Skill UI

This skill provides comprehensive testing for WebSocket APIs, covering protocol basics, Cross-Site WebSocket Hijacking (CSWSH), and common security flaws. Use it when testing applications that rely on real-time communication, chat features, or persistent data streams. It validates Origin checks, session binding, and message integrity.

A comprehensive CI/CD pipeline for Quarkus applications, designed to verify code quality and deployment readiness. It covers all phases: build, static code analysis (SonarQube, Checkstyle), rigorous functional testing (Unit, Integration, API), security scanning (OWASP, dependency checks), native image compatibility testing, performance load testing (K6), and container image validation (Trivy, Grype).

A comprehensive guide and toolkit for performing End-to-End (E2E) testing on native Windows desktop applications (WPF, WinForms, Win32, Qt) using pywinauto and the Windows UI Automation (UIA) API. Covers setup, locator strategies, and page object modeling for robust desktop automation.

Expert skill for building Model Context Protocol (MCP) servers and tools from scratch. Covers the full development lifecycle—from defining tool schemas and resources to implementation, testing, and publishing to registries. Supports robust patterns using TypeScript and Python for integrating custom capabilities into AI agents.

This skill automatically routes subtasks to the most cost-effective Claude model (Haiku, Sonnet, or Opus) based on complexity. It logs real token usage and cost per session, and includes an A/B testing feature to validate model tier savings against your actual workload, ensuring accurate cost control.

Turn any OpenAPI or Swagger spec into an MCP server using the mcp-use TypeScript SDK. Maps REST operations to LLM-callable tools with zod schemas, auth wiring, live testing, and one-command deploy.

This skill provides a demonstration of interacting with external APIs and services using various command-line tools (CLI). It showcases core automation patterns, including fetching API documentation details and listing messages using specific application CLIs, making it ideal for testing and learning API integration flows.

This skill generates a comprehensive and structured developer onboarding document for any service or codebase. It guides new engineers through the entire product lifecycle, covering architectural overview, local development setup, key coding patterns, testing strategies, CI/CD deployment processes, and team contacts, ensuring rapid productivity from day one.

Use Mailtrap Email Sandbox to capture and inspect outbound emails without sending them to real recipients. This is crucial for development, staging, and CI/CD environments. It allows developers to test email content, headers, attachments, and spam scores using dedicated APIs, SMTP settings, or SDKs, ensuring mail integrity before deployment. Ideal for automation and rigorous quality checks.

This guide details using the comprehensive AADInternals PowerShell toolkit for defensive validation of Microsoft Entra ID, Azure AD, and AD FS environments. It covers unauthenticated tenant reconnaissance, acquiring access tokens for multiple Microsoft APIs, and critically, testing for federation backdoors (Golden SAML) by simulating advanced attack techniques (MITRE T1606.002). It is designed for authorized red-team assessments to map external attack surfaces and validate identity infrastructure hardening.

GraphRunner is a powerful PowerShell toolset built on the Microsoft Graph API, designed for authorized red-teaming engagements against M365/Entra ID tenants. After obtaining a valid Graph token, it enables reconnaissance, establishes persistence (e.g., injecting OAuth apps and inbox rules), performs privilege escalation, and exfiltrates sensitive data from mailboxes, SharePoint, and Teams. Use only in authorized testing environments.

Detailed methods for red-teaming and penetration testing of LLM applications. This skill extracts sensitive system prompts, secrets, and embedded logic using advanced techniques like jailbreaking, encoding tricks, and automated scanners (Garak, Promptfoo), ensuring compliance with OWASP LLM07:2025.