Skill UI

A comprehensive, 10-phase methodology for authorized security assessment of modern APIs, including REST, GraphQL, WebSocket, and SOAP. This guide covers the entire testing lifecycle—from endpoint discovery and authentication bypass (JWT/OAuth 2.0) to sophisticated authorization flaws (BOLA/IDOR/BFLA), input validation, rate limiting, and CI/CD integration testing.

A specialized skill for advanced runtime analysis of Android applications, primarily used in CTF and security research. It covers techniques like hooking specific system boundaries (JNI, WebView), bypassing security measures (SSL pinning, root checks), and recovering sensitive data or request signatures. Ideal for deep inspection of app trust boundaries and complex mobile logic.

A specialized downstream skill for deep security analysis of JSON Web Tokens (JWT), JWS, and JWE. It guides the identification of vulnerabilities where token components (headers, claims, keying) lead to unauthorized identity assumption or privilege escalation. Use this to trace the full path from token supply to final application acceptance.

This skill is designed for deep security and behavioral analysis within the Kubernetes control plane. It specializes in tracing complex interactions, including RBAC edge cases, service-account trust paths, admission webhook behavior, resource mutation, and cluster-level state drift. Use it when diagnosing why live workloads differ from manifest declarations, or when investigating cluster-wide permission issues.

This skill provides comprehensive management of the Web Application Firewall (WAF) for Power Pages production sites. It allows users to check the current protection status, recommend necessary security measures, and apply granular rules such as IP blocking, country restrictions, path access controls, and rate limits. Use it to secure sites against brute-force attacks or common web vulnerabilities.

A comprehensive tool to inspect and configure critical HTTP security headers (such as CSP, CORS, X-Frame-Options) for modern web applications. It identifies security gaps, assesses cross-origin permissions, and guides users through hardening settings like cookie behavior, ensuring the site meets current industry security standards.

A comprehensive guide to conducting authorized security assessments across API-driven applications. This skill covers REST, gRPC, and WebSocket protocols, addressing the full OWASP API Security Top 10 2023. Techniques include identifying Broken Object Level Authorization (BOLA/IDOR), broken authentication, excessive data exposure, and implementing fuzzing for various API endpoints. Designed for professional penetration testing engagements.

This skill provides an active penetration testing toolchain covering information gathering, port scanning, vulnerability scanning, web attacks (SQL injection, XSS), directory brute-forcing, and password cracking. It exposes 20+ security tools to AI agents via MCP servers for authorized security assessments.

Runs a comprehensive security scan on a live, deployed Power Pages site. It analyzes the site's public surface for vulnerabilities, fetching the latest report and providing a plain-language summary of findings, categorized by severity. Ideal for auditing, testing, or assessing the safety of a production environment.

A deterministic method for placing signature, date, and text fields in a web e-signature composer via browser automation. It uses fixed signature pages and numeric coordinates instead of drag-and-drop. This skill ensures repeatable field positions, correct recipient ownership, and security gates before sending. Ideal for automating envelope preparation for generated agreements when API access is unavailable.

Orchestrate complex multi-phase objectives into guided sequences of skill invocations. Use for shipping SaaS MVPs, web security audits, AI agent systems, browser QA, and DDD domain modeling with verified checkpoints.

Design and implement robust API integrations using expert patterns for REST, GraphQL, and webhooks. Focus on contract-first design, resilience, observability, and security. Includes strategies for authentication, rate limiting, error handling, and debugging to ensure production-ready solutions.