Skill UI

Automates the static security analysis of Android APK/AAB files using the Mobile Security Framework (MobSF). This skill identifies critical vulnerabilities such as hardcoded secrets, insecure permissions, weak cryptography, and structural flaws (mapping to OWASP Mobile Top 10) without requiring application execution. It is essential for integrating security gates into CI/CD pipelines, performing pre-release quality assurance, and enhancing penetration testing coverage.

This tool simulates advanced security testing to identify vulnerabilities in API rate limiting. It bypasses throttling controls by manipulating request headers (like X-Forwarded-For spoofing), varying source IP addresses, and manipulating endpoint paths. Essential for assessing API resilience against brute-force attacks, credential stuffing, and resource exhaustion, aligning with OWASP API Security guidelines.

Perform comprehensive and structured API security testing using Postman. This skill covers testing for OWASP API Security Top 10 vulnerabilities, including authentication bypass, authorization flaws (BOLA), injection, and data exposure. It guides users through setting up multi-role environments, writing automated test scripts for regression testing, and integrating the workflow with CI/CD tools like Newman and OWASP ZAP.

OWASP Threat Dragon is an open-source tool designed for security professionals and developers. It guides users through creating detailed data flow diagrams (DFD) to map system architecture. The framework enables the systematic identification of vulnerabilities by applying established methodologies like STRIDE and LINDDUN, culminating in comprehensive, compliance-ready threat model reports.

A comprehensive guide for performing systematic security assessments on web applications. Following the OWASP Web Security Testing Guide (WSTG), this process identifies critical vulnerabilities such as broken authentication, authorization flaws (IDOR), SQL injection, and Cross-Site Scripting (XSS). The workflow covers reconnaissance, mapping, and advanced testing techniques using tools like Burp Suite and sqlmap, ensuring deep coverage beyond automated scanner capabilities. Ideal for pre-production security validation and compliance audits.

This tool guides the process of reviewing security findings from DAST and SAST scanners. It uses the OWASP risk rating methodology to classify vulnerabilities (true positive, false positive, needs review) and calculate a comprehensive risk score based on likelihood and impact, ensuring development teams prioritize the most critical issues.

This guide details implementing robust, multi-layered security for public-facing API Gateway endpoints using AWS WAF. Key features include configuring managed rule groups for OWASP Top 10 protection, setting up granular rate limiting to prevent abuse, implementing bot mitigation, and performing IP reputation filtering. Essential for maintaining API integrity and availability.

A comprehensive security script designed to test REST API authentication mechanisms for common vulnerabilities. It assesses broken token validation, missing authentication on critical endpoints, weak password policies, and session management flaws. The tool specifically evaluates JWT implementation, API key handling, and adherence to OWASP API Security Top 10, helping identify authentication bypasses before production deployment.

A comprehensive framework for testing REST and GraphQL APIs against Broken Object Level Authorization (BOLA) and Insecure Direct Object Reference (IDOR). This tool simulates an attacker's behavior by systematically intercepting and modifying object identifiers (IDs, UUIDs, slugs) within API calls. It helps identify critical authorization flaws, ensuring that an authenticated user cannot access or modify resources belonging to other tenants or users, adhering to OWASP API Security Top 10.

This tool systematically tests API endpoints for mass assignment (over-posting) vulnerabilities. It simulates an attacker injecting undocumented or privileged fields (such as 'role' or 'balance') into standard API requests. By analyzing the server's response, it determines if the API binds all client-supplied parameters to the data model without proper filtering, which could allow unauthorized privilege escalation or data modification. This is critical for achieving OWASP API Top 10 compliance.

A comprehensive guide for systematically assessing REST and GraphQL API endpoints against the OWASP API Security Top 10 risks. This includes practical workflows for testing critical vulnerabilities such as Broken Object Level Authorization (BOLA), broken authentication, excessive data exposure, and rate limiting, using tools like Burp Suite, Postman, and ffuf. Ideal for pre-deployment audits and authorized penetration testing engagements.

AuraKit converts a single /aura command into a secure full-stack Claude pipeline with 34 modes, OWASP SEC-01~15 safeguards, runtime hooks, tiered models, token savings, and multilingual reviewers.