Skill UI

Automates installation, configuration, verification, repair, update, and uninstallation of Hyprland on Fedora Linux, with GPU-aware detection for NVIDIA, AMD, and Intel. Includes safety measures like backups and explicit user consent.

Detect unsafe file handling and path traversal vulnerabilities in upload, save, and extract flows. Focuses on user-controlled paths or filenames, providing probes to test if agents write outside intended directories. Useful for security assessment of AI agents with file handling capabilities.

Build real-time bidirectional streaming applications using the Gemini Live API. Supports WebSocket-based audio/video/text streaming, voice activity detection, function calling, and session management. Includes SDKs for Python and JavaScript for low-latency AI interactions.

Comprehensive guide for browser automation, web scraping, and testing with go-rod and the Chrome DevTools Protocol, including stealth anti-bot-detection patterns for dynamic SPA sites.

Detects hardcoded secrets like API keys, tokens, and passwords embedded in source code, configuration files, or Infrastructure as Code (IaC). Used when an agent can access its codebase to identify security vulnerabilities at rest. Focuses on secrets stored in files rather than runtime leaks.

Train object detection, image classification, and SAM/SAM2 segmentation models locally or on Hugging Face Jobs with dataset validation and Hub saving.

This skill detects when AI agents exploit human trust through social engineering, deceptive guidance, or false assurances. It identifies prompts that induce unsafe actions, request sensitive credentials, or impersonate authority figures. Use this when evaluating agent safety, security advice, or decision-influencing workflows. Skip for static information.

Security skill for detecting missing or weak rate limiting on authentication endpoints. Identifies brute force vulnerabilities in OTP, password reset, and login systems. Requires explicit authorization for authorized security assessments only. Includes shadow-throttle detection and enumeration techniques.

This skill helps identify and exploit specific vulnerabilities in Next.js applications, such as Server Actions authentication bypasses, middleware bypasses, and SSRF via image optimization. It provides commands for fingerprinting, version detection, and testing attack vectors. Requires explicit written authorization for target scope.

This skill helps identify and exploit specific vulnerabilities in Node.js applications. It covers techniques like prototype pollution, Express trust proxy abuse, and template engine SSTI. Users must have explicit authorization before testing. It includes fingerprinting, detection, and exploitation chains for critical security issues.

Detects and exploits server-side template injection (SSTI) across Jinja2, Twig, Freemarker, ERB, Spring, Velocity, Mako, Thymeleaf, and Smarty, offering detection payloads, RCE escalation paths, and authorized testing guidance.

This skill provides systematic methodologies for identifying and exploiting Insecure Direct Object Reference (IDOR) vulnerabilities in web applications. It covers detection techniques using parameter manipulation, exploitation via Burp Suite, and remediation strategies. Requires authorized security assessments and multiple test accounts to verify cross-user access. Outputs include vulnerability reports, proof of concept, and remediation recommendations.