Skill UI

This skill provides a structured methodology for authorized security assessments of REST, GraphQL, WebSocket, and SOAP APIs. It covers discovery, authentication flaws (JWT/OAuth), authorization issues (BOLA/IDOR), rate-limit testing, and CI/CD integration. Includes 10-phase workflow from reconnaissance to reporting, utilizing tools like Entropy, Burp, and FireTail for comprehensive vulnerability identification.

Workflow for assessing REST and GraphQL API security, covering discovery, authentication, authorization, input validation, rate limiting, GraphQL testing, error handling, and reporting.

A planning framework for authorized security assessments, specifically bug bounty hunting. It guides users to confirm engagement types, define scope, and adopt an attacker mindset before executing tests. Includes workflows for red teaming, pentesting, and internal audits, emphasizing authorization and defensive guidance.

This skill guides authorized security assessments and bug bounty engagements. It covers scope definition, evidence collection, impact validation, and reporting. It enforces mandatory authorization checks before testing to ensure legal compliance and safety. It helps organize the workflow for finding and reporting vulnerabilities responsibly.

A command-line utility to search and extract data from Burp Suite project files (.burp). It enables regex-based searches on response headers or bodies, extraction of security audit findings, and analysis of captured HTTP traffic. Requires Burp Suite Professional and the burpsuite-project-file-parser extension. Ideal for security auditing and traffic analysis workflows.

Specialize in creating efficient CI/CD pipelines and GitHub Actions workflows to automate development processes. This skill reduces manual work, improves consistency, and accelerates delivery while maintaining quality and security. Ideal for designing multi-stage build, test, and deploy flows, replacing manual steps with reliable automation.

A comprehensive workflow bundle covering the entire cloud-native development lifecycle. It guides users through critical phases, including cloud infrastructure setup (AWS, Azure, GCP, Terraform IaC), container orchestration with Kubernetes, robust CI/CD pipeline automation, observability implementation, security hardening, cost optimization, and disaster recovery planning. This ensures best practices across all stages of modern application deployment.

Authorized cloud, container, and Kubernetes security assessment workflow covering metadata SSRF, IAM misconfiguration, container escape paths, and cluster RBAC review, with tooling like kubectl, Trivy, and kube-bench.

Perform authorized static analysis on source code to identify security vulnerabilities using tools like Semgrep and CodeQL. This workflow covers pattern hunting, dangerous API detection, and verification of vulnerability fixes. Essential for white-box audits and PR security reviews.

This skill orchestrates a comprehensive multi-dimensional code review using specialized agents. It covers code quality, architecture, security, performance, testing, and documentation. Users can configure focus areas like security, performance, or TDD compliance. It integrates static analysis, security scanning, and automated metrics to provide actionable feedback and remediation guidance for software development projects.

Expert in modern CI/CD pipelines, GitOps workflows, and platform engineering. Specializes in designing and implementing secure, zero-downtime deployment strategies for enterprise-scale applications. Proficient with Kubernetes, ArgoCD, Terraform, and advanced security compliance practices.

This skill assists in validating application configurations through schemas, tests, and security checks. It ensures environment consistency and error-free setups. Use it for configuration management workflows, best practices, and checklists. It helps create comprehensive validation strategies to maintain secure and reliable system configurations across all environments.