Skill UI

This domain-agnostic skill ranks impediments, risks, and gaps by using a specialized value-stream scoring model. It evaluates countermeasures based on four criteria: Return on Investment (ROI), Cost to Implement, Ease of Deployment, and Risk Factor. A proprietary formula calculates a final Priority score (1-100), allowing users to quickly determine the optimal sequence for remediation, improvement backlogs, or triage items.

This skill guides the process of converting complex, repetitive, and often private operational workflows originating in the Hermes environment into safe, reusable, and public skills for the ECC workflow layer. It focuses heavily on data sanitization, requiring users to strip out all sensitive information such as absolute paths, private credentials, personal identifiers, and proprietary data before publication. Use this when an internal 'operator' routine needs to become a standardized, shareable business asset.

Generate a high-fidelity, multi-screen mobile prototype simulating a gamified experience, perfect for habit trackers, life management apps, or RPG concepts. The output features three distinct phone frames: cover/value proposition, daily quests dashboard, and detailed quest view, all presented on a single dark showcase stage. Ideal for visualizing user journeys and engagement mechanics.

Generate a comprehensive, multi-screen mobile onboarding prototype displayed in a side-by-side HTML format. This tool is perfect for designing the initial user experience (UX) flow, covering splash screens, value proposition details, and final sign-in steps. Ideal for apps needing a polished debut experience.

Wraps any existing HTML artifact (landing page, dashboard, etc.) with a live sidebar panel of controls. This panel allows users to instantly adjust design variables—such as accent color, typography scale, layout density, and dark mode—by rewriting CSS custom properties in real time. All changes are persisted via localStorage, enabling continuous exploration and variant testing without losing state.

Automates end-to-end provisioning for freshly plugged M5Stack or ESP32 boards: detect the device, flash UIFlow 2.0 firmware, and install a MicroPython app bundle. Useful for first-time setup, reflashing, app refresh, and smoke testing.

A comprehensive playbook detailing identification and bypass techniques for major binary protections, including ASLR, PIE, NX/DEP, RELRO, and stack canaries. This guide is essential for understanding how to exploit modern, difficult-to-break systems in advanced security research and CTF competitions.

This toolset provides a comprehensive development workflow for iterating on MicroPython applications (such as Claude Buddy, Hello, and Snake) on the Cardputer-Adv device. It allows developers to add new apps, push single updated .py files without full re-flashing, monitor device serial logs, or execute one-shot REPL commands directly from the host machine. Essential for rapid prototyping and debugging embedded systems.

A comprehensive playbook for identifying and exploiting clickjacking vulnerabilities (UI redress). Learn how to test if target pages can be framed, bypass security headers like X-Frame-Options and CSP frame-ancestors, and execute high-impact actions through invisible iframes. This guide covers single-click, multi-step, and drag-and-drop attack vectors, applicable to sensitive endpoints like account deletion or admin panels.

This comprehensive playbook details advanced techniques for detecting Prototype Pollution vulnerabilities in JavaScript environments (Node.js and browser). It covers various attack vectors, including using `__proto__` and `constructor.prototype` paths, and provides black-box testing payloads for JSON parsing, query string merging, and deep object assignment. Use this when analyzing applications for potential Remote Code Execution (RCE) or unintended property leakage via object merging sinks.

This expert playbook details advanced techniques for exploiting stack-based vulnerabilities, including classic buffer overflows, Return-Oriented Programming (ROP), ret2libc, and specialized gadgets like ret2csu and SROP. It provides comprehensive guidance on bypassing modern memory mitigations (NX, ASLR, PIE) to hijack program control flow and achieve reliable remote code execution in userland binaries.

This playbook provides expert-level techniques for exploiting common infrastructure services that are exposed without proper authentication. Coverage includes Redis RCE, Rsync data theft, PHP-FPM code execution, AJP file reads, and MongoDB/Hadoop vulnerabilities. Essential for deep penetration testing and security auditing.