Skill UI

A comprehensive guide to conducting authorized security assessments across API-driven applications. This skill covers REST, gRPC, and WebSocket protocols, addressing the full OWASP API Security Top 10 2023. Techniques include identifying Broken Object Level Authorization (BOLA/IDOR), broken authentication, excessive data exposure, and implementing fuzzing for various API endpoints. Designed for professional penetration testing engagements.

This skill provides an active penetration testing toolchain covering information gathering, port scanning, vulnerability scanning, web attacks (SQL injection, XSS), directory brute-forcing, and password cracking. It exposes 20+ security tools to AI agents via MCP servers for authorized security assessments.

Runs a comprehensive security scan on a live, deployed Power Pages site. It analyzes the site's public surface for vulnerabilities, fetching the latest report and providing a plain-language summary of findings, categorized by severity. Ideal for auditing, testing, or assessing the safety of a production environment.

This skill provides comprehensive, non-destructive testing for deployed Power Pages sites. It navigates the site, performs page crawling, verifies HTTP status codes, captures network API requests (Web API/OData), and detects console errors. It supports testing core site load, authentication flow, and data integrity.

A comprehensive, black-box workflow designed for professional bug bounty hunting and penetration testing. It guides users through a 5-stage methodology (Intake, Recon, Enum, Hunt, Report), covering 19+ advanced attack playbooks (e.g., RCE, SQLi, XSS, SSRF). The skill integrates real-world exploit cases, structured payloads, and WAF bypass techniques for maximizing vulnerability discovery in web applications and APIs.

This skill audits live web pages for WCAG accessibility violations without modifying the application. It locates issues precisely using CSS selectors and returns a fix worklist for developers. It uses AccessLint tools to check contrast, accessible names, and semantic markup. Suitable for QA and automated testing workflows where manual checks are separate.

Create, edit, validate, and run Agent QA tests, suites, and hooks via MCP or CLI while preserving canonical IDs and schema contracts. Supports web and mobile testing with strict ID validation and safe execution.

This skill provides a structured methodology for authorized security assessments of REST, GraphQL, WebSocket, and SOAP APIs. It covers discovery, authentication flaws (JWT/OAuth), authorization issues (BOLA/IDOR), rate-limit testing, and CI/CD integration. Includes 10-phase workflow from reconnaissance to reporting, utilizing tools like Entropy, Burp, and FireTail for comprehensive vulnerability identification.

This skill enables users to identify and exploit authentication and session management vulnerabilities in web applications. It covers testing methodologies for password policies, session handling, multi-factor authentication, and credential management. Commonly associated with OWASP Top 10 risks, it helps assess security posture against account takeover and unauthorized access.

Use Burp Suite to intercept and modify HTTP traffic, replay requests, scan web applications for vulnerabilities, and document security findings during authorized assessments.

This skill provides a comprehensive guide for implementing dark mode in web and mobile applications. It covers core design principles like surface color selection, elevation through lightness, and accent testing. Includes specific implementation examples for CSS, SwiftUI, and Flutter to ensure reduced eye strain and premium aesthetics.

This skill enables deploying applications and websites to the Vercel platform. It handles various deployment scenarios including linked and unlinked projects, git integration, and team selection. The assistant checks project state, authenticates CLI, and executes preview or production deployments based on user requests. It ensures best practices like using preview branches for testing before production.