOM selectors. Supports platform auto-detection for frameworks like React and Vue, includes structured failure diagnosis, and maintains a learning database for failure patterns. Ideal for end-to-end testing workflows requiring visual assertions and AI-assisted debugging.

This skill enables users to identify and exploit authentication and session management vulnerabilities in web applications. It covers testing methodologies for password policies, session handling, multi-factor authentication, and credential management. Common tools include Burp Suite and Hydra. It is used for security assessments to prevent account takeover and unauthorized access.

Execute comprehensive web application security testing with Burp Suite, covering HTTP interception, request modification, Repeater, scope filtering, and vulnerability scanning for authorized assessments.