Skill UI

Guide to systematically assess REST and GraphQL APIs against the OWASP API Security Top 10 risks using Burp Suite, Postman, ffuf, and curl to discover endpoints, probe auth/authorization flaws, and verify rate limiting before deployment.

Guides penetration testers through identifying CORS misconfigurations on web APIs, validating origin handling, preflight responses, and crafting PoCs to prove sensitive data can be accessed cross-origin during authorized assessments.

A comprehensive skill for identifying and exploiting Cross-Site Scripting (XSS) vulnerabilities in web applications. It systematically tests reflected, stored, and DOM-based contexts by injecting various JavaScript payloads. The process involves mapping all user input points, identifying output contexts (HTML body, attribute, JS string, etc.), and crafting payloads to bypass sanitization and Content Security Policy (CSP) protections, simulating real-world attacks like session hijacking and credential theft.

Guide to using Burp Suite's proxy, scanner, intruder, repeater, and DOM Invader to identify and validate reflected, stored, and DOM-based XSS flaws during authorized web security assessments and bug bounties.

Performs targeted security assessments of JSON Web Token implementations, probing algorithm confusion, claim tampering, brute-force secrets, and misuse during penetration tests of APIs, SSO, and microservice authentication flows.

Evaluates OAuth 2.0 and OpenID Connect deployments for redirect URI flaws, CSRF via missing state, PKCE bypasses, token leakage, and scope escalation to ensure secure authorization-code flows before production onboarding.

tRPC allows developers to build highly type-safe APIs in a full-stack environment without needing to write or maintain separate schemas. It provides end-to-end type safety from server routers to client components, supporting queries, mutations, subscriptions, and robust middleware. Ideal for building modern TypeScript monorepos, Next.js, or Remix applications.

Vibers provides a human code review workflow for AI-generated GitHub projects; add the collaborator, GitHub Action, and commit guidance to receive spec- and security-focused feedback plus follow-up PR fixes.

Orchestrates WCAG 2.2 Level A/AA scans, fixes, and verifications across React, Next.js, Vue, Angular, Svelte, and plain HTML codebases, producing before/after diffs, contrast checks, compliance reports, and CI/CD-ready hooks.

Reverse-engineers frontend, backend, or fullstack codebases into detailed Product Requirements Documents by scanning routes, components, APIs, data models, and interactions to produce business-friendly specs that engineers or AI agents can use to rebuild every page and endpoint.

Scans a company or sector for hiring, funding, product, team, market, and tech signals using CLAUDE web search and Python scoring to surface investment readiness, momentum, and competitive risks for VC deal sourcing.

Run NVIDIA Cosmos Policy evaluations on LIBERO and RoboCasa simulations, enabling headless EGL GPU rendering, inference profiling, and benchmark workflows via public eval entrypoints.