Skill UI

Scans Android APKs for Firebase misconfigurations, testing databases, storage, authentication, and cloud functions to surface vulnerabilities during mobile security audits.

Automatically assists with generating Firebase security rules, offering best-practice guidance, template configurations, and validation checks tailored for GCP compute, storage, and data workloads.

This guide outlines essential security best practices for integrating Firecrawl. It covers secure API key storage (using environment variables and .gitignore), verifying webhook signatures with HMAC-SHA256 for data integrity, implementing key rotation strategies across different environments (dev/staging/prod), and sanitizing scraped content to mitigate XSS and PII risks. Essential for building secure, production-grade systems.

This guide outlines essential security protocols for integrating Fireflies.ai. It covers best practices for managing sensitive API keys (e.g., environment variables, pre-commit hooks), implementing robust HMAC-SHA256 webhook signature verification in multiple languages (TypeScript, Python), and correctly configuring transcript privacy levels to ensure data confidentiality. Ideal for developers setting up production-ready integrations.

Manages Firebase/Firestore CRUD, queries, batch jobs, and security for applications while extending to A2A agent messaging, MCP server integration, and Cloud Run coordination for advanced workflows.

A comprehensive guide detailing the entire workflow for analyzing embedded firmware. It covers hardware-level extraction methods (UART, JTAG, SPI dump), filesystem analysis (SquashFS, JFFS2), binary reverse engineering using tools like Ghidra, and identifying common vulnerabilities (Buffer Overflow, Command Injection). Ideal for security researchers and embedded systems engineers.

This skill provides a structured methodology for reviewing code commits intended to fix security vulnerabilities or address audit findings. It ensures that the original root cause is properly resolved, verifies the fix hasn't introduced new bugs or vulnerabilities (regressions), and validates the overall completeness of the remediation effort. Ideal for security-critical code reviews.

Auto-activating skill that guides analysts through forensics data collector operations, aligning advanced security practices with compliance frameworks while generating validated code and configurations for enterprise deployments.

This skill acts as a comprehensive security scanner specializing in detecting Cross-Site Scripting (XSS) vulnerabilities in client-side code. It performs static analysis across React, Vue, Angular, and vanilla JavaScript, specifically identifying unsafe practices like direct HTML manipulation (innerHTML), raw rendering (v-html), and insecure URL handling. Use it when auditing frontend code for security flaws and needing best practices for secure coding.

An expert skill dedicated to building secure, robust frontend applications. It specializes in preventing client-side vulnerabilities such as XSS and clickjacking. Core capabilities include safe DOM manipulation, implementing Content Security Policy (CSP), advanced input sanitization (allowlisting), and securing complex interactions like secure redirects and session management.

This skill guides the development of robust, security-focused full-stack web applications. It ensures layered security coverage across the entire application stack, from database queries (parameterized queries) to API endpoints (authentication/authorization) and frontend components (input validation, output encoding). Use this when building end-to-end features, microservices, or REST APIs that require simultaneous attention to Frontend, Backend, and Security best practices.

Automated fuzz testing of APIs via the /fuzz-api command to inject malformed, boundary, and random payloads, spotting crashes, SQL injection, XSS, and validation gaps during vulnerability scanning or security reviews.