Skill UI

A specialized skill for detecting discrepancies (drift) between declared API contracts (such as GraphQL schemas, OpenAPI specs, and RPC manifests) and the actual behavior of live backend handlers. It is used to identify hidden operations, contract mismatches, or vulnerabilities resulting from schema evolution, versioning skew, or implementation gaps. Must be used after initial sandbox assumptions are established.

A comprehensive, multi-phase workflow guide for authorized reverse engineering of complex network protocols. Ideal for analyzing proprietary formats such as custom TCP/UDP binary protocols, Protobuf, gRPC, WebSocket frames, and reconstructing state machines from raw PCAP data. This guide covers data collection, field layout restoration, serialization recovery, and secure replaying.

A comprehensive guide to building networked games in Godot 4.7 using ENet. Covers core concepts like setting up peers, defining Remote Procedure Calls (RPCs) with @rpc, assigning per-node authority, and state replication using MultiplayerSpawner/Synchronizer. Essential for implementing robust multiplayer features.

A comprehensive guide to conducting authorized security assessments across API-driven applications. This skill covers REST, gRPC, and WebSocket protocols, addressing the full OWASP API Security Top 10 2023. Techniques include identifying Broken Object Level Authorization (BOLA/IDOR), broken authentication, excessive data exposure, and implementing fuzzing for various API endpoints. Designed for professional penetration testing engagements.

Review Protocol Buffer and gRPC API changes to ensure wire and JSON compatibility. This skill covers safe schema evolution, identifying rollout hazards, and maintaining RPC contract quality. It is used when reviewing proto diffs, modifying messages and services, planning migrations, or diagnosing cross-version failures in distributed systems.

Decision-making guide for API design: choosing REST, GraphQL or tRPC, defining response envelopes, error formats and pagination, planning versioning, authentication, rate limiting and documentation. Includes a heuristic source scanner script.

This expert assists developers in building type-safe, high-performance database layers using Drizzle ORM with TypeScript. It provides deep knowledge of schema design, complex relational querying (joins, aggregations), managing migrations via Drizzle Kit, and seamless integration with modern stacks like Next.js, tRPC, and serverless environments. Ideal for developers needing a zero-overhead, type-safe ORM alternative.

A comprehensive guide for designing and implementing production-grade microservices using gRPC in Go. Covers best practices for API contract standardization with Protobuf and Buf, securing service-to-service communication via mTLS, and integrating deep observability using OpenTelemetry interceptors. Ideal for building high-performance, reliable internal APIs.

A skill for identifying and exploiting authentication bypass vulnerabilities in web applications, including SSO/SAML, OAuth, XMLRPC, and API auth layers. Provides a step-by-step methodology, attack surface signals, and crown jewel targets. For authorized security assessments only.

This skill helps identify gRPC security vulnerabilities during penetration testing. It includes fingerprinting gRPC servers, enumerating services via reflection, testing authentication bypasses, and checking for DoS risks like HTTP/2 Rapid Reset. Requires explicit authorization for offensive use.

A remote MCP server designed for AI agents to dynamically discover, inspect, and verify external tools, APIs, and services. It allows agents to search a curated index of AI-ready websites, check for machine-readable endpoints (like OpenAPI or MCP), and confirm if an endpoint responds correctly to JSON-RPC, enabling robust, dynamic agent workflow building.

Expert guidance on Odoo's external JSON-RPC and XML-RPC APIs. Covers authentication, model calls, CRUD operations, and practical integration examples in Python, JavaScript, and curl. Includes best practices for security and performance.