Skill UI

This expert playbook covers advanced techniques for testing HTTP request smuggling and desynchronization vulnerabilities. It is critical when front proxies, CDNs, or load balancers disagree with the origin server on message framing (Content-Length vs Transfer-Encoding), or during protocol downgrades (HTTP/2 to HTTP/1). Use this to uncover deep security flaws like WAF bypass and session hijacking.

This skill provides a comprehensive playbook for testing the security of SAML-based Single Sign-On (SSO) solutions. It focuses on validating assertion trust by checking signature coverage, audience and recipient restrictions, handling of Assertion Consumer Service (ACS), and identifying potential XML parsing weaknesses or IdP/SP confusion flaws. Use this when evaluating enterprise authentication systems for critical security vulnerabilities.

This comprehensive playbook details expert techniques for exploiting Server-Side Request Forgery (SSRF). It covers bypassing URL filters, accessing cloud metadata endpoints (AWS, GCP, Azure), utilizing advanced protocols like Gopher, and chaining vulnerabilities to achieve Remote Code Execution (RCE) in real-world scenarios. Ideal for penetration testers and security researchers.

This playbook details the methodology for detecting and exploiting subdomain takeover vulnerabilities. It focuses on identifying CNAME/NS/MX records pointing to deprovisioned or unclaimed cloud resources (e.g., AWS S3 buckets, Heroku apps). Understanding these weaknesses allows attackers to serve malicious content under the victim's trusted domain, leading to phishing, credential theft, and security bypasses.

This skill provides comprehensive testing for WebSocket APIs, covering protocol basics, Cross-Site WebSocket Hijacking (CSWSH), and common security flaws. Use it when testing applications that rely on real-time communication, chat features, or persistent data streams. It validates Origin checks, session binding, and message integrity.

This skill enforces disciplined SLO definition based on SRE principles, ensuring that reliability promises are measurable and actionable. It guides users in selecting the right SLI (Service Level Indicator), accurately calculating error budgets, setting multi-window burn-rate alerts, and reviewing existing SLO documents for common architectural flaws (e.g., targets too aggressive, wrong SLI selection). Ideal for defining, reviewing, and maintaining service reliability commitments.

This workflow systematically analyzes deployed AWS resources and Infrastructure-as-Code (IaC) definitions. It collects usage metrics from CloudWatch and Cost Explorer to identify over-provisioning, unused resources, and inefficient configurations (e.g., right-sizing EC2, S3 lifecycle policies). It generates actionable cost optimization recommendations and creates structured GitHub issues for tracking and implementing savings.

This comprehensive workflow analyzes the health status of various AWS resources (EC2, Lambda, RDS, DynamoDB, etc.). It uses AWS CLI to diagnose potential issues by analyzing CloudWatch logs, metrics, and performance data. The process culminates in classifying root causes and generating actionable, tiered remediation plans (Immediate, Short-term, Long-term) to ensure system resilience and stability.

This skill allows users to query the current state of various AWS resources (including EC2, S3, Lambda, RDS, VPC, etc.) using natural language. It translates user intent into strictly read-only AWS CLI commands (e.g., `describe-*`, `list-*`). Crucially, this tool can only view data and is contractually incapable of performing any write, modify, delete, or mutation actions, ensuring maximum safety.

This automated workflow performs a comprehensive review against the AWS Well-Architected Framework (WAF). It scans IaC definitions (Terraform, CloudFormation, CDK) and deployed resources to identify compliance gaps, security risks, and optimization opportunities across six core pillars. Findings are structured and automatically generated as actionable GitHub issues with remediation code examples.

Luna serves as the final quality gate, rigorously reviewing code for objective correctness, security vulnerabilities, and overall reliability. It checks for critical flaws such as injection vulnerabilities, authorization bypasses, race conditions, and adherence to the architectural blueprint. It ensures that only high-quality, safe code progresses to QA and deployment.

This skill performs a systematic, visual, and structural audit of PowerPoint presentations. It checks for layout flaws, text overflow, style inconsistencies, and weak visual hierarchy. Ideal for QAing a deck before a meeting, ensuring readability for specific audiences (e.g., executives, clients), and pinpointing precise fixes with severity ranking.