Skill UI

Automatically scans modern API frameworks (Next.js, Express, FastAPI, Django) to generate comprehensive, ready-to-run test suites. It ensures complete coverage for critical areas including authentication, input validation (boundary/injection), error code matrices, pagination, file uploads, and rate limiting. Ideal for TDD, contract testing, and security audits.

Detailed k6 load testing guidance for APIs, WebSocket, and browser scenarios, covering configuration, realistic scenarios, result analysis, and CI/CD integration to catch regressions before release.

Provides step-by-step practices for testers to probe file path parameters, fuzz traversal payloads, and leverage tools (Burp, ffuf, dotdotpwn) to detect and escalate path traversal or LFI/RFI flaws.

This tool is designed for security professionals to test for Server-Side Request Forgery (SSRF) vulnerabilities. It systematically probes user-controllable URL parameters to identify access to internal network services, cloud metadata endpoints (AWS/GCP/Azure), and restricted local resources. It supports various payload techniques, including protocol handlers (gopher, file), IP encoding, and DNS rebinding, making it essential for thorough security assessments and penetration testing.

Identifies open redirect vulnerabilities in web apps by analyzing redirect parameters, applying bypass payloads, and chaining exploits for phishing or token theft during security assessments.

Step-by-step workflow for uncovering XML-based vulnerabilities such as XXE, XPath injection, SSRF, and entity bombs in web apps, covering prerequisites, payload templates, and out-of-band detection techniques.

A comprehensive skill for identifying and exploiting Cross-Site Scripting (XSS) vulnerabilities in web applications. It systematically tests reflected, stored, and DOM-based contexts by injecting various JavaScript payloads. The process involves mapping all user input points, identifying output contexts (HTML body, attribute, JS string, etc.), and crafting payloads to bypass sanitization and Content Security Policy (CSP) protections, simulating real-world attacks like session hijacking and credential theft.

Guides penetration testers through discovering and exploiting XML External Entity vulnerabilities across APIs, file uploads, and SOAP services to read files, trigger SSRF, and exfiltrate data with tools like Burp Suite, interactsh, and custom payloads.

Evaluates WebSocket APIs for auth bypass, CSWSH, injection, DoS, and leakage by intercepting handshakes and messages with Burp Suite plus crafted payloads.

Guides setting up Firebase Crashlytics in Flutter, covering dependency setup, fatal/non-fatal/isolate error handlers, custom keys/logs/user identifiers, symbol uploads for obfuscation, opt-in reporting controls, and testing workflows for reliable diagnostics.

Covers comprehensive HTML injection attack scenarios, detection tips, and tooling so security testers can validate and document injection points, phishing overlays, and reflected or stored payloads during vulnerability assessments.

This skill demonstrates how to use Playwright MCP to programmatically automate the process of inputting data into a web form. It covers various input types, including text fields, date selection, time setting, and file uploads. The process simulates realistic user interaction for data entry or form submission testing, emphasizing the ability to fill data without final submission for review purposes.