Skill UI

Guides systematic detection and exploitation of cross-site scripting and HTML injection flaws, covering stored/reflected/DOM vectors, payload crafting, and remediation advice for web security assessments.

Detect SQL injection weaknesses by running the sql-injection-detector plugin against codebases, identifying risky queries, and providing remediation guidance to secure applications.

Provides Django security best practices covering production settings, authentication, authorization, CSRF and SQL injection protection, plus deployment hardening to keep live apps safe.

This skill guides the development of production-grade APIs, MCP servers, and enterprise backends using modern C#/.NET best practices. It covers essential architectural components such as dependency injection (DI), advanced caching strategies (e.g., Redis), data access optimization with EF Core/Dapper, and implementing resilience patterns, ensuring robust and scalable software design.

This comprehensive guide details essential security practices for integrating the Exa API. It covers key areas such as secure API key management using environment variables, implementing content moderation to filter unsafe results, restricting results via domain allow/block lists, and sanitizing user queries to prevent injection attacks. Use this when hardening or auditing an Exa-powered application.

This template provides production-ready FastAPI project skeletons, incorporating advanced features such as async patterns, dependency injection, middleware, and robust error handling. It is essential for developers starting new high-performance REST APIs, microservices, or complex backend systems in Python, ensuring adherence to best architectural practices.

Performs a structured, multi-phase audit on local branch changes (diffs) to identify security vulnerabilities, bugs, and code quality issues. It systematically checks for common risks like Injection (SQL, XSS), Broken Authentication, IDOR, CSRF, and business logic flaws, providing detailed severity, evidence, and suggested fixes. Ideal for pre-merge code reviews and security audits.

A comprehensive guide detailing the entire workflow for analyzing embedded firmware. It covers hardware-level extraction methods (UART, JTAG, SPI dump), filesystem analysis (SquashFS, JFFS2), binary reverse engineering using tools like Ghidra, and identifying common vulnerabilities (Buffer Overflow, Command Injection). Ideal for security researchers and embedded systems engineers.

Automated fuzz testing of APIs via the /fuzz-api command to inject malformed, boundary, and random payloads, spotting crashes, SQL injection, XSS, and validation gaps during vulnerability scanning or security reviews.

A comprehensive guide detailing best practices for securing Groq API keys and managing data privacy. It covers critical steps such as using environment variables, implementing secure key rotation procedures, preventing key leaks via pre-commit hooks, and defending against prompt injection attacks for robust application development.

Map web inputs for reflected or stored HTML injection, send crafted tags via URLs, POST bodies, or visible fields, and document appearance/phishing manipulations for authorized security assessments.

A comprehensive guide covering advanced traffic routing and management techniques within a service mesh using Istio. Learn how to implement critical deployment strategies like Canary releases and Blue-Green deployments, configure circuit breakers, manage retries, and perform fault injection testing. Includes YAML templates for VirtualService, DestinationRule, and Gateway setup, essential for reliable production service deployments.