Skill UI

A security assessment skill for identifying WebSocket vulnerabilities including Cross-Site WebSocket Hijacking (CSWSH), message tampering, handshake-layer attacks, and socket.io authorization bypasses. Requires explicit written authorization before testing. Includes reconnaissance, endpoint discovery, and exploit verification techniques for authorized security assessments.

Hunts reflected, stored and blind XSS during authorized web security assessments: reflection verification, unique canary payloads, context-based injection and out-of-band confirmation.

This skill provides systematic methodologies for identifying and exploiting Insecure Direct Object Reference (IDOR) vulnerabilities in web applications. It covers detection techniques using parameter manipulation, exploitation via Burp Suite, and remediation strategies. Requires authorized security assessments and multiple test accounts to verify cross-user access. Outputs include vulnerability reports, proof of concept, and remediation recommendations.

A skill for reverse engineering front-end web applications. It helps locate API signature chains, analyze encrypted request parameters, sample runtime behavior, and reproduce logic locally in Node.js for evidence-based output. Suitable for security assessments and understanding client-side encryption.

This skill specializes in secure mobile application development, focusing on input validation, WebView security, and mobile-specific security patterns. It covers secure data storage, authentication implementation, and platform-specific vulnerabilities for iOS and Android. Ideal for building security-first mobile apps that protect sensitive data against common attack vectors like injection and man-in-the-middle attacks.

This skill guides users to configure and test common network services like HTTP, HTTPS, SNMP, and SMB within a controlled penetration testing lab environment. It covers service enumeration, log analysis, and security testing procedures. Users will learn to set up web servers, secure connections, and file shares while practicing defensive and offensive security techniques on properly configured target systems.

This skill provides a comprehensive command reference for penetration testing tools. It covers network scanning with Nmap, exploitation via Metasploit, password cracking, and web application testing. Users can quickly lookup commands for security assessments, vulnerability identification, and payload generation. It includes examples for host discovery, port scanning, service detection, and common exploit usage.

Operate 20+ security tools like Nmap, SQLMap, and Nuclei via structured workflows for authorized penetration testing, vulnerability scanning, and exploitation. Supports information gathering, web exploitation, and password cracking.

This skill enables authorized reverse engineering of custom binary protocols, Protobuf/gRPC schemas, and WebSocket frames using PCAP data. It helps recover undocumented wire protocols, decode structured traffic, and reconstruct state machines for security analysis and debugging purposes.

Master essential security scanning tools for network discovery, vulnerability assessment, web application testing, wireless security, and compliance validation, covering tool selection, configuration, and authorized usage.

This skill enables comprehensive SQL injection vulnerability assessments on web applications to identify database security flaws and validate input sanitization. It supports detection of in-band, blind, and out-of-band attack vectors. Users can demonstrate exploitation techniques and extract data for authorized security testing purposes only. Requires explicit written permission before execution.

Implement and verify Stripe checkout, subscriptions, webhooks, and refunds with explicit server-side authorization. Covers payment flows, webhook handling, subscription management, and customer management. Provides code patterns for hosted checkout, payment intents, and setup intents. Emphasizes security boundaries and proper use of test accounts.