Skill UI

Detect unexpected code execution paths such as command injection, eval/exec usage, remote execution, or arbitrary code loading. Use probes to test if the agent executes injected commands, evaluates untrusted input, or loads remote scripts.

Voice agents enable natural human-AI conversation through speech recognition and synthesis. This skill covers low-latency architectures like speech-to-speech pipelines and STT-LLM-TTS workflows. It includes optimization strategies for sub-800ms response times, voice activity detection, and integration with tools like Deepgram, ElevenLabs, and OpenAI. Ideal for building production-ready voice assistants with natural interaction flows.

Detects data exfiltration via URL path encoding and chained web_fetch navigation, covering fake trusted UI injection, indirect prompt injection, letter-level path exfiltration, and multi-hop navigation hijacking in agent memory/context scenarios.

A comprehensive asset discovery pipeline for authorized security assessments. It automates subdomain enumeration, live host detection, URL crawling, and vulnerability scanning using tools like subfinder, httpx, nuclei, and katana, delivering prioritized URL lists for penetration testing.

Analyze weight loss data, calculate BMR/TDEE, track energy deficits, and manage weight loss stages. Ideal for BMI, body fat, waist-to-hip ratio, metabolic rate, plateau detection, and personalized weight management progress reports.

Authorized wireless security assessment skill for Wi-Fi capture, WPA handshake analysis, rogue AP detection research, and lab-only deauthentication testing. Includes workflow, toolchain, and safety guidelines for ethical use.

Capture, filter, and inspect network packets with Wireshark for security investigations, performance optimization, and troubleshooting. Covers credential analysis, malware C2 detection, and latency diagnosis.

This skill fetches raw text transcripts from any YouTube video. It prioritizes using the DeepAPI service for reliable, server-side scraping, which bypasses local bot detection issues. If DeepAPI fails or the API key is unavailable, it gracefully falls back to using the local `yt-dlp` tool. The output is always saved as a clean, unformatted .txt file.