Skill UI

A comprehensive framework for performing end-to-end (E2E) testing on various Windows native desktop applications. It utilizes pywinauto and the Windows UI Automation (UIA) API, supporting major frameworks including WPF, WinForms, Win32/MFC, UWP, and Qt. This skill helps automate complex GUI interactions, making it ideal for CI/CD integration and building robust desktop test suites.

This guide provides a comprehensive onboarding process for RuView (WiFi-DensePose). It details three deployment tiers: Docker simulation for quick testing and UI exploration, source code build verification (Rust/Python), and live sensing setup utilizing ESP32 hardware. Ideal for new users or rapid prototyping.

A comprehensive, 10-phase methodology for authorized security assessment of modern APIs, including REST, GraphQL, WebSocket, and SOAP. This guide covers the entire testing lifecycle—from endpoint discovery and authentication bypass (JWT/OAuth 2.0) to sophisticated authorization flaws (BOLA/IDOR/BFLA), input validation, rate limiting, and CI/CD integration testing.

This specialized skill is designed for advanced security analysis, tracing the complete trust chain from cloud metadata services to accepted privilege. It is used in penetration testing or CTF environments to meticulously prove how metadata-derived credentials (such as instance identities or tokens) are issued and subsequently accepted by a cloud or control plane API, thereby exposing the decisive trust edge.

This specialized skill is designed for advanced forensic analysis and penetration testing within Windows environments. It focuses on extracting and proving the replayability of credentials, tickets, and secrets stored in LSASS memory, Kerberos ticket caches, DPAPI, and SSP artifacts. Use it to establish the minimal, actionable chain (host artifact -> extracted material -> accepted privilege) that proves a decisive edge for privilege escalation.

Creates task-oriented technical documentation with progressive disclosure for READMEs, API docs, architecture docs, and markdown. Also generates formal security reports (reverse engineering, penetration testing, CTF, malware/APT analysis) in the user's project directory with Evidence-Finding-Path chain.

A comprehensive guide to conducting authorized security assessments across API-driven applications. This skill covers REST, gRPC, and WebSocket protocols, addressing the full OWASP API Security Top 10 2023. Techniques include identifying Broken Object Level Authorization (BOLA/IDOR), broken authentication, excessive data exposure, and implementing fuzzing for various API endpoints. Designed for professional penetration testing engagements.

A comprehensive guide covering the full attack lifecycle in Kubernetes. Techniques include service account token theft, RBAC misconfiguration exploitation, kubelet API abuse, pod escape, and cloud metadata compromise across major cloud platforms (AWS, GCP, Azure). Essential for security assessment and penetration testing of cloud-native environments.

Detailed methodology for achieving NT AUTHORITY\SYSTEM or local Administrator privileges on Windows targets. Covers token impersonation (JuicyPotato, PrintSpoofer), exploiting service misconfigurations, DLL hijacking, UAC bypass techniques, persistent access, and credential harvesting (LSA, DPAPI). Essential toolkit for red team and penetration testing engagements.

This skill provides comprehensive, non-destructive testing for deployed Power Pages sites. It navigates the site, performs page crawling, verifies HTTP status codes, captures network API requests (Web API/OData), and detects console errors. It supports testing core site load, authentication flow, and data integrity.

This specialized sub-agent is responsible for transforming high-level feature proposals and technical specifications into a formal, comprehensive 'design.md' document. It systematically captures all necessary technical details, including architectural decisions, data flow diagrams, detailed file changes, API contracts, and thorough testing strategies. Use this skill during the planning phase of any complex software change to ensure technical completeness and feasibility.

A comprehensive, black-box workflow designed for professional bug bounty hunting and penetration testing. It guides users through a 5-stage methodology (Intake, Recon, Enum, Hunt, Report), covering 19+ advanced attack playbooks (e.g., RCE, SQLi, XSS, SSRF). The skill integrates real-world exploit cases, structured payloads, and WAF bypass techniques for maximizing vulnerability discovery in web applications and APIs.