Skill UI

This tool performs comprehensive security testing on GraphQL APIs by generating deeply nested, recursive, or highly repetitive queries. It specifically aims to identify Denial-of-Service (DoS) vulnerabilities and resource exhaustion issues by overwhelming the server's CPU, memory, or database connections. Essential for security auditors and penetration testers.

A comprehensive deep dive into reverse engineering ransomware encryption mechanisms. It details the analysis of hybrid encryption models (AES/RSA), identifying specific cryptographic APIs (CryptoAPI, CNG), and locating implementation flaws such as weak key generation or IV reuse. This guides authorized security professionals in finding potential decryption opportunities without paying a ransom.

A comprehensive framework for testing REST and GraphQL APIs against Broken Object Level Authorization (BOLA) and Insecure Direct Object Reference (IDOR). This tool simulates an attacker's behavior by systematically intercepting and modifying object identifiers (IDs, UUIDs, slugs) within API calls. It helps identify critical authorization flaws, ensuring that an authenticated user cannot access or modify resources belonging to other tenants or users, adhering to OWASP API Security Top 10.

This guide details methodologies for identifying and exploiting XML External Entity (XXE) injection vulnerabilities in web applications. It covers basic file retrieval, blind XXE detection using out-of-band techniques, and data exfiltration, all critical steps during authorized penetration testing of XML-consuming APIs and services.

A comprehensive guide for assessing the security of JSON Web Token (JWT) implementations. This toolkit details attacks against cryptographic weaknesses, including algorithm confusion (e.g., RS256 to HS256), 'none' attacks, brute-forcing HMAC secrets, and claim manipulation. Ideal for penetration testing and security audits of modern APIs and SSO systems.

tRPC allows developers to build highly type-safe APIs in a full-stack environment without needing to write or maintain separate schemas. It provides end-to-end type safety from server routers to client components, supporting queries, mutations, subscriptions, and robust middleware. Ideal for building modern TypeScript monorepos, Next.js, or Remix applications.

MCPB is a specialized local server bundle that packages the entire runtime environment (Node.js or Python) alongside the server code. It allows developers to distribute and run complex MCP services directly on a user's machine without requiring the user to pre-install specific runtimes or toolchains. Use this when the server must interact with the local filesystem, desktop applications, or OS-level APIs.

A comprehensive guide for building or reviewing SwiftUI User Interfaces that utilize the modern Liquid Glass aesthetic. This skill focuses on correctly implementing native Apple APIs (like `glassEffect` and `GlassEffectContainer`) while ensuring proper fallback mechanisms, modifier ordering, and performance for iOS 26+ devices. Ideal for adopting cutting-edge iOS design patterns.

This skill provides comprehensive forensic analysis of cryptocurrency payment flows stemming from ransomware attacks. It leverages blockchain APIs and advanced techniques to identify wallet clusters, track fund movement through obfuscation methods like mixers and peel chains, and map funds to exchanges. It is crucial for law enforcement, incident responders, and threat intelligence analysts conducting ransomware attribution.

This tool monitors Certificate Transparency (CT) logs to detect unauthorized certificate issuance for owned domains, discover hidden subdomains, and track suspicious certificate activity. By querying public CT logs and APIs (like crt.sh), it helps build continuous security pipelines, identify potential phishing infrastructure, and map the external attack surface for comprehensive threat intelligence.

Guides calling Feishu IM APIs to retrieve chat histories, thread replies, cross-chat searches, and media/file downloads while handling pagination, time filters, and permission constraints so agents can answer questions about past conversations.

Manage BrowserWing’s intelligent browser automation platform: install Chrome, configure LLM providers, generate AI-explored scripts, and operate the script lifecycle through HTTP APIs for autonomous exploration, execution, and troubleshooting.